Ardamax Keylogger 4.0.zip
- SHA256 f804b40b0aa9a45cd51200b89d03ec0d9a89a4b4422df090fe8414e5c73cc1c0
Overview
overview
10Static
static
7Ardamax Ke....0.zip
windows7-x64
1Ardamax Ke....0.zip
windows10-2004-x64
1Ardamax Ke...al.txt
windows7-x64
1Ardamax Ke...al.txt
windows10-2004-x64
1Ardamax Ke...ch.exe
windows7-x64
10Ardamax Ke...ch.exe
windows10-2004-x64
10Ardamax Ke...kl.exe
windows7-x64
7Ardamax Ke...kl.exe
windows10-2004-x64
7$PLUGINSDI...ol.dll
windows7-x64
7$PLUGINSDI...ol.dll
windows10-2004-x64
7out.dll
windows7-x64
1out.dll
windows10-2004-x64
1$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...er.bmp
windows7-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows7-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
31.dat
windows7-x64
31.dat
windows10-2004-x64
32.dat
windows7-x64
32.dat
windows10-2004-x64
33.dat
windows7-x64
33.dat
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Ardamax Keylogger 4.0.zip
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ardamax Keylogger 4.0.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/Patch/Serial.txt
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/Patch/Serial.txt
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/Patch/ardamax.keylogger.4.0-patch.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/Patch/ardamax.keylogger.4.0-patch.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/install_akl.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/install_akl.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
out.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
out.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/DcryptDll.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/DcryptDll.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20240419-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
1.dat
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
1.dat
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
2.dat
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
2.dat
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
3.dat
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral32
Sample
3.dat
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Ardamax Keylogger 4.0.zip
- Size 2.5MB
- Sample240430-t97vdaba4z
- SHA256 f804b40b0aa9a45cd51200b89d03ec0d9a89a4b4422df090fe8414e5c73cc1c0
- MD5 3638863969e24cf4d2af8124e030b906
- SHA1 1503f80640140ea96da52a6fc2ad65b74580e475
- SHA512 ed3588b345f1386b6d6de0936d5a811c82300ae596733e36c2ea931b085c00bb205e8282bc1317478c35423b9b069c2f15f3cfe16dca22350bcf99c28eabba6a
- SSDEEP 49152:FDRomxAvKc6vqBYWOxQ2VjEaqcT8H1TTBZPvpf19ZHXdzRNo0C7TPz:BRoc/cS4YWOQyjEM8lBXf1/HX5Ri0CHz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack002/$PLUGINSDIR/AccessControl.dll acprotect -
resource yara_rule static1/unpack002/$PLUGINSDIR/AccessControl.dll upx - Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack001/Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/install_akl.exe unpack002/$PLUGINSDIR/AccessControl.dll unpack003/out.upx unpack002/$PLUGINSDIR/DcryptDll.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/UAC.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack002/$PLUGINSDIR/nsExec.dll unpack002/Uninstall.exe unpack004/$PLUGINSDIR/UAC.dll unpack002/lzma.exe - NSIS installer 4 IoCs
resource yara_rule static1/unpack001/Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/install_akl.exe nsis_installer_1 static1/unpack001/Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/install_akl.exe nsis_installer_2 static1/unpack002/Uninstall.exe nsis_installer_1 static1/unpack002/Uninstall.exe nsis_installer_2
File Explorer
-
Ardamax Keylogger 4.0.zip.zip 2.5MB
-
