7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb
- SHA256 7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb
-
Class file contains resources related to AdWind
Password
infected
Overview
overview
10Static
static
100490e8427a...c7.elf
ubuntu-18.04-amd64
0490e8427a...c7.elf
debian-9-armhf
0490e8427a...c7.elf
debian-9-mips
0490e8427a...c7.elf
debian-9-mipsel
068428a4ac...26.exe
windows7-x64
1068428a4ac...26.exe
windows10-2004-x64
8087421ac22...94.elf
debian-9-mipsel
100c4791a6b4...ea.elf
debian-12-armhf
10d9bd2ae2e...ea.exe
windows7-x64
70d9bd2ae2e...ea.exe
windows10-2004-x64
70fa00d4f4f...70.dll
windows7-x64
10fa00d4f4f...70.dll
windows10-2004-x64
110de02fec8...d1.bat
windows7-x64
110de02fec8...d1.bat
windows10-2004-x64
81157191701...32.exe
windows7-x64
71157191701...32.exe
windows10-2004-x64
1016e81343ec...a5.exe
windows7-x64
716e81343ec...a5.exe
windows10-2004-x64
717691f0962...b7.elf
debian-12-mipsel
617c24104e8...12.exe
windows7-x64
317c24104e8...12.exe
windows10-2004-x64
31816cd993d...28.exe
windows7-x64
71816cd993d...28.exe
windows10-2004-x64
71b8cda768b...8a.elf
debian-12-armhf
11df6acbc11...b7.elf
ubuntu-18.04-amd64
1df6acbc11...b7.elf
debian-9-armhf
1df6acbc11...b7.elf
debian-9-mips
1df6acbc11...b7.elf
debian-9-mipsel
1e7706ed04...b0.elf
ubuntu-18.04-amd64
1e7706ed04...b0.elf
debian-9-armhf
1e7706ed04...b0.elf
debian-9-mips
1e7706ed04...b0.elf
debian-9-mipsel
Static task
static1
38 signatures
Behavioral task
behavioral1
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
debian9-mipsbe-20240226-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
087421ac222e935579dfd3b7a5120451fd9d9a663d3d1872c04b6154b238c894.elf
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
0c4791a6b47491a0c43cea0ba54357e391a3c8b23aa28025489bbe43bb9ea6ea.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral16
Sample
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral17
Sample
16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral18
Sample
16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral19
Sample
17691f0962027e7110f727ae997f8af5885dd783674d1db023d467ec478515b7.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
1b8cda768ba75d723b2b0b34cf955f7ec9469b4e33c6fde6494eefd60a139d8a.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
debian9-mipsbe-20240226-en
debian-9-mips
22 signatures
150 seconds
Behavioral task
behavioral28
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
debian9-mipsbe-20240226-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
0 signatures
150 seconds
Errors
Reason
could not process APK: could not decode AXML: sblock: string with idx 268435468 not found
General
- Target 7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb
- Size 289.5MB
- Sample240422-1xtwbagh68
- SHA256 7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb
- MD5 405394c381ca2000e01428e79d03cecb
- SHA1 cb41f1d9e06c1b783378a43486c7d997a3635b68
- SHA512 40266c79a3d2c010882cfc4b237c6d27989dc385fd23d8bafe89e4ff329a181fed4ba44dac91187ffd2698d51af44454917e901375aa0dc87624ec956f12f80d
- SSDEEP 6291456:BN08aneiYsmfO6eRtz+WmPn4auzQgHDXuDFHVfuc1Fyn6RQuj3jN31S:j08aneo2eTTI2NHDXuDjxPyn6zj3jN3M
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
gafgyt
C2
-
94.156.64.4:42516
Extracted
Family
-
mirai
Botnet
-
SORA
Extracted
Family
-
mirai
Botnet
-
MIRAI
Extracted
Family
-
blacknet
Botnet
-
HacKed
C2
-
http://botnetera.pagekite.me/
Mutex
-
BN[pjClIrDI-2470224]
Attributes
-
antivm
true
-
elevate_uac
true
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
35dcbc7eb742dd4f1edfbccf7826c724
-
startup
false
-
usb_spread
false
Extracted
Family
-
mirai
Botnet
-
MIRAI
Extracted
Family
-
xworm
C2
-
involved-hurt.gl.at.ply.gg:35238
Attributes
-
Install_directory
%LocalAppData%
-
install_file
WindowsHealthSystem.exe
Extracted
Family
-
redline
Botnet
-
cheat
C2
-
0.tcp.eu.ngrok.io:18950
Extracted
Family
-
mirai
C2
-
hoiiaz.iaz.coby
Extracted
Family
-
redline
Botnet
-
tg
C2
-
163.5.112.53:51523
Extracted
Family
-
stealc
C2
-
http://185.216.70.109
Attributes
-
url_path
/eb488f9cb9d466ca.php
Extracted
Family
-
mirai
Botnet
-
SORA
Extracted
Family
-
mirai
Botnet
-
MIRAI
C2
-
client.orxy.space
Extracted
Family
-
mirai
Botnet
-
MIRAI
Signatures
- Adwind family
- Android Triada payload 1 IoCs
resource yara_rule static1/unpack001/3476006a8f64bfe72a8b04477f6005293b5854cfbc58bee2ea28e59b58f0e316.apk family_triada - Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe family_asyncrat - Asyncrat family
- BlackNET payload 1 IoCs
resource yara_rule static1/unpack001/2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b.exe family_blacknet - Blacknet family
- Class file contains resources related to AdWind 2 IoCs
resource yara_rule sample family_adwind3 sample family_adwind6 - Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b.exe disable_win_def -
resource yara_rule static1/unpack001/3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855.exe dcrat static1/unpack001/57bfb1ccdc00493daf0987426bc3744bfcc0f2777b78594e840832a776b32a9f.exe dcrat static1/unpack001/99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0.exe dcrat static1/unpack001/de00660d0d96ff67cb8e89a8d8525567327b109bc54b9042e5fdd516dcc0e51a.exe dcrat static1/unpack001/e0acb3c17aac695ada5fd83580506ffa0e6972bd8551e961c3f7b6ecc22dc793.exe dcrat static1/unpack001/ec4949fff4b4320c7b50929a7d72b90fc1ca703d39c7819f31ec95a8e7e91ed7.exe dcrat -
resource yara_rule static1/unpack001/e0acb3c17aac695ada5fd83580506ffa0e6972bd8551e961c3f7b6ecc22dc793.exe Dark_crystal_rat static1/unpack001/ec4949fff4b4320c7b50929a7d72b90fc1ca703d39c7819f31ec95a8e7e91ed7.exe Dark_crystal_rat - Dcrat family
- Detect Socks5Systemz Payload 1 IoCs
resource yara_rule static1/unpack001/63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15.dll family_socks5systemz - Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe family_xworm - Detect ZGRat V1 3 IoCs
resource yara_rule static1/unpack001/403237121c807d41f44f036f65336713a673d5b98756abe86faa5e883a068ea7.exe family_zgrat_v1 static1/unpack001/547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe family_zgrat_v1 static1/unpack001/8058db39c9c75269344ca81e210acb61595abf9b3e4e7a67ec380ba9ba756400.exe family_zgrat_v1 - Detected Gafgyt variant 29 IoCs
resource yara_rule static1/unpack001/0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf family_gafgyt static1/unpack001/1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf family_gafgyt static1/unpack001/1f580428fa8afd15832fcd04f5d6832be9f7a7144ff17e19c89d2b07e7f51f2c.elf family_gafgyt static1/unpack001/2796760675e5efbef0319f0285c2e1d07c11b038311c02e16c2407ba57c38413.elf family_gafgyt static1/unpack001/2b4b073178b573aa181fdc6e8063c778c90f76235d640c186b99278186509e74.elf family_gafgyt static1/unpack001/377c3c3679e44acbc13388ca7ec69f2346b321aa42110fc6ee44a44c54d67105.elf family_gafgyt static1/unpack001/3c52855c535816927fd94405b87fef074296ca34994d04686b7fe141bb48d20d.elf family_gafgyt static1/unpack001/42f781f94b9df3f0625426ea2ae3f668a83b52faf78c8c5ddfccab1690967e90.elf family_gafgyt static1/unpack001/44243d0823b6951aa36d0c1a8aea39866bbf33f5d0bbb76dfa3b5290ffe83683.elf family_gafgyt static1/unpack001/49ebe60b13e18860b25f920c8c8ed486bd9f0789c47c65df1f32c6dcb1a2cb83.elf family_gafgyt static1/unpack001/6e6d31e5b9a61454a66a24114583d5bdc3d7f2472bfea10fb639580fc058a1c8.elf family_gafgyt static1/unpack001/706e63fa9b69849f7f9c518fff1314f02632bf0b9040c9c5f4ce506c0e11f25c.elf family_gafgyt static1/unpack001/71b748425fa7055b9060ac5d6587bc18948c46558e6789ddb213df076d379d0c.elf family_gafgyt static1/unpack001/868891f4f0e322d258224ca43c84c055c21babac5fe1ae87542b8888ab3f0b33.elf family_gafgyt static1/unpack001/8dba2039fd6f20170d4f1046a5a9d3413c58a657ce34658f5681e07296263d95.elf family_gafgyt static1/unpack001/8ffa8c43fdc61c96e1a017be3eadff98e0f9d35f08ee9ecdd6da7bf2776d730a.elf family_gafgyt static1/unpack001/9088a8c9590582ef92ac8b0c371d86fcf80fb37629d7d007585e8589fcb99be7.elf family_gafgyt static1/unpack001/91f974e26d0662021f8a33d76ae3ba59d530046ae6ddd9712b54bb411a163f41.elf family_gafgyt static1/unpack001/93baaaabfc573289b7cea910738e996f36b616b93a40a2ecfb84d14d1a2e5da2.elf family_gafgyt static1/unpack001/a508368a916bcc275163c40126bfdcaa26d5dc3294257356f16799a79ed7eebf.elf family_gafgyt static1/unpack001/a9dbdd95ebd8c9e6fb7de29c21103ddba18a62f2393bfa7ba365a491e37b342a.elf family_gafgyt static1/unpack001/aaef77108648df18c61d1da23ec384fa62fe17e559da38ec128911437cdf939c.elf family_gafgyt static1/unpack001/bcb2ec0810dd5fe31592e0b8c7739102620ce48b4bfc06bd3708de614896d180.elf family_gafgyt static1/unpack001/cd517989776d85f3669e300ab401543aa354f80b7d467fdb93824b1a287b9238.elf family_gafgyt static1/unpack001/ce88ab5d77ab447ef12a4e2859602ac2a167ac360078fa9c6d0eed2ba3bfec51.elf family_gafgyt static1/unpack001/d29ebdaa0a822094a12e32d12fd13b401385c2f78941c9f4e222db7b370abf5a.elf family_gafgyt static1/unpack001/df6ab7c6ac612aa19b1392455b4250f20e03381c64d6d7443859f319a61f1cb1.elf family_gafgyt static1/unpack001/e47c0cc3b00de906596cf4e63820d391d4e0e2ccc78a2c4f60cfe8d1991a345d.elf family_gafgyt static1/unpack001/f0ee3752736d8d62f1731e60c26db491dfec0fffe85075b6757ddda257056bee.elf family_gafgyt - Gafgyt family
- Irata family
- Irata payload 2 IoCs
resource yara_rule static1/unpack001/77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk family_irata3 static1/unpack001/77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk family_irata4 - Mirai family
- RedLine payload 2 IoCs
resource yara_rule static1/unpack001/5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe family_redline static1/unpack001/8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c.exe family_redline - Redline family
- SectopRAT payload 2 IoCs
resource yara_rule static1/unpack001/5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe family_sectoprat static1/unpack001/8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c.exe family_sectoprat - Sectoprat family
- Socks5systemz family
- Stealc family
- Triada family
- XZUtil is a linux backdoor releated to the CVE-2024-3094. 1 IoCs
resource yara_rule static1/unpack001/257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc.elf family_xzutil - Xworm family
- Xzutil family
- Zgrat family
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule static1/unpack001/547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe net_reactor -
resource yara_rule static1/unpack001/087421ac222e935579dfd3b7a5120451fd9d9a663d3d1872c04b6154b238c894.elf upx static1/unpack001/0c4791a6b47491a0c43cea0ba54357e391a3c8b23aa28025489bbe43bb9ea6ea.elf upx static1/unpack001/0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe upx static1/unpack001/3545082c16d0e05faad342c614b27793ab0ec940a174ab5162dce1787ea8472e.elf upx static1/unpack001/42c1afa196dd457a3c9ec69e786c029b7b98f0b5be4041cfbd8b2910352435eb.elf upx static1/unpack001/77de41f017ba6908cf75448383dcdd01d3d54dc55fc3a38f3f5b60542c637cf8.elf upx static1/unpack001/9cddfa73a9c86cc4d92b6edac2dec8e66ffa5b809fd6e8da6a97d38da5ea4079.elf upx static1/unpack001/a216c05b201d5586208af929795cb944aa883aa8db9ba9c1b40df1a11ee3f8a1.elf upx static1/unpack001/a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be.elf upx static1/unpack001/b8c409f2545de5b25184b21e745ec3c1b44efc2c5707c8766494f43f91856611.elf upx static1/unpack001/b92ce8d8be97c7ba25eb090403e6cb0e3b1ebc9e899517acaefcbcb0e6a7a643.elf upx static1/unpack001/bb6c8c6772bc0e8ba9a3416e53e4791fcf2d753642c771c84ecce5f4a2fec948.elf upx static1/unpack001/c2655050d7396dc127478a94de8698cad30189dfc594f8e61bfbdf8c1307929f.elf upx static1/unpack001/c955e4df8eac2ab783ba558fecf707bf76f8268913cee596c6d85b2dffb24e5f.elf upx static1/unpack001/cd2d4fd57d36ab0e4bc6cca12eefad3c38e46df6964fa6e70534e8f66ef6209a.elf upx static1/unpack001/ded0b3101d0cf256b0a87535dd5d006176c0aa59c023bfbd2c6eac4fc6f0d40b.elf upx static1/unpack001/e180555303654e1f2b1c0337521988fdccc795a2d6ab246c9b50fee7b98f3012.elf upx static1/unpack001/f510c5adad382a960167228ddd818c4599a96a7cea5f0ac37cdb9f57f97692c4.elf upx - Declares services with permission to bind to the system 3 IoCs
description ioc Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications. android.permission.BIND_TELECOM_CONNECTION_SERVICE Required by remote views services to bind with the system. Allows apps to share and display views across different processes. android.permission.BIND_REMOTEVIEWS Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions. android.permission.BIND_CHOOSER_TARGET_SERVICE - Requests dangerous framework permissions 24 IoCs
description ioc Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS Required to be able to advertise and connect to nearby devices via Wi-Fi. android.permission.NEARBY_WIFI_DEVICES Required to be able to access the camera device. android.permission.CAMERA Allows an application to record audio. android.permission.RECORD_AUDIO Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application a broad access to external storage in scoped storage. android.permission.MANAGE_EXTERNAL_STORAGE Allows an application to access any geographic locations persisted in the user's shared collection. android.permission.ACCESS_MEDIA_LOCATION Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read audio files from external storage. android.permission.READ_MEDIA_AUDIO Allows an application to read image files from external storage. android.permission.READ_MEDIA_IMAGES Allows an application to read video files from external storage. android.permission.READ_MEDIA_VIDEO Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker. android.permission.READ_MEDIA_VISUAL_USER_SELECTED Allows an app to post notifications. android.permission.POST_NOTIFICATIONS Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack003/out.upx autoit_exe static1/unpack001/717d6956f37bcd29a3f05cb5439f875b31729d4bece0a0d0bd3ad59ba572fd5d.exe autoit_exe - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/ec4949fff4b4320c7b50929a7d72b90fc1ca703d39c7819f31ec95a8e7e91ed7.exe pyinstaller - Unsigned PE 71 IoCs
Checks for missing Authenticode signature.
resource unpack001/068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe unpack001/0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe unpack003/out.upx unpack001/0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.exe unpack001/16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe unpack001/17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe unpack007/$PLUGINSDIR/AccessControl.dll unpack007/$PLUGINSDIR/nsProcess.dll unpack007/CommandPost.exe unpack007/Uninstall.exe unpack001/1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe unpack001/2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635.exe unpack001/2e48ee0fb3ddd63efeecd900a9d2bde365e2fe1fcbb3c43c882362ae935c5066.exe unpack001/2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b.exe unpack001/31b6a608393ad6cadd7eadf286795aef37260c9b99e837f1d7a1aa4e9a7f901b.exe unpack001/320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe unpack001/38236f53a4ebd47d951837540ec9d965c21f15816de7dbd3291624ffbaaf506c.exe unpack001/382c9aa9b4ec7137d69ebc20fe58b83acbb8bf0bce324d10fb58aba91b805c9f.exe unpack001/385aeb4409a86678ca21a745b04350d1dd8593cec972d77524f83323b9160fa7.exe unpack001/3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855.exe unpack001/3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe unpack001/403237121c807d41f44f036f65336713a673d5b98756abe86faa5e883a068ea7.exe unpack001/462113bece051066dcdbeda693499e8d79f439e30cd6daf3dd089ea1e42fd35a.exe unpack001/4744b94d6954de78dc1394d5f1f8f4dce2179eae5b8d453f99d8adf93a3eb9a9.exe unpack001/4a0007763fc1a326967ad2400f16fecdd8d540258dcbb555345d9a4e02092bb5.exe unpack001/4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe unpack001/51787c72e5315249cc7625f28609f16211a3774cbe839fe0df550bcaf3a27c56.exe unpack001/547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe unpack001/57bfb1ccdc00493daf0987426bc3744bfcc0f2777b78594e840832a776b32a9f.exe unpack001/5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe unpack001/609ef2b560381e8385a71a4a961afc94a1e1d19352414a591cd05217e9314625.exe unpack001/60f45dc57494e24ac5676556834ad9c30fc889bd9cceed706a4c4546e593cfa9.exe unpack001/63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15.dll unpack001/679d5cdadcc48fa79574ce12e8d0fd2e19823dc4b7e39a84b5b286672f45a72d.exe unpack001/6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe unpack001/6dc7164ea78b8668d8a1492d543f24a9edaaad990403f4451c546a0d4115a3bd.exe unpack001/6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe unpack001/717d6956f37bcd29a3f05cb5439f875b31729d4bece0a0d0bd3ad59ba572fd5d.exe unpack001/72e63f73ced48b29f196e48030215273a17f7827c310f2747321cbc1f388c206.exe unpack001/768ea7c6f1285d70a63d32bbd3f3a0e9c530fdbd1c16e10672c42485e35bc077.exe unpack001/7822fa6c35cbd1cfb95c780970deef14d8b53c62ade3a4bcf63c494c3f2e5bbd.exe unpack001/8058db39c9c75269344ca81e210acb61595abf9b3e4e7a67ec380ba9ba756400.exe unpack001/8724a46a073a1f2395ca1d288d9e54364f286e69fba1b1606a17bb87c6bab2b3.exe unpack001/8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c.exe unpack001/92bb1f19f3a6337be028edfb89c898d49927cbb732f94796251c70d29e8ba9e1.exe unpack001/956f3fe2d9989f0269cd72c70c00468a6f6dea368871a9745ba3836ec3a162c9.exe unpack001/99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0.exe unpack001/a5d8c237485f07aae4b3e174009cd4d2f848a1bd3c98be4f33cd77f6c24572d4.exe unpack001/a650788cbf36edbdae7bb666d8518c9766d22fa009a288de6127fd67a03d3687.exe unpack001/a8c8ccccf9766d3bcd5dd78d4ae5a64aec55f961b8f3cf2bef74b4aef48422a3.exe unpack001/a8cc7d8092e02077f21bf65badf8871748630912e3738a2410ff5cd18ead2fbb.exe unpack001/ad8a91a51631f9084a5d6e95b621530de757b15aa2ae5efef2ca89cae6c4e8d6.exe unpack001/af6208c1ff499c7748dd133582093281a7084e6828178dbaaea88b55a9a833a8.exe unpack001/b1ffedb752d53a9bac21cb82ba09c524fc4831670b3e9cbbe3ad375c9b153083.exe unpack001/bd817f08b4b45d7a6edcbf36a7149648bb61eb4bca360a3ecf6b21c1e8fc7519.exe unpack001/c0b4860057005ee1549b38ec8c27f1ac5c7888d4deafdacf9a7698c3edf378f7.exe unpack001/c5c3c6fc136b01b4c88c7f70afc99fe20fdeaf6292570946acd2c315a7a5e119.exe unpack001/d89e00734a9bab127b81271423595b2fc6cc7e69020035a3696f472d42cc22d2.exe unpack001/daada19cab8e9cf064bfe1b219398dfa5ed5fe45832bfef1d5f284be93b4347d.exe unpack001/dd7e94e3adb6ccf95559adf51a9f0234763f972fd6480d7cf23916bdc1549507.exe unpack001/de00660d0d96ff67cb8e89a8d8525567327b109bc54b9042e5fdd516dcc0e51a.exe unpack001/dec9918265c77439780f448c5b6b06d8919ad2b7a23d714c25ab08a494df5340.exe unpack001/dfde7c566bce1a75aff9f68348058a6986e8376d5b4dbea5cd62310e0c154d5e.exe unpack001/e0acb3c17aac695ada5fd83580506ffa0e6972bd8551e961c3f7b6ecc22dc793.exe unpack001/e5f6faf2edd6464c3c9de112d5b1eb2ebbb4fce6cefd3ebb58fdb67fba948204.exe unpack001/e98c4cfd56efe46b3de730a430ba2f7adcd30b0988d64f9c9f962383d4e44a68.exe unpack001/ec4949fff4b4320c7b50929a7d72b90fc1ca703d39c7819f31ec95a8e7e91ed7.exe unpack001/f06ca39ee01d7599cbeaad5da92e51d282f5e6ae6a8375e9e3b819fd793c6070.exe unpack001/f0efcd8945cee60e24c6642fdba101d894c182f60ca05d8a011890974ec5499a.exe unpack001/f8ddcfdadfced3f3f98483aeb191fa8d7a2314c5156dc2a52bde756ac3358977.exe unpack001/ff750e0026cb14b5121b065eeba0b573b847aebb030f934c82c330bf1192716a.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/a7ab5280efdd1f09f7c15daafa507b5a889e30cb9bfa0060ae5cf29a64c9d410.exe nsis_installer_1 static1/unpack001/a7ab5280efdd1f09f7c15daafa507b5a889e30cb9bfa0060ae5cf29a64c9d410.exe nsis_installer_2
File Explorer
-
7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb.zip 289.5MB
-
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf.elf 115KB
-
068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe.exe 2.7MB
-
087421ac222e935579dfd3b7a5120451fd9d9a663d3d1872c04b6154b238c894.elf.elf 29KB
-
0c4791a6b47491a0c43cea0ba54357e391a3c8b23aa28025489bbe43bb9ea6ea.elf.elf 50KB
-
0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe.exe 725KB
-
out.upx.exe 806KB
-
0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.exe.dll 149KB
-
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat.bat .vbs 1.1MB
-
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe.exe 14.4MB
-
16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe.exe 6.9MB
-
17691f0962027e7110f727ae997f8af5885dd783674d1db023d467ec478515b7.elf.elf 177KB
-
17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe.exe 4.6MB
-
$PLUGINSDIR/AccessControl.dll.dll 15KB
-
$PLUGINSDIR/modern-header.bmp6KB
-
$PLUGINSDIR/nsProcess.dll.dll 4KB
-
CommandPost.exe.exe 7.9MB
-
Uninstall.exe.exe 79KB
-
icon.ico97KB
-
1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe.exe 1.7MB
-
1b8cda768ba75d723b2b0b34cf955f7ec9469b4e33c6fde6494eefd60a139d8a.elf.elf 142KB
-
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf.elf 115KB
-
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf.elf 61KB
-
1f580428fa8afd15832fcd04f5d6832be9f7a7144ff17e19c89d2b07e7f51f2c.elf.elf 127KB
-
257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc.elf.elf 1.2MB
-
262a10ee377a4945ce30e115e2ab1bf9ff2fc0f35741bbb72e40f145de24bd50.elf.elf 133KB
-
267909cf4a62955a35b0fe013afbfd62d7ae1a1eef6d7a24d7ce50db52d48ce7.bat6KB
-
2796760675e5efbef0319f0285c2e1d07c11b038311c02e16c2407ba57c38413.elf.elf 115KB
-
27cd090cf83877750416d37dc6ddd8ff319b4854414e4275d67f96652376bcf0.zip.zip 530KB
-
27e181c699f14c3e53cabc89941ac40917165cc4be34d2c7f9d6eca0e16b508c.elf.elf 62KB
-
2b4b073178b573aa181fdc6e8063c778c90f76235d640c186b99278186509e74.elf.elf 150KB
-
2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635.exe.exe 9.7MB
-
2bac99f5be34b649749a4ce8ab7c8103f9dce863cbc490f273c27297b2c465ec.elf.elf 81KB
-
2cfeefaa133519defee56f4253c7c7f2396d784ed8e09d2212ab5bee6cf52b50.elf.elf 150KB
-
2e48ee0fb3ddd63efeecd900a9d2bde365e2fe1fcbb3c43c882362ae935c5066.exe.exe 647KB
-
2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b.exe.exe 141KB
-
31b6a608393ad6cadd7eadf286795aef37260c9b99e837f1d7a1aa4e9a7f901b.exe.exe 355KB
-
320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe.exe 2.0MB
-
3476006a8f64bfe72a8b04477f6005293b5854cfbc58bee2ea28e59b58f0e316.apk.apk 76.1MB
-
3545082c16d0e05faad342c614b27793ab0ec940a174ab5162dce1787ea8472e.elf.elf 36KB
-
377c3c3679e44acbc13388ca7ec69f2346b321aa42110fc6ee44a44c54d67105.elf.elf 101KB
-
38236f53a4ebd47d951837540ec9d965c21f15816de7dbd3291624ffbaaf506c.exe.exe 5.0MB
-
382c9aa9b4ec7137d69ebc20fe58b83acbb8bf0bce324d10fb58aba91b805c9f.exe.exe 3.3MB
-
385aeb4409a86678ca21a745b04350d1dd8593cec972d77524f83323b9160fa7.exe.dll 624KB
-
38719e8104f65d7193c30dcd823b4a4d363f85b4c886f36316fa185f832a5bac.vbs.vbs 2KB
-
3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855.exe.exe 827KB
-
3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe.exe 294KB
-
3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe.exe .ps1 234KB
-
3c52855c535816927fd94405b87fef074296ca34994d04686b7fe141bb48d20d.elf.elf 127KB
-
3eaa57d60ec0a1932473ea109c3217a023aedd47f6921092b2f1ff2613e73926.elf.elf 90KB
-
403237121c807d41f44f036f65336713a673d5b98756abe86faa5e883a068ea7.exe.exe 1.6MB
-
42c1afa196dd457a3c9ec69e786c029b7b98f0b5be4041cfbd8b2910352435eb.elf.elf 30KB
-
42f781f94b9df3f0625426ea2ae3f668a83b52faf78c8c5ddfccab1690967e90.elf.elf 117KB
-
44243d0823b6951aa36d0c1a8aea39866bbf33f5d0bbb76dfa3b5290ffe83683.elf.elf 97KB
-
462113bece051066dcdbeda693499e8d79f439e30cd6daf3dd089ea1e42fd35a.exe.exe 46KB
-
4744b94d6954de78dc1394d5f1f8f4dce2179eae5b8d453f99d8adf93a3eb9a9.exe.exe 79.3MB
-
4884c907196c6492f16b3ecb2b2ab21b5642be51d7977047b2ef6154fc2f8ce5.elf.elf 81KB
-
4978b11e4e9669aebe9e03adeeac643e6bbb44d9d3d2493065c915aacc549c48.elf.elf 36KB
-
49ebe60b13e18860b25f920c8c8ed486bd9f0789c47c65df1f32c6dcb1a2cb83.elf.elf 109KB
-
4a0007763fc1a326967ad2400f16fecdd8d540258dcbb555345d9a4e02092bb5.exe.exe 3.3MB
-
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe.exe 70KB
-
51787c72e5315249cc7625f28609f16211a3774cbe839fe0df550bcaf3a27c56.exe.exe 9.7MB
-
5212ef58efb4b855a2aaf4bbaf81a4912810982631e2afaf246963fea954fe64.vbs.vbs 38KB
-
52f0294f8dd4741d22f39e30ef4a1818523b8899a4462d437321b4e51ca4bcba.pdf.pdf 28KB
-
547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe.exe 334KB
-
561ba061b626753994e3d3389e2b5b74e42f39b4ab4b863b20a16bca6f1832fc.elf.elf 173KB
-
57bfb1ccdc00493daf0987426bc3744bfcc0f2777b78594e840832a776b32a9f.exe.exe 828KB
-
58977c7fcf81b48cc636ed15cc410fe08d5d8a66291f3d2cc034cf41f57dec2f.vbs.vbs 2KB
-
5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe.exe 386KB
-
5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe.exe 95KB
-
609ef2b560381e8385a71a4a961afc94a1e1d19352414a591cd05217e9314625.exe.exe 421KB
-
60f45dc57494e24ac5676556834ad9c30fc889bd9cceed706a4c4546e593cfa9.exe.exe 716KB
-
63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15.dll.dll 623KB
-
643afed61e85d74cfd348f181b699599588cdd4033d6cc5a8a6fddfb356e0f7b.vbs.vbs 2KB
-
679d5cdadcc48fa79574ce12e8d0fd2e19823dc4b7e39a84b5b286672f45a72d.exe.exe 1.9MB
-
6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe.exe 2.7MB
-
6dc7164ea78b8668d8a1492d543f24a9edaaad990403f4451c546a0d4115a3bd.exe.dll 666KB
-
6e6d31e5b9a61454a66a24114583d5bdc3d7f2472bfea10fb639580fc058a1c8.elf.elf 150KB
-
6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe.exe 2.6MB
-
6ff73b622e94d94a55f450e110199303d1d01ee1033a8e13c19a2a34ff333be3.elf.elf 180KB
-
706e63fa9b69849f7f9c518fff1314f02632bf0b9040c9c5f4ce506c0e11f25c.elf.elf 109KB
-
717d6956f37bcd29a3f05cb5439f875b31729d4bece0a0d0bd3ad59ba572fd5d.exe.exe 1.1MB
-
71b748425fa7055b9060ac5d6587bc18948c46558e6789ddb213df076d379d0c.elf.elf 124KB
-
72e63f73ced48b29f196e48030215273a17f7827c310f2747321cbc1f388c206.exe.exe 444KB
-
768ea7c6f1285d70a63d32bbd3f3a0e9c530fdbd1c16e10672c42485e35bc077.exe.exe 5.3MB
-
77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk.apk 2.6MB
-
77de41f017ba6908cf75448383dcdd01d3d54dc55fc3a38f3f5b60542c637cf8.elf.elf 31KB
-
7822fa6c35cbd1cfb95c780970deef14d8b53c62ade3a4bcf63c494c3f2e5bbd.exe.exe 522KB
-
7be542aa39730d33b7fe6da737c67c0cde6905534d6b8b9cc8d6b4ecaf5bf3fb.elf.elf 134KB
-
8058db39c9c75269344ca81e210acb61595abf9b3e4e7a67ec380ba9ba756400.exe.exe 1.9MB
-
85d5c21050bd72c4ee02060d0be234ac35babc785567dca5bfc1d299150576b7.img.iso 624KB
-
868891f4f0e322d258224ca43c84c055c21babac5fe1ae87542b8888ab3f0b33.elf.elf 109KB
-
8724a46a073a1f2395ca1d288d9e54364f286e69fba1b1606a17bb87c6bab2b3.exe.exe 654KB
-
8863212f3ed09431d93e3ade911684bbb405ee60e260d7c7dc311494c7228346.z.lzh 2.3MB
-
89662007a7136d32afb4b5056e1ade62064bf2a46c84c423241dbd9e1a720412.elf.elf 118KB
-
8b31383f256042caad7b8be1b0f5162af5e0e7743bd7dc6399c48cb9caa61465.elf.elf 179KB
-
8be691d37a49147305a2eb476a9d9187acda20f48e3853fee0bf4049df14fcf9.elf.elf 134KB
-
8cbb73314a196e67b87761a0bb1f9ec65c5504577e59d7ade33cf061ed614733.elf.elf 177KB
-
8dba2039fd6f20170d4f1046a5a9d3413c58a657ce34658f5681e07296263d95.elf.elf 122KB
-
8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c.exe.exe 95KB
-
8ffa8c43fdc61c96e1a017be3eadff98e0f9d35f08ee9ecdd6da7bf2776d730a.elf.elf 97KB
-
9088a8c9590582ef92ac8b0c371d86fcf80fb37629d7d007585e8589fcb99be7.elf.elf 97KB
-
91f974e26d0662021f8a33d76ae3ba59d530046ae6ddd9712b54bb411a163f41.elf.elf 105KB
-
92bb1f19f3a6337be028edfb89c898d49927cbb732f94796251c70d29e8ba9e1.exe.exe 318KB
-
93baaaabfc573289b7cea910738e996f36b616b93a40a2ecfb84d14d1a2e5da2.elf.elf 155KB
-
94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d.zip.zip 375KB
-
956f3fe2d9989f0269cd72c70c00468a6f6dea368871a9745ba3836ec3a162c9.exe.exe 152KB
-
99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0.exe.exe 827KB
-
9cddfa73a9c86cc4d92b6edac2dec8e66ffa5b809fd6e8da6a97d38da5ea4079.elf.elf 23KB
-
9e2cff011b63ac85dc3b815db92ebbbc3f09bf237950bdff092a825c71d9fd89.exe.exe 497KB
-
9f2a79f96c8381d4b8615034448960ca30b78739d78cf6396130cbfe813b850e.r00.rar 17KB
-
a1de866d5f75b3f31becb07f4660e2a3cc29d242888be38fadb5a54657156745.zip.apk 8.5MB
-
a216c05b201d5586208af929795cb944aa883aa8db9ba9c1b40df1a11ee3f8a1.elf.elf 26KB
-
