NotMyFault.zip
- SHA256 e26db5a12a6e1f83085cc40446a0b8fb6e322b989c46f4cb649a955682c15de4
Static task
static1
General
- Target NotMyFault.zip
- Size 1.4MB
- Sample240427-tsz37sch49
- SHA256 e26db5a12a6e1f83085cc40446a0b8fb6e322b989c46f4cb649a955682c15de4
- MD5 3098d0f7a888949089cdfb9351904303
- SHA1 ca50aef1aff4b17be449ec7276b01ba728ca7c6f
- SHA512 2a0972c2d7854c6b84a1f68dc437f99b7cbb4cd03a46f275c30d5f0c80f6140bceb33cdc29e7ec96e4ff76796e388090b46112e709e6736bb0fe388c64dacff2
- SSDEEP 24576:OpJA0obRiRMjQ8rrifP+cNjoWrb7CWzSvZ7nToHL/dWP10N7XaBI4XuB8R:OpqTNNxQWcNjNXCWY7n2YP10N7XaO4+o
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
NotMyFault.zip.zip 1.4MB
-
Eula.txt7KB
-
notmyfault.exe.exe 299KB
-
notmyfault64.exe.exe 339KB
-
notmyfault64a.exe336KB
-
notmyfaultc.exe.exe 757KB
-
notmyfaultc64.exe.exe 955KB
-
notmyfaultc64a.exe1.2MB
Eula.txt
- SHA256 8329bcbadc7f81539a4969ca13f0be5b8eb7652b912324a1926fc9bfb6ec005a
- MD5 8c24c4084cdc3b7e7f7a88444a012bfc
- SHA1 5ab806618497189342722d42dc382623ac3e1b55
- SHA512 6c74bed85638871fd834b30183e1536e48512dd0f8471624732ac1b487f0eba34dec99f88d2d583335f66df543d5fabf4b8c9456255df2248a4c086f111f0baa
- SSDEEP 192:RCVPxjERdQe/lb9iLbRvhSXH3DsDw3zF55Mz6h:RcFERdXlRiLbujuw3zF55jh
- MD5 SHA1 SHA512 SSDEEP
notmyfault.exe
- IMPHASH 71d2b333657c418a4fc6bf14257a63e8
- SHA256 41ddb886060471d702693cbff1e7aa73c8ada5b29d9ee313de9972ab663a100d
- MD5 833d5bbdf80d17a384e9b27798ea4d6c
- SHA1 4ab55a97e76fd2cdb55ed305c984d87e9a06b1b1
- SHA512 ae0011fd58b09f752d2c1a926b8740780798cd17b2704adb666826d8334e07208ceaac661122c8d7ac82178f3f39aee2ac2724776e96dfd3ee526d9e98a82ec8
- SSDEEP 6144:whvkHmbGp7MCvRDlfJHbwZCjO0fNg1iyk:whMGbGlR5Pm1i/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3d:4a:fd:5f:cc:44:47:79:e5:95:57:87:b2:7e:3e:35:bb:75:03:af:00:2d:5f:df:22:75:29:da:bf:b7:13:77
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
16347
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\1\s\exe\Win32\Release\NotMyFault.pdb
shlwapi
StrFormatKBSizeA
comctl32
PropertySheetA
kernel32
VerifyVersionInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
FindResourceA
ReadConsoleInputW
SetConsoleMode
CreateFileW
WideCharToMultiByte
ReadFile
GetConsoleMode
LoadLibraryExA
FlushFileBuffers
LCMapStringW
FormatMessageA
MulDiv
LoadLibraryA
SizeofResource
LockResource
LoadResource
FreeLibrary
GetPhysicallyInstalledSystemMemory
GetTickCount
GetSystemInfo
GetCurrentProcess
DeviceIoControl
SetFileAttributesA
DeleteFileA
GetEnvironmentVariableA
GetLastError
VerSetConditionMask
CloseHandle
SetLastError
CreateFileA
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleA
DecodePointer
GetCommandLineW
GetStdHandle
GetModuleFileNameW
GetFileType
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
WriteConsoleW
GetConsoleOutputCP
GetVersionExA
SetEndOfFile
ReadConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
SetStdHandle
ExitProcess
GetModuleHandleExW
GetConsoleCP
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
WriteFile
HeapAlloc
HeapFree
user32
InvalidateRect
ReleaseDC
GetDC
DrawTextA
KillTimer
SetTimer
SetFocus
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
ShowWindow
PostQuitMessage
PostMessageA
FillRect
wsprintfA
LoadCursorA
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextA
GetDlgItem
EndDialog
DialogBoxIndirectParamA
SendMessageA
MessageBoxA
RegisterWindowMessageA
gdi32
SetTextColor
SetBkMode
SelectObject
DeleteObject
DeleteDC
CreateSolidBrush
CreateFontIndirectA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
EndPage
StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
comdlg32
PrintDlgA