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/Patch/Serial.txt72B
-
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/Patch/ardamax.keylogger.4.0-patch.exe.exe 1.1MB
-
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/install_akl.exe.exe 1.5MB
-
$PLUGINSDIR/AccessControl.dll.dll 8KB
-
out.upx.dll 14KB
-
$PLUGINSDIR/DcryptDll.dll.dll 18KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/UAC.dll.dll 13KB
-
$PLUGINSDIR/modern-header.bmp25KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
1.dat956KB
-
2.dat36KB
-
3.dat24KB
-
4.dat337KB
-
Uninstall.exe.exe 51KB
-
$PLUGINSDIR/UAC.dll.dll 13KB
-
$PLUGINSDIR/modern-header.bmp25KB
-
data16B
-
lzma.exe.exe 63KB
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/Patch/Serial.txt
- SHA256 293d1e093df996a037d7113bfbaf604dfe9916c98d323e382a1c4f5caa0d6c69
- MD5 717e011ae782156ed6f06e1e64e689ae
- SHA1 811d09a8e7fa14bd1a952fd00a9aad1ec6542c19
- SHA512 58d5095117e3e2d92795bda1d160032d26a024ab3ceaff51277108abe854842b5cc75b750d2efff8b90f8a0d94f98c5207e9199dd3634eee33cf86af119a42d9
- MD5 SHA1 SHA512
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/Patch/ardamax.keylogger.4.0-patch.exe
- IMPHASH dc73a9bd8de0fd640549c85ac4089b87
- SHA256 dd2b0a0ad91ec54c644acc338074f3b8a8cea431a2f8f9ec14b5beed65e1baa3
- MD5 0e9bbf3419efd1d9be9a405f4f65ae5b
- SHA1 30cf22bf6656a156ba4f399673382af58f31444e
- SHA512 75dcb0b176f494e4e9e7d705152e34be6ab2f9826a1f3f7dcac95b7bf8c66e5d85173450968974fcb9cb02c1143e2c0908d4e117ad56a55e384304d9c10fec8c
- SSDEEP 24576:u3sA36quTADSOsCQOxCzE/XpGhs9SqfQ0+IvMk0XFROXAfy67E:u8LtONx/5zUwQ0jgXbOyyt
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
6a:85:03:b4:48:ad:4e:d8:5c:8f:31:99:e8:97:d9:01:59:8b:b1:09
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=AoRE Team \ ,OU=Acunetix Development Department,O=AoRE Team \ ,L=Ta' Xbiex,ST=Malta,C=MT
Chains
Jul 4, 2012
Subject
CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA
Serial Number
0a
Issuer
CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Aug 6, 2003 - Aug 5, 2013
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=AoRE Team \ ,OU=Acunetix Development Department,O=AoRE Team \ ,L=Ta' Xbiex,ST=Malta,C=MT
Serial Number
6a:43:bc:c9:22:92:c6:06:2d:36:aa:3f:5e:30:23:90
Issuer
CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
May 21, 2010 - Aug 7, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Minor OS version
0
Major OS version
5
Entry point
4139
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile
Name
.text
Size
512B
Virtual Size
502B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
82B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=17, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/install_akl.exe
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 4bc86c4f344c2e7f607e280d3e8efca5efd7f9c2066c006505278e3d75cc1229
- MD5 2c89ae0ecee4942362b964cfb4d46e09
- SHA1 6760f0fc9bdd9fa37d77a0bcae9d8c19608a9530
- SHA512 c1d9666b5d5b432c12c96bcf5e819c4a5b8182f596f00973f5c7b08cf41e7a5c9664fcff3011c727a7fa77e4351d55142906860613d903a996720b9e849011e3
- SSDEEP 24576:s6Z+1GMIDTY9sMWCb6EmJe98VqQoYV7eEX+xMhjeH53XGwU/oH9t9FrJrX/rns83:7ZYuTY9EG6zA98CYJeEZjkowU/oH9t9F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12491
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/AccessControl.dll
- SHA256 8a8f5bafc105186c85f14e017ab6da33ae8f88a9635e51756f90b6d95381d80d
- MD5 9f1a88b953fd2a2c23b09703b253186c
- SHA1 29d5a5a24e7f782a07e9f5d2ec1d1a6218fec737
- SHA512 10b3a812c92b7324bddcd23adf923fcaec2532f31bdd9fbf17494fc33f99aa0a0a48b94f1fdd6599fa0189567626a90b324a1d132bf9cb8b00a6afc547e64018
- SSDEEP 192:RmcLe8uWVNz5ZalBK/7rUlYg5q5LcywvX5:RJdNzMKXUlYg5qPq5