a500adc3648a600aa908706447807d99183e2d2ae24390d6f99d5a7a9873b405.elf.elf 71KB
-
a508368a916bcc275163c40126bfdcaa26d5dc3294257356f16799a79ed7eebf.elf.elf 114KB
-
a5d8c237485f07aae4b3e174009cd4d2f848a1bd3c98be4f33cd77f6c24572d4.exe.exe 3.3MB
-
a650788cbf36edbdae7bb666d8518c9766d22fa009a288de6127fd67a03d3687.exe.exe 56KB
-
a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be.elf.elf 35KB
-
a7ab5280efdd1f09f7c15daafa507b5a889e30cb9bfa0060ae5cf29a64c9d410.exe.exe 692KB
-
a8c8ccccf9766d3bcd5dd78d4ae5a64aec55f961b8f3cf2bef74b4aef48422a3.exe.exe 4.2MB
-
a8cc7d8092e02077f21bf65badf8871748630912e3738a2410ff5cd18ead2fbb.exe.exe 871KB
-
a9dbdd95ebd8c9e6fb7de29c21103ddba18a62f2393bfa7ba365a491e37b342a.elf.elf 139KB
-
aa07d206f75fd176b841511b90306f657b279c2eff54ebbea5a7277f140f27dc.elf.elf 177KB
-
aaef77108648df18c61d1da23ec384fa62fe17e559da38ec128911437cdf939c.elf.elf 150KB
-
ad22ea87eec108a68d36e8a75877fe97814b84acd0b2f77a4c8593bcb953bc9f.exe.exe 321KB
-
ad8a91a51631f9084a5d6e95b621530de757b15aa2ae5efef2ca89cae6c4e8d6.exe.exe 79KB
-
af6208c1ff499c7748dd133582093281a7084e6828178dbaaea88b55a9a833a8.exe.exe 878KB
-
b1ceed4ed790fc9665b04298d7d6bff248aa890a86bae52d350da3d88c6c862a.elf.elf 149KB
-
b1ffedb752d53a9bac21cb82ba09c524fc4831670b3e9cbbe3ad375c9b153083.exe.exe 3.3MB
-
b2997d1d5b68e317c0fd8b0cd2915e5ff242bf31b39d825e8296eee36d070578.elf.elf 118KB
-
b582fac0b16e16390868882590ac8d81dc00ecd845bffa59a478baa11573617c.exe.exe 477KB
-
b8c409f2545de5b25184b21e745ec3c1b44efc2c5707c8766494f43f91856611.elf.elf 31KB
-
b8dcce8209230d9c12ab47d501d02ef73b5374529fda3d798f0adcd8346024af.elf.elf 134KB
-
b92ce8d8be97c7ba25eb090403e6cb0e3b1ebc9e899517acaefcbcb0e6a7a643.elf.elf 33KB
-
b949c9d92b95837703f915abaa930856264c64e723d8a6b6dd93434c03562b09.exe.exe 7.9MB
-
bb6c8c6772bc0e8ba9a3416e53e4791fcf2d753642c771c84ecce5f4a2fec948.elf.elf 57KB
-
bbb16e52cd7134b0d1de4aa9c449fc7d9f084783bb4e31b061414e2e3a7e86df.rar.rar 618KB
-
bcb2ec0810dd5fe31592e0b8c7739102620ce48b4bfc06bd3708de614896d180.elf.elf 106KB
-
bd817f08b4b45d7a6edcbf36a7149648bb61eb4bca360a3ecf6b21c1e8fc7519.exe.exe 2.0MB
-
be2346fa2bef1b558f011862043e37bf5cef8b2290202a64a450a08750820462.exe.exe 234KB
-
c0b4860057005ee1549b38ec8c27f1ac5c7888d4deafdacf9a7698c3edf378f7.exe.exe 355KB
-
c1539ba94c7dbafa391aa83f94a2b9a536097c8c8d6f1c522a93156941ce4c86.exe.exe 6.3MB
-
c2655050d7396dc127478a94de8698cad30189dfc594f8e61bfbdf8c1307929f.elf.elf 31KB
-
c4702d262bd679d87b1521b719809e170933f5510a9a7d40a6b858b8609ecbee.elf.elf 149KB
-
c4edf7b8cdffb67fcd62ef81485c04648b11a14a8452f407133f131e2f74a57a.exe.exe 2.2MB
-
c5c3c6fc136b01b4c88c7f70afc99fe20fdeaf6292570946acd2c315a7a5e119.exe.dll 687KB
-
c7c643bc00955e3cb3d3c0b7286a0cf1c35864c42e91064d7108085e7eabfae9.elf.elf 36KB
-
c845049d5b0e627fa7c6a07c416d510fa20c2544d8ae193349412e7245350eec.elf.elf 144KB
-
c955e4df8eac2ab783ba558fecf707bf76f8268913cee596c6d85b2dffb24e5f.elf.elf 27KB
-
caeb5b0338795678a139244858d2e19c0a7bd401604a02af1a17880a137258b1.zip.zip 3.0MB
-
cbe27936a3beb1902517906f7da1d6d3f6ef8d1a0eda5e033f4da436df7cd88b.iso.iso .vbs 100KB
-
cbf82db6eb47c89413ceb34f20db5fd67beca54befa14cdcd0e4be903e432c9f.elf.elf 90KB
-
cd2d4fd57d36ab0e4bc6cca12eefad3c38e46df6964fa6e70534e8f66ef6209a.elf.elf 26KB
-
cd517989776d85f3669e300ab401543aa354f80b7d467fdb93824b1a287b9238.elf.elf 113KB
-
cd5578bdb5130615e3667f36e665a03cf4b8c943899ab8ea679653c224036d8b.exe.exe 332KB
-
cd94340d01668e3f499ed9a694f2507bc7d6bc10a5dacb467d951297794f313b.elf.elf 66KB
-
ce88ab5d77ab447ef12a4e2859602ac2a167ac360078fa9c6d0eed2ba3bfec51.elf.elf 150KB
-
d29ebdaa0a822094a12e32d12fd13b401385c2f78941c9f4e222db7b370abf5a.elf.elf 97KB
-
d5a372d3a991f01ec9b1deb385bed8eaaf63cdd637920abff57d0b115a36113b.elf.elf 73KB
-
d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52.exe.exe 331KB
-
d89e00734a9bab127b81271423595b2fc6cc7e69020035a3696f472d42cc22d2.exe.exe 3.3MB
-
daada19cab8e9cf064bfe1b219398dfa5ed5fe45832bfef1d5f284be93b4347d.exe.exe 361KB
-
dce5434e660c66954f7859390e33d969f0a493a77cc84f1e42df7b17ab9bfa53.elf.elf 70KB
-
dd7e94e3adb6ccf95559adf51a9f0234763f972fd6480d7cf23916bdc1549507.exe.exe 3.3MB
-
de00660d0d96ff67cb8e89a8d8525567327b109bc54b9042e5fdd516dcc0e51a.exe.exe 3.4MB
-
dec9918265c77439780f448c5b6b06d8919ad2b7a23d714c25ab08a494df5340.exe.exe 12.2MB
-
ded0b3101d0cf256b0a87535dd5d006176c0aa59c023bfbd2c6eac4fc6f0d40b.elf.elf 34KB
-
df6ab7c6ac612aa19b1392455b4250f20e03381c64d6d7443859f319a61f1cb1.elf.elf 139KB
-
dfde7c566bce1a75aff9f68348058a6986e8376d5b4dbea5cd62310e0c154d5e.exe.exe 708KB
-
e0807ac9d5c0eefe90916de1c25e6ad9a3e1e82d36a8e10a560a62e4dd85f7cf.elf.elf 118KB
-
e0acb3c17aac695ada5fd83580506ffa0e6972bd8551e961c3f7b6ecc22dc793.exe.exe 2.6MB
-
e180555303654e1f2b1c0337521988fdccc795a2d6ab246c9b50fee7b98f3012.elf.elf 35KB
-
e3327c6ff58afd7a0d8d49713b2dea034598ec4608ff26f93059b5ce9ab6981f.r00.rar 17KB
-
e47c0cc3b00de906596cf4e63820d391d4e0e2ccc78a2c4f60cfe8d1991a345d.elf.elf 155KB
-
e5f6faf2edd6464c3c9de112d5b1eb2ebbb4fce6cefd3ebb58fdb67fba948204.exe.exe 57KB
-
e741af35bc6e35843115dbe5d50ecfc1ab9cd76ddeb223a79635238b11529141.zip.zip 588KB
-
e98c4cfd56efe46b3de730a430ba2f7adcd30b0988d64f9c9f962383d4e44a68.exe.exe 3.3MB
-
ec4949fff4b4320c7b50929a7d72b90fc1ca703d39c7819f31ec95a8e7e91ed7.exe.exe 9.3MB
-
ed6110fc7d2bb1b2cfee09b42f3796446ed3e562611ab7e3302d00d6c9dca5b2.elf.elf 179KB
-
eed7407407a9058c06504a43cc841a5b83cb468a5659b4037b5e0020a477c1c7.elf.elf 130KB
-
ef5c5bc8a2823eded5167c858c649dc6509f653109fe7a45be71bae0474c70f9.elf.elf 177KB
-
efe8773c0e8f211fc8a8a8fe4d033d5dcd03556d2c9b9a31028a77f9f4f0a00d.elf.elf 91KB
-
f06ca39ee01d7599cbeaad5da92e51d282f5e6ae6a8375e9e3b819fd793c6070.exe.exe 702KB
-
f0ee3752736d8d62f1731e60c26db491dfec0fffe85075b6757ddda257056bee.elf.elf 125KB
-
f0efcd8945cee60e24c6642fdba101d894c182f60ca05d8a011890974ec5499a.exe.exe 5.0MB
-
f1177ed5175645c04536f34ceb702a955e53f5aebbc0df99a71ee3f9e6f2db7a.elf.elf 61KB
-
f2fa5a8697826c7c7c292cf2b646dd74a26048b810583d32c0eeea36f15e6ae4.elf.elf 142KB
-
f510c5adad382a960167228ddd818c4599a96a7cea5f0ac37cdb9f57f97692c4.elf.elf 32KB
-
f8ddcfdadfced3f3f98483aeb191fa8d7a2314c5156dc2a52bde756ac3358977.exe.exe 3.3MB
-
f986080126053f75b9e364d584fd9ef321858356610066c3eb4b3be37e809581.elf.elf 80KB
-
fca1c84d387959435ca272cd08a56301b08610279a787efa38f1d023dad28119.elf.elf 157KB
-
fce4211fa64e7c108ca2cf317e8f76bdf2cedd7f09283ad161a2befa755e48cc.jar.jar 181KB
-
ff750e0026cb14b5121b065eeba0b573b847aebb030f934c82c330bf1192716a.exe.exe 47KB
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
- SHA256 0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7
- MD5 864bda0dc36b639210f886e6968394b7
- SHA1 6e5d6d3cfeae7f5b0cb4987ea35fbfc4ea100527
- SHA512 37cfcf70855ad24970cd76e911d39ddd788090f1e0bb8815b8d41af00b38dd66e6bcd57ab3102cac3a2e896c135ea7a9f3b1ed50839373056b3037261d80a87b
- SSDEEP 3072:6oLEcVdOAnowHfbEqyas7J3UPwenmvI0PDGnSQNER:6oLEcPOAnowLyaoJ3ajnmvI0PDGnSQNM
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
- IMPHASH 5929190c8765f5bc37b052ab5c6c53e7
- SHA256 068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26
- MD5 853a9918a66c6de88c9d8577726f2605
- SHA1 36b6e43bcd91cdb0ca35c48a3b8644ba0d51f305
- SHA512 7980da87d70698ea26bf2109174cdbad041ff1c35ef19beb29985fa6a9ffeaa17df920b7ad9331700863cf7cc7b492e06fa1b9ff06a35e14779b742559d04489
- SSDEEP 24576:W0FRFbz9JmGF6uabHxZ2/AVWcE1+APcSs+x4HRjcKx+Afz0bRK+m4pGAhiBLqx7I:Wc5/mGJae/AJcBPcRjcA+AYDZLx7acT
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
6
Entry point
5312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddAtomA
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateThread
CreateWaitableTimerExW
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
FormatMessageA
FreeEnvironmentStringsW
GetAtomNameA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetHandleInformation
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RaiseFailFastException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetLastError
SetProcessAffinityMask
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_lock
_memccpy
_onexit
_setjmp
_strdup
_ultoa
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
longjmp
malloc
memcpy
memmove
memset
printf
realloc
signal
strerror
strlen
strncmp
vfprintf
wcslen
_cgo_dummy_export
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
158KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
087421ac222e935579dfd3b7a5120451fd9d9a663d3d1872c04b6154b238c894.elf
- SHA256 087421ac222e935579dfd3b7a5120451fd9d9a663d3d1872c04b6154b238c894
- MD5 caa62fc5426fda5bb51dd6dcfc804b5b
- SHA1 c1648ab78484ea318efa729b41f0fff80772a8b3
- SHA512 5b6678cc985a4e180032c2ef9ecc094b22ea2c7de3ab2cc9bfa265ef444c13582bcb3183125ab1193d9f5a45ceee46ff49d5773532242f8821d8ba845b39a460
- SSDEEP 768:Mqa+lipfbBFUDuQZHAOrvWj6rRjrM1u2BYiQnUWsx:0bB2aQZJvWjyhL2BY7nix
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
0c4791a6b47491a0c43cea0ba54357e391a3c8b23aa28025489bbe43bb9ea6ea.elf
- SHA256 0c4791a6b47491a0c43cea0ba54357e391a3c8b23aa28025489bbe43bb9ea6ea
- MD5 386982ad3916c76d79d706af4d8639fc
- SHA1 9b4e80785492dbbfc8c585587851bce3844f48a2
- SHA512 24ba01f9473a9fd5d5e8e0056952147f5ac2a9b166552dfc25fccf36b3b82e2eb608f0fc6994a92546617586cba82ef9469e9785d48e7f8d4875d2492c90ea1f
- SSDEEP 1536:EFE+30g4zbPVfqnB+1F5WfLKSMdD6elLB:0E+3szbtP13sL6h9BB
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe
- SHA256 0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea
- MD5 4b0a935fbc037ea00bf17468d4cf5b85
- SHA1 169cd19c1d29bebd2c7fe5a8de25b1429f8f2aed
- SHA512 0bee469d0188505772af1fd9af4a6710c201475340045b97024102a63aaba14f940e6ee36d118d338e836b4ee7ba03387001ce81724c4f4433123f5b9d83dd4f
- SSDEEP 12288:w6Wq4aaE6KwyF5L0Y2D1PqL5C38Lua13KVsrOQW60Ztsmhv3:GthEVaPqL58F2rBjmB3
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
933584
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
644KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
264KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
201KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 1bbbca0f24b38afc6e09cc1440f70392a9d040f53fed82de44593d843816f094
- MD5 370186163877d8a3947bd1cfdbd6e0ed
- SHA1 32ddfe5a267eeb3851ae905ce7134d6377a8d65d
- SHA512 ecbb4b0db39beb658f490acb3b79e2bce6dd8c7f5066fb04bf55919378bd1d923db74264146f3392f52269f8e3ec8320b9b3374444da0edb540029fe20dc8499
- SSDEEP 12288:khkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcJC:8RmJkcoQricOIQxiZY12
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.exe
- IMPHASH 5304b37e58964835f00e3b016aebe4ef
- SHA256 0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70
- MD5 d466c92a9ed1b0dd7a9789d24182b387
- SHA1 619c3496cb1494bcabbae38bf78bceb501608a7a
- SHA512 2fe67183a79118853f89b97bc0e43b74ce02692be8e5fa4e79e45fb09010d599b961191913c3836652536b2382321d8a5191921965aeea85616127ba2e6ac6bb
- SSDEEP 3072:cs2t+jk/d1uce+aD7UKg6THMGANMemOI:E7ufgKg6TsvI
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
38996
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVolumeInformationW
FindFirstFileW
FindNextFileW
WriteFile
TerminateProcess
GetModuleFileNameW
GetDynamicTimeZoneInformation
PeekNamedPipe
CreateMutexW
FindClose
WaitForSingleObject
CreateFileW
GetSystemDirectoryW
GetLogicalDriveStringsW
MultiByteToWideChar
Sleep
GetLastError
ReadFile
LoadLibraryW
GetProcAddress
GetFileSize
ExitProcess
GetComputerNameW
CreateProcessW
CopyFileW
GetComputerNameA
GetCurrentThreadId
TerminateThread
CreateThread
OpenThread
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetStartupInfoW
CloseHandle
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
HeapAlloc
HeapFree
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
user32
wsprintfA
CharUpperW
shell32
SHGetFolderPathW
crypt32
CryptStringToBinaryA
CryptBinaryToStringA
DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetSymLoadError
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MiniDumpReadDumpStream
MiniDumpWriteDump
RangeMapAddPeImageSections
RangeMapCreate
RangeMapFree
RangeMapRead
RangeMapRemove
RangeMapWrite
RemoveInvalidModuleList
ReportSymbolLoadSummary
SearchTreeForFile
SearchTreeForFileW
SetCheckUserInterruptShared
SetSymLoadError
StackWalk
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymAllocDiaString
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFreeDiaString
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymFunctionTableAccess64AccessRoutines
SymGetDiaSession
SymGetExtendedOption
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrEx
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameEx
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextEx
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevEx
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileChecksum
SymGetSourceFileChecksumW
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetDiaSession
SymSetExtendedOption
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
WinDbgExtensionDllInit
WinNextCheckIfConfigIsAttributionWorthy
_EFN_DumpImage
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo
Name
.text
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=134, id=261, version=27412,
count=15, id=260, version=28619,
count=9, id=259, version=28619,
count=38, id=261, version=28619,
count=9, id=257, version=27412,
count=108, id=1, productName=Unmarked objects,
count=1, id=259, productName=VS2019 v16.6.2 build 28806, version=28806,
count=3, id=265, version=28806,
count=1, id=256, productName=VS2019 v16.6.2 build 28806, version=28806,
count=1, id=258, productName=VS2019 v16.6.2 build 28806, version=28806,
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
- SHA256 10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1
- MD5 4030841f8cd4b3ac37ab0a0b9332f3a5
- SHA1 6d05584de372399fbadd59a1e6a1eefee90f8725
- SHA512 a8c40c3fa3f7f9ba47eed94a55a2562719073fd568d4aa96a081a46ce150e0b068b453e812eaef3fe15cafae3b66127e23ed4d72669173c8c254ba58d32534c0
- SSDEEP 24576:+NAwcGqisVN8rXpLOnM+YCftp99Jj9Pgxp1QrKDI:+NKVVsxmt9j
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe
- IMPHASH b5a014d7eeb4c2042897567e1288a095
- SHA256 11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432
- MD5 ecaa6f88c3b6594914a8ffde04fd5d84
- SHA1 885e4370299d369f7285ba5f2c544cbcd70a5fd0
- SHA512 94712c9ceddc1e2abd7ec19dc39bf2cbea54d3430f66887e2e0861c2cdb4c4ee24c39d3140c9374e826049516b814c3fcfcf4c49402bc5c2335d87bc0ee67f83
- SSDEEP 393216:hp8QGQCKH9iqYCfy8tW5MrYR0aioa4CMRmrrCZRBkyQzy:v8QGrK5GXR9ioaJMRmrrdysy
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
Password
infected
PE Signature issue
Digest
f1:f4:7a:b6:b0:5a:e3:44:7f:61:bc:4c:71:32:24:72:ff:16:8f:ae:fa:73:6b:34:c8:9a:15:29:ee:ef:1f:03
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Taipei,C=TW
Chains
Sep 21, 2023
PE Signature issue
Digest
f1:f4:7a:b6:b0:5a:e3:44:7f:61:bc:4c:71:32:24:72:ff:16:8f:ae:fa:73:6b:34:c8:9a:15:29:ee:ef:1f:03
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Da’an District,ST=Taipei City,C=TW
Chains
Sep 21, 2023
CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Da’an District,ST=Taipei City,C=TW
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Da’an District,ST=Taipei City,C=TW
Serial Number
05:ad:e4:6d:b0:2a:2f:78:46:2a:29:37:27:e8:d8:74
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 12, 2021 - Jun 8, 2024
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Taipei,C=TW
Serial Number
33:00:00:2a:56:3b:36:cd:48:0f:a3:a4:09:00:00:00:00:2a:56
Issuer
CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 20, 2023 - Sep 23, 2023
Subject
CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Taipei,C=TW
Serial Number
33:00:00:2a:56:3b:36:cd:48:0f:a3:a4:09:00:00:00:00:2a:56
Issuer
CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 20, 2023 - Sep 23, 2023
Subject
CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:27:af:ad:af:67:15:26:b8:e3:00:00:00:00:00:27
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2023 - Apr 4, 2024
Minor OS version
0
Major OS version
4
Entry point
73199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
kernel32
GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetModuleHandleW
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceExA
MulDiv
GlobalFree
GlobalAlloc
lstrcmpiA
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MultiByteToWideChar
GetLocaleInfoW
lstrlenA
lstrcmpiW
GetEnvironmentVariableW
lstrcmpW
GlobalMemoryStatusEx
VirtualAlloc
WideCharToMultiByte
ExpandEnvironmentStringsW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetThreadLocale
GetLocalTime
GetSystemTimeAsFileTime
lstrlenW
GetTempPathW
SetEnvironmentVariableW
CloseHandle
CreateFileW
GetDriveTypeW
SetCurrentDirectoryW
GetModuleFileNameW
GetCommandLineW
GetVersionExW
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
TerminateThread
ResumeThread
SuspendThread
IsBadReadPtr
LocalFree
lstrcpyW
FormatMessageW
GetSystemDirectoryW
DeleteCriticalSection
GetFileSize
SetFilePointer
ReadFile
SetFileTime
SetEndOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetModuleHandleA
SystemTimeToFileTime
GetLastError
CreateThread
WaitForSingleObject
GetExitCodeThread
Sleep
SetLastError
SetFileAttributesW
GetDiskFreeSpaceExW
lstrcatW
ExitProcess
CompareFileTime
GetStartupInfoA
user32
CharUpperW
EndDialog
DestroyWindow
KillTimer
ReleaseDC
DispatchMessageW
GetMessageW
SetTimer
CreateWindowExW
ScreenToClient
GetWindowRect
wsprintfW
GetParent
GetSystemMenu
EnableMenuItem
EnableWindow
MessageBeep
LoadIconW
LoadImageW
wvsprintfW
IsWindow
DefWindowProcW
CallWindowProcW
DrawIconEx
DialogBoxIndirectParamW
GetWindow
ClientToScreen
GetDC
DrawTextW
ShowWindow
SystemParametersInfoW
SetFocus
SetWindowLongW
GetSystemMetrics
GetClientRect
GetDlgItem
GetKeyState
MessageBoxA
wsprintfA
SetWindowTextW
GetSysColor
GetWindowTextLengthW
GetWindowTextW
GetClassNameA
GetWindowLongW
GetMenu
SetWindowPos
CopyImage
SendMessageW
GetWindowDC
gdi32
GetCurrentObject
StretchBlt
SetStretchBltMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetObjectW
GetDeviceCaps
DeleteObject
CreateFontIndirectW
DeleteDC
shell32
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
ole32
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
oleaut32
VariantClear
OleLoadPicture
SysAllocString
msvcrt
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
memset
_wcsnicmp
strncmp
malloc
memmove
_wtol
memcpy
free
memcmp
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
_controlfp
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5
- MD5 755c6c74f65a7eb6fac438c71232090b
- SHA1 ecd899ca1c4764a57a8a15f7ac41624196f1a4e7
- SHA512 f0dcf9c4d84708a6dd665c53d0d8b72209de79cd571836a496d9cf3dbdc757f82a69e6788b2037484720fa6e966ff5c6719be4f7faa36486561856b1f7e6379c
- SSDEEP 3072:MNA/391UUU35AkH+wWtailGlIQZboLRM9ua/aHyvZRVed2idrTj4i4MzNrpFFbmO:MNALUU4T7sGlVbAP//zNCbuIQ
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
192942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
183KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
17691f0962027e7110f727ae997f8af5885dd783674d1db023d467ec478515b7.elf
- SHA256 17691f0962027e7110f727ae997f8af5885dd783674d1db023d467ec478515b7
- MD5 a34eeacb65f86c57bdea56175af169ef
- SHA1 6f474269c97412679d64187a3e99eec1707b4200
- SHA512 7e763bec443a758df9c6f322087a07cf12406a5b46ba6049ddf3fd33c780f1bbe32cd7dd7e7fb19f9a43bd4d168984de1df925c525304099e6f8cd44947da432
- SSDEEP 3072:Mwoe3s52Zt9nQiX/GpO1SMRpp6NWJdWQwi:MnSskZDQiX/2ObRWoDWf
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12
- MD5 8ceb3a5e7da3309b307a2407298a7cee
- SHA1 c7b571e5020866e068c8b780782be72cf5f8df3f
- SHA512 80a5cd2d600cee52ac02dd2534c7415a714e41d403486dac3e181706f5ea1a63f610c46b09c46035d60462f2b20bc5fdaf8e4ca1aafaa0ffaadd9430ea3b7277
- SSDEEP 98304:jf3t4BNLhoAfN/BKhtrW4+UbTRS2S6A4nzSHkKZkWKR/J7gyTT:jf3t4zNoAFYhdW4ZJzfOkCkWu/dgO
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/AccessControl.dll
- IMPHASH 6b225baf8d24583523d4f42890e12522
- SHA256 5fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52
- MD5 d74bb4447af48da081c7d9b499f3a023
- SHA1 dadf6e140e6fd8e49a1851cc144bb022e0adb185
- SHA512 9a15de5c6b08914f5e5bbc1c318fb0e84da28a316cf51ccddca8dfb64cd67b7ad06acac307b41d5086a0740055d327007ff890807d6853bb2e767179a3b3d758
- SSDEEP 192:0hdGZ2E0hm+Gc7ROMzCPvXWROt086dXHGrEKcDDi0b5ZsgMgiCXyo1Fp01eLLuIt:0hdGZ2E0YWV2908oj21ILud8
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
14295
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
CloseHandle
lstrlenW
lstrcatW
lstrcmpiW
GetFileAttributesW
LocalAlloc
LoadLibraryA
GetCurrentProcess
GetProcAddress
lstrcpyW
GetLastError
LocalFree
GlobalFree
lstrcpynW
user32
wsprintfW
advapi32
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSidSubAuthority
RegCloseKey
OpenProcessToken
RegGetKeySecurity
LookupAccountSidW
GetSidIdentifierAuthority
AdjustTokenPrivileges
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
RegOpenKeyExW
RegSetKeySecurity
IsValidSid
GetSecurityDescriptorDacl
GetUserNameW
GetNamedSecurityInfoW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSidSubAuthorityCount
InitializeSecurityDescriptor
LookupAccountNameW
SetEntriesInAclW
ClearOnFile
ClearOnRegKey
DenyOnFile
DenyOnRegKey
DisableFileInheritance
DisableRegKeyInheritance
EnableFileInheritance
EnableRegKeyInheritance
GetCurrentUserName
GetFileGroup
GetFileOwner
GetRegKeyGroup
GetRegKeyOwner
GrantOnFile
GrantOnRegKey
NameToSid
RevokeOnFile
RevokeOnRegKey
SetFileGroup
SetFileOwner
SetOnFile
SetOnRegKey
SetRegKeyGroup
SetRegKeyOwner
SidToName
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=42, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$PLUGINSDIR/modern-header.bmp
- SHA256 3afef9d995fb77512b3e61152589089a7e856432c3c45243eb459d49c8bc95a3
- MD5 d87c81fa4ebc1e505dfc9ea462d90212
- SHA1 0d259d5eda687b165ec3928082a3e53749f740d5
- SHA512 9df06754cea3ba987b98754420c51c6ae8ee3498a0ba79807de2c3e112f69f3136def7c0a311797403f2657bdc0fdb8fe120975850d90d254fa01ca8f9c488fb
- SSDEEP 96:/VQDZnMVHBk+8sd9HXV4JEvOLtndITN0gWQhaqNalvQKa:/2dqFXHXV4JwOxndIp0gTTNaXa
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
$PLUGINSDIR/nsProcess.dll
- IMPHASH a49b0342971aa199fc6349725b90146d
- SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
- MD5 faa7f034b38e729a983965c04cc70fc1
- SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
- SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
- SSDEEP 48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
4097
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
OpenProcess
lstrcpynA
lstrlenA
LoadLibraryA
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExA
GlobalFree
GlobalAlloc
user32
GetWindowThreadProcessId
EnumWindows
wsprintfA
PostMessageA
_CloseProcess
_FindProcess
_KillProcess
_Unload
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
910B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
250B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=24, id=1, productName=Unmarked objects,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CommandPost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f27af6504285706f0a32470955a45c9b6f6f860cd73580b7074aa2277d033388
- MD5 cb97105462eb022605c2b6d434c30aba
- SHA1 c3b2e2b94aecfda319b5b97d92580d20abdafe58
- SHA512 74b0959ca537d780ded779a45f4ed5198f563d63fa742badfd05f7a03caf9271cb6649ccbd6a16eee92bfd2026629e9d4658680bd1fe150df86f6de506df6eb9
- SSDEEP 196608:u5BKd5QJ+ENE7qXlfvpkSIR5sTyC6M/+3rb:u/KwtJvpkS/yC8
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8166798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\admin\source\repos\CommandPost\CommandPost\obj\Release\CommandPost.pdb
mscoree
_CorExeMain
Name
.text
Size
7.8MB
Virtual Size
7.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Uninstall.exe
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 9a2f76a40341a4ede271813c27e8da28da3108709b6c99f22abde151f60793e8
- MD5 c35f0cb2adc35c19ef16e847d81cf2fd
- SHA1 4b327c5296fcccc72b0e55e923cb2a9d4049beef
- SHA512 44bc72732bc66ca23cc3ff0c30a57eb7fe2e3f2cf78f35eea5699cc571bde12e54da73aeebecd8ff4524f7e397dc86865034e03b25b3af366a88a3e091b0c6e8
- SSDEEP 1536:JmsAYBdTU9fEAIS2PEtuLgjiLrGAv00ef3a:IfY/TU9fE9PEtuL+arGAK/a
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
icon.ico
- SHA256 03719709db3e30621048f4358924b3ed2fe973308ca056458aa5a6131ae7ec37
- MD5 a7701d6bb05c224c87f9393979e7f59f
- SHA1 e52f784214433a9b461a77d19f4418dee736c18f
- SHA512 9fedc91e5dcdf803febe89ed89453ff39d2bbefb27dec0f058ecbe4235a0bd0d87a057d69f946353ca2819e9c06288d1278a66244e47bbf5e12842b3aacd3d33
- SSDEEP 768:FYby/kQaiyU2Ju80AsRYrJyQWE5o3oN4a3CX7II6ukOUklCgQAXBTRE:FWy/kQt32Jd0fur0PNBXEI6uqiU
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe
- IMPHASH e569e6f445d32ba23766ad67d1e3787f
- SHA256 1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228
- MD5 74a37bb794ed287696eac4495ffae13f
- SHA1 0097bc646687e8441db0079c3f85320be39e4a13
- SHA512 17770d69d3792f1663d58d2d5c1b1cbcac04ac9ef85c0416bb4f69ca3410b710953f384039999e8719a798bf4cd751226a2282affb7f959197eeccb782126950
- SSDEEP 24576:s7FUDowAyrTVE3U5F/9GqKVKic6QL3E2vVsjECUAQT45deRV9RZ:sBuZrEUwzKIy029s4C1eH93
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
745196
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
comctl32
InitCommonControls
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
user32
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
oleaut32
SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate
netapi32
NetWkstaGetInfo
NetApiBufferFree
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
AdjustTokenPrivileges
GetTokenInformation
ConvertSidToStringSidW
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
718KB
Virtual Size
718KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
27KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
1b8cda768ba75d723b2b0b34cf955f7ec9469b4e33c6fde6494eefd60a139d8a.elf
- SHA256 1b8cda768ba75d723b2b0b34cf955f7ec9469b4e33c6fde6494eefd60a139d8a
- MD5 95917209bb8848eae1a1c23bc9f1d408
- SHA1 6a1d24d516661a8ce45621215d567005504abdee
- SHA512 a210dd4775612be960fbb2850f7a4f13680e40386b37ca05605434f9670e70d535fab839df9dd5b013910056a0cd8f32f163208af9ce890af789e485fab3a480
- SSDEEP 3072:PccxTBU5zIUJXXxhtn/aZ6OVCRLCSpO8BC:PciBy7JXhht/anmXpO8BC
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
- SHA256 1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7
- MD5 d465f896ac0fa592fd84f65824c424f2
- SHA1 307e056622700b43eebb6bb43080708fcd6e7990
- SHA512 7034166cf7c3e05f9555c4356b31c1ab9d1abb3b68f3483448bf1983a3fdad5adf5f38c1f32ee5de069a8b59c5b43e48b0f4abf776ab1246265bcfa1a434794b
- SSDEEP 3072:L+YUpmc5hIof5UM7XgYjykKdYmm/QcuLB126DNb:LwU1of5UMPyk2Ymm/QcuLB126DNb
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
- SHA256 1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0
- MD5 013c472aa24c1a90c7d3d9f7cb429acf
- SHA1 c2d2332e6ae7896feb69591968752431656fac40
- SHA512 0fc535975b93d62f32e54993413093b236d64aedb8fd76822d66988e85d9649833dca3479159b8e16dc92645a26c36b92ae9b422e642c94dacfd1c212184dd1c
- SSDEEP 768:WV8SNmQEPAPJD7E9NsB8UI8t/PMJTjKxVnjDbwqctNcjvwRgIP:WhNgPE7As8x8t/ETjKx9jDbDSGKP
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
1f580428fa8afd15832fcd04f5d6832be9f7a7144ff17e19c89d2b07e7f51f2c.elf
- SHA256 1f580428fa8afd15832fcd04f5d6832be9f7a7144ff17e19c89d2b07e7f51f2c
- MD5 0589691fb8aea57598cb05690213a08a
- SHA1 69b0f2fe133f6abfa26fcbddad36967edfa294ac
- SHA512 11cb390e18428ec9a11fae60606126235d75f99469b0bd50e92e64d513ae1ae21446f3ac3227a9c599ec73a117cfbcc7b5419ddda8e8680759b98c6122a1c773
- SSDEEP 3072:+DShVLkDZ6waCAdclgbYJOmP46aQyfPluesNb:VhVeZ6zclgboOmP46aQyfPluesNb
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc.elf
- SHA256 257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc
- MD5 a78380f647766a2bc099844375bd5a4c
- SHA1 4546876d037d899090260fcf9fe49683998cc9de
- SHA512 16f9c97b8f46f85ef003174b94ff5444d91845e759ae3fee3e7f468e22232c8afb0d068942eb8b73686caca299f3998bf0cb235a918ea81e3c2ddc15167f5c43
- SSDEEP 12288:EOAMgUW8jfDhKGCotRnmpi6pF4XhCZDicNFeDG/p1vaKfgUZmao:/I2j7hZCoPnmp3p7DbNcK7zw
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
XZUtil is a linux backdoor releated to the CVE-2024-3094.