ChooseColorA
advapi32
RegQueryValueExA
RegGetValueA
RegFlushKey
RegDeleteValueA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
StartServiceA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
RegSetValueExA
RegQueryValueExW
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
shell32
CommandLineToArgvW
Name
.text
Size
129KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=165, id=261, version=30795,
count=20, id=260, version=30795,
count=38, id=261, version=31616,
count=17, id=260, version=31616,
count=20, id=259, version=31616,
count=19, id=257, version=30795,
count=190, id=1, productName=Unmarked objects,
count=4, id=260, version=31630,
count=3, id=261, version=31630,
count=1, id=255, version=31630,
count=1, id=151,
count=1, id=258, version=31630,
notmyfault64.exe
- IMPHASH 299a958cc3ab9ff9641c86b34f45977e
- SHA256 817cd2e8846c5d90782017a7f29daf7915e5e38e6dd165fb81cdd4642e90f218
- MD5 c338b6fd5b568411039d8a46394133cf
- SHA1 06a684c8e8ec66396db2685c0419c8bfb78b1220
- SHA512 161f6746bb526a9a1af8d581ccec796119ea0f2d6d7608a12248c698ec9fc1803afd79f162cdc59357a75a3744ad9363c9ba92ed73dc7c04b14523d54a584b18
- SSDEEP 6144:M0tmWXSbO1mP1xqDxcW2JjusYmCjO0fNgl:M0tmNb+mLceu9ml
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
63:52:bd:47:a7:b1:f8:dd:ff:f7:d8:82:e1:6d:8c:c9:e4:02:bf:e6:85:82:15:33:fd:a0:72:b1:74:6c:7c:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
18504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\1\s\exe\x64\Release\NotMyFault64.pdb
shlwapi
StrFormatKBSizeA
comctl32
PropertySheetA
kernel32
VerifyVersionInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
FindResourceA
ReadConsoleInputW
SetConsoleMode
CreateFileW
WideCharToMultiByte
ReadFile
GetConsoleMode
LoadLibraryExA
FlushFileBuffers
LCMapStringW
FormatMessageA
MulDiv
LoadLibraryA
SizeofResource
LockResource
LoadResource
FreeLibrary
GetPhysicallyInstalledSystemMemory
GetTickCount
GetSystemInfo
GetCurrentProcess
DeviceIoControl
SetFileAttributesA
DeleteFileA
GetEnvironmentVariableA
GetLastError
VerSetConditionMask
CloseHandle
SetLastError
CreateFileA
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleA
GetCommandLineW
GetStdHandle
GetModuleFileNameW
GetFileType
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
WriteConsoleW
GetConsoleOutputCP
GetVersionExA
SetEndOfFile
ReadConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
SetStdHandle
ExitProcess
GetModuleHandleExW
GetConsoleCP
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
WriteFile
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
user32
InvalidateRect
ReleaseDC
GetDC
DrawTextA
KillTimer
SetTimer
SetFocus
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
ShowWindow
PostQuitMessage
PostMessageA
FillRect
wsprintfA
LoadCursorA
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextA
GetDlgItem
EndDialog
DialogBoxIndirectParamA
SendMessageA
MessageBoxA
RegisterWindowMessageA
gdi32
SetTextColor
SetBkMode
SelectObject
DeleteObject
DeleteDC
CreateSolidBrush
CreateFontIndirectA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
EndPage
StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
comdlg32
PrintDlgA
ChooseColorA
advapi32
ControlService
RegGetValueA
RegFlushKey
RegDeleteValueA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
StartServiceA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
CloseServiceHandle
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
shell32
CommandLineToArgvW
Name
.text
Size
146KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=162, id=261, version=30795,
count=10, id=260, version=30795,
count=40, id=261, version=31616,