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33616
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ClearOnFile
ClearOnRegKey
DenyOnFile
DenyOnRegKey
DisableFileInheritance
DisableRegKeyInheritance
EnableFileInheritance
EnableRegKeyInheritance
GetCurrentUserName
GetFileGroup
GetFileOwner
GetRegKeyGroup
GetRegKeyOwner
GrantOnFile
GrantOnRegKey
NameToSid
RevokeOnFile
RevokeOnRegKey
SetFileGroup
SetFileOwner
SetOnFile
SetOnRegKey
SetRegKeyGroup
SetRegKeyOwner
SidToName
Name
UPX0
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=48, version=9044,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=41, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 39b62bf74ace31d2d8041bf1748e3d83ad0b0b674dc7600b651164f748a38667
- MD5 5173088bda257c4f549247031a21caab
- SHA1 e6f3c1c3b1d5d53f6adb23cf9a264b8f5d0dc479
- SHA512 01f14c768ba2f9f11c5e344ba44b75dafe486e7742ca8896e0a985d80b71192336e2472f7a2be17801fe0c753bd1eddc8494af53dc436ab727ed3d0fa3c7ae9f
- SSDEEP 192:ThzPKgdc4SN+XIjjAZaK26N6dlJmclFcyw:ThzPM0/aAUF9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4152
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=48, version=9044,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=41, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/DcryptDll.dll
- IMPHASH 322977d1ab076375f887588994151f0a
- SHA256 e1691357acd27f45b0e09e07a0f1b7118205ee14f76918de406c83e157b18737
- MD5 1e2a7f9a7ec8733f758083d2d3d36f94
- SHA1 41fbde9dafc13291bb1fdcfc48fbd9f5d97b443a
- SHA512 7f647a84a4c7dc11841bc1b2ec794281b30d605b75d8ef7d49ef7e216c85d4902c5fb7b8dd2a1dbd535efbfdd767913ff0aa61611ee53fcbb88a2405200e7297
- SSDEEP 384:kZyQSewDbPmRqcXx2kMPrd9cbkUmR08EM26:kbtwnmR/xQdckUSEM26
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
10783
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcmpA
CreateFileA
lstrlenA
DeleteFileA
WriteFile
ReadFile
GetFileSize
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
lstrcpynA
GlobalAlloc
GlobalFree
lstrcpyA
Decrypt
HexDecoder
HexEncoder
LoadStr
MD5Hash
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
942B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=137, version=30729,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=19, id=1, productName=Unmarked objects,
count=6, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
$PLUGINSDIR/System.dll
- IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10544
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=42, version=8803,
count=4, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/UAC.dll
- IMPHASH 55a6a096df3564193c302728985d6bda
- SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
- MD5 431e5b960aa15af5d153bae6ba6b7e87
- SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
- SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
- SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateProcessA
GlobalAlloc
lstrlenA
GetVersionExA
SetLastError
GetProcAddress
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
UnmapViewOfFile
WaitForSingleObject
GetCurrentProcessId
GetLastError
DuplicateHandle
SetCurrentDirectoryA
MapViewOfFile
Sleep
OpenProcess
GetExitCodeProcess
GetModuleHandleA
GetExitCodeThread
CreateThread
CreateFileMappingA
CreateEventA
MultiByteToWideChar
FormatMessageA
LocalFree
GlobalFree
CloseHandle
GetModuleFileNameA
lstrcatA
GetPrivateProfileIntA
GetPrivateProfileStringA
SetEvent
LoadLibraryA
user32
DialogBoxParamA
CharNextA
CallNextHookEx
SetForegroundWindow
IsWindowVisible
GetClassNameA
SetWindowsHookExA
DispatchMessageA
TranslateMessage
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
DefWindowProcA
PostMessageA
CreateWindowExA
GetWindowThreadProcessId
CallWindowProcA
SetWindowPos
GetWindowRect
UnhookWindowsHookEx