262a10ee377a4945ce30e115e2ab1bf9ff2fc0f35741bbb72e40f145de24bd50.elf
- SHA256 262a10ee377a4945ce30e115e2ab1bf9ff2fc0f35741bbb72e40f145de24bd50
- MD5 f389886a847d6e69148c5cc795ef9ebd
- SHA1 3c157e3ef052503181f6520fbe95240060d7e3a1
- SHA512 6b1acae24692d583a6673d817af32282f305884df7de68a73f3ed76e7e567d2821ad6c0d611480da7437051b42a2d7823d461e3f8cc49ab96918b1219ea4d911
- SSDEEP 1536:O+65RMfLd4/IbINUgicUwK9xpNvTxNfjbo8PgUF7MJqvAfItK510LHqQe2khhyz3:Odcd4TUYUB9xr7x17ga7MdfrhhQqo
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
267909cf4a62955a35b0fe013afbfd62d7ae1a1eef6d7a24d7ce50db52d48ce7.bat
- SHA256 267909cf4a62955a35b0fe013afbfd62d7ae1a1eef6d7a24d7ce50db52d48ce7
- MD5 c3a090912dd6f7c536225858fb24387c
- SHA1 3773938587b06c7dc300b3d973c715c685a28877
- SHA512 7ff0e8434fafbc88e3e444a0300504c01e3976c369662ec55c70e38c1178f8e383522362efc2c4bde8c338bbb6c14007617a8696a6cb2082036c00136db6f0f8
- SSDEEP 192:UPtKEKMJRLI0WCUaypBO2xzk4oquKEwY6edkEEhd:UPtKdMJpJV2xo4oCEwAAhd
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
2796760675e5efbef0319f0285c2e1d07c11b038311c02e16c2407ba57c38413.elf
- SHA256 2796760675e5efbef0319f0285c2e1d07c11b038311c02e16c2407ba57c38413
- MD5 4fe32715422fb3e917e0862c968d92fc
- SHA1 38389592a134c3845acaaef60aaa1ea5e98cb0b2
- SHA512 aa61f8d7f959a3f729b2e1ed77c5545220807e304f8445955a6b1c9caa193ef4e9d965ca59ce7b9fadaf098a32a2c51a3eb8c7b3546e7f92ee3f584c6bdd88f8
- SSDEEP 3072:hqIkB/Ldm6cGswYLVDFyh/lJ3CnV97emvI0PDGnSQNER:hqIkBTo6cGswcyh9J3WXemvI0PDGnSQ6
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
27cd090cf83877750416d37dc6ddd8ff319b4854414e4275d67f96652376bcf0.zip
- SHA256 27cd090cf83877750416d37dc6ddd8ff319b4854414e4275d67f96652376bcf0
- MD5 8e7bd31ba55449c888d3b013612f539a
- SHA1 ca64ca50a07e1936fe00f2ff8509f03c5e1b3826
- SHA512 4a7607aa60b27d1045bc0f39dea0e5882c8c0fb49f34eb8df188f29a23597716911c7042bc2ecb7a782d5d4e523cde8ef09729571ddced315e15ec4ecb93b171
- SSDEEP 3072:GXo30AGpsrN/L3MbeLRb19yZFTvbzK9UsJp/1G2Tl+StFV7+xoLDSVpS:2o/J3SSb19yzzK9hp/vx+StFV7MoL6S
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
27e181c699f14c3e53cabc89941ac40917165cc4be34d2c7f9d6eca0e16b508c.elf
- SHA256 27e181c699f14c3e53cabc89941ac40917165cc4be34d2c7f9d6eca0e16b508c
- MD5 e8708f827c4559c956d96a43d10617ae
- SHA1 987f00a30840f19e86bf63d957f597e3e989f5a5
- SHA512 a8268865a951ccf1fe16ba1eeaf4eaa1c7c5fb2b9b0f3503d0aa8958b8f3cb08d57bb46332f891aeabaf8770f628bcbbb152915b3fb811cd84438b39cfa20c69
- SSDEEP 768:oe2V5Ds1WRxUFaYiTW2NamlX3vu6aCgFlQ3xQkgFHTn0au783JNVPM4R/wsJn+Dz:oBgWHc+S2R6FTn0D783JU4R/wqn+KC
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
2b4b073178b573aa181fdc6e8063c778c90f76235d640c186b99278186509e74.elf
- SHA256 2b4b073178b573aa181fdc6e8063c778c90f76235d640c186b99278186509e74
- MD5 5d56a442ec59555956e27a72a1cba483
- SHA1 002763e66b2f3856d386a9faaf62eab610a3fde1
- SHA512 d1d5f40419d3156efa0de16c719f02d853b36a3c409d3d62bd763befa739fc368f86b1823f4881ef2661d66a149cb6fb321178af7db2cf2d46fc5d3fcc5baf85
- SSDEEP 3072:f3Yco4c+tKiAY/5hlKdcWDURxuZq+1uPNd5R:v6kB/5hl0lURxuZq+1uPNd5R
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635
- MD5 e959a251d4fd9d7c2bb495120b34e0c7
- SHA1 f1fd8ceb0c33d51d36e7b48fe2672ee1873a8d5c
- SHA512 bb87ec1a60d28a8949ba0bbb4f2cf8c839f1648420ad24016d2aec87d400193071936e9f2239d8df609c4c08cd144c204466e3da71615d90988498718aef0eb0
- SSDEEP 3072:g2YHCLwn3UjOikH+LGP34o7KerVUzeeDXbwa21Dv9ua/aHyvDTd2iWtxILgcaL1K:g2YHuwn3UFdbwvsvj3xh
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
193118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
2bac99f5be34b649749a4ce8ab7c8103f9dce863cbc490f273c27297b2c465ec.elf
- SHA256 2bac99f5be34b649749a4ce8ab7c8103f9dce863cbc490f273c27297b2c465ec
- MD5 ad8386d085209e80efb83b5d9ffc3981
- SHA1 b81e08d6f5144ba1bf4acf2a28d1577bc95a7d44
- SHA512 35fe10cc741f58eb71e86883e8fc90161ca313599d50dc26206ce62badbd5333543b2ed60abcb1a0b6f9d048ee5b51356a857b4d2889150d5963bdf13e9331c1
- SSDEEP 1536:0/WS0ZlJVfdtV7QiVFnFk6tXpN+tQDkAlM50tJv0:qHcv7G6tX+SD1l8Qv0
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
2cfeefaa133519defee56f4253c7c7f2396d784ed8e09d2212ab5bee6cf52b50.elf
- SHA256 2cfeefaa133519defee56f4253c7c7f2396d784ed8e09d2212ab5bee6cf52b50
- MD5 c2b9c468309d87c79398b01bed8f85a8
- SHA1 d9ba2ef9fbc5d47c42cf370d3d38d68b10535c21
- SHA512 f47dd02ecfe7848cf2b8d7ab3852167a371013a71ca8670ab8b14e98493018c038dc269ea2169c862167b3a38ff4095a957fe0dbfb5767b81ad00e2174a42002
- SSDEEP 3072:fcyWqgG6CH7XUS4zA07tYTEVrjbi/LSD/J1yRN+cq:fcybESAAuYT3LSDHyR0cq
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
2e48ee0fb3ddd63efeecd900a9d2bde365e2fe1fcbb3c43c882362ae935c5066.exe
- IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
- SHA256 2e48ee0fb3ddd63efeecd900a9d2bde365e2fe1fcbb3c43c882362ae935c5066
- MD5 4532fe89506406de9ebaa83778d74c8f
- SHA1 8015b822fc7df8d33ec3416e773f7189e9b74b5f
- SHA512 50706520d3df0669ac2b7a75a6a234cd28deec92e8be98e0e4ce7ef8848952cc07b53e30723bf4668ee3f940714360f6ba705bfe83e2d47f3163c86e407ba36a
- SSDEEP 12288:w3qcsNKVUdaaPDodw7y1Q3krddMK341VhJ5mhj2ZCm03Pjzkjp:w33uK2daGz+1Q3qdMKoDhJkhWCmQjzAp
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b
- MD5 8c64a02c90f20524920e6e5e482b5a55
- SHA1 cc0f119b3d8e6d91f6e49d9cd21df4bc6b478b52
- SHA512 45b43dace1960596f7da79f9fec0dc4189ad7d8c5c3d6f6372a6b52d5adc5077ab50e5832852b0e69c92a02b637fb96d5b2f275738a653cb1113e42a9c2a7105
- SSDEEP 1536:VZuhD5z28TC2u8OpBPncFPAcTgbSUPH4Lh0tY7:ah0BPncKCgbSKHahoY7
- MD5 SHA1 SHA512 SSDEEP
-
BlackNET payload
-
Class file contains resources related to AdWind
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
31b6a608393ad6cadd7eadf286795aef37260c9b99e837f1d7a1aa4e9a7f901b.exe
- IMPHASH 6c17cd221979c51b4b1f1bc0b7dc863e
- SHA256 31b6a608393ad6cadd7eadf286795aef37260c9b99e837f1d7a1aa4e9a7f901b
- MD5 cf1d6b216e37745bf725a0b327f0045e
- SHA1 3278b37ac35b877d3d5e9e1aff82d94bce532709
- SHA512 70b4f8651efd28af344059d62886f38595a692c642b8ebf0a81a69bfa948c471d73b7b7888d4a91c97e0bbe0d44f819e3ffcdae06dccfa790c77503ec5b7130b
- SSDEEP 6144:aR74gEBkjnu0zpAhr5lX8+CcpsUS5YKLFBVERB:a+gEBkjnXAhFlMSpBS5Htm
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14675
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\noyiworerew.pdb
kernel32
SetThreadContext
GetConsoleAliasesLengthW
GetLocaleInfoA
GlobalAddAtomA
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GetVolumeInformationA
GlobalFindAtomA
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
FindNextVolumeW
WriteConsoleW
FileTimeToSystemTime
FindResourceA
GetTempPathW
GetLastError
ChangeTimerQueueTimer
SetLastError
GetProcAddress
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
RemoveDirectoryW
VirtualLock
GetModuleFileNameA
GetCurrentDirectoryA
GetWindowsDirectoryW
GetStringTypeW
OutputDebugStringW
FlushFileBuffers
CreateFileA
GetNumaNodeProcessorMask
ExitThread
GetEnvironmentVariableW
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
GetConsoleMode
SetFilePointerEx
SetStdHandle
CreateFileW
user32
CharUpperBuffA
DrawCaption
gdi32
SetTextColor
advapi32
ReadEventLogW
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
192KB
Virtual Size
41.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe
- SHA256 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d
- MD5 7c75ba2571e91dca0ebb1319aa20da5f
- SHA1 ccef5b75906891ca1e3870ee25b04b1217fab8d7
- SHA512 88231259a4f6ad9502c6ade78d8c6c6f53653b6c122894c1217fe67baf2c880522ffd855c4f5478a0b104f4ef3d00ee39cf209abb749f9ea40026179dab37a4c
- SSDEEP 49152:32lHrEP4oHhGa6yGE4jz7WCp4VpO5STuxDNtS9W1Cf:mlLoHhzxGEGX2DWBxD/S9nf
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
39716
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
3476006a8f64bfe72a8b04477f6005293b5854cfbc58bee2ea28e59b58f0e316.apk
- SHA256 3476006a8f64bfe72a8b04477f6005293b5854cfbc58bee2ea28e59b58f0e316
- MD5 d4d73a10d80f4f09d54340088f352554
- SHA1 6ca0a0b90cc1e7df7a3a6fcdc419cb1684c5d22b
- SHA512 6af85127eeb011213e97e8af7761445394cbbccc04d2dfb6d4c739cad7c9465c9c89c4d37432cb3fa423cfcea809a71a1eab0891b1a82bca92857145656b77ff
- SSDEEP 1572864:Lcga40E1c4sL0MmD+PwpJjTVveOwZIjZMxNgN9O7hZw3:ggqEe0rDamwZ6Z+gfQZ4
- MD5 SHA1 SHA512 SSDEEP
-
Android Triada payload
-
Class file contains resources related to AdWind
com.fmwhatsapp
com.fmwhatsapp.settings.SettingsNotifications
android.permission.FOREGROUND_SERVICE_DATA_SYNC
android.permission.RECEIVE_SMS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.READ_PHONE_NUMBERS
android.permission.VIBRATE
android.permission.ACCESS_NETWORK_STATE
android.permission.FOREGROUND_SERVICE_MICROPHONE
android.permission.FOREGROUND_SERVICE_CAMERA
android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.USE_BIOMETRIC
android.permission.USE_FINGERPRINT
android.permission.SCHEDULE_EXACT_ALARM
android.permission.AUTHENTICATE_ACCOUNTS
android.permission.GET_ACCOUNTS
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.INTERNET
android.permission.NEARBY_WIFI_DEVICES
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.READ_EXTERNAL_STORAGE
android.permission.MANAGE_EXTERNAL_STORAGE
android.permission.MANAGE_OWN_CALLS
android.permission.ACCESS_MEDIA_LOCATION
android.permission.BLUETOOTH
android.permission.BROADCAST_STICKY
android.permission.CHANGE_NETWORK_STATE
android.permission.FOREGROUND_SERVICE_LOCATION
android.permission.GET_TASKS
android.permission.INSTALL_SHORTCUT
android.permission.MANAGE_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.NFC
android.permission.READ_CONTACTS
android.permission.READ_PROFILE
android.permission.READ_SYNC_SETTINGS
android.permission.READ_SYNC_STATS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.SEND_SMS
android.permission.USE_CREDENTIALS
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_MEDIA_AUDIO
android.permission.READ_MEDIA_IMAGES
android.permission.READ_MEDIA_VIDEO
android.permission.READ_MEDIA_VISUAL_USER_SELECTED
android.permission.POST_NOTIFICATIONS
android.permission.WRITE_SYNC_SETTINGS
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.FOREGROUND_SERVICE
android.permission.USE_FULL_SCREEN_INTENT
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
com.google.android.c2dm.permission.RECEIVE
com.google.android.gms.permission.AD_ID
com.google.android.providers.gsf.permission.READ_GSERVICES
com.sec.android.provider.badge.permission.READ
com.sec.android.provider.badge.permission.WRITE
com.htc.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.UPDATE_SHORTCUT
com.sonyericsson.home.permission.BROADCAST_BADGE
com.sonymobile.home.permission.PROVIDER_INSERT_BADGE
com.huawei.android.launcher.permission.READ_SETTINGS
com.huawei.android.launcher.permission.WRITE_SETTINGS
com.huawei.android.launcher.permission.CHANGE_BADGE
com.fmwhatsapp.permission.BROADCAST
com.fmwhatsapp.permission.MAPS_RECEIVE
com.fmwhatsapp.permission.REGISTRATION
com.whatsapp.sticker.READ
com.facebook.services.identity.FEO2
com.fmwhatsapp.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.REORDER_TASKS
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
com.fmwhatsapp.instrumentation.ui.InstrumentationAuthActivity
com.fmwhatsapp.migration.export.ui.ExportMigrationActivity
com.fmwhatsapp.intent.action.migrate.ios.START
com.fmwhatsapp.payments.ui.GlobalPaymentOrderDetailsActivity
com.fmwhatsapp.payments.GlobalPaymentTransactionDetailActivity
com.fmwhatsapp.home.ui.HomePlaceholderActivity
com.fmwhatsapp.home.ui.StarredMessagesPlaceholderActivity
com.fmwhatsapp.HomeActivity
android.nfc.action.NDEF_DISCOVERED
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
com.fmwhatsapp.product.newsletterenforcements.geosuspend.NewsletterGeosuspensionInfoActivity
com.fmwhatsapp.product.newsletterenforcements.alerts.NewsletterAlertsActivity
com.fmwhatsapp.product.newsletterenforcements.enforcedmessages.EnforcedMessagesActivity
com.fmwhatsapp.payments.ui.IndiaUpiPaymentMethodSelectionActivity
com.fmwhatsapp.payments.ui.IndiaUpiBalanceDetailsActivity
com.fmwhatsapp.payments.ui.IndiaUpiPaymentsValuePropsActivity
com.fmwhatsapp.payments.ui.IndiaUpiPaymentsValuePropsBottomSheetActivity
com.fmwhatsapp.payments.ui.IndiaUpiIncentivesValuePropsActivity
com.fmwhatsapp.payments.ui.IndiaUpiPinPrimerFullSheetActivity
com.fmwhatsapp.payments.ui.IndiaUpiPinSetUpCompletedActivity
com.fmwhatsapp.payments.ui.IndiaUpiPaymentsTosActivity
com.fmwhatsapp.payments.ui.IndiaUpiPaymentTransactionDetailsActivity
com.fmwhatsapp.payments.ui.IndiaUpiPaymentsAccountSetupActivity
com.fmwhatsapp.payments.ui.IndiaUpiBankPickerActivityOld
com.fmwhatsapp.payments.onboarding.IndiaUpiBankPickerActivity
com.fmwhatsapp.payments.ui.IndiaUpiBankAccountPickerActivity
com.fmwhatsapp.payments.ui.IndiaUpiDobPickerActivity
com.fmwhatsapp.payments.ui.IndiaUpiDebitCardVerificationActivity
com.fmwhatsapp.payments.ui.IndiaUpiBankAccountAddedLandingActivity
com.fmwhatsapp.payments.ui.IndiaUpiSimVerificationActivity
com.fmwhatsapp.payments.ui.IndiaUpiOnboardingErrorEducationActivity
com.fmwhatsapp.payments.ui.IndiaUpiBankAccountDetailsActivity
com.fmwhatsapp.payments.ui.IndiaUpiDeviceBindStepActivity
com.fmwhatsapp.payments.ui.IndiaUpiVpaContactInfoActivity
com.fmwhatsapp.payments.ui.IndiaUpiChangePinActivity
com.fmwhatsapp.payments.ui.IndiaUpiCheckBalanceActivity
com.fmwhatsapp.payments.ui.IndiaUpiSendPaymentActivity
com.fmwhatsapp.payments.ui.IndiaUpiSendPaymentActivityBottomSheet
com.fmwhatsapp.payments.ui.IndiaUpiCheckOrderDetailsActivity
com.fmwhatsapp.payments.ui.IndiaUpiPaymentSettingsActivity
com.fmwhatsapp.payments.ui.IndiaUpiMandateHistoryActivity
com.fmwhatsapp.payments.ui.IndiaUpiContactPicker
com.fmwhatsapp.payments.ui.IndiaUpiInteropSendToUpiActivity
com.fmwhatsapp.payments.ui.IndiaUpiQrCodeScanActivity
com.fmwhatsapp.payments.ui.IndiaUpiQrTabActivity
com.fmwhatsapp.payments.ui.IndiaUpiQrCodeUrlValidationActivity
com.fmwhatsapp.payments.ui.IndiaUpiPaymentLauncherActivity
com.fmwhatsapp.payments.ui.IndiaUpiMandatePaymentActivity
com.fmwhatsapp.payments.ui.IndiaUpiQuickBuyActivity
com.fmwhatsapp.payments.ui.IndiaUpiProfileDetailsActivity
com.fmwhatsapp.payments.ui.IndiaUpiNumberSettingsActivity
com.fmwhatsapp.payments.ui.IndiaUpiStepUpActivity
com.fmwhatsapp.payments.ui.IndiaUpiInterOpHybridActivity
com.fmwhatsapp.payments.receiver.IndiaUpiPayIntentReceiverActivity
android.intent.action.VIEW
com.fmwhatsapp.payments.ui.IndiaPaymentTransactionHistoryActivity
com.fmwhatsapp.payments.ui.mapper.register.IndiaUpiMapperValuePropsActivity
com.fmwhatsapp.payments.ui.mapper.register.IndiaUpiMapperLinkActivity
com.fmwhatsapp.payments.ui.mapper.register.IndiaUpiMapperPendingActivity
com.fmwhatsapp.payments.ui.mapper.register.IndiaUpiCreateCustomNumberActivity
com.fmwhatsapp.payments.ui.IndiaUpiPauseMandateActivity
com.fmwhatsapp.payments.ui.IndiaUpiPaymentsBlockScreenShareActivity
com.fmwhatsapp.payments.ui.mapper.register.IndiaUpiMapperConfirmationActivity
com.fmwhatsapp.payments.ui.IndiaUpiProvideMoreInfoActivity
com.fmwhatsapp.payments.ui.IndiaUpiProvideMoreInfoBottomSheetActivity
com.fmwhatsapp.payments.ui.IndiaUpiAccountRecoveryFinishActivity
com.fmwhatsapp.payments.phoenix.flowconfigurationservice.activities.IndiaUpiFcsPinHandlerActivity
com.fmwhatsapp.payments.IndiaUpiPaymentInvitePickerActivity
com.fmwhatsapp.payments.phoenix.flowconfigurationservice.activities.IndiaUpiFcsAddPaymentMethodActivity
com.fmwhatsapp.payments.phoenix.flowconfigurationservice.activities.IndiaUpiFcsConsumerOnboardingActivity
com.fmwhatsapp.payments.phoenix.flowconfigurationservice.activities.IndiaUpiFcsResetPinActivity
com.fmwhatsapp.payments.ui.international.IndiaUpiInternationalActivationActivity
com.fmwhatsapp.payments.ui.international.IndiaUpiInternationalDeactivationActivity
com.fmwhatsapp.payments.ui.international.IndiaUpiInternationalValidateQrActivity
com.fmwhatsapp.payments.phoenix.flowconfigurationservice.activities.IndiaUpiFcsTransactionConfirmationActivity
com.fmwhatsapp.payments.ui.IndiaWebViewUpiP2mHybridActivity
com.fmwhatsapp.conversation.EditBroadcastRecipientsSelector
com.fmwhatsapp.conversation.conversationrow.ContactSyncActivity
com.fmwhatsapp.conversation.conversationrow.album.MediaAlbumActivity
com.fmwhatsapp.conversation.conversationrow.message.MessageDetailsActivity
com.fmwhatsapp.conversation.conversationrow.message.KeptMessagesActivity
com.fmwhatsapp.conversation.conversationrow.message.reporttoadmin.messageslist.ReportToAdminMessagesActivity
com.fmwhatsapp.conversation.conversationrow.message.reporttoadmin.reporttoadminreporterslist.ReportToAdminReportersActivity
com.fmwhatsapp.conversation.conversationrow.message.StarredMessagesActivity
com.fmwhatsapp.Conversation
android.intent.action.VIEW
android.intent.action.SENDTO
com.fmwhatsapp.Conversation
com.fmwhatsapp.conversationslist.ArchiveNotificationSettingActivity
com.fmwhatsapp.conversationslist.ArchivedConversationsActivity
com.fmwhatsapp.conversationslist.HiddenConversationsActivity
com.fmwhatsapp.conversationslist.SmsDefaultAppWarning
com.fmwhatsapp.conversation.EditMessageActivity
com.fmwhatsapp.conversation.selection.SingleSelectedMessageActivity
com.fmwhatsapp.conversation.selection.SelectedImageAndVideoAlbumActivity
com.fmwhatsapp.conversationslist.LockedConversationsActivity
com.whatsapp.voipcalling.VoipActivityV2
com.whatsapp.calling.calllink.view.CallLinkActivity
com.whatsapp.calling.callhistory.group.GroupCallParticipantPickerSheet
com.whatsapp.calling.callhistory.group.GroupCallLogActivity
com.whatsapp.calling.callhistory.group.GroupCallParticipantPicker
com.whatsapp.calling.callhistory.CallLogActivity
com.whatsapp.calling.spam.CallSpamActivity
com.whatsapp.calling.callrating.CallRatingActivity
com.whatsapp.calling.callrating.CallRatingActivityV2
com.whatsapp.calling.VoipAppUpdateActivity
com.whatsapp.calling.VoipNotAllowedActivity
com.whatsapp.calling.VoipPermissionsActivity
com.whatsapp.calling.schedulecall.upcomingcalls.view.UpcomingScheduledCallsActivity
com.whatsapp.calling.psa.view.GroupCallPsaActivity
com.fmwhatsapp.community.CommunityMembersActivity
com.fmwhatsapp.community.deactivate.DeactivateCommunityDisclaimerActivity
com.fmwhatsapp.community.EditCommunityActivity
com.fmwhatsapp.community.ManageGroupsInCommunityActivity
com.fmwhatsapp.community.CommunityNUXActivity
com.fmwhatsapp.community.AddGroupsToCommunityActivity
com.fmwhatsapp.community.CommunityHomeActivity
com.fmwhatsapp.community.CommunityNavigationActivity
com.fmwhatsapp.community.NewCommunityActivity
com.fmwhatsapp.community.LinkExistingGroups
com.fmwhatsapp.community.CommunitySettingsActivity
com.fmwhatsapp.community.membersuggestedgroups.MemberSuggestedGroupsManagementActivity
com.fmwhatsapp.group.GroupChatInfoActivity
com.fmwhatsapp.chatinfo.ListChatInfoActivity
com.fmwhatsapp.chatinfo.ContactInfoActivity
com.fmwhatsapp.businessupsell.BusinessProfileEducation
com.fmwhatsapp.newsletter.NewsletterInfoActivity
com.fmwhatsapp.biz.BusinessProfileExtraFieldsActivity
com.fmwhatsapp.businessupsell.BusinessAppEducation
com.fmwhatsapp.biz.linkedaccounts.LinkedAccountMediaView
com.fmwhatsapp.biz.linkedaccounts.LinkedIGPostsSummaryViewActivity
com.fmwhatsapp.companiondevice.optin.ui.ForcedOptInActivity
com.fmwhatsapp.companiondevice.LinkedDevicesActivity
com.fmwhatsapp.companiondevice.LinkedDevicesEnterCodeActivity
com.fmwhatsapp.companiondevice.CompanionHelloConfirmationActivity
com.fmwhatsapp.companiondevice.LinkedDeviceEnterNicknameActivity
com.fmwhatsapp.companiondevice.LinkedDeviceEditDeviceActivity
com.fmwhatsapp.qrcode.DevicePairQrScannerActivity
com.fmwhatsapp.contextualhelp.ContextualHelpActivity
com.fmwhatsapp.deeplink.DeepLinkActivity
com.fmwhatsapp.extensions.phoenix.PhoenixExtensionsBottomSheetActivity
com.fmwhatsapp.extensions.bloks.WaExtensionsBottomsheetModalActivity
com.fmwhatsapp.inappsupport.ui.ContactUsActivity
com.fmwhatsapp.inappsupport.ui.SupportBloksActivity
com.fmwhatsapp.inappsupport.ui.SupportVideoActivity
com.fmwhatsapp.companionmode.registration.RegisterAsCompanionActivity
com.fmwhatsapp.companionmode.registration.CompanionBootstrapActivity
com.fmwhatsapp.companionmode.registration.CompanionPostLogoutActivity
com.fmwhatsapp.companionmode.registration.RegisterAsCompanionEnterNumberActivity
com.fmwhatsapp.companionmode.registration.RegisterAsCompanionLinkCodeActivity
com.fmwhatsapp.bridge.wfs.ui.WfsActivity
com.fmwhatsapp.registration.ChangeNumberNotifyContacts
com.fmwhatsapp.registration.ChangeNumberOverview
com.fmwhatsapp.registration.NotifyContactsSelector
com.fmwhatsapp.registration.ChangeNumber
com.fmwhatsapp.registration.VerifyTwoFactorAuth
com.fmwhatsapp.registration.EULA
com.fmwhatsapp.registration.flashcall.PrimaryFlashCallEducationScreen
com.fmwhatsapp.registration.deviceswitching.DeviceSwitchingSelfServeEducationScreen
com.fmwhatsapp.registration.directmigration.RequestPermissionFromSisterAppActivity
com.fmwhatsapp.registration.RegisterPhone
com.fmwhatsapp.registration.VerifyPhoneNumber
android.intent.action.VIEW
com.fmwhatsapp.registration.VerifyCaptcha
com.fmwhatsapp.registration.RegisterEmail
com.fmwhatsapp.registration.VerifyEmail
com.fmwhatsapp.registration.accountdefence.DeviceConfirmationRegistrationActivity
com.fmwhatsapp.registration.accountdefence.ui.OldDeviceSecureAccountActivity
com.fmwhatsapp.registration.accountdefence.ui.OldDeviceSecureAccount2FaActivity
com.fmwhatsapp.registration.directmigration.RestoreFromConsumerDatabaseActivity
com.fmwhatsapp.registration.accountdefence.ui.OldDeviceMoveAccountNoticeActivity
com.fmwhatsapp.registration.RegisterName
com.fmwhatsapp.registration.parole.CustomRegistrationBlockActivity
com.fmwhatsapp.registration.MaacGrantConsentActivity
com.fmwhatsapp.intent.action.maac.consent
com.fmwhatsapp.businessdirectory.view.activity.BusinessDirectoryActivity
com.fmwhatsapp.businessdirectory.view.activity.DirectoryBusinessChainingActivity
com.fmwhatsapp.businessdirectory.view.activity.BusinessDirectoryMapViewActivity
com.fmwhatsapp.businessdirectory.view.activity.BusinessDirectorySERPMapViewActivity
com.fmwhatsapp.businessdirectory.view.activity.DirectorySetLocationMapActivity
com.fmwhatsapp.businessdirectory.view.activity.BusinessDirectoryFrequentContactedActivity
com.fmwhatsapp.businessapisearch.view.activity.BusinessApiSearchActivity
com.fmwhatsapp.payments.ui.BrazilPaymentSettingsActivity
com.fmwhatsapp.payments.ui.BrazilPayBloksActivity
com.fmwhatsapp.payments.ui.BrazilPaymentActivity
com.fmwhatsapp.payments.ui.BrazilPaymentActivityBottomSheet
com.fmwhatsapp.payments.ui.BrazilSmbPaymentActivity
com.fmwhatsapp.payments.ui.BrazilSmbPaymentActivityBottomSheet
com.fmwhatsapp.payments.ui.BrazilPaymentTransactionDetailActivity
com.fmwhatsapp.payments.ui.BrazilPaymentCardDetailsActivity
com.fmwhatsapp.payments.ui.BrazilFbPayHubActivity
com.fmwhatsapp.payments.ui.BrazilMerchantDetailsListActivity
com.fmwhatsapp.payments.ui.BrazilViralityLinkVerifierActivity
com.fmwhatsapp.payments.ui.BrazilDyiReportActivity
com.fmwhatsapp.payments.ui.BrazilPaymentContactSupportActivity
com.fmwhatsapp.payments.ui.BrazilPaymentContactSupportP2pActivity
com.fmwhatsapp.payments.ui.BrazilPaymentCareTransactionSelectorActivity
com.fmwhatsapp.payments.ui.BrazilPaymentReportPaymentActivity
com.fmwhatsapp.payments.ui.BrazilPaymentDPOActivity
com.fmwhatsapp.payments.ui.BrazilPaymentIntegrityAppealActivity
com.fmwhatsapp.payments.ui.BrazilPaymentContactOmbudsmanActivity
com.fmwhatsapp.payments.ui.BrazilOrderDetailsActivity
com.fmwhatsapp.payments.ui.BrazilAccountRecoveryPinActivity
com.fmwhatsapp.payments.ui.BrazilPixKeySettingActivity
com.fmwhatsapp.framework.alerts.ui.AlertCardListActivity
com.fmwhatsapp.payments.ui.P2mLitePaymentSettingsActivity
com.fmwhatsapp.payments.ui.P2mLiteOrderDetailsActivity
com.fmwhatsapp.payments.ui.P2mLiteDyiReportActivity
com.fmwhatsapp.payments.ui.P2mLiteWebViewActivity
com.fmwhatsapp.payments.ui.P2mLitePaymentTransactionDetailActivity
com.fmwhatsapp.payments.ui.BusinessHubActivity
com.fmwhatsapp.payments.ui.MerchantPayoutTransactionHistoryActivity
com.fmwhatsapp.payments.ui.PaymentTransactionHistoryActivity
com.fmwhatsapp.payments.ui.PaymentGroupParticipantPickerActivity
com.fmwhatsapp.payments.ui.PaymentTransactionDetailsListActivity
com.fmwhatsapp.payments.ui.PaymentDeleteAccountActivity
com.fmwhatsapp.payments.ui.PaymentContactPicker
com.fmwhatsapp.payments.ui.PaymentsUpdateRequiredActivity
com.fmwhatsapp.payments.ui.ViralityLinkVerifierActivity
com.fmwhatsapp.payments.ui.PaymentInvitePickerActivity
com.fmwhatsapp.payments.ui.IncentiveValuePropsActivity
com.fmwhatsapp.payments.ui.PaymentCheckoutOrderDetailsItemListActivity
com.fmwhatsapp.payments.care.csat.CsatSurveyBloksActivity
com.fmwhatsapp.payments.ui.PaymentWebViewActivity
com.fmwhatsapp.payments.ui.MessageWithLinkWebViewActivity
com.fmwhatsapp.payments.ui.CheckoutLiteWebViewActivity
com.fmwhatsapp.payments.ui.CreateOrderContactPicker
com.fmwhatsapp.contact.picker.ContactsAttachmentSelector
com.fmwhatsapp.contact.picker.ContactsAttachmentSelectorBottomSheet
com.fmwhatsapp.contact.picker.ContactPickerHelp
com.fmwhatsapp.contact.picker.invite.InviteNonWhatsAppContactPickerActivity
com.fmwhatsapp.contact.picker.AddGroupParticipantsSelector
com.fmwhatsapp.contact.picker.ListMembersSelector
com.fmwhatsapp.contact.picker.PhoneContactsSelector
com.fmwhatsapp.contact.picker.PhoneContactsSelectorBottomSheet
com.fmwhatsapp.quickcontact.QuickContactActivity
com.fmwhatsapp.contact.picker.AudienceSelectionContactPicker
com.fmwhatsapp.contact.picker.ContactPicker
android.intent.action.PICK
android.intent.action.SEND
android.intent.action.SEND_MULTIPLE
android.intent.action.CREATE_SHORTCUT
com.fmwhatsapp.contact.contactform.ContactFormActivity
com.fmwhatsapp.updates.ui.statusmuting.MutedStatusesActivity
com.fmwhatsapp.textstatuscomposer.TextStatusComposerActivity
com.fmwhatsapp.status.playback.MyStatusesActivity
com.fmwhatsapp.status.audienceselector.StatusPrivacyActivity
com.fmwhatsapp.status.playback.StatusReplyActivity
com.fmwhatsapp.status.audienceselector.StatusTemporalRecipientsActivity
com.fmwhatsapp.status.audienceselector.StatusRecipientsActivity
com.fmwhatsapp.status.playback.MessageReplyActivity
com.fmwhatsapp.status.playback.StatusPlaybackActivity
com.fmwhatsapp.mediacomposer.MediaComposerActivity
com.fmwhatsapp.gifvideopreview.GifVideoPreviewActivity
com.fmwhatsapp.documentpicker.DocumentPreviewActivity
com.fmwhatsapp.notification.PopupNotification
com.fmwhatsapp.newsletter.ui.NewsletterCreationActivity
com.fmwhatsapp.newsletter.ui.NewsletterEditActivity
com.fmwhatsapp.newsletter.ui.NewsletterEditDescriptionActivity
com.fmwhatsapp.newsletter.ui.delete.DeleteNewsletterActivity
com.fmwhatsapp.newsletter.ui.profilephoto.ViewNewsletterProfilePhoto
com.fmwhatsapp.newsletter.ui.directory.NewsletterDirectoryActivity
com.fmwhatsapp.newsletter.ui.waitlist.NewsletterWaitListActivity
com.fmwhatsapp.newsletter.ui.settings.NewsletterSettingsActivity
com.fmwhatsapp.newsletter.ui.ShareNewsletterInviteLinkActivity
com.fmwhatsapp.privacy.checkup.PrivacyCheckupHomeActivity
com.fmwhatsapp.privacy.checkup.PrivacyCheckupDetailActivity
com.fmwhatsapp.payments.phoenix.webview.activity.FcsWebViewActivity
com.fmwhatsapp.settings.SettingsSetupUserProxyActivity
com.fmwhatsapp.settings.About
com.fmwhatsapp.settings.Licenses
com.fmwhatsapp.settings.SettingsAccount
com.fmwhatsapp.settings.SettingsPasskeys
com.fmwhatsapp.settings.SettingsSecurity
com.fmwhatsapp.settings.SettingsChatHistory
com.fmwhatsapp.settings.SettingsHelpV2
com.fmwhatsapp.settings.SettingsNotifications
android.intent.action.MAIN
com.fmwhatsapp.settings.SettingsJidNotificationActivity
com.fmwhatsapp.settings.SettingsUserProxyActivity
com.fmwhatsapp.settings.Settings
com.fmwhatsapp.settings.SettingsDataUsageActivity
android.intent.action.MANAGE_NETWORK_USAGE
com.fmwhatsapp.settings.SettingsNetworkUsage
com.fmwhatsapp.settings.autoconf.ShareAutoConfVerifierActivity
com.fmwhatsapp.settings.chat.wallpaper.downloadable.picker.DownloadableWallpaperPickerActivity
com.fmwhatsapp.settings.chat.wallpaper.downloadable.picker.DownloadableWallpaperPreviewActivity
com.fmwhatsapp.settings.chat.wallpaper.DefaultWallpaperPreview
com.fmwhatsapp.settings.chat.wallpaper.WallpaperCurrentPreviewActivity
com.fmwhatsapp.settings.chat.wallpaper.SolidColorWallpaper
com.fmwhatsapp.settings.chat.wallpaper.SolidColorWallpaperPreview
com.fmwhatsapp.settings.chat.wallpaper.WallpaperCategoriesActivity
com.fmwhatsapp.settings.chat.wallpaper.GalleryWallpaperPreview
com.fmwhatsapp.settings.chat.wallpaper.YoGalleryWallpaperPreview
com.fmwhatsapp.settings.SettingsPrivacy
com.fmwhatsapp.settings.SettingsChat
com.fmwhatsapp.settings.SettingsCallingPrivacyActivity
com.fmwhatsapp.settings.SettingsPrivacyAdvancedActivity
com.fmwhatsapp.authgraphql.ui.CommonBloksActivity
com.fmwhatsapp.backup.encryptedbackup.EncBackupMainActivity
com.fmwhatsapp.bonsai.discovery.BonsaiDiscoveryActivity
com.fmwhatsapp.bonsai.onboarding.BonsaiOnboardingActivity
com.fmwhatsapp.email.EmailVerificationActivity
com.fmwhatsapp.email.UpdateEmailActivity
com.fmwhatsapp.email.VerifyEmailActivity
com.fmwhatsapp.storage.StorageUsageActivity
com.fmwhatsapp.storage.StorageUsageGalleryActivity
com.fmwhatsapp.gallery.NewMediaPicker
com.fmwhatsapp.gallery.MediaGalleryActivity
com.fmwhatsapp.messaging.ViewOnceViewerActivity
com.fmwhatsapp.group.GroupMembersSelector
com.fmwhatsapp.group.GroupPermissionsActivity
com.fmwhatsapp.group.newgroup.NewGroup
com.fmwhatsapp.group.GroupAddPrivacyActivity
com.fmwhatsapp.group.GroupAdminPickerActivity
com.fmwhatsapp.group.EditGroupAdminsSelector
com.fmwhatsapp.group.GroupAddBlacklistPickerActivity
com.fmwhatsapp.group.GroupProfileEmojiEditor
com.fmwhatsapp.group.GroupPendingParticipantsActivity
com.fmwhatsapp.acceptinvitelink.AcceptInviteLinkActivity
com.fmwhatsapp.invites.ViewGroupInviteActivity
com.fmwhatsapp.invites.InviteGroupParticipantsActivity
com.fmwhatsapp.shareinvitelink.ShareGroupInviteLinkActivity
com.fmwhatsapp.writenfctag.WriteNfcTagActivity
com.fmwhatsapp.location.GroupChatLiveLocationsActivity2
com.fmwhatsapp.location.GroupChatLiveLocationsActivity
com.fmwhatsapp.invites.SMSPreviewInviteGroupParticipantsActivity
com.fmwhatsapp.group.HistorySettingActivity
com.fmwhatsapp.xfamily.groups.ui.LinkExistingGroupActivity
com.fmwhatsapp.xfamily.groups.ui.GroupMembersSelectorActivity
com.whatsapp.stickers.store.preview.StickerStorePackPreviewActivity
com.whatsapp.stickers.store.StickerStoreActivity
com.whatsapp.stickers.thirdparty.AddThirdPartyStickerPackActivity
com.whatsapp.intent.action.ENABLE_STICKER_PACK
com.fmwhatsapp.payments.phoenix.flowconfigurationservice.resource.permission.FcsRequestPermissionActivity
com.fmwhatsapp.wabloks.ui.WaBloksActivity
com.fmwhatsapp.wabloks.ui.WaBloksActivityWithCustomPreloadScreens
com.fmwhatsapp.wabloks.ui.WaBloksGenericBottomSheetActivity
com.fmwhatsapp.wabloks.ui.WaFcsModalActivity
com.fmwhatsapp.wabloks.ui.WaFcsPreloadedBloksActivity
com.fmwhatsapp.wabloks.ui.WaFcsBottomSheetModalActivity
com.fmwhatsapp.wabloks.ui.WaBloksBottomSheetActivity
com.fmwhatsapp.account.delete.DeleteAccountActivity
com.fmwhatsapp.account.delete.DeleteAccountConfirmation
com.fmwhatsapp.phonematching.CountryPicker
com.fmwhatsapp.account.delete.DeleteAccountFeedback
com.fmwhatsapp.account.remove.RemoveAccountActivity
com.fmwhatsapp.accountsync.LoginActivity
android.intent.action.VIEW
com.fmwhatsapp.accountsync.ProfileActivity
android.intent.action.VIEW
com.fmwhatsapp.accountsync.CallContactLandingActivity
android.intent.action.VIEW
com.fmwhatsapp.authentication.AppAuthenticationActivity
android.appwidget.action.APPWIDGET_CONFIGURE
com.fmwhatsapp.authentication.AppAuthSettingsActivity
com.fmwhatsapp.avatar.home.AvatarHomeActivity
com.fmwhatsapp.avatar.profilephoto.AvatarProfilePhotoActivity
com.fmwhatsapp.backup.google.RestoreFromBackupActivity
com.fmwhatsapp.backup.google.RestoreTransferSelectorActivity
com.fmwhatsapp.backup.google.GoogleDriveNewUserSetupActivity
com.fmwhatsapp.backup.google.SettingsGoogleDrive
com.fmwhatsapp.blockbusiness.BlockBusinessActivity
com.fmwhatsapp.blockinguserinteraction.BlockingUserInteractionActivity
com.fmwhatsapp.blocklist.BlockList
com.fmwhatsapp.businesscollection.view.activity.CollectionProductListActivity
com.fmwhatsapp.ShareProductLinkActivity
com.fmwhatsapp.ShareCatalogLinkActivity
com.fmwhatsapp.CatalogImageListActivity
com.fmwhatsapp.CatalogMediaView
com.fmwhatsapp.biz.catalog.view.activity.CatalogListActivity
com.fmwhatsapp.biz.catalog.view.activity.ProductListActivity
com.fmwhatsapp.biz.catalog.view.activity.CatalogCategoryTabsActivity
com.fmwhatsapp.catalogcategory.view.activity.CatalogAllCategoryActivity