count=16, id=260, version=31616,
count=9, id=259, version=31616,
count=19, id=257, version=30795,
count=198, id=1, productName=Unmarked objects,
count=4, id=260, version=31630,
count=3, id=261, version=31630,
count=1, id=255, version=31630,
count=1, id=151,
count=1, id=258, version=31630,
notmyfault64a.exe
- SHA256 9526f9d840f43f702181d5f77d201f27bf2ec38274ac73703a8df6d6264b68a5
- MD5 2f215d219aeab3d6b3ff357a0fbe53e7
- SHA1 1fd769b02426ad459c5af6a77b3f2dad3b7388e0
- SHA512 b2ad375986f55b30ffc154b7452b622bba2d825ec7f8d5cca29927c01af8cc867c712ca6ba8c76ae8cc8b8657aadcb68ddbda8e717e810c386dfb71bad21e162
- SSDEEP 6144:1xKo1JblDGWQB6Ap8MGEdgRF/lwXPVCjO0f09j:SKpQc48MGEdiwSc
- MD5 SHA1 SHA512 SSDEEP
notmyfaultc.exe
- IMPHASH 1876849667143b24d30c9cae3eb8084a
- SHA256 6454a6f2bb7b5eea6c5e524fc3df5e93f77c2fbe17892679e458cac0d2a33adc
- MD5 0e3a8bbc35cf4178d96ad9d2468481fb
- SHA1 c088537bb62afd6b4bb337b0d69b6579af20eb2b
- SHA512 08731ba1696da906c0cb417a8d5d00407ef1957a57099811ba131a71fe127931e1530091001707b3576d0d33c71c33a0b6f1c59c457fa2953b34af27b01e9132
- SSDEEP 6144:4hk22I+KQBf4t2WtIO7BCo0PyoGyzQAv+GY/lTafkzEbuNXZWfe7mafCjO0f4fq:4G2t+Kt3tIOYpjGO+lNaVbuNXukooq
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
07:b5:3a:3d:63:42:f4:70:32:5e:1a:d4:20:e8:2f:7b:85:2c:f2:5e:ac:d9:89:22:f7:dc:29:f7:6d:a4:9c:eb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
4471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\1\s\exe\Win32\Release Console\NotMyFaultC.pdb
version
VerQueryValueW
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
kernel32
GetCurrentProcess
GetSystemInfo
GetTickCount
GetPhysicallyInstalledSystemMemory
FreeLibrary
LoadResource
LockResource
SizeofResource
LoadLibraryA
FormatMessageA
FindResourceA
Sleep
CloseHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
CreateEventA
WaitForSingleObject
DeviceIoControl
SetFileAttributesA
DeleteFileA
VerSetConditionMask
GetEnvironmentVariableA
VerifyVersionInfoW
GetLastError
CreateFileA
LoadLibraryExA
GetVersionExA
SetLastError
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleA
GetCommandLineW
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
GetFileType
GetProcessHeap
SetConsoleCtrlHandler
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
DecodePointer
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
SetStdHandle
ExitProcess
GetModuleHandleExW
GetConsoleCP
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
WriteFile
GetCommandLineA
HeapAlloc
HeapFree
GetTempPathW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentThread
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
WideCharToMultiByte
CreateFileW
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
PeekConsoleInputA
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
OutputDebugStringW
user32
wsprintfA
LoadCursorA
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextA
GetDlgItem
EndDialog
SendMessageA
DialogBoxIndirectParamA
gdi32
StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
EndPage
comdlg32
PrintDlgA
advapi32
RegGetValueA
RegFlushKey
RegDeleteValueA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
StartServiceA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
Name
.text
Size
524KB
Virtual Size
524KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
270B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=165, id=261, version=30795,
count=20, id=260, version=30795,
count=38, id=261, version=31616,
count=17, id=260, version=31616,
count=20, id=259, version=31616,
count=13, id=257, version=30795,
count=159, id=1, productName=Unmarked objects,