com.fmwhatsapp.biz.product.view.activity.ProductDetailActivity
com.fmwhatsapp.biz.product.view.activity.ProductBottomSheetTransparentActivity
com.fmwhatsapp.biz.compliance.view.BusinessComplianceDetailActivity
com.fmwhatsapp.identity.IdentityVerificationActivity
android.nfc.action.NDEF_DISCOVERED
com.fmwhatsapp.identity.ScanQrCodeActivity
android.nfc.action.NDEF_DISCOVERED
com.fmwhatsapp.camera.LauncherCameraActivity
com.fmwhatsapp.camera.CameraActivity
android.intent.action.CREATE_SHORTCUT
com.fmwhatsapp.chatlock.ChatLockAuthActivity
com.fmwhatsapp.chatlock.ChatLockRequestAuthInterstitialActivity
com.fmwhatsapp.chatlock.ChatLockSettingsActivity
com.fmwhatsapp.chatlock.ChatLockCreateSecretCodeActivity
com.fmwhatsapp.chatlock.ChatLockConfirmSecretCodeActivity
com.fmwhatsapp.corruptinstallation.CorruptInstallationActivity
com.fmwhatsapp.crop.CropImage
com.fmwhatsapp.datasharingdisclosure.ui.ConsumerDisclosureActivity
com.fmwhatsapp.dmsetting.ChangeDMSettingActivity
com.fmwhatsapp.dmsetting.DisappearingMessagesSettingActivity
com.fmwhatsapp.ephemeral.ChangeEphemeralSettingActivity
com.fmwhatsapp.expiringgroups.ChangeExpiringGroupsSettingActivity
com.fmwhatsapp.documentpicker.DocumentPickerActivity
com.fmwhatsapp.documentpicker.DocumentPickerBottomSheetActivity
com.fmwhatsapp.documentpicker.AudioPickerBottomSheetActivity
com.fmwhatsapp.gallerypicker.GalleryPickerLauncher
com.fmwhatsapp.gallerypicker.GalleryPicker
com.fmwhatsapp.gallerypicker.GalleryPickerBottomSheetActivity
com.fmwhatsapp.gallerypicker.MediaPicker
com.fmwhatsapp.greenalert.GreenAlertActivity
com.fmwhatsapp.inappbugreporting.InAppBugReportingActivity
com.fmwhatsapp.inappbugreporting.BugReportingCategoriesActivity
com.fmwhatsapp.lastseen.PresencePrivacyActivity
com.fmwhatsapp.lastseen.LastSeenBlockListPickerActivity
com.fmwhatsapp.location.LocationPicker
com.fmwhatsapp.location.LocationPicker2
com.fmwhatsapp.location.LocationPickerBottomSheet
com.fmwhatsapp.location.LocationPicker2BottomSheet
com.fmwhatsapp.location.LiveLocationPrivacyActivity
com.fmwhatsapp.mediaview.MediaViewActivity
com.fmwhatsapp.migration.android.view.GoogleMigrateImporterActivity
com.fmwhatsapp.migration.export.ui.ExportMigrationDataExportedActivity
com.fmwhatsapp.migration.transfer.ui.ChatTransferActivity
com.fmwhatsapp.migration.transfer.ui.P2pTransferQrScannerActivity
com.fmwhatsapp.notification.OtpOneTapNotificationHandlerActivity
com.fmwhatsapp.polls.PollResultsActivity
com.fmwhatsapp.polls.PollCreatorActivity
com.fmwhatsapp.polls.PollCreatorBottomSheetActivity
com.fmwhatsapp.profile.ViewProfilePhoto
com.fmwhatsapp.profile.ProfilePhotoBlockListPickerActivity
com.fmwhatsapp.profile.WebImagePicker
com.fmwhatsapp.profile.ProfileInfoActivity
com.fmwhatsapp.profile.ProfilePhotoReminder
com.fmwhatsapp.profile.ResetGroupPhoto
com.fmwhatsapp.profile.ProfilePhotoPrivacyActivity
com.fmwhatsapp.profile.ResetPhoto
com.fmwhatsapp.profile.ViewProfilePhoto$SavePhoto
com.fmwhatsapp.profile.AboutStatusPrivacyActivity
com.fmwhatsapp.profile.AboutStatusBlockListPickerActivity
com.fmwhatsapp.profile.SetAboutInfo
com.fmwhatsapp.profile.CapturePhoto
com.fmwhatsapp.qrcode.contactqr.ContactQrActivity
com.fmwhatsapp.qrcode.AuthenticationActivity
com.fmwhatsapp.qrcode.GroupLinkQrActivity
com.fmwhatsapp.qrcode.contactqr.QrSheetDeepLinkActivity
com.fmwhatsapp.report.ReportActivity
com.fmwhatsapp.softenforcementsmb.BusinessPolicyView
com.fmwhatsapp.passkey.PasskeyCreateEducationScreen
com.fmwhatsapp.waquickpromotionclient.ui.PushPsaNotificationActivity
com.fmwhatsapp.waquickpromotionclient.ui.PushPsaNotificationAction
com.fmwhatsapp.systemstatus.SystemStatusActivity
com.fmwhatsapp.textstatus.AddTextStatusActivity
com.fmwhatsapp.twofactor.SettingsTwoFactorAuthActivity
com.fmwhatsapp.twofactor.TwoFactorAuthActivity
com.fmwhatsapp.twofactor.AddEmailActivity
com.fmwhatsapp.userban.ui.BanAppealActivity
com.fmwhatsapp.accountswitching.routing.AccountSwitchingRoutingActivity
com.fmwhatsapp.Main
android.intent.action.MAIN
com.fmwhatsapp.support.DescribeProblemActivity
com.fmwhatsapp.inappsupport.ui.SupportTopicsActivity
com.fmwhatsapp.inappsupport.ui.FaqItemActivityV2
com.fmwhatsapp.support.faq.SearchFAQ
com.fmwhatsapp.support.faq.FaqItemActivity
com.fmwhatsapp.viewsharedcontacts.ViewSharedContactArrayActivity
com.fmwhatsapp.support.Remove
com.fmwhatsapp.messaging.CaptivePortalActivity
com.fmwhatsapp.insufficientstoragespace.InsufficientStorageSpaceActivity
com.fmwhatsapp.spamwarning.SpamWarningActivity
com.fmwhatsapp.VoiceMessagingActivity
com.google.android.voicesearch.SEND_MESSAGE_TO_CONTACTS
com.fmwhatsapp.audiopicker.AudioPickerActivity
com.fmwhatsapp.xfamily.accountlinking.ui.AccountLinkingWebAuthActivity
android.intent.action.VIEW
com.fmwhatsapp.webview.ui.WaInAppBrowsingActivity
com.fmwhatsapp.privacy.disclosure.ui.PrivacyDisclosureContainerActivity
com.fmwhatsapp.xfamily.crossposting.ui.ShareToFacebookActivity
com.fmwhatsapp.RequestPermissionActivity
com.fmwhatsapp.xfamily.accountlinking.ui.AccountLinkingNativeAuthActivity
com.fmwhatsapp.contactinput.contactscreen.NativeContactActivity
com.fmwhatsapp.accountswitching.secondaryprocess.AccountSwitchingActivity
androidx.credentials.playservices.HiddenActivity
com.google.android.gms.auth.api.signin.internal.SignInHubActivity
com.google.android.gms.common.api.GoogleApiActivity
androidx.car.app.CarAppPermissionActivity
androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity
android.intent.action.MAIN
androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity
android.intent.action.MAIN
androidx.test.core.app.InstrumentationActivityInvoker$EmptyFloatingActivity
android.intent.action.MAIN
org.npci.upi.security.pinactivitycomponent.UserAuthInfoActivity
org.npci.upi.security.pinactivitycomponent.GetCredential
org.npci.upi.security.pinactivitycomponent.GetCredential
com.fmwhatsapp.yo.x.rlf
com.fmwhatsapp.youbasha.ui.lockV2.locktypes.Pattern
com.fmwhatsapp.youbasha.ui.lockV2.locktypes.Fingerprint
com.fmwhatsapp.youbasha.ui.lockV2.locktypes.Pin
com.fmwhatsapp.youbasha.ui.themeserver.OnThemesActivity
com.fmwhatsapp.youbasha.ui.themeserver.SingleItemView
com.fmwhatsapp.youbasha.ui.YoSettings.AllSettings
com.fmwhatsapp.youbasha.ui.YoSettings.IconChoose
com.fmwhatsapp.youbasha.ui.activity.CustomList
com.fmwhatsapp.youbasha.ui.activity.ContactsPicker
com.fmwhatsapp.youbasha.ui.activity.CallsPrivacy
com.fmwhatsapp.youbasha.ui.activity.VoiceNoteSounds
com.fmwhatsapp.yo.ChatGenSingle
com.fmwhatsapp.youbasha.ui.YoSettings.Home
com.fmwhatsapp.youbasha.ui.YoSettings.Convo
com.fmwhatsapp.youbasha.ui.YoSettings.Universal
com.fmwhatsapp.youbasha.ui.YoSettings.Updates
com.fmwhatsapp.youbasha.ui.YoSettings.Support
com.fmwhatsapp.youbasha.ui.YoSettings.About
com.fmwhatsapp.youbasha.ui.YoSettings.BaseSettingsActivity
com.fmwhatsapp.youbasha.ui.YoSettings.Themes
com.fmwhatsapp.youbasha.ui.YoSettings.YoWAWidget
com.fmwhatsapp.youbasha.ui.YoSettings.BasePreferenceActivity
com.fmwhatsapp.youbasha.ui.YoSettings.HideMedia
com.fmwhatsapp.youbasha.ui.YoSettings.UniversalSettings
com.fmwhatsapp.youbasha.ui.YoSettings.BackupRestore
com.fmwhatsapp.youbasha.ui.YoSettings.UniversalColors
com.fmwhatsapp.youbasha.ui.YoSettings.SecPrivacy
com.fmwhatsapp.youbasha.ui.YoSettings.HomeFAB
com.fmwhatsapp.youbasha.ui.YoSettings.HomeRows
com.fmwhatsapp.youbasha.ui.YoSettings.HomeHeader
com.fmwhatsapp.youbasha.ui.YoSettings.HomeStatus
com.fmwhatsapp.youbasha.ui.YoSettings.ConvoActionBar
com.fmwhatsapp.youbasha.ui.YoSettings.ConvoEntry
com.fmwhatsapp.youbasha.ui.YoSettings.UniversalStyle
com.fmwhatsapp.youbasha.ui.YoSettings.ConvoMore
com.fmwhatsapp.youbasha.ui.YoSettings.ConvoBubbleTicks
com.fmwhatsapp.youbasha.ui.YoSettings.ConvoPicsInChat
com.fmwhatsapp.youbasha.ui.activity.RestartAppActivity
com.fmwhatsapp.youbasha.ui.activity.FMNewsActivity
com.fmwhatsapp.yo.MediaPreviewActivity
com.fmwhatsapp.yo.massmsger.SavedCollections
com.fmwhatsapp.yo.massmsger.MassSender
com.fmwhatsapp.yo.autoschedreply.ListMessages
com.fmwhatsapp.yo.autoschedreply.AddMessage
com.fmwhatsapp.yo.autoschedreply.EditMessage
com.fmwhatsapp.yo.autoschedreply.AutoMsg
com.fmwhatsapp.yo.autoschedreply.Auto_message
com.fmwhatsapp.instrumentation.service.InstrumentationFGService
com.fmwhatsapp.instrumentation.api.InstrumentationService
com.fmwhatsapp.instrumentation.REQUEST
com.fmwhatsapp.contact.sync.ContactsSyncAdapterService
android.content.SyncAdapter
com.fmwhatsapp.accountsync.AccountAuthenticatorService
android.accounts.AccountAuthenticator
com.fmwhatsapp.AlarmService
com.fmwhatsapp.backup.google.GoogleBackupService
com.fmwhatsapp.migration.transfer.service.DonorP2pTransferService
com.fmwhatsapp.migration.transfer.service.ReceiverP2pTransferService
com.fmwhatsapp.migration.android.integration.service.GoogleMigrateService
com.fmwhatsapp.migration.export.service.MessagesExporterService
com.whatsapp.calling.service.VoiceFGService
com.whatsapp.calling.telecom.SelfManagedConnectionService
android.telecom.ConnectionService
com.fmwhatsapp.messaging.MessageService
com.fmwhatsapp.ExternalMediaManager
com.fmwhatsapp.location.LocationSharingService
com.fmwhatsapp.service.BackgroundMediaControlService
com.fmwhatsapp.notification.AndroidWear
com.fmwhatsapp.VoiceMessagingService
com.fmwhatsapp.appwidget.WidgetService
com.fmwhatsapp.notification.DirectReplyService
com.fmwhatsapp.service.GcmFGService
com.fmwhatsapp.service.YoHiddenService
com.fmwhatsapp.service.UnsentMessagesNetworkAvailableJob
com.fmwhatsapp.media.transcode.MediaTranscodeService
com.fmwhatsapp.media.download.service.MediaDownloadService
com.fmwhatsapp.wearos.WearOsListenerService
com.google.android.gms.wearable.BIND_LISTENER
com.google.android.gms.wearable.MESSAGE_RECEIVED
com.fmwhatsapp.push.GcmListenerService
com.google.firebase.MESSAGING_EVENT
com.fmwhatsapp.push.RegistrationIntentService
com.fmwhatsapp.perf.profilo.ProfiloUploadService
com.fmwhatsapp.crash.upload.ExceptionsUploadService
androidx.credentials.playservices.CredentialProviderMetadataHolder
com.google.android.gms.auth.api.signin.RevocationBoundService
com.google.android.gms.analytics.AnalyticsService
com.google.android.gms.analytics.AnalyticsJobService
com.google.firebase.messaging.FirebaseMessagingService
com.google.firebase.MESSAGING_EVENT
com.google.firebase.components.ComponentDiscoveryService
androidx.work.impl.background.systemalarm.SystemAlarmService
androidx.work.impl.background.systemjob.SystemJobService
androidx.work.impl.foreground.SystemForegroundService
androidx.room.MultiInstanceInvalidationService
androidx.sharetarget.ChooserTargetServiceCompat
android.service.chooser.ChooserTargetService
org.npci.upi.security.pinactivitycomponent.CLRemoteServiceImpl
org.npci.upi.security.services.CLRemoteService
com.fmwhatsapp.instrumentation.notification.DelayedNotificationReceiver
com.fmwhatsapp.registration.RegRetryVerificationReceiver
com.fmwhatsapp.alarm.REGISTRATION_RETRY
com.fmwhatsapp.conversation.conversationrow.nativeflow.reminder.ScheduledReminderMessageAlarmBroadcastReceiver
com.fmwhatsapp.AlarmBroadcastReceiver
com.fmwhatsapp.migration.android.api.DeferredRestoreBroadcastReceiver
com.google.android.apps.pixelmigrate.IOS_APP_DATA_AVAILABLE
com.fmwhatsapp.notification.OtpZeroTapMarkAsReadNotificationHandlerReceiver
com.fmwhatsapp.otp.OtpRequestedReceiver
com.fmwhatsapp.otp.OTP_REQUESTED
com.fmwhatsapp.otp.OtpIdentityHashRequestedReceiver
com.fmwhatsapp.otp.ID_HASH_REQUESTED
com.fmwhatsapp.registration.RegistrationCompletedReceiver
com.fmwhatsapp.SMBRegistrationCompleted
com.fmwhatsapp.accountswitching.notifications.InactiveAccountNotificationReceiver
com.fmwhatsapp.accountswitching.inactiveaccount.IgnoreCall
com.whatsapp.calling.calllink.CallLinkShareReceiver
com.fmwhatsapp.ExternalMediaManager$ExternalMediaStateReceiver
android.intent.action.MEDIA_BAD_REMOVAL
android.intent.action.MEDIA_EJECT
android.intent.action.MEDIA_MOUNTED
android.intent.action.MEDIA_REMOVED
android.intent.action.MEDIA_SHARED
android.intent.action.MEDIA_UNMOUNTED
com.fmwhatsapp.appwidget.WidgetProvider
android.appwidget.action.APPWIDGET_UPDATE
com.fmwhatsapp.notification.MessageNotificationDismissedReceiver
com.fmwhatsapp.notification.MissedCallNotificationDismissedReceiver
com.fmwhatsapp.notification.MessageOtpNotificationBroadcastReceiver
com.fmwhatsapp.location.FinalLiveLocationBroadcastReceiver
com.fmwhatsapp.registration.directmigration.MigrationProviderOrderedBroadcastReceiver
com.fmwhatsapp.registration.directmigration.initialMigrationInfoAction
com.fmwhatsapp.registration.directmigration.recoveryTokenAction
com.fmwhatsapp.registration.directmigration.setMigrationStateOnProviderSide
com.fmwhatsapp.registration.directmigration.MigrationRequesterBroadcastReceiver
com.fmwhatsapp.registration.directmigration.providerIsLoggedOutAction
com.fmwhatsapp.registration.directmigration.providerAppMigrationSpaceNeededAction
com.fmwhatsapp.registration.PreRegNotificationLearnMoreReceiver
com.fmwhatsapp.accounttransfer.AccountTransferReceiver
com.google.android.gms.auth.START_ACCOUNT_EXPORT
com.fmwhatsapp.TellAFriendReceiver
com.fmwhatsapp.schedulecall.ScheduleCallBroadcastReceiver
com.fmwhatsapp.companionmode.CompanionStateHolder$CompanionPreferenceStateReceiver
com.fmwhatsapp.companionmode.CompanionStateHolder$CompanionLogoutStateReceiver
com.fmwhatsapp.companiondevice.CompanionDeviceVerificationReceiver
com.fmwhatsapp.push.WAFbnsPreloadReceiver
com.facebook.rti.fbns.intent.RECEIVE
com.fmwhatsapp.phoneid.PhoneIdRequestReceiver
com.facebook.GET_PHONE_ID
com.fmwhatsapp.systemreceivers.boot.BootReceiver
android.intent.action.BOOT_COMPLETED
com.fmwhatsapp.systemreceivers.appupdated.AppUpdatedReceiver
android.intent.action.MY_PACKAGE_REPLACED
com.google.android.gms.analytics.AnalyticsReceiver
com.google.firebase.iid.FirebaseInstanceIdReceiver
com.google.android.c2dm.intent.RECEIVE
androidx.car.app.notification.CarAppNotificationBroadcastReceiver
androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
android.net.conn.CONNECTIVITY_CHANGE
androidx.work.impl.background.systemalarm.RescheduleReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
androidx.work.impl.background.systemalarm.UpdateProxies
androidx.work.impl.diagnostics.DiagnosticsReceiver
androidx.work.diagnostics.REQUEST_DIAGNOSTICS
com.fmwhatsapp.yo.WidgetProvider
android.appwidget.action.APPWIDGET_UPDATE
com.fmwhatsapp.yo.autoschedreply.Receiver
android.intent.action.BOOT_COMPLETED
com.fmwhatsapp.yo.FMBackupReceiver
android.intent.action.BOOT_COMPLETED
com.fmwhatsapp.instrumentation.api.InstrumentationProvider
com.fmwhatsapp.migration.export.api.ExportMigrationContentProvider
com.whatsapp.stickers.storage.WhitelistPackQueryContentProvider
com.fmwhatsapp.accountswitching.AccountSwitchingContentProvider
com.fmwhatsapp.registration.directmigration.MigrationContentProvider
androidx.core.content.FileProvider
com.fmwhatsapp.contentprovider.MediaProvider
com.fmwhatsapp.registration.autoconf.LoginStatusContentProvider
com.google.firebase.provider.FirebaseInitProvider
3545082c16d0e05faad342c614b27793ab0ec940a174ab5162dce1787ea8472e.elf
- SHA256 3545082c16d0e05faad342c614b27793ab0ec940a174ab5162dce1787ea8472e
- MD5 1df9e4dcca97685f475d975c2a66f464
- SHA1 fc0570fdd2168e6648ff2fa68936ac9b86c5f696
- SHA512 ebda8ab2f0be540cc18021be7d068c72c3250522834a068881a6cc4d201358c3c527593473d7dac70a5e88151a208dab519b23eead1fc8f14e6ae13f1fe2a88d
- SSDEEP 768:WJMcRjFvxqt6hqFFT1RxJhhX4TUYTnDajfTtJl7vfi9q3UELrP:gDPh6FT9Jcr/ajfTtJlTXLz
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
377c3c3679e44acbc13388ca7ec69f2346b321aa42110fc6ee44a44c54d67105.elf
- SHA256 377c3c3679e44acbc13388ca7ec69f2346b321aa42110fc6ee44a44c54d67105
- MD5 ba8c3d833bf5596f87b29eaf2a2c8147
- SHA1 8b402e35103a9d0b88122790849476afa96b58d3
- SHA512 bbf30bbc1adb96e702921a2d0da940a5c269410d03e6d747dac5bbd61974777d0ba69c3a72114bfd8106d2504520009cea4b58f72cb52a3d222ccca5679b67d8
- SSDEEP 3072:SOGAEtZoGZKWl6u4YTnbHgbimmFVcqq0G27ZT:SqEtZ755nbHgbimmFVcqq0G27ZT
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
38236f53a4ebd47d951837540ec9d965c21f15816de7dbd3291624ffbaaf506c.exe
- IMPHASH e569e6f445d32ba23766ad67d1e3787f
- SHA256 38236f53a4ebd47d951837540ec9d965c21f15816de7dbd3291624ffbaaf506c
- MD5 a62116303f018a5fed26e7eed9150394
- SHA1 84e69321b3ab1db9317e23de13de813658b7d392
- SHA512 b4f880c80db4e6918e17b55ecb8e72f73922496ef0cf4f1ff8dc088e4fc38c89db663cabbed4dba18fe35f361a46429c643281908c88dcd417417b9308b231f3
- SSDEEP 98304:SkLHILYGLm8qmYj01QAwCo8u9qW7+HzzuqMYdzBDDRhC3+bsTTa74:9HIlm8g01QAfo1qWIXPMkdtsTC4
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
745196
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
comctl32
InitCommonControls
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
user32
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
oleaut32
SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate
netapi32
NetWkstaGetInfo
NetApiBufferFree
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
AdjustTokenPrivileges
GetTokenInformation
ConvertSidToStringSidW
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
718KB
Virtual Size
718KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
27KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
382c9aa9b4ec7137d69ebc20fe58b83acbb8bf0bce324d10fb58aba91b805c9f.exe
- IMPHASH fb0a8b4a81655f744a37af985e009476
- SHA256 382c9aa9b4ec7137d69ebc20fe58b83acbb8bf0bce324d10fb58aba91b805c9f
- MD5 81143246c472aa6876287e5c57589e04
- SHA1 3f196474e3c617ad72cdaacc3bca118021055219
- SHA512 79d9eadd3d81ef649ef0f3d811d818893bdb1de43050bd8d8f4188a45521a17d9485bec40e9d159b3625410a599ec260c74bcd8552849198ba8153dfd5c0c2db
- SSDEEP 49152:EX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeK5c:ElRsZ47/QXoHUOfAoj1ny
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1940876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\MeshAgent\MeshAgent\Release\MeshService64.pdb
comctl32
InitCommonControlsEx
dbghelp
SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump
iphlpapi
GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo
ws2_32
WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select
crypt32
CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore
gdiplus
GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup
ncrypt
NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey
kernel32
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer
user32
EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect
gdi32
SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject
advapi32
CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus
shell32
ShellExecuteExW
ole32
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
981KB
Virtual Size
981KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=176, id=243, version=40116,
count=38, id=242, version=40116,
count=1, id=199, version=41118,
count=10, id=259, version=24123,
count=33, id=261, version=24123,
count=25, id=260, version=24123,
count=496, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=209, version=65501,
count=1, id=208, version=65501,
count=29, id=203, version=65501,
count=398, id=1, productName=Unmarked objects,
count=53, id=264, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
385aeb4409a86678ca21a745b04350d1dd8593cec972d77524f83323b9160fa7.exe
- IMPHASH bb2ac363335230ef73bf96bf5001e65e
- SHA256 385aeb4409a86678ca21a745b04350d1dd8593cec972d77524f83323b9160fa7
- MD5 f5cebd94ae600e202ba5d78f61092241
- SHA1 c7f133ab0e80f9f3ad4743982b5c35dd1a05db25
- SHA512 35c55266e754832660927dc381d83dae8f09f0faad3cc381ca5f09ad09445c78bdcedf01ef1ece8c29e4859a7c7eba1f8117199198d7ca84ac87d12d5cdad4b4
- SSDEEP 12288:7hCjJHCSy69iQOOKBaSRXU+4pKu5dbM/vyb+oF/:7hCjJHW69iQOOMRXU+4MYdI3Q+
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
392212
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
shlwapi
StrStrW
kernel32
TlsFree
MultiByteToWideChar
WaitForSingleObject
GetLastError
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
GetStringTypeW
GetCPInfo
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
SetStdHandle
HeapSize
CreateFileW
Name
.text
Size
525KB
Virtual Size
525KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
38719e8104f65d7193c30dcd823b4a4d363f85b4c886f36316fa185f832a5bac.vbs
- SHA256 38719e8104f65d7193c30dcd823b4a4d363f85b4c886f36316fa185f832a5bac
- MD5 22a7f421830e6c34cdbe88a48d7f3a94
- SHA1 5948c0d7e4d84e58e03db69b11d570a8794d9a56
- SHA512 b1c996332329f99c9775425f9a07e6ad00ea469faa15d1bb1a85dac1f89a357d440d136aabd61fe597647ae2ceae37ca89e2b13694b91f37b284f2f0ec397097
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855
- MD5 81f8eacc0997ace2ee1d89b25391783c
- SHA1 7d880a37dc2ea2819e9081f0eb97d75c4ac63763
- SHA512 ba138c654a421f33ba9adc40c42db3dc167cabc6a96e0cb0a78b3f76a853f67f3519d16c7ad1b2c5c2d8fc06b3d9ba1ac5d5eea58c15bea0c453c65143cfb443
- SSDEEP 24576:TYMB0+EFNTfgJyzf/0X807GUj1sVr46Ec:TYMBiFNT3zfkG81q0F
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
840398
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
813KB
Virtual Size
812KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe
- IMPHASH ba98ed9b6030d773e739745aeaf6e0bb
- SHA256 3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9
- MD5 54935c8ce5efca8a4589caa0d3e9258f
- SHA1 b0eb42a85371e15ef92020c37406f59e786a503d
- SHA512 3fb388b769a5cae21a035ae999e5d190d941c4a146cf77e5481a5ea8337b8e1a0259a206ad04d1a902842412584825db5d2fbd7c9425fcc855581e294b7d26bc
- SSDEEP 3072:CX8L3hvoXS+bakYZXhJ1KcRvPHiiKXU57jdPWfd9Drt67JUPFk+Hc/vyK1nhlXWl:CsvYSo6r1xIiKkLixP+qIyK1nfXy5IB
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14723
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\nizavoyibam-vaha92\cin84 kubi-kobuwedataf\fiveja.pdb
kernel32
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetConsoleAliasesLengthA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GlobalFindAtomA
LoadLibraryW
TerminateThread
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
CopyFileW
FileTimeToSystemTime
GetEnvironmentVariableA
GetTempPathW
GetLastError
GetCurrentDirectoryW
GetLocaleInfoA
SetLastError
GetProcAddress
LoadLibraryA
WriteConsoleA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
RemoveDirectoryW
VirtualLock
GetModuleFileNameA
GetFileAttributesExW
GetWindowsDirectoryW
GlobalAddAtomW
FindNextVolumeA
GetVolumeInformationW
WriteConsoleW
GetStringTypeW
OutputDebugStringW
FindResourceA
SetThreadContext
ChangeTimerQueueTimer
GetNumaNodeProcessorMask
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetConsoleMode
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
CreateFileW
user32
CharUpperBuffA
DrawCaption
gdi32
SetTextColor
advapi32
RegisterEventSourceW
ole32
CoGetPSClsid
winhttp
WinHttpSetDefaultProxyConfiguration
msimg32
AlphaBlend
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
131KB
Virtual Size
41.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5
- MD5 47573a5a6be2c7209517807e507f4e9c
- SHA1 b0d0d999c9855c95f6c4e739b8d873ff4b6b940c
- SHA512 9bea8f64b374fcfd9dc343379b220bc71aa83090f5798eab229c511bd5ecb52c88c56d38b0f860ed410dc59bb19477216c99c961a87e291be262333fd8c3c99b
- SSDEEP 6144:5qLFfq23vFmPFvyYrNFOqTOTWZ/gFOnWyqSwgcnRtabUAl:EN/EPFvPr3OI/gFT/SBJbUk
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
8f:92:b8:e1:1d:20:b7:c7:95:49:96:79:cd:17:08:f4:d6:ee:55:13:42:3f:5d:0a:84:0e:b4:2b:7c:56:74:f2
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8f:92:b8:e1:1d:20:b7:c7:95:49:96:79:cd:17:08:f4:d6:ee:55:13:42:3f:5d:0a:84:0e:b4:2b:7c:56:74:f2
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Feb 7, 2024
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 18, 2022 - Oct 15, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 14, 2023 - Sep 4, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
4
Entry point
15086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\df5bxtbhflbbh\obj\Release\Laptop.pdb
mscoree
_CorExeMain
Name
.text
Size
211KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
3c52855c535816927fd94405b87fef074296ca34994d04686b7fe141bb48d20d.elf
- SHA256 3c52855c535816927fd94405b87fef074296ca34994d04686b7fe141bb48d20d
- MD5 b58aed38846fd4279f31036021e96639
- SHA1 a685c590b68189257c3b1d219a0e23e2d86d1ea5
- SHA512 9a945dc0258b7156c78c739ab76a08b8ff2ffff9092408626c1ed1f934c7fbb2dd07918b1cfabffbd507c4b266ab8ed317337ff2b61979271b6c7af860885b5d
- SSDEEP 3072:3v8G4ZNBQTZiNPR6Iwd9g+pYAOhmm/QMurB12CGNb:RrUlkYXmm/QMurB12CGNb
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
3eaa57d60ec0a1932473ea109c3217a023aedd47f6921092b2f1ff2613e73926.elf
- SHA256 3eaa57d60ec0a1932473ea109c3217a023aedd47f6921092b2f1ff2613e73926
- MD5 f05a2d1fedcb4f8c8793756d3706a06f
- SHA1 655d8be64b04a25251c53ff81eeeb6be0ba568a7
- SHA512 5834e84a9775d1171669afc0e679901af17c0a5599ef8393a563dc600533ad21a01fff2aa020ea038e8e62b8a463b77aa8ba73a13743ea324595366ecf4b7669
- SSDEEP 1536:BdcmZSmS8+UTqCAJ9Z75mP1NZq5oNh0fTsYtSccHzO:f/gmSKmZ7Uz45Yh+xE3O
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
403237121c807d41f44f036f65336713a673d5b98756abe86faa5e883a068ea7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 403237121c807d41f44f036f65336713a673d5b98756abe86faa5e883a068ea7
- MD5 273871f35f2caf23a15cc9be0c1cb47f
- SHA1 6e18e88ac62602fd7c41202e28a1c1a50859bed2
- SHA512 01f81a2a21f84002464c665f35bc49287c81bdb9b65f190cdc28b900a533838bdb85d818bfb75e47f01022b755fdae63bb17b1bc1040020d8211736f8f5bc6f1
- SSDEEP 24576:2hUHMPreD7hz3b8ctDWYONBJb8gqtK5HGojgc5Gnpln9WqDqk4swI3:KFSD7hz0Bp8gMK5HGoYp59WtHI
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1660142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
42c1afa196dd457a3c9ec69e786c029b7b98f0b5be4041cfbd8b2910352435eb.elf
- SHA256 42c1afa196dd457a3c9ec69e786c029b7b98f0b5be4041cfbd8b2910352435eb
- MD5 0842c61836702a0076322f2b7d544573
- SHA1 f5abaa6bd4119636147e1bbb74407f097d8509f5
- SHA512 493bb8235286e258af22211a2c29a051780f2397c9bf76fff5b5bd6f7a9e9906a8e80d93bb8a7aeea7e0b3bca65e8886796d21a671e8ecb10f7ef8570feb52a5
- SSDEEP 384:MpS56NYte96zrpEQQJM73j1AMjtA0/cp/M86ShEbrB0by26zqyTAuErDNu+v1RB:9JlEQAMn1AQ4y8vhkl0mJqYAN/NRB
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
42f781f94b9df3f0625426ea2ae3f668a83b52faf78c8c5ddfccab1690967e90.elf
- SHA256 42f781f94b9df3f0625426ea2ae3f668a83b52faf78c8c5ddfccab1690967e90
- MD5 ed2e28c4c58f0558907e547c729b818a
- SHA1 1d75b9249613867a9cd39630505bd5150735dbae
- SHA512 cddf0905857e12fb80fb8e1c15499b018170bf383846443a1219c1c2f4dfd9be9b581900c0ba1e4ec8c4a4a73ee012beb6232dd4ab5284dfb44e1451da649c29
- SSDEEP 3072:sJDZ+6lJQTnoo3nKVz3ecxPWh5hLSFuX0wX4eoC9DQlD6ObAF5R:k3eo+h5hLSFuDJoC9DQlD6ObAF5R
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
44243d0823b6951aa36d0c1a8aea39866bbf33f5d0bbb76dfa3b5290ffe83683.elf
- SHA256 44243d0823b6951aa36d0c1a8aea39866bbf33f5d0bbb76dfa3b5290ffe83683
- MD5 00ccdd3a0f020aa6a40155d9c5024368
- SHA1 9ba28c91cc10c103d206b5546fc132f473f2a7c4
- SHA512 e14089c76516a88601e97b441b56cc68728e6ae0149614507aa32dab6a09baa2f9f32d016d90682a1d43688112ac81b1ae57eca26b33277859f842bd0db5934c
- SSDEEP 3072:gjtwgA6UlYzZveohR9kIEvfdGZmmFVcqq0G27ZT:gjhzt3mIEvfAmmFVcqq0G27ZT
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
462113bece051066dcdbeda693499e8d79f439e30cd6daf3dd089ea1e42fd35a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 462113bece051066dcdbeda693499e8d79f439e30cd6daf3dd089ea1e42fd35a
- MD5 55d049aa40f4bab3580e113b2459c783
- SHA1 6ce6092d251f56967572fd9f7e1df5ab62249176
- SHA512 95f20808585f11b7c604385a069e4ee7425ab9b38ccf9fcd2712adc3cf5068ff8f8db5bde8fcdef4022a77b39446d14dae43110444fce6d382b5127acb3d21b0
- SSDEEP 768:DoIUbME2Mi8XnOH3DlindvOg5Brb4g5diS9k5mYIP+w10xTpt3Yk7SkqQB5pLThX:3KMzMi8+xaJB5d4WiS9k5mYFwapr7bB5
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4744b94d6954de78dc1394d5f1f8f4dce2179eae5b8d453f99d8adf93a3eb9a9.exe
- IMPHASH 00be6e6c4f9e287672c8301b72bdabf3
- SHA256 4744b94d6954de78dc1394d5f1f8f4dce2179eae5b8d453f99d8adf93a3eb9a9
- MD5 60c9fb178e3d757a504020e2da59f9f8
- SHA1 22f298f2b479d0515c1599d449374e866b1c78e9
- SHA512 f4fc63e0f27cd8a8a0f94ae467a17b9235c7aeab406cb0591cebfa7eec96e1d4c1df9e4a055d42a6a279148bd6fec273b217b9e69fbd192e61aea7d9d69aa4e4
- SSDEEP 1572864:Qcgl2JLufX15eOAZ/ybGWSnr5oSaIS9W5XeNIY6hocj/IAwQidBvMFXbZ6T0V2Jv:1glTfX15349t9zlENp6KS/jwQiDvMVbA
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
120057
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GetTickCount
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer
gdiplus
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
Name
.text
Size
186KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
498KB
Virtual Size
498KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=139, id=243, version=40116,
count=24, id=242, version=40116,
count=22, id=259, version=24123,
count=19, id=260, version=24123,
count=44, id=261, version=24123,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=267, id=1, productName=Unmarked objects,
count=48, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
4884c907196c6492f16b3ecb2b2ab21b5642be51d7977047b2ef6154fc2f8ce5.elf
- SHA256 4884c907196c6492f16b3ecb2b2ab21b5642be51d7977047b2ef6154fc2f8ce5
- MD5 fd9e9043c013c629e610724dac744d17
- SHA1 91d154fed58cfc12bb35385db27428e1990b6a81
- SHA512 4b27da06e57b6f3b054a8793eafc4273801aaf728ddf555730610185e60424249ce5ce002d01cb66c870ebc7567f5aa3479beb1bedd3d3f0378c843d73e946b9
- SSDEEP 1536:9CnY3wloi0y5fYuBjOo3tYCYicAZrn7ad/vYodUMQiA9PRPd37on59Oai:h34oi0UpXmCTZrn7ad3G9PRPd3UnrOB
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
4978b11e4e9669aebe9e03adeeac643e6bbb44d9d3d2493065c915aacc549c48.elf
- SHA256 4978b11e4e9669aebe9e03adeeac643e6bbb44d9d3d2493065c915aacc549c48
- MD5 85ae7dc0b14c77fe48606ebbd686bcba
- SHA1 468ace04a54b090a8ddb8dd38acf1d4881b9a799
- SHA512 850702053687cfe719b8e386f023fc83542fd404aae02a5d89070bed9c1e8b918f1f06d41044048794f4a6f5d76c637c60bd1032e4a4e9960034f8fa7d28a163
- SSDEEP 768:DOIBvjFC629/XMG5rnKgYLsn13L2oSlwv:DzhFbG/cG5rf13LNv
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
49ebe60b13e18860b25f920c8c8ed486bd9f0789c47c65df1f32c6dcb1a2cb83.elf
- SHA256 49ebe60b13e18860b25f920c8c8ed486bd9f0789c47c65df1f32c6dcb1a2cb83
- MD5 2300529a86a3936b0587cf8aae88244c
- SHA1 b84867a93a333155e3875809aa271b338b272c68
- SHA512 c4b6956a029293a7a190a4dd9c7128ffd1a52f1c1855bbaf3c1b47eeea502b9bfa0fc15df008c817ebb8d64be0915cd0194c7412c227e789483ead0e47b5bef3
- SSDEEP 3072:OwNUWqpCgYXlrSyWUfMNGMmH1cuEgv26uN/:OwNjqpC/G8fMNGMmH1cuEgv26uN/
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
4a0007763fc1a326967ad2400f16fecdd8d540258dcbb555345d9a4e02092bb5.exe
- IMPHASH fb0a8b4a81655f744a37af985e009476
- SHA256 4a0007763fc1a326967ad2400f16fecdd8d540258dcbb555345d9a4e02092bb5
- MD5 97302f31f8e4dc1c354a3b2a2b3cc6b6
- SHA1 0517d142d362846e0cb234babfea33511391acca
- SHA512 6577ae13f62fae38421459b7c3d92ae01ccd048578b01d3a863c19cf302fb7c6b9549fa640b22c833f3644ea4aa316ac81720b6310f3d492e869a75219b666a9
- SSDEEP 49152:EX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeK52:ElRsZ47/QXoHUOfAoj1n8
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1940876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\MeshAgent\MeshAgent\Release\MeshService64.pdb
comctl32
InitCommonControlsEx
dbghelp
SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump
iphlpapi
GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo
ws2_32
WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select
crypt32
CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore
gdiplus
GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup
ncrypt
NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey
kernel32
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer
user32
EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect
gdi32
SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject
advapi32
CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus
shell32
ShellExecuteExW
ole32
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
981KB
Virtual Size
981KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=176, id=243, version=40116,
count=38, id=242, version=40116,
count=1, id=199, version=41118,
count=10, id=259, version=24123,
count=33, id=261, version=24123,
count=25, id=260, version=24123,
count=496, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=209, version=65501,
count=1, id=208, version=65501,
count=29, id=203, version=65501,
count=398, id=1, productName=Unmarked objects,
count=53, id=264, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311
- MD5 109adf5a32829b151d536e30a81ee96b
- SHA1 dc23006a97e7d5bc34eedec563432e63ed6a226a
- SHA512 74e7fb13e195dcf6b8ed0f40c034925c3762b2e0c43c8faede99ce79a4b07966ff5336769db3f9f5bb4c0478cefc879d59b43d5ded5bda3e75d19bd0a1e9e9e5
- SSDEEP 1536:QeYZA06UMG73jWw9o5zeS6LQR9bAayaIMbckM6mfOWcNFOfab:QfZxfMGTFXS6LQR9bAaZbfsfOPMab
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
77326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
51787c72e5315249cc7625f28609f16211a3774cbe839fe0df550bcaf3a27c56.exe
- IMPHASH d0243dfde80694c4b1420314e367e553
- SHA256 51787c72e5315249cc7625f28609f16211a3774cbe839fe0df550bcaf3a27c56
- MD5 1e50660de92e806e9ecb84b110c7c5d3
- SHA1 051e568ef2e3f5a1696c932c2e008a281cdc8ab7
- SHA512 c361523d21e757994b4356aead3040dcc3688a123b74e35b62ce56cbe5ad4cf081f62063c93e3c58ca91638a45d9bf170013a99257419e37db74e05fdd2205f0
- SSDEEP 196608:Rbu/R9MI8RuajVoF9inPAhm/88UZjgNdV0aPj4657n/gk:Ra/AAY/8tZCPj9x
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1718303
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\WarZ\src\RSUpdate\Release\DomoZLauncher.pdb
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXCreateFontA
D3DXSaveSurfaceToFileA
D3DXGetImageInfoFromFileInMemory
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXCreateTextureFromFileInMemory
d3d9
Direct3DCreate9
kernel32
FreeLibrary
GetFileSize
WriteFile
ReadFile
GetFileTime
FormatMessageA
GetComputerNameA
GetOEMCP
GetACP
CreateProcessA
LoadLibraryExW
GetSystemDirectoryW
LocalAlloc
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetStdHandle
GetTimeZoneInformation
LCMapStringW
GetTickCount
GetLocalTime
GetSystemTime
SystemTimeToFileTime
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
SetFilePointer
DeleteFileW
MoveFileW
GetTempPathA
GetTempPathW
GetCurrentDirectoryW
GetFullPathNameW
LocalFree
GetLastError
InterlockedIncrement
InitializeCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
SetFileAttributesA
MoveFileA
LCMapStringA
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
FileTimeToSystemTime
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
DeleteCriticalSection
FlushFileBuffers
CreateThread
GetCurrentThreadId
CreateFileA
GetConsoleCP
IsValidCodePage
GetCPInfo
GetStdHandle
SetHandleCount
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapReAlloc
ExitProcess
GetModuleHandleW
GetProcessHeap
GetFileType
GetDriveTypeA
FileTimeToLocalFileTime
HeapAlloc
HeapFree
RaiseException
RtlUnwind
GetStartupInfoA
GetCommandLineA
UnhandledExceptionFilter
ExitThread
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
GetExitCodeProcess
SetUnhandledExceptionFilter
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
Module32Next
InterlockedDecrement
CreateFileMappingA
UnmapViewOfFile
MulDiv
DuplicateHandle
GetCurrentThread
TryEnterCriticalSection
InterlockedExchangeAdd
SetEndOfFile
GetSystemInfo
MapViewOfFile
InterlockedExchange
GetFileAttributesA
CreateDirectoryA
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
DeleteFileA
SetConsoleTitleA
AllocConsole
Sleep
GlobalAlloc
GlobalUnlock
GlobalLock
GetCurrentProcess
TerminateProcess
GetCurrentDirectoryA
GetFullPathNameA
CreateEventA
SetEvent
OutputDebugStringA
OpenEventA
LeaveCriticalSection
EnterCriticalSection
CloseHandle
TerminateThread
WaitForSingleObject
GetVersionExA
GetProcAddress
GlobalMemoryStatusEx
CopyFileA
GetModuleFileNameA
MultiByteToWideChar
LoadLibraryA
FindFirstFileA
CreateFileW
FindClose
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
user32
GetWindowLongA
SendMessageA
SetFocus
MessageBoxA
GetClientRect
ClientToScreen
ShowCursor
PostQuitMessage
RegisterClassA
CreateWindowExA
GetActiveWindow
InvalidateRect
UpdateWindow
PeekMessageW
GetMessageW
BeginPaint
EndPaint
ReleaseCapture
GetCursorPos
GetWindowRect
SetCapture
DefWindowProcA
SetWindowLongA
SetWindowTextA
ShowWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetCaretBlinkTime
ClipCursor
GetFocus
GetKeyState
OpenClipboard
GetClipboardData
CloseClipboard
GetAsyncKeyState
SwitchToThisWindow
AdjustWindowRect
SetWindowPos
SetRect
LoadStringW
LoadCursorA
SetClipboardViewer
ChangeClipboardChain
LoadIconA
gdi32
SetTextAlign
SetBkColor
DeleteObject
GetTextExtentPoint32A
SelectObject
DeleteDC
GetDeviceCaps
CreateICA
GetStockObject
CreateFontA
CreateCompatibleDC
LineTo
MoveToEx
ExtTextOutA
CreatePen
SetMapMode
CreateDIBSection
SetTextColor
advapi32
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
GetUserNameA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptExportKey
CryptDestroyKey
CryptGetUserKey
CryptEnumProvidersA
CryptGetProvParam
CryptAcquireContextW
RegOpenKeyExA
shell32
SHGetFolderPathA
ShellExecuteA
ole32
CoCreateInstance
CoInitializeEx
CoInitialize
oleaut32
SysAllocString
SysFreeString
iphlpapi
GetAdaptersInfo
dbghelp
MakeSureDirectoryPathExists
MiniDumpWriteDump
ws2_32
getsockopt
setsockopt
ioctlsocket
WSAGetLastError
socket
WSAStartup
ntohs
inet_ntoa
getsockname
gethostbyname
inet_addr
htons
connect
select
__WSAFDIsSet
bind
closesocket
shutdown
recv
send
dinput8
DirectInput8Create
crypt32
CryptDecodeObject
CertSetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCreateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetSubjectCertificateFromStore
CryptMsgControl
CryptMsgGetParam
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CryptDecryptMessage
CryptEncodeObject
CryptEncryptMessage
CertNameToStrW
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
754KB
Virtual Size
753KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
101KB
Virtual Size
784KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
163KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=13, id=150, version=20413,
count=55, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=392, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, productName=VS2010 build 30319, version=30319,
count=3, id=171, productName=VS2010 build 30319, version=30319,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=218, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, version=21202,
count=28, id=123, productName=VS2005 build 50727, version=50727,
count=409, id=1, productName=Unmarked objects,
count=28, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
5212ef58efb4b855a2aaf4bbaf81a4912810982631e2afaf246963fea954fe64.vbs
- SHA256 5212ef58efb4b855a2aaf4bbaf81a4912810982631e2afaf246963fea954fe64
- MD5 883530fd75a356dad534bdb7aa39e947
- SHA1 2f7cd81fb69b269273068bc97a012216f67e35d0
- SHA512 53d804000f64091fd407747262d011c5d73d892be9cf137d1466bd4150bebb0851fdc11e6937163e845ec3cb7e6929e10e8601833d20fa75e126dbf1a2f46362
- SSDEEP 768:u0ygBLXWAZGc8NnKwiQ6x/dSNQT1AOBG/m:Z3qNnKwKLTBB
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
52f0294f8dd4741d22f39e30ef4a1818523b8899a4462d437321b4e51ca4bcba.pdf
- SHA256 52f0294f8dd4741d22f39e30ef4a1818523b8899a4462d437321b4e51ca4bcba
- MD5 d5f344454f75030d52003e7022ca6423
- SHA1 68c1b2359888b946eadecefc67d6faaa9abcaf71
- SHA512 6e85aeeecfe8c8344a170fcbae6f1a6b87cc2023ac709ef4831a18afb205de3149d1c1c9e7f3c1cbc3776dfc5ae7e7b8e83c8ed20b6a04348d6880ad66fbc31f
- SSDEEP 384:7o1C86BVbBnIrqDthH7p9N0QU83BCWu6Ht+Bhu3QJtWLtGwifAPCDaXdnhll//og:7ogjnIE91VHQvuAvyliC22Jhfqy
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b
- MD5 dcddcc30b20e45b6c7df7f7ad6b4a20b
- SHA1 a4ba98056c7ecf194487dc0cc18f502d8c483bdc
- SHA512 3c143403a66478e396afe666dc9580acaf3ae6d42c3ab32cbc5d0639db50f8468ced12b018f1cb776646fbe09163f9a732014fc4cc6ea23823e9abf5b439b933
- SSDEEP 6144:hhVXST5YkgLQ2bnPMcqenB4g4Rb4xSMD4jA1qq0T6:jV+YLs2LVqenWbqf1qqL
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Class file contains resources related to AdWind
-
Detect ZGRat V1
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
278606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
264KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
561ba061b626753994e3d3389e2b5b74e42f39b4ab4b863b20a16bca6f1832fc.elf
- SHA256 561ba061b626753994e3d3389e2b5b74e42f39b4ab4b863b20a16bca6f1832fc
- MD5 0fc92c32d979d2a21bb0f96f3264ecc0
- SHA1 950ecdca60e6f1f4b38a59a385efdcb6d46b0c55
- SHA512 1c85b7445d4d6d802fa16cdce8cf88346fce5821cf54fbdf2163a65c8085687b6ca944e9a0d8d25e87624201eec928daf73153aef8a93a1f3b21892783ff9ea5
- SSDEEP 3072:IJr9C/K3cjnwz45NlK2Ez+CUG6iAedxdmQpq:IJr9O8csU4bTqi3xIQpq
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
57bfb1ccdc00493daf0987426bc3744bfcc0f2777b78594e840832a776b32a9f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 57bfb1ccdc00493daf0987426bc3744bfcc0f2777b78594e840832a776b32a9f
- MD5 7f014bedf67806cd5b9b5bac160f6375
- SHA1 d97923c167b8eab1280756bb1f45f41df5ee88e0
- SHA512 2ada9501663b5ef753da3c0340710f19a4969ad32f80d99a2a75cc792539c412c34eaee9751afc8f70ae0f0bac5b65e68734c6dcda73516ff76ed9d47b75fef8
- SSDEEP 12288:5qZOoyGg+IahNs6zxwsM6ZBRpMsrf7p1bRJiaIv2cBjRlavtgItFz4W:5qZrYahy6z5MwPpMsDcB1WeItFzz
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
841054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
813KB
Virtual Size
813KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
58977c7fcf81b48cc636ed15cc410fe08d5d8a66291f3d2cc034cf41f57dec2f.vbs
- SHA256 58977c7fcf81b48cc636ed15cc410fe08d5d8a66291f3d2cc034cf41f57dec2f
- MD5 37ef05da68000d994be060a3a4f3cccc
- SHA1 6f1ea9397dd902bc8354ff5c0be98ad708ad7ae0
- SHA512 d2fae949f594be72a27214a4040402c0bb70d9775bb215e5dfbf0449a80f9ffceec4c16582c55f5bda0aa0690aa33db13eb39d44775c42db8d6de7fd716c47c0
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28
- MD5 cfd2733ba128f49a373042a1a6c3fe19
- SHA1 5782fffc3d9e4d815fa0ec6315c5f237edfb9ae9
- SHA512 be1a9fae4148cd6b567903f8fe707c1812d2782c8a718f81f6d30240c498f1aa5419f5fc22a318727a07e0e232c1538209743a97b9c01e5f4a679462ac2819d8
- SSDEEP 12288:DHKzTnUs8oF7lWrf4p0fM5kzzLsK8Qll6V:DqzTUvEjCfMiHYMoV
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
eb:84:98:05:56:51:35:94:0c:54:a3:d5:e8:96:06:9e:6d:2a:c4:cb:21:d8:06:de:56:a8:dd:b3:55:8e:cb:8c
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
eb:84:98:05:56:51:35:94:0c:54:a3:d5:e8:96:06:9e:6d:2a:c4:cb:21:d8:06:de:56:a8:dd:b3:55:8e:cb:8c
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Feb 7, 2024
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 18, 2022 - Oct 15, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 14, 2023 - Sep 4, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
4
Entry point
380238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\9w7kjnhf\obj\Release\Laptop.pdb
mscoree
_CorExeMain
Name
.text
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e
- MD5 7a8ecbc488543dd3ce6cfe5ba9d5cd8b
- SHA1 87031bf7d870ffb4a6bec6e44a38045834017b50
- SHA512 e6f9080c58f1f10fdcedb23e4efd525ad4a40573c0f69f65d8ec3f6e5de45544bd8b5b96ad6603e1b291eb6697b3ed03cd4265d9249ffe90fcc22ef977f95eef
- SSDEEP 1536:Fqsgaq+A/lbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2/3teulgS6pQl:DfZeYP+zi0ZbYe1g0ujyzdjQ
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
RedLine payload
-
SectopRAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
609ef2b560381e8385a71a4a961afc94a1e1d19352414a591cd05217e9314625.exe
- IMPHASH 32a31bfad8ca2c4b8a1a523b9cceb9d8
- SHA256 609ef2b560381e8385a71a4a961afc94a1e1d19352414a591cd05217e9314625
- MD5 1fc71d8e8cb831924bdc7f36a9df1741
- SHA1 8b1023a5314ad55d221e10fe13c3d2ec93506a6c
- SHA512 46e5e2e57cb46a96c5645555809713ff9e1a560d2ad7731117ef487d389319f97a339c3427385a313883a45c2b8d17ce9eec5ca2094efa3d432dd03d0ca3bb28
- SSDEEP 12288:dNs70wrxwDBwTGvwDYwC9woS/Cw4AvcqOh2Q0fPbU3FM1jJS:D20wrxwDBwTGvwDYwYwoS/Cw4/qVQWbr
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
56800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\omtnkdoj\bnwv\yogisfk\cqf.pdb
comdlg32
GetOpenFileNameA
GetSaveFileNameA
gdi32
BitBlt
DeleteDC
CreateCompatibleDC
GetStockObject
SetBkColor
SetTextColor
SelectObject
GetDeviceCaps
CreateCompatibleBitmap
CreateBitmap
TextOutA
DeleteObject
kernel32
RtlUnwind
SetStdHandle
WideCharToMultiByte
GetSystemTimeAsFileTime
WriteFile
GetModuleHandleW
LeaveCriticalSection
DeleteCriticalSection
GetConsoleCP
SetConsoleCtrlHandler
Sleep
GetCurrentThreadId
RaiseException
GetStdHandle
MultiByteToWideChar
TerminateProcess
GetStringTypeW
EnumSystemLocalesW
LoadLibraryExW
ReadFile
OutputDebugStringW
GetCPInfo
HeapFree
GetModuleFileNameW
FormatMessageA
GetCurrentProcess
GetLastError
FreeEnvironmentStringsW
AreFileApisANSI
HeapSize
SetUnhandledExceptionFilter
GetModuleFileNameA
GetConsoleMode
GetEnvironmentStringsW
FlushFileBuffers
IsValidCodePage
CreateSemaphoreW
IsProcessorFeaturePresent
GetACP
EnterCriticalSection
LCMapStringW
FreeLibrary
GetProcAddress
DecodePointer
GetFileType
EncodePointer
CreateFileW
GetProcessHeap
GetOEMCP
TlsFree
CloseHandle
GetStartupInfoW
SetFilePointerEx
HeapAlloc
QueryPerformanceCounter
IsValidLocale
GetModuleHandleExW
TlsGetValue
GetLocaleInfoW
TlsSetValue
IsDebuggerPresent
CompareStringW
InitializeCriticalSectionAndSpinCount
GetDateFormatW
CreateFileA
UnhandledExceptionFilter
LoadLibraryW
SetPriorityClass
InterlockedDecrement
WriteConsoleW
GetTimeFormatW
GetModuleHandleA
HeapReAlloc
SetLastError
GetCurrentProcessId
GetCurrentThread
GetUserDefaultLCID
ExitProcess
FatalAppExitA
InterlockedExchange
InterlockedIncrement
TlsAlloc
GetCurrentDirectoryA
shell32
ShellExecuteA
user32
GetMessageA
InvalidateRect
SetDlgItemTextA
PostQuitMessage
SetCursor
PeekMessageA
DestroyWindow
AdjustWindowRect
MessageBoxA
LoadImageA
GetSystemMenu
IsIconic
DefWindowProcA
LoadStringA
RegisterClassExA
SetForegroundWindow
CloseWindow
GetCursorPos
ReleaseDC
GetSystemMetrics
LoadIconA
CreateWindowExA
ShowCursor
SetWindowPos
GetCursor
SendMessageA
RemoveMenu
GetDlgItemTextA
EndDialog
DialogBoxParamA
GetDC
LoadCursorA
DispatchMessageA
TranslateMessage
WaitMessage
winmm
timeKillEvent
PlaySoundA
timeSetEvent
Name
.text
Size
55KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
357KB
Virtual Size
361KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=41, id=2, version=7274,
count=2, id=1, productName=Unmarked objects,
count=2, id=16, version=7346,
count=15, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
60f45dc57494e24ac5676556834ad9c30fc889bd9cceed706a4c4546e593cfa9.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 60f45dc57494e24ac5676556834ad9c30fc889bd9cceed706a4c4546e593cfa9
- MD5 8b1a48867be18f24f03ad4eb3c2d416e
- SHA1 fb43f27f014f1b267e331a9983fd8c90628896a6
- SHA512 c1f3ece8fd6038ab5737f2ec59020f75bcaf9ba60a6ad6775c5dab358019e982547d60789d1aeee9e83193c254f710d5785baf290180078c882b29ac26802396
- SSDEEP 12288:LlV6od3j7Qm1Yf4CLgi20+L0TEMrG5atBIE3jRWZUFJyfllGRRtXXfMKLvq1DOjn:xV6od3j7Q6Yfvci9bS4tBIET+EKXA
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
738990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
714KB
Virtual Size
713KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15.dll
- IMPHASH 99f735f47b2cd370c9d9f10c289154e0
- SHA256 63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15
- MD5 8e3161bdec7310b024db91255398f39e
- SHA1 12c65adfa60de424dbf2aa0a1cc6fba9b25063bd
- SHA512 b70946035c50674ebf1503c1f8de95952f1e9c7d7fcce6e85ef43195fb4f65e9347fae4ee3a05d30af99e4b68254852056ff2c7aa12123f70b3ff6cf48b78e40
- SSDEEP 12288:2jsgiZdvAeRw3+aXHv50cCleBqq2cvpzwnAmvRKLiTOkkRpZHD0kmiIjcBDfg5En:ksgwdvAOMP50cCleBqqzvp0nAmvR+iTs
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detect Socks5Systemz Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
80978
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
wininet
InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetReadFile
InternetOpenUrlA
dnsapi
DnsFree
DnsQuery_A
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
VirtualQuery
CreateFileA
lstrlenA
TlsGetValue
SetWaitableTimer
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
QueryPerformanceCounter
InterlockedCompareExchange
SleepEx
WriteFile
InitializeCriticalSection
TlsSetValue
TerminateThread
InitializeCriticalSectionAndSpinCount
GetTickCount
GetProcessHeap
HeapAlloc
CreateEventA
GetCurrentProcess
HeapFree
WaitForSingleObject
SetEvent
Sleep
GetSystemTimeAsFileTime
LeaveCriticalSection
ReadFile
lstrcatA
InterlockedExchange
GetLastError
SetLastError
GetProcAddress
QueueUserAPC
EnterCriticalSection
InterlockedExchangeAdd
LocalAlloc
PostQueuedCompletionStatus
WaitForMultipleObjects
GetModuleFileNameA
CreateIoCompletionPort
GetModuleHandleA
DeleteCriticalSection
GetVersionExA
TlsAlloc
CloseHandle
CreateWaitableTimerA
LocalFree
TlsFree
DeleteFileA
CreateThread
FreeLibrary
LoadLibraryA
DeviceIoControl
HeapSize
GetModuleHandleW
GetModuleFileNameW
SetEndOfFile
CreateFileW
ReadConsoleW
FlushFileBuffers
WriteConsoleW
SetStdHandle
HeapReAlloc
OutputDebugStringW
SetFilePointerEx
LCMapStringW
GetStdHandle
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
GetConsoleMode
GetConsoleCP
FormatMessageA
OpenEventA
ReleaseSemaphore
GetCurrentProcessId
GetCurrentThreadId
ResetEvent
ResumeThread
EncodePointer
DecodePointer
ExitThread
LoadLibraryExW
GetCommandLineA
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
user32
wsprintfA
shell32
SHGetSpecialFolderPathA
ws2_32
ioctlsocket
WSAStringToAddressA
connect
inet_ntoa
WSAStartup
ntohl
inet_addr
htonl
getaddrinfo
WSARecv
WSASend
select
htons
ntohs
getsockname
shutdown
setsockopt
WSACleanup
freeaddrinfo
WSASetLastError
closesocket
getsockopt
WSASocketA
WSAGetLastError
Name
.text
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
2B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
411KB
Virtual Size
411KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=29, id=223, productName=VS2013 build 21005, version=21005,
count=142, id=224, productName=VS2013 build 21005, version=21005,
count=3, id=225, productName=VS2013 UPD3 build 30723, version=30723,
count=51, id=225, productName=VS2013 build 21005, version=21005,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=150, id=1, productName=Unmarked objects,
count=6, id=229, version=30723,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD3 build 30723, version=30723,
643afed61e85d74cfd348f181b699599588cdd4033d6cc5a8a6fddfb356e0f7b.vbs
- SHA256 643afed61e85d74cfd348f181b699599588cdd4033d6cc5a8a6fddfb356e0f7b
- MD5 590c086d7f52e3d3987a2d7f289b6a36
- SHA1 66568942077f8d1f4fa5e99886bda18785a7c6ac
- SHA512 86fd1d6a449eba7501862fb38cc1d49bae91baa6bf955f3be567e294484ba8e3937346edf2b91ccc4603828dc99614f7b3d9bdfd8102ddd32fe7d3fb1e7e2ca7
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
679d5cdadcc48fa79574ce12e8d0fd2e19823dc4b7e39a84b5b286672f45a72d.exe
- IMPHASH 0ae9e38912ff6bd742a1b9e5c003576a
- SHA256 679d5cdadcc48fa79574ce12e8d0fd2e19823dc4b7e39a84b5b286672f45a72d
- MD5 1a933b075452db624a756f76662a0614
- SHA1 264bedf3867851461ea52b75650f414fcebb61ef
- SHA512 8f84c2c548d5774c5e942cef1dc5e0eb6e82a79d22a30b636bf0a98fad535cfab5e77a380c1c167ea33caca1ee397e64490eff0672cc915d1c8e797eb63e1071
- SSDEEP 24576:GubsnafAPyjSzuubsnafAPyjZrilCQZCC3kmnrAa1rmqUeIiVfox2oTVZHeBFpUH:YI4wI1iln73XnrA0dqiFoHcpfi/Znqh0
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
133008
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetCurrentProcessId
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetTimeFormatW
GetDateFormatW
LocalFree
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetNumberFormatW
DecodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapReAlloc
HeapAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
oleaut32
SysAllocString
SysFreeString
VariantClear
gdiplus
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree
Name
.text
Size
203KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=142, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=253, version=31616,
count=19, id=260, version=31616,
count=23, id=259, version=31616,
count=53, id=261, version=31616,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=282, id=1, productName=Unmarked objects,
count=49, id=261, version=31630,
count=1, id=256, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,
6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe
- IMPHASH 5929190c8765f5bc37b052ab5c6c53e7
- SHA256 6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97
- MD5 bcc93e415a05ea5bb4ac3985fe389866
- SHA1 54afd186ad33eea4266fdcae4229e8fe48e4e8eb
- SHA512 a5ec0307abaab0f9a5a5c28cb1bcae8847dd21b91c9f8a84e0e0294b2b039a5d68c22cb8a4f56f5bb6e344e26df5ab1416612c8c3cb1c7f8980ae137dda49016
- SSDEEP 49152:wrtSAbjawsGcz8QfpyvcRjBZPohnKZV7+P:bOaw1uF4
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
5312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddAtomA
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateThread
CreateWaitableTimerExW
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
FormatMessageA
FreeEnvironmentStringsW
GetAtomNameA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetHandleInformation
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RaiseFailFastException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetLastError
SetProcessAffinityMask
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_lock
_memccpy
_onexit
_setjmp
_strdup
_ultoa
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
longjmp
malloc
memcpy
memmove
memset
printf
realloc
signal
strerror
strlen
strncmp
vfprintf
wcslen
_cgo_dummy_export
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
158KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
6dc7164ea78b8668d8a1492d543f24a9edaaad990403f4451c546a0d4115a3bd.exe
- IMPHASH bb2ac363335230ef73bf96bf5001e65e
- SHA256 6dc7164ea78b8668d8a1492d543f24a9edaaad990403f4451c546a0d4115a3bd
- MD5 3b39ad2ec92ee2f396274fe4e9d847f6
- SHA1 e4eba4a7c50eac6244195187b401b6a76d76c8fe
- SHA512 cbc2039ec5377f21f22142f1d4e2517afa1a7ca5085498a78094a9c733cc2b239a7342a6511465f71d22d1969f5e07129e462d8a774164c8650eae4c6e60178c
- SSDEEP 12288:8A5ke3Na3oGg+/vxfI8ao3NsmDyEuE4wdUQaPep/dxTAErBhRoJ:8A5V3Na33g+/vxfIQ3Ns4yEuElUQaPY4
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
434932
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
shlwapi
StrStrW
kernel32
TlsFree
MultiByteToWideChar
WaitForSingleObject
GetLastError
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
GetStringTypeW
GetCPInfo
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
SetStdHandle
HeapSize
CreateFileW
Name
.text
Size
567KB
Virtual Size
566KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
6e6d31e5b9a61454a66a24114583d5bdc3d7f2472bfea10fb639580fc058a1c8.elf
- SHA256 6e6d31e5b9a61454a66a24114583d5bdc3d7f2472bfea10fb639580fc058a1c8
- MD5 fd3f0ccdbbf4dddca9aab0883d7c0abf
- SHA1 2b542e6c63ce929c35b003d74270dd0eb470087c
- SHA512 a2a332a0fe391eaee4f401e010448542eea50a70809daa0e2df27ed72884c80cd4faa205115292d1fa506b1c8000b5182e05f2909cb33d2897266d4a0be886b9
- SSDEEP 3072:C2ttgUm6Oq+loz+5hdCNzhsURxuZq+1uPNd5R:C2ttgxq++z+5hdC8URxuZq+1uPNd5R
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
- IMPHASH a9c887a4f18a3fede2cc29ceea138ed3
- SHA256 6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957
- MD5 55e393da1714013720ddf266c7906f43
- SHA1 91a636913604184c010c2d9e0b331a804a2c0ab4
- SHA512 40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a
- SSDEEP 49152:VvONaX/Lpt/IvKfeF4tIDpdIA/gvCRtDKYZ8NfBcPQSqzULJgxl6Y4KB7KkP3C+Y:VGNajwvKfpyMdvCRNZZ8NJcPQSEU9Q6z
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5425
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
msvcrt
malloc
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit
shell32
ShellExecuteA
kernel32
SetUnhandledExceptionFilter
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
6ff73b622e94d94a55f450e110199303d1d01ee1033a8e13c19a2a34ff333be3.elf
- SHA256 6ff73b622e94d94a55f450e110199303d1d01ee1033a8e13c19a2a34ff333be3
- MD5 7977d9f9a292e4d56b2bd552d90ff407
- SHA1 4cd80ca4a841c06d9e8c67a07f8a606ae0977885
- SHA512 c21f13c1c78272a70cd99d366166c88642e8f8f929b790ef44a3157b6c4162ee670e52ea24b895010114a46fff9d2bb7c22933a30b9c6f0cac167cbde498ab81
- SSDEEP 3072:xESFFNySClK1Tvk3ahn4qfdQGGgQzWo6Wi/YpEoGM/RxMQkunSh:SSHNwlKBM3ahn4qFQ/KoXi/yJGM/RxMf
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
706e63fa9b69849f7f9c518fff1314f02632bf0b9040c9c5f4ce506c0e11f25c.elf
- SHA256 706e63fa9b69849f7f9c518fff1314f02632bf0b9040c9c5f4ce506c0e11f25c
- MD5 a8d4033221fd7bc7ba9e0b2decc5b533
- SHA1 b12ab18a5f9078573af681e640378a0070e3eaef
- SHA512 e515eadd959099e28ac3f8ffd139eac1286c456f92d2f12c3fbbe73d00e4851181394b6f91a06be4aef650668b8de0f0fa0b2c4ce7f6516e39717050aac31da9
- SSDEEP 3072:F+2nztygC57i4mCxSKIDEphaKf7Az8E6PCNVOXinYuM8R:HGhPmCQIphayc8E6PCNVOXinYuM8R
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
717d6956f37bcd29a3f05cb5439f875b31729d4bece0a0d0bd3ad59ba572fd5d.exe
- IMPHASH c4540f421523fe2dc591e50be5ad7d0b
- SHA256 717d6956f37bcd29a3f05cb5439f875b31729d4bece0a0d0bd3ad59ba572fd5d
- MD5 11218beab3a287e8edaa2b417dd0aa5b
- SHA1 e1b6a813471861bcb87e9e0fe37427841bdf87ee
- SHA512 f5f6f3ad6b6ece3b0f395cce9c1dffe177a27fc488f64b00bfa2d85c88a3664b2b8f5b5e99e6a3d066051bd3dd92c6669eec5e334a7b88f386c25763f97bee54
- SSDEEP 24576:vqDEvCTbMWu7rQYlBQcBiT6rprG8a0GXCT/:vTvC/MTQYxsWR7a0
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
gethostbyname
recv
send
socket
inet_ntoa
setsockopt
ntohs
WSACleanup
WSAStartup
sendto
htons
__WSAFDIsSet
select
accept
listen
bind
inet_addr
ioctlsocket
recvfrom
WSAGetLastError
closesocket
gethostname
connect
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
mpr
WNetGetConnectionW
WNetCancelConnection2W
WNetUseConnectionW
WNetAddConnection2W
wininet
HttpOpenRequestW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
InternetConnectW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpSendEcho
IcmpCloseHandle
IcmpCreateFile
userenv
DestroyEnvironmentBlock
LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile
uxtheme
IsThemeActive
kernel32
DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetShortPathNameW
DeleteFileW
IsDebuggerPresent
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
LoadResource
LockResource
SizeofResource
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
LoadLibraryW
GetLocalTime
CompareStringW
GetCurrentThread
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
VirtualAlloc
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
CloseHandle
GetFullPathNameW
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetACP
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetStringTypeW
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetCurrentDirectoryW
FindNextFileW
WriteConsoleW
user32
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
PeekMessageW
GetInputState
UnregisterHotKey
CharLowerBuffW
MonitorFromPoint
MonitorFromRect
LoadImageW
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
ClientToScreen
GetCursorPos
DeleteMenu
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
SystemParametersInfoW
LockWindowUpdate
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
RegisterHotKey
GetCursorInfo
SetWindowPos
CopyImage
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
TrackPopupMenuEx
GetMessageW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
DispatchMessageW
keybd_event
TranslateMessage
ScreenToClient
gdi32
EndPath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
GetDeviceCaps
SetPixel
CloseFigure
LineTo
AngleArc
MoveToEx
Ellipse
CreateCompatibleBitmap
CreateCompatibleDC
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
SelectObject
StretchBlt
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
GetDIBits
StrokePath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
RegCreateKeyExW
GetSecurityDescriptorDacl
GetAclInformation
GetUserNameW
AddAce
SetSecurityDescriptorDacl
InitiateSystemShutdownExW
shell32
DragFinish
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
CreateStdDispatch
CreateDispTypeInfo
UnRegisterTypeLi
UnRegisterTypeLibForUser
RegisterTypeLibForUser
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
VariantChangeType
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
SysStringLen
QueryPathOfRegTypeLi
SysAllocString
VariantInit
VariantClear
DispCallFunc
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
SafeArrayDestroyDescriptor
VariantCopy
OleLoadPicture
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
277KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
71b748425fa7055b9060ac5d6587bc18948c46558e6789ddb213df076d379d0c.elf
- SHA256 71b748425fa7055b9060ac5d6587bc18948c46558e6789ddb213df076d379d0c
- MD5 dc4180dd40cc67d78a8b7af890a730a6
- SHA1 e49497d1c97475c2e8e38cfdf6f79f16d5d116bb
- SHA512 492631005106e3376d7b5c750c68b934cca1c93543e2e2e26962693881509e9f710ef38977816fe6410d55edab3753e211c27e6109fce57ceee5b4c16fe4a8c4
- SSDEEP 3072:YYYV3hNPZz4Xphak7v7P59/nYEP/UnSQf/R:uDltEphakrt9/nYEP/UnSQf/R
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
72e63f73ced48b29f196e48030215273a17f7827c310f2747321cbc1f388c206.exe
- IMPHASH 511795205251937189f1413f04853250
- SHA256 72e63f73ced48b29f196e48030215273a17f7827c310f2747321cbc1f388c206
- MD5 2d2ca48b8c09de0645b7fd0223c922f0
- SHA1 de1f948065d612cd649564e466e362198f8ce3e6
- SHA512 452f545f1f4d834a2cd92910fe5caa8c0f2ffdbaf2b3a0370c17f953422d37c13e10212219cae04fad93d07e81f370010a1951b29f2e83f78694ed68637d27bb
- SSDEEP 12288:5mRuurqzlzZByCt6+AoCPsNBhY0ySvp4:5ormzZ0Ct9A3PcS0yD
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5591
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LocalUnlock
PulseEvent
GetConsoleAliasesLengthW
GetProcessIoCounters
WriteConsoleOutputCharacterA
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
InterlockedDecrement
CreateDirectoryW
CreateNamedPipeW
GetLocaleInfoW
FatalAppExitW
SetConsoleCP
HeapCreate
ReplaceFileA
GetConsoleAliasesW
GetStdHandle
GetComputerNameA
SetLastError
CreateTimerQueueTimer
SetStdHandle
PrepareTape
LoadLibraryA
LocalAlloc
AddAtomA
DebugSetProcessKillOnExit
lstrcatW
VirtualProtect
EnumDateFormatsW
GetFileTime
SetFileAttributesW
GetVolumeInformationW
WriteConsoleW
CloseHandle
SetFilePointer
GetCurrentDirectoryW
GetSystemDefaultLangID
FlushFileBuffers
GetConsoleMode
HeapAlloc
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetModuleFileNameW
Sleep
HeapSize
EnterCriticalSection
LeaveCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
GetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
RtlUnwind
HeapFree
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetConsoleCP
CreateFileW
user32
SetActiveWindow
GetClassLongA
advapi32
GetAce
ole32
CoTaskMemFree
Name
.text
Size
415KB
Virtual Size
415KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
768ea7c6f1285d70a63d32bbd3f3a0e9c530fdbd1c16e10672c42485e35bc077.exe
- IMPHASH b237ac2118704db9e7609540658f5790
- SHA256 768ea7c6f1285d70a63d32bbd3f3a0e9c530fdbd1c16e10672c42485e35bc077
- MD5 fcce0a9aa496c81dceda922d4423f2ba
- SHA1 5a19575e35004deddb90de07262467c34adba53a
- SHA512 b63137f4c4dffee3c5222d27b18e74cffdd11cc216a2915d11153067fa605c4c7f15c5c4afe3fa64dc24b1c46b5d34a94aed61eb30928f8e9b32be980fbf46a8
- SSDEEP 98304:XX2a7J2JcPj1735LBLQwovLvpMyH3CzFRmr4BgDF7L:XX2a70JWL5d0wo1MyXC3vOZ
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
_wcsicmp
_wcsnicmp
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
memset
signal
strcat
strcpy
strlen
strncmp
strstr
vfprintf
wcscat
wcscpy
wcslen
wcsncmp
wcsstr
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk
- SHA256 77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042
- MD5 40981142bcde486676e5eea7bcdfadbb
- SHA1 b61860a7ef0ec87174b92c59c6b68265a32619c4
- SHA512 584e8dbd93b9d89c29d3b7180f524a1d3077cad2fc10542db15f8a604290f475ddd2ddcbabbf5a406f048d224bcadd00348abfcce39f9885a569ef6e2a9ec090
- SSDEEP 49152:J/G52p3JiUhiZu/Rtzr52jvAOpPK4Nc5hFV3MM0b9kpYgs6V/Dce7q5px671:Rvp5piZmpCvBpPKr3r8MIWpYMV/6pS
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Irata payload
Madsal.com
.main
Madsal.com.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.VIBRATE
android.permission.POST_NOTIFICATIONS
android.permission.READ_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.ACCESS_NETWORK_STATE
com.google.android.c2dm.permission.RECEIVE
com.google.android.gms.permission.AD_ID
Madsal.com.permission.C2D_MESSAGE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.READ_CONTACTS
.main
android.intent.action.MAIN
.main
android.intent.action.MAIN
.chrome
.mainchange
.second
.telegram
.villain
.youtube
com.google.android.gms.measurement.AppMeasurementService
com.google.android.gms.measurement.AppMeasurementJobService
com.google.firebase.components.ComponentDiscoveryService
com.google.firebase.iid.FirebaseInstanceIdService
com.google.firebase.INSTANCE_ID_EVENT
com.google.firebase.messaging.FirebaseMessagingService
com.google.firebase.MESSAGING_EVENT
anywheresoftware.b4a.objects.FirebaseNotificationsService
com.google.firebase.MESSAGING_EVENT
.starter
.installrequest
.brodcast
.recivesms
.firebasemessaging
.serverurl
.smstext
.lastsms
.balance
.what