count=4, id=260, version=31630,
count=3, id=261, version=31630,
count=1, id=255, version=31630,
count=1, id=151,
count=1, id=258, version=31630,
notmyfaultc64.exe
- IMPHASH 35183cea407883c8fcd73669c0a3536a
- SHA256 1f4dfe0f4e7421cf2fc7c0b57138c12d65f02b5edf6ee86f5d7627a1d5a4bad4
- MD5 08b89d543c173fc2adae048784fe618b
- SHA1 6002f6ec3858c4925b41c7470ac584c0d616116f
- SHA512 bc4b5198d18fea618be96f8993c7dbf8399cf47262989e5495bef7c9516cc24cdc902d6f5c5931cc2bbf4c57893c45c8986ea0f5353f950f9712aaae411703fe
- SSDEEP 12288:HWE64y4d4tn9xiiPMwmbkurRRD+YEtDYnV:zCB9gembkuHDPExYnV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
51:09:f6:6c:5b:dd:45:dd:70:a3:f2:83:ae:24:f3:4d:a9:9b:65:59:b6:e6:ec:71:2f:2e:b4:b4:63:1f:f5:00
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
13636
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\1\s\exe\x64\Release Console\NotMyFaultC64.pdb
version
VerQueryValueW
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
kernel32
GetCurrentProcess
GetSystemInfo
GetTickCount
GetPhysicallyInstalledSystemMemory
FreeLibrary
LoadResource
LockResource
SizeofResource
LoadLibraryA
FormatMessageA
FindResourceA
Sleep
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
CreateEventA
WaitForSingleObject
DeviceIoControl
SetFileAttributesA
DeleteFileA
VerSetConditionMask
GetEnvironmentVariableA
CloseHandle
GetLastError
CreateFileA
LoadLibraryExA
GetVersionExA
SetLastError
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleA
GetCommandLineW
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
GetFileType
GetProcessHeap
SetConsoleCtrlHandler
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
VerifyVersionInfoW
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
SetStdHandle
ExitProcess
GetModuleHandleExW
GetConsoleCP
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
WriteFile
GetCommandLineA
HeapAlloc
HeapFree
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentThread
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
WideCharToMultiByte
CreateFileW
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
PeekConsoleInputA
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
OutputDebugStringW
user32
wsprintfA
LoadCursorA
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextA
GetDlgItem
EndDialog
SendMessageA
DialogBoxIndirectParamA
gdi32
StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
EndPage
comdlg32
PrintDlgA
advapi32
RegGetValueA
RegFlushKey
RegDeleteValueA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
StartServiceA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
Name
.text
Size
651KB
Virtual Size
651KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
132KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
1024B
Virtual Size
671B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=162, id=261, version=30795,
count=10, id=260, version=30795,
count=40, id=261, version=31616,
count=16, id=260, version=31616,
count=9, id=259, version=31616,
count=13, id=257, version=30795,
count=167, id=1, productName=Unmarked objects,
count=4, id=260, version=31630,
count=3, id=261, version=31630,
count=1, id=255, version=31630,
count=1, id=151,
count=1, id=258, version=31630,
notmyfaultc64a.exe
- SHA256 c5fe16b105fb91c77bf1e7bdb1030cce0b015a00304a5ad6663af305501b2fab
- MD5 097564d06f04a4a6e93a94a98aedce41
- SHA1 9e19b1e5a819b185d79858534b0c7fd01675e8ab
- SHA512 e50e5cc26ddd928a86e8bd5c84b1ff1011ee1695a1e50f83e8cfd7844a524038efdf2812fd9017b7c0292ada6aa7c9bb3561de3fc8f4491d4c312131c0b3256b
- SSDEEP 12288:nr//+HadzaFxwb+IesokN4696/EVjUE+iS0a842IMFEymEIvh8EW:3UZAa+C8EW
- MD5 SHA1 SHA512 SSDEEP