.searchsms
com.google.android.gms.measurement.AppMeasurementReceiver
com.google.firebase.iid.FirebaseInstanceIdReceiver
com.google.android.c2dm.intent.RECEIVE
com.google.android.c2dm.intent.REGISTRATION
com.google.firebase.iid.FirebaseInstanceIdInternalReceiver
.starter$starter_BR
android.intent.action.BOOT_COMPLETED
.installrequest$installrequest_BR
android.intent.action.BOOT_COMPLETED
.brodcast$brodcast_BR
android.intent.action.BOOT_COMPLETED
.recivesms$recivesms_BR
android.provider.Telephony.SMS_RECEIVED
.firebasemessaging$firebasemessaging_BR
android.intent.action.BOOT_COMPLETED
.serverurl$serverurl_BR
android.intent.action.BOOT_COMPLETED
.smstext$smstext_BR
android.intent.action.BOOT_COMPLETED
.lastsms$lastsms_BR
android.intent.action.BOOT_COMPLETED
.balance$balance_BR
android.intent.action.BOOT_COMPLETED
.what$what_BR
android.intent.action.BOOT_COMPLETED
.searchsms$searchsms_BR
.httputils2service
com.google.firebase.provider.FirebaseInitProvider
77de41f017ba6908cf75448383dcdd01d3d54dc55fc3a38f3f5b60542c637cf8.elf
- SHA256 77de41f017ba6908cf75448383dcdd01d3d54dc55fc3a38f3f5b60542c637cf8
- MD5 dc95ab359e3d05947ac8b8c834b0674e
- SHA1 e19e5b9d32400bd80302a8a156f3058546176af8
- SHA512 4fbd4abdc12a44ad3b33438b94c88cb65280e9cf1ebe159a591f699fd83f59a85f6d45f34d5bc48c3ebdb9c8ab183cd047b0d14f2fc4fe8e162f3a4020e918d2
- SSDEEP 768:t8nT4CpFuE4ruw68Z4Eby1w2EfpfcjUPV8gvrFtks3Uozg:vCL4lnuKxEjUPpzg
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
7822fa6c35cbd1cfb95c780970deef14d8b53c62ade3a4bcf63c494c3f2e5bbd.exe
- IMPHASH b5a014d7eeb4c2042897567e1288a095
- SHA256 7822fa6c35cbd1cfb95c780970deef14d8b53c62ade3a4bcf63c494c3f2e5bbd
- MD5 b2bb695b656dfb91e01967de3a8beee3
- SHA1 30ebac4eb84aa036bed8f8931b6493348b87108a
- SHA512 4c052ae34c2063b2d2ec8a9a877eaa4c20906d979d94305430bb00a3e7991ec7349b7a3965a0479dd48a1763bdb66e449a5be4c8d9c59abcaa3f180fedf8d269
- SSDEEP 12288:Mk5L2FqPzzhB4kLSQ4ybubjWlj+o2sjdg:M2yQPvnlS7ybubjKj+NsRg
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
73199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
kernel32
GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetModuleHandleW
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceExA
MulDiv
GlobalFree
GlobalAlloc
lstrcmpiA
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MultiByteToWideChar
GetLocaleInfoW
lstrlenA
lstrcmpiW
GetEnvironmentVariableW
lstrcmpW
GlobalMemoryStatusEx
VirtualAlloc
WideCharToMultiByte
ExpandEnvironmentStringsW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetThreadLocale
GetLocalTime
GetSystemTimeAsFileTime
lstrlenW
GetTempPathW
SetEnvironmentVariableW
CloseHandle
CreateFileW
GetDriveTypeW
SetCurrentDirectoryW
GetModuleFileNameW
GetCommandLineW
GetVersionExW
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
TerminateThread
ResumeThread
SuspendThread
IsBadReadPtr
LocalFree
lstrcpyW
FormatMessageW
GetSystemDirectoryW
DeleteCriticalSection
GetFileSize
SetFilePointer
ReadFile
SetFileTime
SetEndOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetModuleHandleA
SystemTimeToFileTime
GetLastError
CreateThread
WaitForSingleObject
GetExitCodeThread
Sleep
SetLastError
SetFileAttributesW
GetDiskFreeSpaceExW
lstrcatW
ExitProcess
CompareFileTime
GetStartupInfoA
user32
CharUpperW
EndDialog
DestroyWindow
KillTimer
ReleaseDC
DispatchMessageW
GetMessageW
SetTimer
CreateWindowExW
ScreenToClient
GetWindowRect
wsprintfW
GetParent
GetSystemMenu
EnableMenuItem
EnableWindow
MessageBeep
LoadIconW
LoadImageW
wvsprintfW
IsWindow
DefWindowProcW
CallWindowProcW
DrawIconEx
DialogBoxIndirectParamW
GetWindow
ClientToScreen
GetDC
DrawTextW
ShowWindow
SystemParametersInfoW
SetFocus
SetWindowLongW
GetSystemMetrics
GetClientRect
GetDlgItem
GetKeyState
MessageBoxA
wsprintfA
SetWindowTextW
GetSysColor
GetWindowTextLengthW
GetWindowTextW
GetClassNameA
GetWindowLongW
GetMenu
SetWindowPos
CopyImage
SendMessageW
GetWindowDC
gdi32
GetCurrentObject
StretchBlt
SetStretchBltMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetObjectW
GetDeviceCaps
DeleteObject
CreateFontIndirectW
DeleteDC
shell32
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
ole32
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
oleaut32
VariantClear
OleLoadPicture
SysAllocString
msvcrt
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
memset
_wcsnicmp
strncmp
malloc
memmove
_wtol
memcpy
free
memcmp
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
_controlfp
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
7be542aa39730d33b7fe6da737c67c0cde6905534d6b8b9cc8d6b4ecaf5bf3fb.elf
- SHA256 7be542aa39730d33b7fe6da737c67c0cde6905534d6b8b9cc8d6b4ecaf5bf3fb
- MD5 c442c058602aabbb3010e6b8a38593c5
- SHA1 9b6f7af6d61ddc499b72b1a8b9406ec1a8c141f2
- SHA512 9b70568fff7a90e6ceacb83936c59a86ad0589b443cdf96869230de43b1b08a2a29cb4c4d17c8635406b980cb7af8a243b0e816f8c1940438cc474d07e557684
- SSDEEP 1536:PxOsifsuuha1xpwva270LO9gdJVeP1ezvAtPtcuJPIEqQUSLQ9oC:ta1x2Sdq9KVy1ft3E9oC
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
8058db39c9c75269344ca81e210acb61595abf9b3e4e7a67ec380ba9ba756400.exe
- IMPHASH 12e12319f1029ec4f8fcbed7e82df162
- SHA256 8058db39c9c75269344ca81e210acb61595abf9b3e4e7a67ec380ba9ba756400
- MD5 2321b6dc48330c256fe55e7db41c0bb7
- SHA1 11043d1de13185df1ee81608d9708e9c9c5267a8
- SHA512 2a44a26c67e6793dfb49d0bb6b09ba817c37768d8a8732e1bd9e2c4526b88232ea6386b62a8f1ca8794cb959ffd309c4353aa05cc1e7e9af3f04959b584168cf
- SSDEEP 24576:2TbBv5rUyXVFPDlUEPRQY0TTl4e1vBYzcbo9GIqiZoqHQzg2oP/8xDH6KebPBMfv:IBJFPDlNIOzQo9hqiaqi4/stwPBMII
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
128304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
DecodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
LocalFree
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
oleaut32
SysAllocString
SysFreeString
VariantClear
gdiplus
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree
Name
.text
Size
199KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=142, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=253, version=30625,
count=19, id=260, version=30625,
count=23, id=259, version=30625,
count=52, id=261, version=30625,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=277, id=1, productName=Unmarked objects,
count=49, id=261, version=30709,
count=1, id=256, version=30709,
count=1, id=255, version=30709,
count=1, id=258, version=30709,
85d5c21050bd72c4ee02060d0be234ac35babc785567dca5bfc1d299150576b7.img
- SHA256 85d5c21050bd72c4ee02060d0be234ac35babc785567dca5bfc1d299150576b7
- MD5 216be0b5a0bbe6066604530539b647b6
- SHA1 08db883b7f03dba4d4fcdad820628bd78290850c
- SHA512 85fda1373b3c1b04fe0a69848baf0c91dec09103ef167ea3f7a77bdbc1aeb32f0c9ae9b556e4d0f2b09adc6c7fb0ad4fd98d4c434c2b13ce0af931c52d90e433
- SSDEEP 12288:P7mXTBXS/irGja/5InbFnnnBqf7tKms2G3a6nAwTYkrhRqlNvREqE6rn03dl2AIS:SA/irs452bFnnnB2JfsP3a6nAwTYkrhX
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
868891f4f0e322d258224ca43c84c055c21babac5fe1ae87542b8888ab3f0b33.elf
- SHA256 868891f4f0e322d258224ca43c84c055c21babac5fe1ae87542b8888ab3f0b33
- MD5 15d708c60aa5c721679a06c5b1323b22
- SHA1 77d75deebe4937c71448e89e5e7bbb73f90bb14e
- SHA512 f383eb5a2c550f6fed9098e1c51f56dd8de66122fae6847baaf7008077e48efd85058ee80d1fd6a20518b3fa8f998dbb7e547986cf35da11f1b78d9541596c2f
- SSDEEP 3072:Ft2nlia9qRBFZm4z1EYfcbJrphawfWJv03CKPCNVOXinYuM8R:gsVm4z6YgNphasCcFPCNVOXinYuM8R
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
8724a46a073a1f2395ca1d288d9e54364f286e69fba1b1606a17bb87c6bab2b3.exe
- SHA256 8724a46a073a1f2395ca1d288d9e54364f286e69fba1b1606a17bb87c6bab2b3
- MD5 cb8ae5e2795958bde1a3499a035c18c4
- SHA1 a1cd65d1b22632629da5df5d3c86fa01eddd12e6
- SHA512 783876272848ca9beac60020cc2e2155384e9dde1eb9c8989744823e211f92a654de8e0d0d8d1bb0ecf7bcc332aeb3745220b4f5ac62520adc77dd11fb0a93f7
- SSDEEP 12288:/i2KlHqrOPpKqeyLHKV7LtZRrcKZDf5SrzYJ2vp6pynfp:/ElKSPpbzKV7LtZRrpZDf5vJm6up
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\HFayo\obj\Release\HFayo.pdb
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
8863212f3ed09431d93e3ade911684bbb405ee60e260d7c7dc311494c7228346.z
- SHA256 8863212f3ed09431d93e3ade911684bbb405ee60e260d7c7dc311494c7228346
- MD5 2a954473a859eb56fca0acbadc501d3b
- SHA1 2fce46a812929bbf365003ff1730949d8333710f
- SHA512 4b6abc2a8a26a7835b9b273ba32e3ea9bf3d5b000cb4f0995f0f84641c03acc978fe7fe43d534a774aaa9229bc4b37148ce1f0c8a7f435b6776c766890ec3018
- SSDEEP 49152:kh5iUYFHokmfrP4d7evPfyjN7RyVHjLJ9/alMzC2JfJOvUKi5LYeS:IiUEokmfj4d7enfyPKHj19ylKfJRYUdU
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
89662007a7136d32afb4b5056e1ade62064bf2a46c84c423241dbd9e1a720412.elf
- SHA256 89662007a7136d32afb4b5056e1ade62064bf2a46c84c423241dbd9e1a720412
- MD5 035645668f2dc148b676d1ff512bf9bf
- SHA1 04f00cd6ab7f2b0b6e3633f8e4217a928cb316a3
- SHA512 ac73a5d93e157e5b8de66e198fc8d1d8e525930c64b79a261920feec330d5dba2aa73e4a8ebd1fae5388c5effba431bffd96d6cc099c69def324d7150b2e2eb4
- SSDEEP 1536:xaIOwvPA686vppjfwQZ0QSCZKX8ZrqWm9YlXzWzynkvfQw1V:xgw1vw80QS1XYm9uzW2nkvx1V
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
8b31383f256042caad7b8be1b0f5162af5e0e7743bd7dc6399c48cb9caa61465.elf
- SHA256 8b31383f256042caad7b8be1b0f5162af5e0e7743bd7dc6399c48cb9caa61465
- MD5 9b05828cb2ba0cc89254caa62dd93a8d
- SHA1 9bf3ab53e2c874c92e1754f14b21ab1d5d9803ff
- SHA512 52750599970ff0c34d1f906ffe62abaaaf7aa1138e219d33f00934f15c4adc527e83aefa7fbc4445f6542c1a7c386f1d09e792896426278b0cd8ee61dda610d2
- SSDEEP 3072:BB30rZbraNZHIwauV5I4CDvbzv2iaBhSPcUFoSM/RgaMV4wz:BBkFra7owauV5I4CDX4BhSPrSSM/RgaC
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
8be691d37a49147305a2eb476a9d9187acda20f48e3853fee0bf4049df14fcf9.elf
- SHA256 8be691d37a49147305a2eb476a9d9187acda20f48e3853fee0bf4049df14fcf9
- MD5 808e7e7decb1f65729a88462c65ebe2d
- SHA1 df0bb6ddd62db94e17901e17363b8d961639741f
- SHA512 a18b50c9e925e5777de5bf22989d6f1e4dd4c9314d2bcec6105937f3f3346aca31dc52901f1c4043d4e7a234ac1e37c7f2349ef02cb9e601bf82bc5058f9bc64
- SSDEEP 1536:7Jz4NaWs/hGh6dxpwvS20w/m90pxVN31+ivAtPGcuJP1sqMUyL4ciD:Z06dx2aC+9KVl1YtRMciD
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
8cbb73314a196e67b87761a0bb1f9ec65c5504577e59d7ade33cf061ed614733.elf
- SHA256 8cbb73314a196e67b87761a0bb1f9ec65c5504577e59d7ade33cf061ed614733
- MD5 a084ebae6d2c179b3e9513bb4560a8dc
- SHA1 990b207cf4d36e3a2f0c5a2406c596e7ad1f5a62
- SHA512 7aae232b1ba9b769fdd5db5575565e3e41894e6d13eea0b924511b070d82dd77c186e5aad5f450387632eb2b382be7ade412bac021fce840b7dbadf7b72e2448
- SSDEEP 3072:ZIV+/Az3yKDUS9JVpWwKpGfYsqdRrNXkeZG:ZIVekyq1VpRKp6ovRke
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
8dba2039fd6f20170d4f1046a5a9d3413c58a657ce34658f5681e07296263d95.elf
- SHA256 8dba2039fd6f20170d4f1046a5a9d3413c58a657ce34658f5681e07296263d95
- MD5 74ca17a962720262e4449302a1b295d7
- SHA1 90e9582e7bd4b5766899957a8cb5975124ebac7a
- SHA512 cd2bb89b171c83f4f2491c05411b85b1c854b941922e119880a8400fcacd1178a2035786049f1db51327d0c5e266c5c5773ac91e7f4749c0db0edb1a0f50ca24
- SSDEEP 3072:FDcYVLWKlAQTv+mYUbpl2m7/L7QsvmGugiNb:WYVxlAk9YUbH2m7/L7QsvmGugiNb
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c
- MD5 184ac479b3a878e9ac5535770ca34a2b
- SHA1 1f99039911cc2cfd1a62ce348429ddd0f4435a60
- SHA512 e0f5185ae890b902ea5325066df23959106712e7990e120a1b9752bbd0331cac968af5ddd6092f75a1c576d4c83f4093dfbf53a2c90870d1c02b31a0e8282bb4
- SSDEEP 1536:1qs+lqWWlbG6jejoigI/43Ywzi0Zb78ivombfexv0ujXyyed2HteulgS6pg:zCReY/+zi0ZbYe1g0ujyzdDg
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
RedLine payload
-
SectopRAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8ffa8c43fdc61c96e1a017be3eadff98e0f9d35f08ee9ecdd6da7bf2776d730a.elf
- SHA256 8ffa8c43fdc61c96e1a017be3eadff98e0f9d35f08ee9ecdd6da7bf2776d730a
- MD5 12fb7f29220d76dc1e60623b0db9f86e
- SHA1 5a16a5226a3c77b075eed1de584d4f3a52527d58
- SHA512 0571ab96e06922ab86a2de9bfd39db475d64f9fcfa4ee57a819cf06f4cd6a4d8e7ef2a7d6b2ae40346e71c613909df70928f9279a8007fd7f89f88f3d26faf84
- SSDEEP 3072:A2k6Kko6o+ngPmmVjeWntzWfEtv+G3fjKw5hoTuXXnf0OzTyoQQub:jdEsgPmmVjeWnnPjKw5hkuXXnf0OzTyv
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
9088a8c9590582ef92ac8b0c371d86fcf80fb37629d7d007585e8589fcb99be7.elf
- SHA256 9088a8c9590582ef92ac8b0c371d86fcf80fb37629d7d007585e8589fcb99be7
- MD5 0aa29bcffa4a4ef175a80369c91f21b5
- SHA1 22529d6a124898a9416d3a6fe2b9134703ec87c0
- SHA512 dbd849d8d32001e968d6c343f7d2273c11565376e880d2a60f9a51f9598237317bbd13e8a3d3f7d051125473f56607f1b2b85d85d7cd6bff5e6ac036081b6d5e
- SSDEEP 3072:aPaqjPQP39VjGWX98732V7kGyNVf5heTe7FXnf0OzTyoQQub:ahQP39VjGWXW9NVf5h+0FXnf0OzTyoQ7
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
91f974e26d0662021f8a33d76ae3ba59d530046ae6ddd9712b54bb411a163f41.elf
- SHA256 91f974e26d0662021f8a33d76ae3ba59d530046ae6ddd9712b54bb411a163f41
- MD5 2ae268125fd652dbfe54f1ec2c73cfe4
- SHA1 3639e518dcc1145704d4432e18d359d0aae8d9c2
- SHA512 5144d1d1f9f13309ba87f00a4ff1d40e23becf52090c2dcaab5bc47fc55f5cbeccafc4cb416547e6bce4c84d473518a03dd8f6c8d37d82667351c1bb0790a90b
- SSDEEP 3072:btTQn622oNI8zpUX5hLwtOCwLkY0Px9gQNfR:btc6Vs/UX5hLwtOLLkY0Px9gQNfR
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
92bb1f19f3a6337be028edfb89c898d49927cbb732f94796251c70d29e8ba9e1.exe
- IMPHASH b2c192dde66d798d732cf15b9e7a6998
- SHA256 92bb1f19f3a6337be028edfb89c898d49927cbb732f94796251c70d29e8ba9e1
- MD5 333cda533763d54739d8c51ea950b55f
- SHA1 79dd0936accb50b74068759ee87a9e4160a16148
- SHA512 690afa5e0aaef477d4c8954205a9d38a81f90b1a9c67f4b1e9a904b46b269fdf6d00befbb52389e2aed107e3bd3d98ccdaaa1f1bfc712937f098ded398a6336c
- SSDEEP 6144:XB63yzLaSnROAGvuPrxj4qiTPwvtQ7+kQdvRAc/W:xGy3aSnsAQuB41y9dv2c
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10796
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetSystemDefaultLangID
DebugActiveProcess
GetDateFormatW
CreateFileA
GetConsoleAliasesLengthW
GetNumaProcessorNode
HeapAlloc
InterlockedIncrement
HeapFree
CreateHardLinkA
ConnectNamedPipe
GetModuleHandleW
ReadConsoleOutputA
GlobalAlloc
GlobalFindAtomA
LoadLibraryW
GetLocaleInfoW
GetConsoleAliasExesLengthW
GetFileAttributesA
lstrcpynW
GetAtomNameW
LocalHandle
GetModuleFileNameW
FindNextVolumeMountPointW
SetConsoleTitleA
WritePrivateProfileStringW
GetThreadLocale
GetProcAddress
SetComputerNameA
SetCalendarInfoW
SetConsoleDisplayMode
WaitForMultipleObjects
SetSystemTime
SetConsoleTitleW
HeapSetInformation
VirtualProtect
GetCurrentDirectoryA
DeleteCriticalSection
FindAtomW
CreateFileW
ReadFile
FlushFileBuffers
EncodePointer
DecodePointer
ExitProcess
GetCommandLineW
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
IsProcessorFeaturePresent
WriteFile
GetStdHandle
HeapCreate
EnterCriticalSection
LeaveCriticalSection
Sleep
HeapSize
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
MultiByteToWideChar
HeapReAlloc
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
CloseHandle
user32
GetMonitorInfoW
LoadIconA
CopyRect
winhttp
WinHttpCloseHandle
WinHttpAddRequestHeaders
Name
.text
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
212KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=24, id=158, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=38, id=171, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=110, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
93baaaabfc573289b7cea910738e996f36b616b93a40a2ecfb84d14d1a2e5da2.elf
- SHA256 93baaaabfc573289b7cea910738e996f36b616b93a40a2ecfb84d14d1a2e5da2
- MD5 66617f9932e2e20f48493f12c80fceb7
- SHA1 278410f9e356ad62dc2d66c426d2b60545918923
- SHA512 22fa7850204dc9296eaba8312cebe36facc2cdb999590f0fca2cd8bbeb09cb049ec792e2439bd6b2fcc54e6a9bbab0f2199c4069705a315630228ca0855d2c91
- SSDEEP 3072:1LNqrhHZ0P6bRFBQivfRjHkLwmrThPaLEne7rNb:1Lsrr0PeRTJBgLwmrThPaLEne7rNb
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d.zip
- SHA256 94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d
- MD5 55c5f95a5ce1154c61d38b3eda83ad19
- SHA1 9dc914ef0a0dc1bc43169cf87c6b23ddb60ec966
- SHA512 f6be0297bcfecc03b1309a984d45839c0e5ada10e75c707dbef16da777a3adb8bd42b12639ce7cde9d9ccb352f871b4b7623da2738c1c2852bac4fcc2e34702b
- SSDEEP 6144:taKYsu0ULNbubfC0/2wYiY1+E+Wi73Cx8x0Sn+QOJ2FUJ1EqO3d12opWKoAte:oKY5VLNbV0+iY1l76SH8+XYFEEVNjpWx
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
956f3fe2d9989f0269cd72c70c00468a6f6dea368871a9745ba3836ec3a162c9.exe
- IMPHASH 1ef0d6e4c3554a91026b47d9a27bf6db
- SHA256 956f3fe2d9989f0269cd72c70c00468a6f6dea368871a9745ba3836ec3a162c9
- MD5 3b05873b63e0486cf79b3a96250a6301
- SHA1 8c59b569af0a7ed656769d5eef333612a4cb985f
- SHA512 57c9243dce876cd4900fd33b3168e6648b481fc916e45b471f8ee574dbc397b04abdda7b93b1b99c62d2e7076f831fe2a62c3e32e3a13669f2bcdbd86a5416d4
- SSDEEP 3072:/PhSlG8SHgpJSG61doHN4NgQaUukOkzybZE0fwpur0MV0:/PqZryZoIg5vkOkOdE0fmuK
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
79536
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
strncpy
malloc
??_V@YAXPAX@Z
memchr
??_U@YAPAXI@Z
strtok_s
strcpy_s
vsprintf_s
memmove
memcpy
strlen
memset
memcmp
__CxxFrameHandler3
kernel32
GetCurrentThreadId
LocalAlloc
VirtualQueryEx
OpenProcess
ReadProcessMemory
GetLastError
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
TlsGetValue
TlsSetValue
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
ExitProcess
Sleep
WriteFile
GetStdHandle
GetModuleFileNameW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
HeapAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
RaiseException
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
urukd
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=24, id=171, productName=VS2010 build 30319, version=30319,
count=13, id=158, productName=VS2010 build 30319, version=30319,
count=59, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=31104,
count=84, id=1, productName=Unmarked objects,
count=15, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0
- MD5 1df7042de91ebbe0fdc6dce717df04a5
- SHA1 a4bc62ba308105e53a0d438cf8b90337434b8853
- SHA512 b71e5e653bd05283a6ceaacc477ee905138b9af9f2beb48e04ccb9eea72f26c44bb9f338c891ca2e5fb9b44e19b8a06e2050235cfe2d17a9bdf145fa8a73484b
- SSDEEP 12288:rqimbc9qvl/LOVMPFLT3Mf++Ly798NEyfNo8lfGk:rANvl/aMPJ5iy7mNi8f
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
840446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
813KB
Virtual Size
812KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
9cddfa73a9c86cc4d92b6edac2dec8e66ffa5b809fd6e8da6a97d38da5ea4079.elf
- SHA256 9cddfa73a9c86cc4d92b6edac2dec8e66ffa5b809fd6e8da6a97d38da5ea4079
- MD5 f51a15df86abbdcf8fd4768f1ef44e27
- SHA1 42fe8b12a04ce76ec0bdd6f2b82a96d37ce2778d
- SHA512 76bc1ee0e4d4e45c195b908fca5a38b4735cbed6be2df429a4668f0e337b874abc34ba5366e483fee945e9c65af99fd91257a01046addf3d4d68bcd7188090f9
- SSDEEP 384:UqBOyNdyWDZc/PeVQgbToruFIKzeBomvV/nJ2o+qCLG66pP5cnhymdGUop5h7L:R/5Zc/47ToruFIQeBomd/nJ2kCf6r6sX
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
9e2cff011b63ac85dc3b815db92ebbbc3f09bf237950bdff092a825c71d9fd89.exe
- IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
- SHA256 9e2cff011b63ac85dc3b815db92ebbbc3f09bf237950bdff092a825c71d9fd89
- MD5 7db4f0b656648bc9bc2e5c3a1c90e49f
- SHA1 9edbcc3647f905f7effcb6271969ca0f0e0c02ae
- SHA512 f14e6dc056b6808bc1ed92da0dfefc38400fa4a1819d64dff03c29bae1aa8aaec7faf3dc2c54cfaacb027b9c28c076cdd5ff90cd076c29e7016b4b1ec2986328
- SSDEEP 6144:1DKW1Lgbdl0TBBvjc/cIJ3chiXF7jS0P1yM3qAwMF2b5h:Nh1Lk70TnvjckIJ3c47jMMufb5h
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
Digest
38:d2:ad:7c:b0:1a:8a:14:b3:af:8f:0e:63:65:46:b8:ab:77:44:17:11:bf:b8:49:38:93:6a:94:5e:bb:e1:b8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=AAAA CLEANING REMOVALS LIMITED,O=AAAA CLEANING REMOVALS LIMITED,ST=Kent,C=GB
Chains
Apr 19, 2024
CN=AAAA CLEANING REMOVALS LIMITED,O=AAAA CLEANING REMOVALS LIMITED,ST=Kent,C=GB
CN=Certera Code Signing CA,O=Certera,C=US
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAAA CLEANING REMOVALS LIMITED,O=AAAA CLEANING REMOVALS LIMITED,ST=Kent,C=GB
CN=Certera Code Signing CA,O=Certera,C=US
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=AAAA CLEANING REMOVALS LIMITED,O=AAAA CLEANING REMOVALS LIMITED,ST=Kent,C=GB
Serial Number
e0:42:cf:38:a9:cf:02:4a:38:f0:8e:81:65:59:09:85
Issuer
CN=Certera Code Signing CA,O=Certera,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 8, 2023 - May 7, 2024
Subject
CN=Certera Code Signing CA,O=Certera,C=US
Serial Number
21:66:f0:8a:51:eb:fc:ab:cc:8f:44:30:91:a9:4b:0e
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 7, 2022 - Sep 6, 2032
Minor OS version
0
Major OS version
5
Entry point
52527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
ole32
OleInitialize
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
356KB
Virtual Size
355KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
9f2a79f96c8381d4b8615034448960ca30b78739d78cf6396130cbfe813b850e.r00
- SHA256 9f2a79f96c8381d4b8615034448960ca30b78739d78cf6396130cbfe813b850e
- MD5 1381417eb380772e91ebd893c2d48cc0
- SHA1 fb3a8a59055d55f49d65ce0015ebf86fc9ec907f
- SHA512 efc2edfba5e0d5f201500cc3ee8bc90801c5cd8ba4ac9b7579f60be1a8a2894210a6e8e777d1d7df8676c11e6ba1cd7e5c2e03e86a4a1bc476be07d0eb927058
- SSDEEP 384:opMECx+NYz7PjKukIAqq0iFyxTwfDOkPTzPFJbSF+/fdDbMXgMmui:obCxQu1ASYowfjTzPTbn/NbSg/ui
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
a1de866d5f75b3f31becb07f4660e2a3cc29d242888be38fadb5a54657156745.zip
- SHA256 a1de866d5f75b3f31becb07f4660e2a3cc29d242888be38fadb5a54657156745
- MD5 9f4e25cdd7cf65b7714204ca91162e0f
- SHA1 6b824048947cbb6c99ab24fd62cd0eb603f30fd8
- SHA512 d07a6d10cbc9264a0623d31a478c2ef30e77ae13e3d021504e4e46d2a807a829a0e2d848447f5f4dab25a68c836c0c1c1cfc21365bbdc7b05167961e99bdaa6e
- SSDEEP 49152:P826LuO1F0uqpLVmMGyYQ3CwnJUiBqW0ucmDmzZzdGGYQTOzfUNYqK0cg9cDo:PbUP1DsV/GyCQxpmzZzBfTs0t9d
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
a216c05b201d5586208af929795cb944aa883aa8db9ba9c1b40df1a11ee3f8a1.elf
- SHA256 a216c05b201d5586208af929795cb944aa883aa8db9ba9c1b40df1a11ee3f8a1
- MD5 cb6d04beddae662745e81aa5ecced571
- SHA1 0ba0614065a401c2282066e96a4c2ebef66e1134
- SHA512 0c547986db1ff71821a4dc99a7ee4501cc826ec47666fec23be1d55e9918c8d562285c413813f1f32c930fed9fdf42fd2ef5bb804845c917a6880b2c439ce02b
- SSDEEP 768:YYIiyWMqFTKlQNV5qws9AO9fYBxDBs3UozY:YFiyWMqFTKlQ4v6OqdszY
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
a500adc3648a600aa908706447807d99183e2d2ae24390d6f99d5a7a9873b405.elf
- SHA256 a500adc3648a600aa908706447807d99183e2d2ae24390d6f99d5a7a9873b405
- MD5 77dca408be29e7a7a0e44191245d5745
- SHA1 5b768e1ec0168051d4f7a1c0143cab779e51ccca
- SHA512 d27dddd966d5b21fe69187b8c8559fa905b3dc7bb1e573056d5db8e3c75c5e9a0ea1892234f94486d34fa8370f27f383dcfaef5fe18ad25d1735f8e04034470b
- SSDEEP 1536:3pCcVaNLyFXyubEFXhCiyNZAU4Hc2c6vc+NauCp:Z4oM1+u9vc+xCp
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
a508368a916bcc275163c40126bfdcaa26d5dc3294257356f16799a79ed7eebf.elf
- SHA256 a508368a916bcc275163c40126bfdcaa26d5dc3294257356f16799a79ed7eebf
- MD5 535e42bda70b4c58e32e5f244ee715f1
- SHA1 70150ad2d0028bf5fbac7781aa18665102b6070e
- SHA512 1d907628b4333ca1e653fc7e73e6ecbb5cb2307bb060169b4fcee62e9e6d5c171101e93d3afeea9deafd3bea1820c3b3d1c78317d7e0acb49b415c4a5b2e62cf
- SSDEEP 3072:uirMUYZMo/QJLRZDsqtxqLX5I/uJioud2yd1m7FnVqfJXoebNb:SKo/O8qtUbKXbm7FnVqfJXoebNb
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
a5d8c237485f07aae4b3e174009cd4d2f848a1bd3c98be4f33cd77f6c24572d4.exe
- IMPHASH fb0a8b4a81655f744a37af985e009476
- SHA256 a5d8c237485f07aae4b3e174009cd4d2f848a1bd3c98be4f33cd77f6c24572d4
- MD5 be7a3b4521ce129d9a677940b0a51638
- SHA1 2e71e2c8d35327eb704d9660afe4cb9db595521e
- SHA512 02882430d0adf7adee9e3c30c95cf20a7a9753bad8131826b5788f67bf5624db9f0a492b4803be7674bb4b0e752c740f72824e3fb9d58fcbd14a3a0833f245fa
- SSDEEP 49152:EX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeK5g:ElRsZ47/QXoHUOfAoj1n6
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1940876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\MeshAgent\MeshAgent\Release\MeshService64.pdb
comctl32
InitCommonControlsEx
dbghelp
SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump
iphlpapi
GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo
ws2_32
WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select
crypt32
CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore
gdiplus
GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup
ncrypt
NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey
kernel32
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer
user32
EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect
gdi32
SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject
advapi32
CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus
shell32
ShellExecuteExW
ole32
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
981KB
Virtual Size
981KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=176, id=243, version=40116,
count=38, id=242, version=40116,
count=1, id=199, version=41118,
count=10, id=259, version=24123,
count=33, id=261, version=24123,
count=25, id=260, version=24123,
count=496, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=209, version=65501,
count=1, id=208, version=65501,
count=29, id=203, version=65501,
count=398, id=1, productName=Unmarked objects,
count=53, id=264, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
a650788cbf36edbdae7bb666d8518c9766d22fa009a288de6127fd67a03d3687.exe
- SHA256 a650788cbf36edbdae7bb666d8518c9766d22fa009a288de6127fd67a03d3687
- MD5 075c4e346b276744d6ebb749ddbb3871
- SHA1 4932b87a5f667808e24b10cb39cea0dfab3d691f
- SHA512 54ac68dfbbc9dce9dff620772b713d4ed3ec085a3b9f1ec5be35d60173b10eb53079b69310f99905faffdc9a12ec00a5dd02e7d5b6df84e71fec9375522351a6
- SSDEEP 1536:A3qRLK2Q0hUEUUeUz4QooMP6/VWlTDdAU:RLPT2U/z59QTDdA
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
39512
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
CODE
Size
36KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be.elf
- SHA256 a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be
- MD5 4808a808fec25b07e9e28b0238e0ba4a
- SHA1 d3c97161ae9ed8f0d926439a3ae42d48f962d726
- SHA512 61e9613881baa8667f0c7ea7858944b629af24c021ba9b15a22a1b1290cb57b71d59ee4aa14bfea1263989e57f8d4668cfad368350c686b4d1783c973c33eab6
- SSDEEP 768:PailI++SHdh9D+NWkWej0/RJkCWk9uqmVwv5sfDWy:Jl+SH9D+NW3e0wk9uqmVwhsX
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
a7ab5280efdd1f09f7c15daafa507b5a889e30cb9bfa0060ae5cf29a64c9d410.exe
- IMPHASH 4f67aeda01a0484282e8c59006b0b352
- SHA256 a7ab5280efdd1f09f7c15daafa507b5a889e30cb9bfa0060ae5cf29a64c9d410
- MD5 0613b5c6e1cbce2a95749aad0f66d0a5
- SHA1 7efd22ff2aeed3bbe316bf99126b6934da672128
- SHA512 e00bd747a765de4f07b162b85f3a9d0f054155fd48dc6fa08658d8e3a7b45403664943958a3dc3b4bcf67a2c59f2f6fddc94245a5c97d164099379dfdc73307d
- SSDEEP 12288:Hpwiapd/PNMdUhTvaqOyXudHs+feJOgxQN08QbXyTTFakU5zxmRgZYqMC:HauFPfeQdQbX4FytdZnMC
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
NSIS installer
PE Signature issue
Digest
de:a5:62:0b:8b:a7:22:d8:49:0f:f8:69:97:e2:54:8f:b6:6d:72:52:0f:f2:bc:b5:5c:b8:9e:fb:76:a7:7f:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Vinduesbjlken,OU=Giantlikeness Altsaxofonernes Klevogn\ ,O=Vinduesbjlken,L=Grainhow,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c104d75747465724048756d7068732e5375
Chains
Apr 19, 2024
Subject
CN=Vinduesbjlken,OU=Giantlikeness Altsaxofonernes Klevogn\ ,O=Vinduesbjlken,L=Grainhow,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c104d75747465724048756d7068732e5375
Serial Number
4a:19:13:40:8a:c0:b8:c5:53:2e:91:3d:94:3e:36:a6:e5:97:5c:b4
Issuer
CN=Vinduesbjlken,OU=Giantlikeness Altsaxofonernes Klevogn\ ,O=Vinduesbjlken,L=Grainhow,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c104d75747465724048756d7068732e5375
Timespan
Apr 30, 2023 - Apr 29, 2026
Minor OS version
0
Major OS version
4
Entry point
12843
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CopyFileA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetFileAttributesA
SetFileAttributesA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
GetCurrentProcess
GetFullPathNameA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
lstrcpynA
SetErrorMode
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
267KB
Virtual Size
266KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
a8c8ccccf9766d3bcd5dd78d4ae5a64aec55f961b8f3cf2bef74b4aef48422a3.exe
- IMPHASH cb23e26cc45ed9aa58fdce155e7da31a
- SHA256 a8c8ccccf9766d3bcd5dd78d4ae5a64aec55f961b8f3cf2bef74b4aef48422a3
- MD5 1c8ae597adb4233cd8b3b88c7aafb419
- SHA1 41af3c8631ccd2000b07d44be346f5ee41820017
- SHA512 85ef0fcda80335ab98c71393f144f75c9b7e45d9fc7e019945a62d74c559c0436ad9f8eb3a27a589f951b9ab2d1170c727fba7f5e6e3e20076b28fc7b8851026
- SSDEEP 98304:F4ixv63obnoZnmdHEGWX5kGS7+PkHyEzoG+CH:bvXUskG+PSyPbTG+CH
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
67759
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb
comctl32
InitCommonControlsEx
shlwapi
SHAutoComplete
kernel32
GetFileAttributesW
SetFileAttributesW
MoveFileW
DeleteFileW
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetFullPathNameW
GetModuleFileNameW
FindResourceW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetLocaleInfoW
GetNumberFormatW
ExpandEnvironmentStringsW
WaitForSingleObject
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
GetTempPathW
MoveFileExW
Sleep
UnmapViewOfFile
MapViewOfFile
GetCommandLineW
CreateFileMappingW
GetTickCount
SetEnvironmentVariableW
OpenFileMappingW
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
IsDBCSLeadByte
GetCPInfo
GlobalAlloc
SetCurrentDirectoryW
WriteConsoleW
GetConsoleOutputCP
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
GetStartupInfoA
GetCommandLineA
SetFileTime
ReadFile
GetFileType
SetEndOfFile
SetFilePointer
GetStdHandle
FlushFileBuffers
WriteFile
CloseHandle
CreateFileW
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetLastError
GetLastError
GetCurrentDirectoryW
CreateFileA
WriteConsoleA
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
RaiseException
RtlUnwind
HeapFree
user32
EnableWindow
GetDlgItem
MessageBoxW
ShowWindow
FindWindowExW
GetParent
MapWindowPoints
CreateWindowExW
UpdateWindow
LoadCursorW
RegisterClassExW
DefWindowProcW
DestroyWindow
CopyRect
CharUpperW
CharToOemA
OemToCharA
OemToCharBuffA
LoadIconW
LoadBitmapW
PostMessageW
GetSysColor
SetForegroundWindow
WaitForInputIdle
IsWindowVisible
DialogBoxParamW
DestroyIcon
SetFocus
GetClassNameW
SendDlgItemMessageW
EndDialog
GetDlgItemTextW
SetDlgItemTextW
wvsprintfW
SendMessageW
GetDC
ReleaseDC
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW
GetWindowRect
GetClientRect
SetWindowPos
GetWindowTextW
SetWindowTextW
GetSystemMetrics
GetWindow
GetWindowLongW
SetWindowLongW
IsWindow
gdi32
GetDeviceCaps
CreateCompatibleDC
GetObjectW
CreateCompatibleBitmap
SelectObject
StretchBlt
DeleteDC
DeleteObject
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
shell32
SHBrowseForFolderW
SHGetMalloc
SHChangeNotify
SHFileOperationW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
ole32
CLSIDFromString
CoCreateInstance
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
oleaut32
VariantInit
Name
.text
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
301KB
Virtual Size
301KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=25, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=126, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=218, id=1, productName=Unmarked objects,
count=86, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
a8cc7d8092e02077f21bf65badf8871748630912e3738a2410ff5cd18ead2fbb.exe
- IMPHASH 48be7b2ca3a92d9dbc1412b42d7e5dac
- SHA256 a8cc7d8092e02077f21bf65badf8871748630912e3738a2410ff5cd18ead2fbb
- MD5 324b6dc1d74d0fa83010c59562203b31
- SHA1 21715af633e6f90984af3a8b6fd58bd86758840d
- SHA512 5ecb30f6f3312463b5d32ea5a8aa1f9426c265cc85616651ffcc22cdcd54eac66a97928f33a4602f191f9a03d294ce9f6289311d95bccccb5aeb7aafe9fb798c
- SSDEEP 24576:pO6BRvYoN8jxoLvP+1eCIKB5Axv+iZ7D:HmjwvPEeqiv+47
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14579
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\xepu_gapodolagaxode loyi-lomayam19 goyudatef\b.pdb
kernel32
GetConsoleAliasExesLengthA
FindResourceW
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GlobalFindAtomA
LoadLibraryW
TerminateThread
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
CopyFileW
GetFileAttributesA
FileTimeToSystemTime
GetModuleFileNameW
GetEnvironmentVariableA
GetTempPathW
GetLocaleInfoA
GetCurrentDirectoryW
ChangeTimerQueueTimer
SetLastError
GetProcAddress
LoadLibraryA
WriteConsoleA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
VirtualLock
VirtualProtect
GetWindowsDirectoryW
GlobalAddAtomW
FindNextVolumeA
GetVolumeInformationW
WriteConsoleW
GetStringTypeW
OutputDebugStringW
RemoveVectoredExceptionHandler
SetThreadContext
GetLastError
GetNumaNodeProcessorMask
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetConsoleMode
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
CreateFileW
user32
CharUpperBuffA
DrawCaption
gdi32
SetTextColor
advapi32
RegisterEventSourceW
ole32
CoGetPSClsid
winhttp
WinHttpSetDefaultProxyConfiguration
msimg32
AlphaBlend
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
708KB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
a9dbdd95ebd8c9e6fb7de29c21103ddba18a62f2393bfa7ba365a491e37b342a.elf
- SHA256 a9dbdd95ebd8c9e6fb7de29c21103ddba18a62f2393bfa7ba365a491e37b342a
- MD5 c161f9d73ca2e53a130680b762579df5
- SHA1 ff2830f335be7d73692dff80072c46d9a244576b
- SHA512 4b2ccdeb1b2e4235c175f4ef1a4054fd2c3449b03fdaa55c85fa92b2efefd68eb37b7c64222d3a43aefbbcefabf6ba487898b2a6931c67df1e2caf1462040269
- SSDEEP 3072:Z41HOuaGVV3NfHUOjqyldqCw3jkmhxQwoVZUNu:Ze3aGVVdqyldq1jkmhxQwoVZUNu
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
aa07d206f75fd176b841511b90306f657b279c2eff54ebbea5a7277f140f27dc.elf
- SHA256 aa07d206f75fd176b841511b90306f657b279c2eff54ebbea5a7277f140f27dc
- MD5 ab683ced68e5aec36ada77d0fc3cef99
- SHA1 ca3588afdeb09e97d429de8c6e3cdeb6c46a4860
- SHA512 72e231d5bf5b7535cb2b5b1a7b5aee3452fbf42d162a138777d3c4a104f0686651cc480e7eaec4d08a6780e2881641192302d5d00b5d7edafb9112ee553ef399
- SSDEEP 1536:tIV+wf5tCDJAi9u/Pt0lpgpDIg2aAaeLM3juwZubDoRHZEA9xT3UHD+uCUHtOnx:tIV+wfXCOvnt0l1A3ywrj9aH6wtOnxA
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
aaef77108648df18c61d1da23ec384fa62fe17e559da38ec128911437cdf939c.elf
- SHA256 aaef77108648df18c61d1da23ec384fa62fe17e559da38ec128911437cdf939c
- MD5 a675bf956f3ba50bdff631d2e2bd9b62
- SHA1 6117bdb7d0c394451d3f74775670c04c7ea9aeea
- SHA512 25216854b44c8711a514460662f35fbf7d3be9d424ba2e0cfd0ded492bc89662792beb85ee4f6cf9d401d5cce92b47c41ac6772281e5b674505f2f373c4ba5fb
- SSDEEP 3072:AvtLZpuGPyaT/05hKWEfSaWURxuZq+1uPNd5R:cQOR05hKWLURxuZq+1uPNd5R
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
ad22ea87eec108a68d36e8a75877fe97814b84acd0b2f77a4c8593bcb953bc9f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ad22ea87eec108a68d36e8a75877fe97814b84acd0b2f77a4c8593bcb953bc9f
- MD5 7664dd88b5199ea04c62e255227fe660
- SHA1 aae161f2758dba896c3f5f7932b9d7af405e4b9a
- SHA512 234145ad2bf7ad8d2db82a58443e7b5c5eb5d63c335f9963623db6970b6d997c47e731dd0727208bfa048f5dba94098d5eb7cb55536dc61929202ec7947d8c57
- SSDEEP 6144:/tb4VOJrzhN3f/1HQG25et4Ll3goGHQ3+/0Tz29uQ:uVOJnhNWG25eGuHPCQ
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
1c:4f:57:40:55:de:68:dd:24:8e:4e:f6:0a:d1:d9:0a:74:16:ec:ee:4e:07:7d:ca:89:74:fa:9b:c7:c2:12:82
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
1c:4f:57:40:55:de:68:dd:24:8e:4e:f6:0a:d1:d9:0a:74:16:ec:ee:4e:07:7d:ca:89:74:fa:9b:c7:c2:12:82
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Feb 7, 2024
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 18, 2022 - Oct 15, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 14, 2023 - Sep 4, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
4
Entry point
314190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\p4lwtx7abv6\obj\Release\Laptop.pdb
mscoree
_CorExeMain
Name
.text
Size
299KB
Virtual Size
298KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ad8a91a51631f9084a5d6e95b621530de757b15aa2ae5efef2ca89cae6c4e8d6.exe
- IMPHASH 8205aeb5586ce5705b2ca0428f26ebd4
- SHA256 ad8a91a51631f9084a5d6e95b621530de757b15aa2ae5efef2ca89cae6c4e8d6
- MD5 97b001bb0b74ca4d972a72a9e3a33001
- SHA1 4a1af8ee2e1c90345741487305b01dbfb2dcf025
- SHA512 73c1e9aeae93278ec71dc69c1c1692a65f04adc574f5852a06efd8ba8905dcf2464a256e6b26ca6bb89db62bce1f2a98aa30cd4b752b7a2d52386492d11133a4
- SSDEEP 1536:WaGLr8g9PeBlyjcvvB+MoooooooVrvXom:W7LV9P2lnvvBmvXom
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70397
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Adam\source\repos\ChaiLdr\ChaiLdr\x64\Debug\ChaiLdr.pdb
kernel32
CreateFileW
ReadFile
WriteFile
GetTempPathW
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
SetCriticalSectionSpinCount
MultiByteToWideChar
ConvertDefaultLocale
SleepEx
GetCurrentProcess
GetThreadId
lstrlenA
lstrlenW
FreeLibrary
VirtualQuery
GetModuleHandleW
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WideCharToMultiByte
RaiseException
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThreadId
GetProcAddress
user32
RegisterClassW
IsWindowVisible
GetWindowContextHelpId
MessageBoxA
GetWindowLongPtrW
IsDialogMessageW
wsprintfW
vcruntime140d
memcpy
memset
__C_specific_handler
__C_specific_handler_noexcept
__vcrt_LoadLibraryExW
__std_type_info_destroy_list
__current_exception
__current_exception_context
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
memcmp
ucrtbased
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
strcpy_s
_exit
__stdio_common_vsprintf_s
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_wmakepath_s
_wsplitpath_s
wcscpy_s
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_CrtDbgReportW
_CrtDbgReport
_time32
__stdio_common_vfprintf
__acrt_iob_func
realloc
malloc
toupper
rand
srand
strcat_s
__setusermatherr
Name
.textbss
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33030,
count=1, id=253, version=33030,
count=24, id=261, version=33030,
count=11, id=260, version=33030,
count=3, id=259, version=33030,
count=7, id=257, version=30795,
count=97, id=1, productName=Unmarked objects,
count=8, id=260, version=33133,
count=1, id=259, version=33133,
count=1, id=255, version=33133,
count=1, id=258, version=33133,
af6208c1ff499c7748dd133582093281a7084e6828178dbaaea88b55a9a833a8.exe
- IMPHASH 6c17cd221979c51b4b1f1bc0b7dc863e
- SHA256 af6208c1ff499c7748dd133582093281a7084e6828178dbaaea88b55a9a833a8
- MD5 a8e619baa8ddf50ac6998e0fe8188e92
- SHA1 2889c4a773df1615f6b5c797738d2c652afcd02f
- SHA512 6707203d1e5e6a684682ff93589da29e255358ab2c07dfb1ed5ee658987c960eee56c7d7d0c5bf27ee98411e7bb52431699c3443fba2232d02bb40ac5dc75058
- SSDEEP 12288:YVMdl6AOdZkdcOcPxsiozYvPKsvnSroNjNBXt0dumDCQm7lyI4aM2Hn/jH5M:YI6HMdfcpsiPPNvnHMdDCoI4a3D5M
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14675
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\yeremaxa59\regugonop-hope.pdb
kernel32
SetThreadContext
GetConsoleAliasesLengthW
GetLocaleInfoA
GlobalAddAtomA
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GetVolumeInformationA
GlobalFindAtomA
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
FindNextVolumeW
WriteConsoleW
FileTimeToSystemTime
FindResourceA
GetTempPathW
GetLastError
ChangeTimerQueueTimer
SetLastError
GetProcAddress
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
RemoveDirectoryW
VirtualLock
GetModuleFileNameA
GetCurrentDirectoryA
GetWindowsDirectoryW
GetStringTypeW
OutputDebugStringW
FlushFileBuffers
CreateFileA
GetNumaNodeProcessorMask
ExitThread
GetEnvironmentVariableW
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
GetConsoleMode
SetFilePointerEx
SetStdHandle
CreateFileW
user32
CharUpperBuffA
DrawCaption
gdi32
SetTextColor
advapi32
ReadEventLogW
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
708KB
Virtual Size
41.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
b1ceed4ed790fc9665b04298d7d6bff248aa890a86bae52d350da3d88c6c862a.elf
- SHA256 b1ceed4ed790fc9665b04298d7d6bff248aa890a86bae52d350da3d88c6c862a
- MD5 1ce3654574b36c39d660cc63f57e4989
- SHA1 725d9f5644f4cbda5a64378a4895f0a49b464ddb
- SHA512 3695f36e2501ffe480a28bd39d3d48dc3a3b794d535cff591b54fb275018405f1f09ef4f7fe6061c27e0c8b49c99d63cfc4db3821695d0121d1c94d3332ecdf0
- SSDEEP 3072:04UCrBz/x6cTpTMEy+ifG/nBNgVHjbivLvND6y5esKHH:CCrPyHfyBNPLvky5MHH
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
b1ffedb752d53a9bac21cb82ba09c524fc4831670b3e9cbbe3ad375c9b153083.exe
- IMPHASH fb0a8b4a81655f744a37af985e009476
- SHA256 b1ffedb752d53a9bac21cb82ba09c524fc4831670b3e9cbbe3ad375c9b153083
- MD5 b354650fa39cbc6e3da06edebade8dc9
- SHA1 25f5d29a6ea3510f766ee9f08e34739c404ce326
- SHA512 7f451774932a5e336eb5c06fc84a9862ff8914c11c9350b15c252c4fb46c889edaef86156b2d650831262cd1a19ce1be45ad7a5c263754000cfe1f6f636c73bf
- SSDEEP 49152:EX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeK5Q:ElRsZ47/QXoHUOfAoj1n2
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1940876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\MeshAgent\MeshAgent\Release\MeshService64.pdb
comctl32
InitCommonControlsEx
dbghelp
SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump
iphlpapi
GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo
ws2_32
WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select
crypt32
CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore
gdiplus
GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup
ncrypt
NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey
kernel32
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer
user32
EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect
gdi32
SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject
advapi32
CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus
shell32
ShellExecuteExW
ole32
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
981KB
Virtual Size
981KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=176, id=243, version=40116,
count=38, id=242, version=40116,
count=1, id=199, version=41118,
count=10, id=259, version=24123,
count=33, id=261, version=24123,
count=25, id=260, version=24123,
count=496, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=209, version=65501,
count=1, id=208, version=65501,
count=29, id=203, version=65501,
count=398, id=1, productName=Unmarked objects,
count=53, id=264, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
b2997d1d5b68e317c0fd8b0cd2915e5ff242bf31b39d825e8296eee36d070578.elf
- SHA256 b2997d1d5b68e317c0fd8b0cd2915e5ff242bf31b39d825e8296eee36d070578
- MD5 d01871b9dadaac5553e0bda15fa4acb7
- SHA1 0127482f1155bdaca6dcf0498d6ccf53eed67d8f
- SHA512 af5725526efc784284c5b5c5a5ea992f147d77d8a5d3bc9bb404d4c9149533ce1880fba71b2670b93e53c3184c4cf05af5c640e723b2c647b5933d926bfb4832
- SSDEEP 1536:Da60wP/HOD9ZeT5aDc+CD0K/nHflnMgEsNqmKW/FRDIhbeyzM:D/P/oAic+K7/VMgJjKWNRDaeQM
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
b582fac0b16e16390868882590ac8d81dc00ecd845bffa59a478baa11573617c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b582fac0b16e16390868882590ac8d81dc00ecd845bffa59a478baa11573617c
- MD5 7fb7ac175a0a249e320a5a296f4c2cd6
- SHA1 8bdafce0468d3dc91f1b4000b2f289254ab1c0a4
- SHA512 456fa03a75c07f6152d332ce652cd076bb35544674f385860e99143c8f5c05bcc6c3de3abccb2fdc900fc22017e14cb7498efa6cdf46a61839d85aad4b3e7395
- SSDEEP 12288:tXDZJb2c3l3MZ10ZVS3nwn3wzvqu5/WORM0a5WUkR:tXDGc3l3K0S30wziWWORMsT
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
9a:14:f4:09:6d:48:44:de:f3:58:c4:bc:5f:93:ec:36:56:0a:4d:53:06:be:c9:85:27:4a:78:ff:db:72:20:8e
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
Chains
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
16:d2:12:80:d4:8c:1a:50:b3:cb:b5:10:06:d7:96:d3:d1:cf:93:5e
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
Chains
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 19, 2010 - Jan 18, 2038
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
Serial Number
7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2018 - Nov 8, 2021
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 19, 2010 - Jan 18, 2038
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
Serial Number
7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2018 - Nov 8, 2021
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
4
Entry point
474490
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
QDHP.pdb
mscoree
_CorExeMain
Name
.text
Size
455KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
b8c409f2545de5b25184b21e745ec3c1b44efc2c5707c8766494f43f91856611.elf
- SHA256 b8c409f2545de5b25184b21e745ec3c1b44efc2c5707c8766494f43f91856611
- MD5 8434c6b88c9bf47b0fa1d31ac68f2b61
- SHA1 f7063ad5fe0a2d6c785b5d8e17e077b301234502
- SHA512 6569546b660b13bee3c88803d1c079eba5e8d48c5c9620db79084103ba3fce8f6186912b37e484eec64c6c4ca2ae93f337cd7b60c339e84426cfc2e4ccb3211c
- SSDEEP 768:oYIsi3N3p4CXfOayHtpFWeEteIRHrmI9q3UELEJ9:oYQlrvFteIRaLc9
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
b8dcce8209230d9c12ab47d501d02ef73b5374529fda3d798f0adcd8346024af.elf
- SHA256 b8dcce8209230d9c12ab47d501d02ef73b5374529fda3d798f0adcd8346024af
- MD5 60876a0667cbe60f9ea7d32a95ed0b59
- SHA1 a22c377222acd32a68ba113d69ea18180cd99e47
- SHA512 fa85c53582aa193df1f76313f6a0b0d4a2e02b1d68741377ce8ba497ff0647b6936830745d2a48099b1d7163f81ba0067a687b88a21e9bccb7e00d722e293a0c
- SSDEEP 1536:reIIcq87ZO8VQzlHaurUAaXlFFAeSz4VAZJsTgVUs/Br22/I/dLl2zUwywmFfbBz:aIIifMrUBVFFM4UiMVUs/Hg/GxyvQQ
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
b92ce8d8be97c7ba25eb090403e6cb0e3b1ebc9e899517acaefcbcb0e6a7a643.elf
- SHA256 b92ce8d8be97c7ba25eb090403e6cb0e3b1ebc9e899517acaefcbcb0e6a7a643
- MD5 f4be45e7b2a0eab112700e156a6278de
- SHA1 e511c0e00cbc89415eb00f44e4a009f0c87540f4
- SHA512 6c6d5e76179cf241fd89d429c9ff995d744b34c6ba3d1e3594fccfcbae421361371929bf4858f9f4de227f7b188a7cde35028cfc755604412be296b148b48856
- SSDEEP 768:0rWQdJv3oXU6qsvXGsJarvKSreSHZIeEcKwfnnZj1Ws3Uoz0e:6d1oXUzsvbaLKSfHZIeEcKwLzJ
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
b949c9d92b95837703f915abaa930856264c64e723d8a6b6dd93434c03562b09.exe
- IMPHASH b5a014d7eeb4c2042897567e1288a095
- SHA256 b949c9d92b95837703f915abaa930856264c64e723d8a6b6dd93434c03562b09
- MD5 2af7aa16a31860ccecf5cbdb13ee3362
- SHA1 610203c76717905de6fb6a85aa00a4d6aa12c2db
- SHA512 04f69be9e3855588048ecc4ec1ce663a34dc6cbf3568ddf876c51c1b370957230ad249e3155321efcb84dbfbc574bbe699c1e49ddca28185ace133334f9a38cc
- SSDEEP 196608:FppF4fDPvqDagLWsMAACcv+P4qbvwZIKQmGb:Fp3cHq+gPMy0+P4s+IKho
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
38:5e:fa:bc:26:c3:0f:dc:13:4d:fe:b3:25:50:ce:35:e8:4a:c0:06:7c:b7:ee:fd:8c:19:2e:bd:56:ed:2c:f2
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US
Chains
Mar 2, 2022
CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
70:9f:d7:0a:dd:71:44:68:a9:c4:f3:03:c0:6f:25:9b:b7:79:52:1e
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US
Chains
Apr 19, 2024
CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US
Serial Number
20:cb:eb:be:f6:dc:20:74:db:4f:41:2a:eb:98:24:56
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 20, 2021 - Nov 19, 2024
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US
Serial Number
20:cb:eb:be:f6:dc:20:74:db:4f:41:2a:eb:98:24:56
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 20, 2021 - Nov 19, 2024
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
73199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
kernel32
GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetModuleHandleW
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceExA
MulDiv
GlobalFree
GlobalAlloc
lstrcmpiA
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MultiByteToWideChar
GetLocaleInfoW
lstrlenA
lstrcmpiW
GetEnvironmentVariableW
lstrcmpW
GlobalMemoryStatusEx
VirtualAlloc
WideCharToMultiByte
ExpandEnvironmentStringsW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetThreadLocale
GetLocalTime
GetSystemTimeAsFileTime
lstrlenW
GetTempPathW
SetEnvironmentVariableW
CloseHandle
CreateFileW
GetDriveTypeW
SetCurrentDirectoryW
GetModuleFileNameW
GetCommandLineW
GetVersionExW
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
TerminateThread
ResumeThread
SuspendThread
IsBadReadPtr
LocalFree
lstrcpyW
FormatMessageW
GetSystemDirectoryW
DeleteCriticalSection
GetFileSize
SetFilePointer
ReadFile
SetFileTime
SetEndOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetModuleHandleA
SystemTimeToFileTime
GetLastError
CreateThread
WaitForSingleObject
GetExitCodeThread
Sleep
SetLastError
SetFileAttributesW
GetDiskFreeSpaceExW
lstrcatW
ExitProcess
CompareFileTime
GetStartupInfoA
user32
CharUpperW
EndDialog
DestroyWindow
KillTimer
ReleaseDC
DispatchMessageW
GetMessageW
SetTimer
CreateWindowExW
ScreenToClient
GetWindowRect
wsprintfW
GetParent
GetSystemMenu
EnableMenuItem
EnableWindow
MessageBeep
LoadIconW
LoadImageW
wvsprintfW
IsWindow
DefWindowProcW
CallWindowProcW
DrawIconEx
DialogBoxIndirectParamW
GetWindow
ClientToScreen
GetDC
DrawTextW
ShowWindow
SystemParametersInfoW
SetFocus
SetWindowLongW
GetSystemMetrics
GetClientRect
GetDlgItem
GetKeyState
MessageBoxA
wsprintfA
SetWindowTextW
GetSysColor
GetWindowTextLengthW
GetWindowTextW
GetClassNameA
GetWindowLongW
GetMenu
SetWindowPos
CopyImage
SendMessageW
GetWindowDC
gdi32
GetCurrentObject
StretchBlt
SetStretchBltMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetObjectW
GetDeviceCaps
DeleteObject
CreateFontIndirectW
DeleteDC
shell32
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
ole32
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
oleaut32
VariantClear
OleLoadPicture
SysAllocString
msvcrt
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
memset
_wcsnicmp
strncmp
malloc
memmove
_wtol
memcpy
free
memcmp
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
_controlfp
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bb6c8c6772bc0e8ba9a3416e53e4791fcf2d753642c771c84ecce5f4a2fec948.elf
- SHA256 bb6c8c6772bc0e8ba9a3416e53e4791fcf2d753642c771c84ecce5f4a2fec948
- MD5 3a7a94ef6f1d2b7c03f86615d6494d37
- SHA1 c10864ed739cd89c1435983eff8c6811ce461fb7
- SHA512 3565a499447726ab392b18c11767f191077a40d8a9c7e5965d3550c0d8678f1179fbd249fbe4cb8f669793d5bb6878003e489b78537037f2697902c631ebced1
- SSDEEP 1536:i/Ha158ZbNDz36Ta4pCaplWWvOKO7yxG8ELwWgnzcNkfgi84:0e5WNDmTa4pCoWA+7yxG8ELWzcms4
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
bbb16e52cd7134b0d1de4aa9c449fc7d9f084783bb4e31b061414e2e3a7e86df.rar
- SHA256 bbb16e52cd7134b0d1de4aa9c449fc7d9f084783bb4e31b061414e2e3a7e86df
- MD5 2538b8d1ea01d885f9fb17df8b41f689
- SHA1 9c4ceac8d81822fe247aadaab6e34294bb2857ae
- SHA512 4b9073e30123d5e2c70ca8be9b1835f50c2b8ddaa63dce032ec76a0fec41587dd31a139b711206f08cd6f71dee191dad3e129948b6d529deb525fb5d8535e22d
- SSDEEP 12288:0Me3gtFRSip1hgzveC3EZeJHvQuc+93I9hUxl+oPkq:0Me+lUzp3UIPASI9e5
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
bcb2ec0810dd5fe31592e0b8c7739102620ce48b4bfc06bd3708de614896d180.elf
- SHA256 bcb2ec0810dd5fe31592e0b8c7739102620ce48b4bfc06bd3708de614896d180
- MD5 0dcfb4863cdd0125a81fad305b58d453
- SHA1 dbbfc3da46a6162f8d93646e0cca655571f74779
- SHA512 efc23894f1dff0adc106126dc35ff0d021588b0314722f83fec45701cee27d54617db94c24b3201fb88baf3c5ae8efd88194a76008216b109c09f35546ce9bf1
- SSDEEP 3072:hL6LwVIV2hsnY/FyLv5hLKz8L8+wkLkY0Px9gQNfR:h+U+Mh2tLv5hLa8Y+FLkY0Px9gQNfR
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
bd817f08b4b45d7a6edcbf36a7149648bb61eb4bca360a3ecf6b21c1e8fc7519.exe
- IMPHASH 5a10b1f71232200699719a8d6c2e95fa
- SHA256 bd817f08b4b45d7a6edcbf36a7149648bb61eb4bca360a3ecf6b21c1e8fc7519
- MD5 1df81dc4b756cb6848f92030435093d9
- SHA1 dd9a2d178460c9b5d62ee6201141454d5cf78139
- SHA512 d80bb3fb203d4721ea5b9bc221a75314c280093906bad9ebbad59bf03296a50db4fef6662ad6a14a648b18b0c1b6f3863e8c84e99804bb4b30a3c8c0d25e986e
- SSDEEP 24576:65/GIR6gOBfpgukEsuytwOQq3ly8lqrOYuqf5xWOQn6522O8cD6:I/G+h/uStV/3ly88rlxOEG
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
646368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\QQ670\Downloads\my_script_tools-main\360QVM_bypass-public\360Safe\RPAVWQ\target\release\deps\RPAVWQ.pdb
advapi32
RegQueryValueExW
RegCloseKey
SystemFunction036
RegOpenKeyExW
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
kernel32
CreateIoCompletionPort
WakeConditionVariable
IsDebuggerPresent
GetQueuedCompletionStatusEx
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetHandleInformation
SwitchToThread
ReleaseSRWLockExclusive
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
GetConsoleMode
AcquireSRWLockExclusive
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentProcess
GetEnvironmentVariableW
IsProcessorFeaturePresent
HeapReAlloc
HeapFree
SetFileCompletionNotificationModes
CreateThread
UnhandledExceptionFilter
ExitProcess
QueryPerformanceCounter
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentProcessId
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
RtlVirtualUnwind
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
HeapAlloc
PostQueuedCompletionStatus
SetThreadStackGuarantee
AddVectoredExceptionHandler
Sleep
FindFirstFileW
GetFullPathNameW
SetLastError
CloseHandle
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerExW
GetProcessHeap
WakeAllConditionVariable
GetLastError
FindNextFileW
lstrlenW
SetUnhandledExceptionFilter
FindClose
ntdll
NtProtectVirtualMemory
NtWriteVirtualMemory
NtAllocateVirtualMemory
NtWaitForSingleObject
NtCreateFile
NtCreateThreadEx
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
ws2_32
ioctlsocket
connect
freeaddrinfo
closesocket
getsockopt
bind
WSASend
WSAIoctl
recv
send
WSACleanup
WSAStartup
getsockname
WSAGetLastError
getpeername
setsockopt
shutdown
WSASocketW
getaddrinfo
secur32
EncryptMessage
FreeContextBuffer
DeleteSecurityContext
QueryContextAttributesW
AcquireCredentialsHandleA
FreeCredentialsHandle
AcceptSecurityContext
InitializeSecurityContextW
DecryptMessage
ApplyControlToken
crypt32
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertOpenStore
CertCloseStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertDuplicateStore
CertDuplicateCertificateChain
bcrypt
BCryptGenRandom
vcruntime140
memmove
__current_exception_context
memset
memcpy
__CxxFrameHandler3
memcmp
__C_specific_handler
__current_exception
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_initialize_narrow_environment
__p___argc
_register_thread_local_exe_atexit_callback
_cexit
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_initialize_onexit_table
__p___argv
_register_onexit_function
_crt_atexit
_c_exit
terminate
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
Name
.text
Size
646KB
Virtual Size
646KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
820KB
Virtual Size
819KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
549KB
Virtual Size
549KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33030,
count=23, id=261, version=33030,
count=9, id=260, version=33030,
count=3, id=259, version=33030,
count=158, id=1, productName=Unmarked objects,
count=23, productName=Unmarked objects (old),
count=1, id=255, version=33134,
count=1, id=258, version=33134,
be2346fa2bef1b558f011862043e37bf5cef8b2290202a64a450a08750820462.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 be2346fa2bef1b558f011862043e37bf5cef8b2290202a64a450a08750820462
- MD5 7c665575a095a3d95e8fd3db9f68dbda
- SHA1 9702fa88095963c1d336cd48bca362a2b33a530e
- SHA512 2d300feb63df4a08d5ff5e235cc2f6e2f293e3a19a012ee75a933e6992c09e6fb2964fcf5f7fd3443c7fff7a66291bfa4bb1acbc0d9bb9fdd1e36c266a59736f
- SSDEEP 6144:TaYIfJebpHDjRu5Wh//MdHavp1RyPaBWuWR0PIDqmvYWx:3I+5EEwCpePae68Ws
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
9d:82:62:59:39:12:dc:a5:0d:dd:11:37:8a:bd:cf:cf:28:9e:25:32:10:38:06:7c:1f:81:90:80:73:d2:45:2f
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
9d:82:62:59:39:12:dc:a5:0d:dd:11:37:8a:bd:cf:cf:28:9e:25:32:10:38:06:7c:1f:81:90:80:73:d2:45:2f
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Feb 7, 2024
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 18, 2022 - Oct 15, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 14, 2023 - Sep 4, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
4
Entry point
15078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\75atu\obj\Release\Laptop.pdb
mscoree
_CorExeMain
Name
.text
Size
211KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
c0b4860057005ee1549b38ec8c27f1ac5c7888d4deafdacf9a7698c3edf378f7.exe
- IMPHASH c4a60923dba9ba09eab802a43aae91ba
- SHA256 c0b4860057005ee1549b38ec8c27f1ac5c7888d4deafdacf9a7698c3edf378f7
- MD5 1c6d62c5e76e239944774bcd332f0d5b
- SHA1 b39bcb742498320052cd03cbd2aa202fa72d1d85
- SHA512 c8fe2e935ab1c9fc12f6610907cf86cf0dc89e56882fb85bc3aa989716d34ed48174d6987faf725514d958a329ece49c98b7334d6154661966508baf5c5b2eb3
- SSDEEP 6144:J2npeaHeN0TQbbZp0sFXVkL0F4m2vr7hfTIXdbAB:JspeaHe7ECVkLirIr7xcXpA
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14707
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\gakiw\68\getikumofu\vohuh.pdb
kernel32
SetThreadContext
GetConsoleAliasesLengthW
GetLocaleInfoA
GlobalAddAtomA
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GetVolumeInformationA
GlobalFindAtomA
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
FindNextVolumeW
WriteConsoleW
FileTimeToSystemTime
FindResourceA
GetTempPathW
GetLastError
ChangeTimerQueueTimer
SetLastError
GetProcAddress
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
RemoveDirectoryW
VirtualLock
GetModuleFileNameA
GetCurrentDirectoryA
GetWindowsDirectoryW
GetStringTypeW
OutputDebugStringW
FlushFileBuffers
CreateFileA
GetNumaNodeProcessorMask
ExitThread
GetEnvironmentVariableW
SetStdHandle
SetFilePointerEx
GetConsoleMode
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
CreateFileW
user32
CharUpperBuffA
DrawCaption
gdi32
SetTextColor
advapi32
RegisterEventSourceW
ole32
CoGetPSClsid
winhttp
WinHttpSetDefaultProxyConfiguration
msimg32
AlphaBlend
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
192KB
Virtual Size
41.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
c1539ba94c7dbafa391aa83f94a2b9a536097c8c8d6f1c522a93156941ce4c86.exe
- IMPHASH b92af7920132d9c164f3fefd70cac1d7
- SHA256 c1539ba94c7dbafa391aa83f94a2b9a536097c8c8d6f1c522a93156941ce4c86
- MD5 c4602c700a3796e72933abd123eac296
- SHA1 7921c32fb0ab96cf615787e75078708e78e01b9d
- SHA512 73f02cb9ed902e1e226e86bd57289674a2409eca548d1d3214ec1a41042a124a866c36aa388fe20363203b36ecbcc9854575c12786951f90a1511e9a57e02d26
- SSDEEP 196608:DkNaoMnpHbJUFPL8hg0qMDGhHvFgalivd2jewvXiWKe:Dkunp1+kRqDhPGkOdi3xb
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
3f:f5:cd:fc:d5:19:fd:d7:25:33:50:da:46:8b:fa:da:c2:67:4d:4b:92:d1:d0:99:c9:b8:39:47:95:a4:c2:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=SAMSUNG PRO B960-P WIFI DDR6,OU=Universal Gen Core Pentium,O=\ Intel,L=¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§,C=6G Bluetooth
Chains
Apr 1, 2024
Subject
CN=SAMSUNG PRO B960-P WIFI DDR6,OU=Universal Gen Core Pentium,O=\ Intel,L=¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§,C=6G Bluetooth
Serial Number
4a:b6:f2:ca:d3:e6:41:4a:ac:7d:42:1a:95:6d:71:1f
Issuer
CN=SAMSUNG PRO B960-P WIFI DDR6,OU=Universal Gen Core Pentium,O=\ Intel,L=¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§,C=6G Bluetooth
Timespan
Jan 31, 2024 - Jun 6, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
6896177
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
GetUserNameA
shell32
ShellExecuteA
ole32
CoCreateInstance
ws2_32
send
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Name
.text
Size
Virtual Size
442KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp2560
Size
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp2561
Size
6.3MB
Virtual Size
6.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
c2655050d7396dc127478a94de8698cad30189dfc594f8e61bfbdf8c1307929f.elf
- SHA256 c2655050d7396dc127478a94de8698cad30189dfc594f8e61bfbdf8c1307929f
- MD5 3a33912fb269ad18862f583d9dc60df7
- SHA1 20310de3338ce2cddd6f2e101534f06564e39f14
- SHA512 33d2182a6661c615972c20fe15ca55e6a6d584e9c49a7a0879c6339e7780abbcac3466c96941408526741b08e41b3c2936692166d27a5586a0a22e025b026399
- SSDEEP 768:jX2p50ej33FdzPXvGJqzngbtCP+y4Sz2FPQ20F6FxH4uVcqgw09IYn:C3nTFNvvGczP+zSKKu4u+qgw09IW
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
c4702d262bd679d87b1521b719809e170933f5510a9a7d40a6b858b8609ecbee.elf
- SHA256 c4702d262bd679d87b1521b719809e170933f5510a9a7d40a6b858b8609ecbee
- MD5 2177324e426847b13ea921ad53816652
- SHA1 b4da4b77ca876d891a124c0a5b265bf619dff3b3
- SHA512 3b975ecdf92eedbbb3a0d7d5e137f84420de9a162b35a1c2ab1c1cf52d2fa96334da97b9deea0cd90a6e526e3272dbdd44dc4f0554a0d1584e3ba7bc6fe44590
- SSDEEP 3072:hMxi3bfR3ovbvDpMKCfo9Sib+VHjbitLyKdAMyTog+B1:6uSVMjf7ibrLySyTSB1
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
c4edf7b8cdffb67fcd62ef81485c04648b11a14a8452f407133f131e2f74a57a.exe
- IMPHASH 0b2f7445f02cff44b10bb9e8cd71c3c0
- SHA256 c4edf7b8cdffb67fcd62ef81485c04648b11a14a8452f407133f131e2f74a57a
- MD5 ee22e773de5fbaa9a849ae3cfff089e6
- SHA1 68817628123d6b4761c48aed0e2fc7ae116c5f54
- SHA512 1d2b89a093f57d5ff6cd9b0d8dcf8893b63ff33c75198efc01cf5c95dbea97c8b94edfa1cbe46bd8c638a61e8f547a38fa9e963beaddd996cd86f6a7406a01f3
- SSDEEP 49152:fwU6djmOtDm2fqpu1YyKbAiiG23AFxvsRnUCrxai:oprD3DY7A9GyAF5sBL
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
Digest
11:c7:7c:e0:13:54:03:5d:4d:77:a1:99:d9:6e:d6:8f:db:a4:08:5a:81:cc:df:c0:ae:83:a1:11:12:8d:ab:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Mar 2, 2021
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
09:c1:ca:c4:ac:05:dd:06:02:10:20:f8:87:7a:e7:e8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 19, 2020 - Dec 22, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
5
Entry point
1986268
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
shell32
SHCreateDirectoryExW
shlwapi
UrlIsW
userenv
CreateEnvironmentBlock
gdi32
GetTextFaceW
advapi32
OpenSCManagerW
comctl32
_TrackMouseEvent
ole32
CoCreateInstance
oleaut32
SafeArrayUnaccessData
gdiplus
GdipCreateBitmapFromScan0
Name
.text
Size
2.1MB
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
54KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=20, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=199, version=41118,
count=45, id=205, version=50929,
count=251, id=206, version=50929,
count=416, id=207, version=50929,
count=2, id=206, version=61219,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=890, id=1, productName=Unmarked objects,
count=72, id=211, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
c5c3c6fc136b01b4c88c7f70afc99fe20fdeaf6292570946acd2c315a7a5e119.exe
- IMPHASH bb2ac363335230ef73bf96bf5001e65e
- SHA256 c5c3c6fc136b01b4c88c7f70afc99fe20fdeaf6292570946acd2c315a7a5e119
- MD5 1d9bc09d7a20b02156bec7668a390c1a
- SHA1 5727f48ad4cbc949fdf587fd893384c50c6c8599
- SHA512 72e67754a1f5ad01003d80b05520b871f0ce023405a1016e3417b9ac7d6b5586a1f3013eeddde099293919fe459b29d69e48e277b04a2f44d149963a8d4f6306
- SSDEEP 12288:uS1eL2DesjJTq3iJDhWetLHV9o1Tv9EgFvxP0OFWMq9/mHo4nrYb:uki2DesjJTjJDhWetL1evdvl0OcMacrk
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
456292
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
shlwapi
StrStrW
kernel32
TlsFree
MultiByteToWideChar
WaitForSingleObject
GetLastError
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
GetStringTypeW
GetCPInfo
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
SetStdHandle
HeapSize
CreateFileW
Name
.text
Size
588KB
Virtual Size
587KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
c7c643bc00955e3cb3d3c0b7286a0cf1c35864c42e91064d7108085e7eabfae9.elf
- SHA256 c7c643bc00955e3cb3d3c0b7286a0cf1c35864c42e91064d7108085e7eabfae9
- MD5 f430e318cceeef7a552f9f0656365803
- SHA1 e07f36c458701fc2559d109ba2a53c0388f1c23a
- SHA512 49e00cc30f2a2567368a1f54657855b1fb30fe103620a26e46b12eb81ec4b87ee98e30a62f4de9ea159f00dae9bd34d57ed056e304ad4cd1ef8d5c9f333ede28
- SSDEEP 768:qOJwAtFM629T/kG57fTKgyVnTnssLdFIooUwh:qOF1GTMG57K6SdFmh
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
c845049d5b0e627fa7c6a07c416d510fa20c2544d8ae193349412e7245350eec.elf
- SHA256 c845049d5b0e627fa7c6a07c416d510fa20c2544d8ae193349412e7245350eec
- MD5 2eac2f3045a63e831cb88b50480bd2c7
- SHA1 05000f9518daada4323b75c4fb6d37833d43a10c
- SHA512 f4ef44db28dced7e8bfa5125d05891091bcd70435a24b1af54651f7b8ed1f085b58fdeb9b1fb183c351079ebc2b2668c36a9c7f942a811c1604d23754f249356
- SSDEEP 3072:ARpOoGeUKySLmXu2gMYRacVRjTh4CddDCY6R:ARQoGe59mXpgMMauaAdDCYI
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
c955e4df8eac2ab783ba558fecf707bf76f8268913cee596c6d85b2dffb24e5f.elf
- SHA256 c955e4df8eac2ab783ba558fecf707bf76f8268913cee596c6d85b2dffb24e5f
- MD5 0ae31e558c2554c083bf63534113f213
- SHA1 d74268706e29a3b23999bc0c8555342e19b833d2
- SHA512 1135c6a2e52aa591da9a4685dc39b5e3feb9aa0868d81fd36117cfe319394c23ba48747058aa4ce907d874ee7d11b027a3bc322c63b6ceca139dc47884bfc687
- SSDEEP 768:i5Ux9mAkWUmq0VolhSdaz3aEVs1fNXWnSF7Ftd:i73WURpfSuaEV0tWnS9FH
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
caeb5b0338795678a139244858d2e19c0a7bd401604a02af1a17880a137258b1.zip
- SHA256 caeb5b0338795678a139244858d2e19c0a7bd401604a02af1a17880a137258b1
- MD5 20fc37921fbbdf65fcca8dfbc256cb89
- SHA1 3f95ac797d2f08438554c6b6cf9bb439c26bf324
- SHA512 418ffef3889a3e5a8f2e1bfd413525586f6eb9e67aca635afa07ebadbadee59d5dd92fb3f02b6226c8fa12c76e659f5db16061357e83ad8274587ef67709348d
- SSDEEP 49152:Bn6J3WM202p5GutgAJuIxyxWqxbwOA4KXJBPic4VNQqFLbCNu/Se6ph5PWZ5Fvct:Z89i7JDmWKwOA4qJtVqFLCu/L6BP+UD
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
cbe27936a3beb1902517906f7da1d6d3f6ef8d1a0eda5e033f4da436df7cd88b.iso
- SHA256 cbe27936a3beb1902517906f7da1d6d3f6ef8d1a0eda5e033f4da436df7cd88b
- MD5 dd43ff0fd508a41accbe9db19d62f747
- SHA1 5026b911b5eddbc67e4650ea129ed38544305c3f
- SHA512 47caab805ca46e148f5716c6ba0e6a5d32a0016b47891eaa6f9f9845df30052953d7e4aff73ffa05939b52c7ac73faac6a3310d2fee992c469ca4765297af207
- SSDEEP 768:9j0agBtKWAZGc8NnKwiQoAMyCgnnDSR9mfJYAwYu:SQqNnKwbmgnDSefJYAD
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
cbf82db6eb47c89413ceb34f20db5fd67beca54befa14cdcd0e4be903e432c9f.elf
- SHA256 cbf82db6eb47c89413ceb34f20db5fd67beca54befa14cdcd0e4be903e432c9f
- MD5 7d1a8d067f16190bc42e73dae4087ee5
- SHA1 3dedfcdad357c3d8efd2f2ecfe762779bf1a5111
- SHA512 c4cc6373655f1d220b6f01d1c347c8f4a6eef5f2631c46e7b39a2df083ad55bb3e5210df21da7b6d524bfb33c0a532a68d2074f5ef6a44c209e378b55a997e7a
- SSDEEP 1536:ILLh55/2MeMKadKFNmQxiP1P9N46rSKH8XysaYiSoc3OU:K9P/2aSFHxi97jrP8lTrWU
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
cd2d4fd57d36ab0e4bc6cca12eefad3c38e46df6964fa6e70534e8f66ef6209a.elf
- SHA256 cd2d4fd57d36ab0e4bc6cca12eefad3c38e46df6964fa6e70534e8f66ef6209a
- MD5 a9a7ecebddeb50b51340b4677743c873
- SHA1 f1f2bed2b25164ffb33e36a5bb49fa12c108b215
- SHA512 a983d04276f115a83bf9897a0f232fe317ff1412255984b61733496af6731866aeb9c63612f0fce600f081ab79f3fd407b9d6cb5f92608d9a07ed52fcf3912c2
- SSDEEP 768:Id3nP+pz0V2eIqXrXHz0jjZcvao4uVcqgw09G:m32AseX3sSSo4u+qgw09G
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
cd517989776d85f3669e300ab401543aa354f80b7d467fdb93824b1a287b9238.elf
- SHA256 cd517989776d85f3669e300ab401543aa354f80b7d467fdb93824b1a287b9238
- MD5 6b1987b086a99361653f7b06891308cf
- SHA1 d1f511fbb0d6cf7078d3434c5d55f160d9921008
- SHA512 3bc68a0da74f37b3e8087216ec42075f3cd823814fb347912823068b606bc34c39949c507badafb0766bc2ff25e2cb2d2d04844a227a40def8b077f5948dbd92
- SSDEEP 3072:1c1viER/rnv5mX1r1rQvH5hqDv3QKY2QnI0PDG4gQNcR:1cJnjnv561r5cH5hqry2QnI0PDG4gQN0
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
cd5578bdb5130615e3667f36e665a03cf4b8c943899ab8ea679653c224036d8b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cd5578bdb5130615e3667f36e665a03cf4b8c943899ab8ea679653c224036d8b
- MD5 3888dc86112846ba5a05594ffa6a5356
- SHA1 e37e15c949a67f3251c627be5560fc45ce48367b
- SHA512 e41963c83170eff8ac4e89198a0c5036b075117a669f443f5dded58a76ea45763f30b15897653b0da2bbb56d2dcc6be41e64608f8732a0fbc782fe3eb49c5614
- SSDEEP 6144:xM/9D4hDRKRr0yNHbaUyxeNVtO6kwqrlRiZ7Uh+2I1HhFQKJ4pzxD:1NoV7ywOzwqKZEOB0pt
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
e0:62:70:23:78:f4:76:95:24:3b:5c:c0:3e:4c:1e:37:44:ac:f2:8a:cd:ec:f2:47:92:d1:ac:11:7b:5e:da:d9
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
e0:62:70:23:78:f4:76:95:24:3b:5c:c0:3e:4c:1e:37:44:ac:f2:8a:cd:ec:f2:47:92:d1:ac:11:7b:5e:da:d9
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Feb 7, 2024
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 18, 2022 - Oct 15, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 14, 2023 - Sep 4, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
4
Entry point
325022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\2tdtwsy6\obj\Release\Croco.pdb
mscoree
_CorExeMain
Name
.text
Size
309KB
Virtual Size
309KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
cd94340d01668e3f499ed9a694f2507bc7d6bc10a5dacb467d951297794f313b.elf
- SHA256 cd94340d01668e3f499ed9a694f2507bc7d6bc10a5dacb467d951297794f313b
- MD5 0768a3dd41abfc9500f7848529844556
- SHA1 80b1b826ac5415580ac0a9959b08f06932515528
- SHA512 98ca368556cc8a369fa72b695966dd0b35bfe4af618708c1c8275786f566e15e5ec6d8de41e4a04d211fc4a4305e07908c1c3b01837f066743e3bd1213963686
- SSDEEP 768:NzwtTAROnTxeKT6m2Ud6Lg28JQB4iQNoFCQgeKLlWTraCo47gkOCg86F3fUJr4wW:NzwtT9lqfA6UJunbKLlWKV4lOCgoJ1N
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
ce88ab5d77ab447ef12a4e2859602ac2a167ac360078fa9c6d0eed2ba3bfec51.elf
- SHA256 ce88ab5d77ab447ef12a4e2859602ac2a167ac360078fa9c6d0eed2ba3bfec51
- MD5 98f990b111bb7d3740eba0a883ab2875
- SHA1 c5b01fd547e1485c88c5225a6b1d57c20f5d39d3
- SHA512 98d79b8a05476b24a926b4133b93eec2e23738d31a2714d75c412ad1b364c047e9588676f3054638dbe31261503dfaf679b1539d8234b3bd30ae6cec84b6e2cb
- SSDEEP 3072:zgDR9el1M8uAJpN5hkK5B3X9tEURxuZq+1uPNd5R:zgDR9eM8u6pN5hk4PmURxuZq+1uPNd5R
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
d29ebdaa0a822094a12e32d12fd13b401385c2f78941c9f4e222db7b370abf5a.elf
- SHA256 d29ebdaa0a822094a12e32d12fd13b401385c2f78941c9f4e222db7b370abf5a
- MD5 5830d21dd285aa36f191cf89358325ee
- SHA1 6055c0e8714c3d71426f48d6f224fb99268e5f27
- SHA512 63a869e1d608c66d5920ef1a71a574feb2c53be2256bc930002f5569d9fc7408be2b4d1c5fba362f55e47cffad1f7dff298bd4e59a3c25a6788a57dce34901d1
- SSDEEP 3072:qJYWRWU8Ud9BQjIvKQ3RPhgaeNK21i5hRTkjCinf0OzTyoQQub:4UPa9BQjIvKmjj2k5hBkminf0OzTyoQ7
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
d5a372d3a991f01ec9b1deb385bed8eaaf63cdd637920abff57d0b115a36113b.elf
- SHA256 d5a372d3a991f01ec9b1deb385bed8eaaf63cdd637920abff57d0b115a36113b
- MD5 e6e3841f3099a9be985a5116943e54e2
- SHA1 2a28d8c44ae220f2ed06d5424ede0563d0881306
- SHA512 ae40f556d8ce77c691d0f8198e1b14b646e731962ad869e304b119ad68eb470c7979f4b8f392b445090a43f9c318d8547db563a05c79b94a02a0d6059d1ed845
- SSDEEP 1536:WRBH0hPAjrk578GnUFRpFvdG9gp1l+OSDhconOOQW:WRiRBUFRpddGSp1iAOn
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52
- MD5 9ef39d6f27e41fc29f9d10acfa5a17c9
- SHA1 4309f3b9cbaafb909c9cf1cf85503c6cfa71b565
- SHA512 0746c8c18055db103628149ce75607e0bb764eb267301c39aa6327fa6346aeefcb6d040afaa9424e7c47315d49239ff24eb24d0da57348ba77297bbc15141e5b
- SSDEEP 6144:2UNT52ujFIdj3e3zpQiaRdY2zZxbkHmNeM7AttjUoM/:BT5ZjFWDebEjzkoqe/
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
8e:cd:ec:ba:37:5c:c7:67:80:32:83:bf:da:e1:d1:08:40:79:08:0d:2d:62:3f:60:12:73:bb:42:fe:af:8f:32
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8e:cd:ec:ba:37:5c:c7:67:80:32:83:bf:da:e1:d1:08:40:79:08:0d:2d:62:3f:60:12:73:bb:42:fe:af:8f:32
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Feb 7, 2024
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 18, 2022 - Oct 15, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 14, 2023 - Sep 4, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
4
Entry point
15086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\0s0h5koezw\obj\Release\Laptop.pdb
mscoree
_CorExeMain
Name
.text
Size
309KB
Virtual Size
308KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
d89e00734a9bab127b81271423595b2fc6cc7e69020035a3696f472d42cc22d2.exe
- IMPHASH fb0a8b4a81655f744a37af985e009476
- SHA256 d89e00734a9bab127b81271423595b2fc6cc7e69020035a3696f472d42cc22d2
- MD5 7e9e8db1070ecca21c82599cee591895
- SHA1 a7d6db965f36916e317f3cb147b1611bb9cb91c4
- SHA512 152954091b9d0d2cae12551f06f756e8c0af2004fd9ddc645599de2c45702f3c34eaa70fa50cd497907cb58293311d648d3714b36afe5b1bb7b487ac2d65be74
- SSDEEP 49152:EX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeK5Z:ElRsZ47/QXoHUOfAoj1nP
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1940876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\MeshAgent\MeshAgent\Release\MeshService64.pdb
comctl32
InitCommonControlsEx
dbghelp
SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump
iphlpapi
GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo
ws2_32
WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select
crypt32
CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore
gdiplus
GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup
ncrypt
NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey
kernel32
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer
user32
EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect
gdi32
SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject
advapi32
CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus
shell32
ShellExecuteExW
ole32
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
981KB
Virtual Size
981KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=176, id=243, version=40116,
count=38, id=242, version=40116,
count=1, id=199, version=41118,
count=10, id=259, version=24123,
count=33, id=261, version=24123,
count=25, id=260, version=24123,
count=496, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=209, version=65501,
count=1, id=208, version=65501,
count=29, id=203, version=65501,
count=398, id=1, productName=Unmarked objects,
count=53, id=264, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
daada19cab8e9cf064bfe1b219398dfa5ed5fe45832bfef1d5f284be93b4347d.exe
- IMPHASH 6c17cd221979c51b4b1f1bc0b7dc863e
- SHA256 daada19cab8e9cf064bfe1b219398dfa5ed5fe45832bfef1d5f284be93b4347d
- MD5 b787d34f7affd95acfad6d9b19728fe7
- SHA1 199a1309d76fe6c5a3c78ee98f58927ba79df1fd
- SHA512 3b36ffaca89b170a68f7ac4b7ad5c92a7644d098300b6f081b29468c88efa60556a44973a8a1abceb2295088bb238e4de84a43cdf0869a70867c49850f9b7241
- SSDEEP 6144:4QP3gUlnmJXzrDkIC4tLJ24+ycW4glgfFkBCT:4SgUlnOvDkIRT+ycW0faM
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14675
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\zawicururis\ronecezuwupu_polagex69.pdb
kernel32
SetThreadContext
GetConsoleAliasesLengthW
GetLocaleInfoA
GlobalAddAtomA
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GetVolumeInformationA
GlobalFindAtomA
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
FindNextVolumeW
WriteConsoleW
FileTimeToSystemTime
FindResourceA
GetTempPathW
GetLastError
ChangeTimerQueueTimer
SetLastError
GetProcAddress
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
RemoveDirectoryW
VirtualLock
GetModuleFileNameA
GetCurrentDirectoryA
GetWindowsDirectoryW
GetStringTypeW
OutputDebugStringW
FlushFileBuffers
CreateFileA
GetNumaNodeProcessorMask
ExitThread
GetEnvironmentVariableW
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
GetConsoleMode
SetFilePointerEx
SetStdHandle
CreateFileW
user32
CharUpperBuffA
DrawCaption
gdi32
SetTextColor
advapi32
ReadEventLogW
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
191KB
Virtual Size
41.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
dce5434e660c66954f7859390e33d969f0a493a77cc84f1e42df7b17ab9bfa53.elf
- SHA256 dce5434e660c66954f7859390e33d969f0a493a77cc84f1e42df7b17ab9bfa53
- MD5 69db855b30d7cb79faa3d0b93d7d1fe9
- SHA1 4bda43094e51a33e9d63fed97eb59551c46f5a7f
- SHA512 436d6b928cdc459d59bf8437fd822ed022a47fded62a618fdb4f498aa578ecbebffe62368daa909de55c206cd0d97a3a25cc3d2dcc9095410b9571e8339f96d0
- SSDEEP 1536:Lb4wvsHDy8lAOfOPW8gusRc9P/ymWuY8Ah+dFKxOQX:Lb+qqcgusRc9PamWphEwOO
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
dd7e94e3adb6ccf95559adf51a9f0234763f972fd6480d7cf23916bdc1549507.exe
- IMPHASH fb0a8b4a81655f744a37af985e009476
- SHA256 dd7e94e3adb6ccf95559adf51a9f0234763f972fd6480d7cf23916bdc1549507
- MD5 60332f4caa7ca2eaaa8ac3b4f0f91760
- SHA1 bdad69e9a3b24236b69b620de270fe92ec38144b
- SHA512 0ec48faaffbf17c2267547f18d5f2673b8dd95db43cfa654b6ac47dcbf3f758c3ee94131b76583100f776ac4443cb00733430c600f789831e9ca7ea4d5e4a8b7
- SSDEEP 49152:EX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeK5v:ElRsZ47/QXoHUOfAoj1np
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1940876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\MeshAgent\MeshAgent\Release\MeshService64.pdb
comctl32
InitCommonControlsEx
dbghelp
SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump
iphlpapi
GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo
ws2_32
WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select
crypt32
CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore
gdiplus
GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup
ncrypt
NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey
kernel32
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer
user32
EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect
gdi32
SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject
advapi32
CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus
shell32
ShellExecuteExW
ole32
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
981KB
Virtual Size
981KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=176, id=243, version=40116,
count=38, id=242, version=40116,
count=1, id=199, version=41118,
count=10, id=259, version=24123,
count=33, id=261, version=24123,
count=25, id=260, version=24123,
count=496, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=209, version=65501,
count=1, id=208, version=65501,
count=29, id=203, version=65501,
count=398, id=1, productName=Unmarked objects,
count=53, id=264, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
de00660d0d96ff67cb8e89a8d8525567327b109bc54b9042e5fdd516dcc0e51a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 de00660d0d96ff67cb8e89a8d8525567327b109bc54b9042e5fdd516dcc0e51a
- MD5 126cc489cbc8477416a030f3e5e772f1
- SHA1 29000ae82a5c27c85c1568569f591d8668a85000
- SHA512 e618201e44c335018de0565dce334d8e8d23f059acb5583d54e0ab252a405223e3f14ab3bd917485f2a54e536952cc47c486862602e1209c4cc7d4c26a68a88c
- SSDEEP 98304:5SOvWkDi/Jqi5PaSn6lrDYyzJpcRTl0ZYYhCAE:HOI6PaSn6lIyFpcRBupC
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3542302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dec9918265c77439780f448c5b6b06d8919ad2b7a23d714c25ab08a494df5340.exe
- IMPHASH 90a754824211c648b161e0e146d30cbf
- SHA256 dec9918265c77439780f448c5b6b06d8919ad2b7a23d714c25ab08a494df5340
- MD5 753d0e24725a4442db6d8b96cfd20bcc
- SHA1 353d42fb3352a54a6e2f67686ccdade7a8e0006c
- SHA512 233c0dfb7da11e31e349ec35e95ba58221a9795140faaf8d6eb5a8c5fa36ae3be20e477351b955accb6818a36fec8fa9dc9d75224c5b9d00c69315f74de29bff
- SSDEEP 393216:TairG52qVGrMSjTYsGRCzhWMmnuzt3tikiXOU:Ta/QrMS/Y3c8Zuzt9hU
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15260625
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ole32
CoGetObjectContext
kernel32
SetEndOfFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
Name
.text
Size
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cSs
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.t_m
Size
Virtual Size
5.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.p N
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
..i%
Size
12.2MB
Virtual Size
12.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ded0b3101d0cf256b0a87535dd5d006176c0aa59c023bfbd2c6eac4fc6f0d40b.elf
- SHA256 ded0b3101d0cf256b0a87535dd5d006176c0aa59c023bfbd2c6eac4fc6f0d40b
- MD5 bd3d9006bbf218921abe0aee33ac9052
- SHA1 98a252a065accee829e6911a8bef0544cc1c8427
- SHA512 e15d88851f29bf459d998a9c912c407e88678d4de8e1910749cc03a4e4f1fe18f14c201f9993a8cf324beb9b50a2496092d401295bd0a2058717798b4fc527eb
- SSDEEP 768:nmyOC2vN/YhN6hZjnmjdkFXAbirLAU+gTNZYYrZQPS4JgGlzDpbuR1JYy:mY2vON6Dj0aQ23AGTNvIS4VJuyy
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
df6ab7c6ac612aa19b1392455b4250f20e03381c64d6d7443859f319a61f1cb1.elf
- SHA256 df6ab7c6ac612aa19b1392455b4250f20e03381c64d6d7443859f319a61f1cb1
- MD5 de495c9fba1252fd5f7479fd3b7ad224
- SHA1 bcfda18cd4f52e9a11d347094386f585dfa94f91
- SHA512 b9a071f2aba009a0c190eb4f388e2e4f46650ec978a6cadc5901c1525cc84ee6bda75114987db5344f004246e0e44318a8ee97cbe80535811fc16b11e9f3ef47
- SSDEEP 3072:4VfyQ+d+pceQGfBbPTa+jthWOiwzte6XP45hLEDyh3O46dZBjUmydQCYMhEFg:CbPTa+jthoEXg5hLE+3C3gmydQCYMhE+
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
dfde7c566bce1a75aff9f68348058a6986e8376d5b4dbea5cd62310e0c154d5e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dfde7c566bce1a75aff9f68348058a6986e8376d5b4dbea5cd62310e0c154d5e
- MD5 989796ca980fa7a832e9cc3dab774100
- SHA1 11de1929468ec2fc2f41e56a4d7f8532299925fb
- SHA512 24fc2e8c77d19e1b95aee3f2a949db7acdd9ff2cbf94fb67aa35adc4547b49f3cd150eb74b1dc365cee912e7e9af001a8268cb99d46b619e638a90cbbe778ac5
- SSDEEP 12288:HULzgOTLmwStBQlygKt9alrz+CaMAWlj1470FBFJuC70wiQ6EQMIZAtLDsFKrgRq:0LzgOHmwJ4gKt9alnvaEXdFpuc0tQyNK
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
730298
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
705KB
Virtual Size
705KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e0807ac9d5c0eefe90916de1c25e6ad9a3e1e82d36a8e10a560a62e4dd85f7cf.elf
- SHA256 e0807ac9d5c0eefe90916de1c25e6ad9a3e1e82d36a8e10a560a62e4dd85f7cf
- MD5 b2ddbe725537a19c6a930cb8f0e73131
- SHA1 757c835e1da7d312aa47dc62c43977804d8224c1
- SHA512 6d645ab5b144a45a3abefcf5553448735a3f70813396fb1d550309d9942a7b04f6444d755be4c01b4e53cb393c070d3ced1579672d8b3e0e1cf90426b19046c3
- SSDEEP 1536:aaS3thSA83CfRAfc34CtKF8BLisgqX/9fHWIgVv2uHgs:a7tou6O4ZF2OqXNHWjVvVgs
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
e0acb3c17aac695ada5fd83580506ffa0e6972bd8551e961c3f7b6ecc22dc793.exe
- IMPHASH fcf1390e9ce472c7270447fc5c61a0c1
- SHA256 e0acb3c17aac695ada5fd83580506ffa0e6972bd8551e961c3f7b6ecc22dc793
- MD5 19a108b062d1ea7a6e0244317ea5f5d9
- SHA1 95ec7835b3ace9e19182c20109491caddd1f3431
- SHA512 7b36d6db9c344ff837df80230dc868ef2d8f2cfc50905a6ce3c04dd918d99741aadc66a2771179c765c72189975e2882861d17f342a51cb8d7f4fd3335274e5b
- SSDEEP 49152:pbA3qUqorP/wJJyyXno/5Ybc9/vh13cBXhJA9BGgIvC/tJLP:pbYrPFjYbcp9cJhCCCn
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
126016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer
gdiplus
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
Name
.text
Size
196KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
392B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=141, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=199, version=41118,
count=22, id=259, version=24123,
count=19, id=260, version=24123,
count=44, id=261, version=24123,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=268, id=1, productName=Unmarked objects,
count=49, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
e180555303654e1f2b1c0337521988fdccc795a2d6ab246c9b50fee7b98f3012.elf
- SHA256 e180555303654e1f2b1c0337521988fdccc795a2d6ab246c9b50fee7b98f3012
- MD5 c48f0e40d26ae8eb2e362393d33cd3cf
- SHA1 461d5d98f71079d155f64a3e6520ab138fc10c7e
- SHA512 b9711e2aef64796b5ac9afc7e1a6fa7a428171eb6126f3ad1418bd81b895ac7793e956484600e325fb720eabc6e2f82401009f21ee3f6e4b194dd6aad35fcb45
- SSDEEP 768:cMNynmsYyYLrA4wwDZfoKGLVI5gui3pkJfd+p3LmOb+nx46x/ZsV:RAndgEXw9wK4OA5Pp7mtxX/+V
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
e3327c6ff58afd7a0d8d49713b2dea034598ec4608ff26f93059b5ce9ab6981f.r00
- SHA256 e3327c6ff58afd7a0d8d49713b2dea034598ec4608ff26f93059b5ce9ab6981f
- MD5 d28a710b51a68a59e2ca954ed66b5d70
- SHA1 da4efec92244bbe4567b3ae1ec7aea34493f84b7
- SHA512 06ed30aab26f85c3b3445f5235974f327b51a9f6ec8f6643cda68ca1f3410a15619e3b444ceb16ac5f59665e1ade5473900e1337117039eef2d498d4e8f2a761
- SSDEEP 384:DVpYNvltDM5H2osJNXdB/8MCbomzmH92+ZEpGEhzJu0Nd7f:Dgvlto5WNnDupz6/tExJZf
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
e47c0cc3b00de906596cf4e63820d391d4e0e2ccc78a2c4f60cfe8d1991a345d.elf
- SHA256 e47c0cc3b00de906596cf4e63820d391d4e0e2ccc78a2c4f60cfe8d1991a345d
- MD5 6153fdb5e5899070229f1c544ab3d291
- SHA1 cc61abc7d93b729f284efd418dfc815deaef2ba9
- SHA512 cf66e060c87cf967af1f134a20668b3f9aabf2b27f3551c33c529e93e9815dfdbd86eef2435a5c6251a30daea1ecae45f19cd11616729b5880ec65e174971141
- SSDEEP 3072:B7esBFP23rWfOB7ZOOyGgWKmrThPaLEne7rNb:1euCloGgrmrThPaLEne7rNb
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
e5f6faf2edd6464c3c9de112d5b1eb2ebbb4fce6cefd3ebb58fdb67fba948204.exe
- SHA256 e5f6faf2edd6464c3c9de112d5b1eb2ebbb4fce6cefd3ebb58fdb67fba948204
- MD5 e262aa55f81b2df2ca85cbfee5af1602
- SHA1 342f652639413504c1e78663046beff1459e891b
- SHA512 aa250e3353c9adb4b54786d30d72bfe5338070bbd242ae3cead52d917fc5aab60c0668033fb0087710252ab1a80ed303d8e11f08a5ffd056c3d9bd211dfdcece
- SSDEEP 768:Hh3qitxsLKP7GpnQ0ZnwAHLt9V1b2vyWcZ+lvTnNw28aAGN/noO2Mduk7x:B3qRLK2Q0/rmPcZQUu+Mdpx
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
39960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
e741af35bc6e35843115dbe5d50ecfc1ab9cd76ddeb223a79635238b11529141.zip
- SHA256 e741af35bc6e35843115dbe5d50ecfc1ab9cd76ddeb223a79635238b11529141
- MD5 04fef3eadffd06e1b7ad1358dd8b6cde
- SHA1 5a29b7e05287bcb18d79aa9e3a87668c8380c83b
- SHA512 8d6cfdf6a5a9809f321067e633c377bddc15a7db06c1be132782328bef7f81489dcbd07221bda641828d3960c9262b0696a57ab0a0495e58afa19e00fdd9722b
- SSDEEP 12288:OWKVpfXBYGRlXh8bdYLMuhgluhk+HFKVerOQQ6WZHsmtv1:z0fW6h8bDcg3lYrBhml1
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
e98c4cfd56efe46b3de730a430ba2f7adcd30b0988d64f9c9f962383d4e44a68.exe
- IMPHASH 12e12319f1029ec4f8fcbed7e82df162
- SHA256 e98c4cfd56efe46b3de730a430ba2f7adcd30b0988d64f9c9f962383d4e44a68
- MD5 ed5d5872da0c90cfa64cdbf0afe49ee1
- SHA1 cc2c4eefffb205c1e32edffb29818e0dd8cd2781
- SHA512 bf8d29066907220b27ea33fbd3881a448287ca785e0de7c59205804e1ab441a3ca23babd3241888e4651656c54ffcd31c1657eda56805cba57e10e4bd82cbb9d
- SSDEEP 49152:zBzf3qbETi+zmZRY5eFbVg7AojI0/1Tq2kNLbCNcdwTS1sgRAb6vN11cjVG:Njqbexmn1Vg7t/1+xNLbCudRsg+6n1CG
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
128304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
DecodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
LocalFree
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
oleaut32
SysAllocString
SysFreeString
VariantClear
gdiplus
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree
Name
.text
Size
199KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=142, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=253, version=30625,
count=19, id=260, version=30625,
count=23, id=259, version=30625,
count=52, id=261, version=30625,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=277, id=1, productName=Unmarked objects,
count=49, id=261, version=30709,
count=1, id=256, version=30709,
count=1, id=255, version=30709,
count=1, id=258, version=30709,
ec4949fff4b4320c7b50929a7d72b90fc1ca703d39c7819f31ec95a8e7e91ed7.exe
- SHA256 ec4949fff4b4320c7b50929a7d72b90fc1ca703d39c7819f31ec95a8e7e91ed7
- MD5 56a2d00386da57ee39b0d31fd51921db
- SHA1 bf0c4f0b51ccafbbb10286f7aa861cd4411f34b1
- SHA512 e45b9aee08a8c7e9362bfe6bf6950139e6e5eec98eb28aa0534c6c4316ad25d0a290b8bcf1c73ad268fdb21871f083bad18c4aed49e42bab5764e49a547ed637
- SSDEEP 98304:TiMfow8zA1h9eT393YigJhH0yqTu/NWPdHdda9D4oRmKU73TY+1wBb8r66XuI6YG:TijA1HeT39Iig+c0/aFF9odggOLvX7H
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8396
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
512B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
770B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9.3MB
Virtual Size
9.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ed6110fc7d2bb1b2cfee09b42f3796446ed3e562611ab7e3302d00d6c9dca5b2.elf
- SHA256 ed6110fc7d2bb1b2cfee09b42f3796446ed3e562611ab7e3302d00d6c9dca5b2
- MD5 6be7582d2cbfddc38d20e24dfecdcd5c
- SHA1 8b92d7f80d7a4013d4428ceedb7a4b9642057c51
- SHA512 e0f60daadea6562789395e9fe3c566a2ed8e87012398d720d4603bee69455125a8e4bb237525913a25f53d01ab5fee9e33a2e6ee9f4ce3d46beb2d4c7abe4e5a
- SSDEEP 3072:JJfmY2G7ritwheIEaao14C+A/85iTBDUPN5OoCHM/R/z:JJ3xriuhhEaao14C+8RBDUPr3IM/R/z
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
eed7407407a9058c06504a43cc841a5b83cb468a5659b4037b5e0020a477c1c7.elf
- SHA256 eed7407407a9058c06504a43cc841a5b83cb468a5659b4037b5e0020a477c1c7
- MD5 5c859ad4f281481e4b209356abf27465
- SHA1 b0b1c6ab892b4865791c0d641a52f21635fa8e40
- SHA512 ab4fd595a978004b628fabb21dcea3630c330b2b7e0ef7ddb9e0d874a66466396f32f9a64ebdb02a071a865f267530e480b32ddab8774d1a3df877b08e12abf8
- SSDEEP 1536:zP8g2CSJG5mIOd34g1A50Y1jAFrZ4V/3ETVO5bTa6MFjpChUDDl0+wywVFN+S4dw:z0FGE16V1jI45ERO5bTKhpCyevQP
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
ef5c5bc8a2823eded5167c858c649dc6509f653109fe7a45be71bae0474c70f9.elf
- SHA256 ef5c5bc8a2823eded5167c858c649dc6509f653109fe7a45be71bae0474c70f9
- MD5 f2da4a3be1b42f5d698838f170cc38ed
- SHA1 c4344a474578240b68b329e763944302988f17e5
- SHA512 536a33e6c8d28d043c7d82e5590625682c99ee0b27883a04d311bd6b0abcb54bb5ba003143bad2eeed042584060d774c25c5871c07fe38e7b884e3108f80511c
- SSDEEP 3072:f6uSXvJnzjP0jCxzpyi579Yxy52tIen9A6qewZQKhaMh:f6uSXvJnvP0OxzYigAEnfqnZphaa
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
efe8773c0e8f211fc8a8a8fe4d033d5dcd03556d2c9b9a31028a77f9f4f0a00d.elf
- SHA256 efe8773c0e8f211fc8a8a8fe4d033d5dcd03556d2c9b9a31028a77f9f4f0a00d
- MD5 3c13ebf19ecca4ddaaa0133a5790caf4
- SHA1 6051db5ed2418068b4c76b49988d7030759bfc22
- SHA512 4ac557d0a585ee5ee0a1343c5ec4a0394f5084b8d33bb1e70f7bd7c8e9ca2385698ad2dbe042ffb8e4ad064c513143e9c65aed9fa110e8130122fb23ee3a79fe
- SSDEEP 1536:oFd1IRgCXUzx7t0fM6lTgcEiyhcgSnyy72wPZnWhZS5xtY+A:oFdmR9XUzxh0fMQTgcEim8yHAdew5bA
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
f06ca39ee01d7599cbeaad5da92e51d282f5e6ae6a8375e9e3b819fd793c6070.exe
- IMPHASH 14a56f4323bef2c2e58c808d9d77b789
- SHA256 f06ca39ee01d7599cbeaad5da92e51d282f5e6ae6a8375e9e3b819fd793c6070
- MD5 117fe02970e46e72906062836e75a8f1
- SHA1 d199329edea5fc3f5f185f6e65010f6aa99e612c
- SHA512 37ff7186653667806d2812fcec2b9c5867ca50aa20451d312ac27a7487a1ecbde348dc1e4526b994c7de2f37033f6cde896965e3387ea4b88fb784806d397a0f
- SSDEEP 12288:qXrz3IloEtdx/wA958n69xVO/MWqne+ljm:qXrzYyEF7+nOxVfWq
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
230611
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualProtect
GetProcAddress
Sleep
VirtualAllocEx
WaitForSingleObject
LoadLibraryA
CreateThread
lstrlenW
VirtualAlloc
FreeConsole
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
CreateFileW
RaiseException
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
HeapSize
WriteConsoleW
Name
.text
Size
340KB
Virtual Size
339KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
345KB
Virtual Size
344KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
f0ee3752736d8d62f1731e60c26db491dfec0fffe85075b6757ddda257056bee.elf
- SHA256 f0ee3752736d8d62f1731e60c26db491dfec0fffe85075b6757ddda257056bee
- MD5 e98dc784f23bd67840fd526934f1d37a
- SHA1 7dbc330cdd0c57741a3d0b59c7b1f6f11671e052
- SHA512 c0af3c040f69dcd92e58499aa18b3831487fcb219ad83b0925dcddbf3fefae5eb8d4ce97432c12da2b6c8142407773e5c5fc81fc9447f9a88072866298539040
- SSDEEP 3072:g1DVLql1Q/noJrllehTmvkt4lb5hLDMzruH0yQGblMh7ojwQQRh6RYAvZR:MTmvJlb5hLUruaojwQQRh6RYAvZR
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detected Gafgyt variant
f0efcd8945cee60e24c6642fdba101d894c182f60ca05d8a011890974ec5499a.exe
- IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
- SHA256 f0efcd8945cee60e24c6642fdba101d894c182f60ca05d8a011890974ec5499a
- MD5 2f2f7e4c70d86138b7ba51b1b0e36f97
- SHA1 493d3a12fc9a3f49ec8a3e7439e720e38fee4f1f
- SHA512 f7bfb4fa7461d4ff09bc18ee1b880f0466edddc139ba8f6a346fc64e2190edb738e7d8b1ddb2f8601b01e1f25ae9c2f66727b6f699fd252a004372eb30fb37b9
- SSDEEP 98304:YaFfxykvp4JMeAO7r6ang7zkNTjw5t46XXH9jVaCM8aWnbTt1jmaapWbkUz:YufxymWJMihxU53HH9LaYSfukU
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
52527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
ole32
OleInitialize
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
f1177ed5175645c04536f34ceb702a955e53f5aebbc0df99a71ee3f9e6f2db7a.elf
- SHA256 f1177ed5175645c04536f34ceb702a955e53f5aebbc0df99a71ee3f9e6f2db7a
- MD5 c451e6052e11308da8ecea0b1f97eb33
- SHA1 2f5da733b821d859fb8f20a9f7f3ee489971b5e7
- SHA512 0f9b0871f3178202f2d9bffbc631ab781f5c388f3d2e394c687edc6c1ddcc45437f66e00a7631910cc2889a10546393cf056b6d74f676acc248dc865cffdb723
- SSDEEP 1536:2JGQevkxS6h9+GUWvQ2uBSVCc/62vwmZtSwz:2Jzskk6uEnuQCGLvnz
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
f2fa5a8697826c7c7c292cf2b646dd74a26048b810583d32c0eeea36f15e6ae4.elf
- SHA256 f2fa5a8697826c7c7c292cf2b646dd74a26048b810583d32c0eeea36f15e6ae4
- MD5 6e020b8330ffef72ba4065ce35fbc382
- SHA1 96860a664552d6fe5534269696ce8c781dd65820
- SHA512 4919e68061977250c2a122396f136b26d4e049b76ab497028333ce75c86750755b41ddadf69177731a8b26226a43451272715d0c3c4820b887f8c3f7e25992d5
- SSDEEP 3072:rEc5rYXUOoDouXWxxmvlaIsVVCk8ZuRBh:rEBXpluXexm9adOZuRBh
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
f510c5adad382a960167228ddd818c4599a96a7cea5f0ac37cdb9f57f97692c4.elf
- SHA256 f510c5adad382a960167228ddd818c4599a96a7cea5f0ac37cdb9f57f97692c4
- MD5 9a4f8fda3e6385e12840513e03330cbe
- SHA1 b847846e068b37da12773e56d31e6384fc56d30a
- SHA512 f9be6a15420096221597b04b2ab9cfabefecbf64c6a3b34c063b9e95275655f4680d4743d13058ba169f56233076a4aedd0737f0a086a23d060d9483b8ea3210
- SSDEEP 768:6y9uLceCskUZFil04fTDFOl09LmQskaGxQiML47bTkQeByZQkbuw:6LQshbTCT5y0hmQAG6vUHsBp2
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
f8ddcfdadfced3f3f98483aeb191fa8d7a2314c5156dc2a52bde756ac3358977.exe
- IMPHASH fb0a8b4a81655f744a37af985e009476
- SHA256 f8ddcfdadfced3f3f98483aeb191fa8d7a2314c5156dc2a52bde756ac3358977
- MD5 b333b92976e460b646930e33ada1a821
- SHA1 00ccd76fa7af92e44029c547514345373d779bea
- SHA512 d47e2a80aadaedae6145023f7206fee01d3780de5f3179fed245105a1d885f31fa79fc0e86d07726bac0eaae33bac75f483ee1eb8271dfc77f31831fe9f33bfd
- SSDEEP 49152:EX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeK5J:ElRsZ47/QXoHUOfAoj1nH
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1940876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\MeshAgent\MeshAgent\Release\MeshService64.pdb
comctl32
InitCommonControlsEx
dbghelp
SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump
iphlpapi
GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo
ws2_32
WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select
crypt32
CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore
gdiplus
GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup
ncrypt
NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey
kernel32
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer
user32
EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect
gdi32
SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject
advapi32
CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus
shell32
ShellExecuteExW
ole32
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
981KB
Virtual Size
981KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=176, id=243, version=40116,
count=38, id=242, version=40116,
count=1, id=199, version=41118,
count=10, id=259, version=24123,
count=33, id=261, version=24123,
count=25, id=260, version=24123,
count=496, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=209, version=65501,
count=1, id=208, version=65501,
count=29, id=203, version=65501,
count=398, id=1, productName=Unmarked objects,
count=53, id=264, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
f986080126053f75b9e364d584fd9ef321858356610066c3eb4b3be37e809581.elf
- SHA256 f986080126053f75b9e364d584fd9ef321858356610066c3eb4b3be37e809581
- MD5 9a0b3958ac5d86418a18bd0578aa1dbf
- SHA1 660f59f7d1248a0c3a7a3696de6c0d34e5a39af0
- SHA512 83f3986edf71f08c007a9ac0b3305bf4402faf48a04584b0664de6268cfb188fc6eebba6ae21c263d16f7dd5f7580f3323320036db63768fb14d42ec70dce07d
- SSDEEP 1536:1yYuo0CcN/V82+0wtrC8LnrZbu1OTCImGCz2wgxaSFDI:1yYuJd0J0wtr3Z/T5mJ7SxI
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
fca1c84d387959435ca272cd08a56301b08610279a787efa38f1d023dad28119.elf
- SHA256 fca1c84d387959435ca272cd08a56301b08610279a787efa38f1d023dad28119
- MD5 a2dea167aa9b33e6fb601ac55c6f8bc0
- SHA1 c59bf88b2b0078baec4bf4de1b867f5f2bd83009
- SHA512 383a38d45458b5e4ab2850a273b0c3810b7580b3133f52664b1ec1d9dddf06740c46170154677ecdc83c4d49a16972f2da9dddc216dca7840bb7f9575af6bf84
- SSDEEP 3072:nv66zeDyxRyCfaoeZh5unJooELSWabmOwvWvviM/99xodwx:nvbzv3jfaoeZh5gJqS/KlvWvKM/9zodQ
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
fce4211fa64e7c108ca2cf317e8f76bdf2cedd7f09283ad161a2befa755e48cc.jar
- SHA256 fce4211fa64e7c108ca2cf317e8f76bdf2cedd7f09283ad161a2befa755e48cc
- MD5 70004f284e51564d15708ab7c1bf17e9
- SHA1 487c2a1381d2babb13fc0b90d047094d56aba2cb
- SHA512 a6373f3938faa46acda9d4a2c5a8d49b151a9c5ba3809673fb7f01bfbc8f4a4df1c7981b979a55faacd00694324110b123b59cee394faeefac0f50dff6c00eda
- SSDEEP 3072:j2maG9KjdT2cq5zlm9ckZEhwFlVIxNKSR/E+WvSSrQPg3XyBIkRLkh7s3VPLDu/:CG9Kp2cqgckZEhwRIxNKSRc+WvLjCBpg
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
ff750e0026cb14b5121b065eeba0b573b847aebb030f934c82c330bf1192716a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ff750e0026cb14b5121b065eeba0b573b847aebb030f934c82c330bf1192716a
- MD5 710abec1c1b5bf284b6bce11e64d1e0d
- SHA1 da771d36e6f7e009563b09cfb92c8930dae28d56
- SHA512 66102200ddfbd3964f000bc916cbd57207050038345111f401096905caf37738acb3e92e50d3117bb07f5c4f375052f9c9ca125feddeb49e417765302a2ce8d9
- SSDEEP 768:qoIUbME2Mi8XnOH3DlindvOg5Brb4g5diS9k5mYIP+w10xTpt3Yk7SkqQB5pxThX:OKMzMi8+xaJB5d4WiS9k5mYFwapr7bBX
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