GetClientRect
FindWindowExA
LoadIconA
CreateDialogParamA
GetWindowLongA
SendMessageW
MessageBoxA
EndDialog
SetWindowLongA
DestroyWindow
EnableWindow
ShowWindow
wsprintfA
GetDlgItem
SendMessageA
LoadStringA
LoadImageA
advapi32
GetUserNameA
OpenSCManagerA
CloseServiceHandle
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
QueryServiceStatus
OpenServiceA
shell32
ShellExecuteExA
ole32
CoInitialize
_
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=84, id=1, productName=Unmarked objects,
count=11, id=93, version=2179,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-header.bmp
- SHA256 6f178942b4130dd4c59215f1ce59cd47226f1ac4149f481486e9a652ea9cd1d8
- MD5 173391c2c5228607d99ca65f29c8fb3e
- SHA1 ba23989bda8532abb9e3d191472751c0e855d13e
- SHA512 9c777fabe2fe6133c876e6069d9bc73cdecbc5b71ce0bfc9484dbddfc2e61fc9ac364387792c181bfadc3dafe8461945295ae4583d17646204afdb3f5cc47c0b
- SSDEEP 384:xurmYyM7XYSv7aI2DV9ZHs+8UAdOuSApkjxxr8mD+NYbXcPUe3Xh41kAJXGtZDT3:xSmY9gpj+mJeq1kcU3Fn
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 1e2884056e655f2b7bc5a904e352fc80
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA
user32
GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect
gdi32
SetTextColor
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=53, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsExec.dll
- IMPHASH d83f71e61ee459ee63ca3e829966a9dc
- SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- MD5 acc2b699edfea5bf5aae45aba3a41e96
- SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
lstrcpyA
lstrcpynA
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
PeekNamedPipe
GetTickCount
CreateProcessA
GetStartupInfoA
CreatePipe
GetVersionExA
GetModuleHandleA
DeleteFileA
lstrcmpiA
lstrlenA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
GetProcAddress
GlobalLock
GetCurrentProcess
user32
SendMessageA
OemToCharBuffA
CharNextA
wsprintfA
CharPrevA
FindWindowExA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
410B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
1.dat
- SHA256 ebd4eb3b92463d780ef1c348e789b2be7d2655bf80e15eab3cee17494ab3f909
- MD5 d42f981a9e2b4b4c83d3773e284084db
- SHA1 df50327c580aa8fb0234584c31a1a290b0240816
- SHA512 ee3ce1008d9bb2b765761ace34c299cfbd8516474bba733dc3222e2274bdf4fef59639916abf40774c690a49a56d1588c02a28ce4bfbc0da038b29457e530b4f
- SSDEEP 24576:EGMIDTY9sMWCb6EmJe98VqQoYV7eEX+xMhjeH53XGwU/ol:EuTY9EG6zA98CYJeEZjkowU/ol
- MD5 SHA1 SHA512 SSDEEP
2.dat
- SHA256 906f584cacf4db8ecf69eac5cba3f3d738f0354b49f749a33e62aa86b168beb8
- MD5 10e2ead8623210e09b5b20ae5adab6a4
- SHA1 6164d9043ffdee6555dea6da0e37b6d32d153991
- SHA512 0445cd5bc3a4705f29095ce9f8add5688dd4d2bbcbc99fb690f8fc094ae7177a3fac5d1604b3a5b0ccc3ad7d600cf779ccd75151f6f854c0ead85b344ffe3a3c
- SSDEEP 768:bzkUio4MDSn6z8acdCWM42D48YA/M97AWeSr/KfBklKrudKRzu5sblESYRWvH4S6:bzjioFS6oaSC42D44MAWeSr/KWlKruow
- MD5 SHA1 SHA512 SSDEEP
3.dat
- SHA256 d1ae17834f149bdf5b85d0fbaa2873bd30702ab1b851ee78517e00f4c0045a46
- MD5 55a3a2561d2c6a6f75ea801eecb8317b
- SHA1 34b0961771ce4d17196c37754e9ffbf541ab60ac
- SHA512 fae63a55df4764fd7caca2470d75e8034ce55be8d7b72d21f442db1c90f750b5eba3a275363190772f0a10d6eb9c149be2e723d0357219c021ec67fb42616393
- SSDEEP 384:tmRzxu+St1ABiXDCvTc/loHr4CF9BeyUBU43kFr3HFex:tmpoTIiXDwSqs2+U43kFpex
- MD5 SHA1 SHA512 SSDEEP
4.dat
- SHA256 f3ecda8cd7e26598ba75a8f22cc3fd1ef8b58bd16f0811c7927d207d75e5c5f3
- MD5 252e5507e09763012f97c60219dc4d91
- SHA1 1215f4460e209812a209c7dcfdcea05f618fec03
- SHA512 38a22354111fd7e4aab84681ea01e5b247989a941279df583e2c9aa9f4c0e34d1ed4850da94064c6efe760f72c215e13cbc299f1635f77a35773ae7a18d062ae
- SSDEEP 6144:6uRKqwVdtwKgyUc55drVZZaslF8olAAxJX9PYsbSi0iFTqfFUFva9X4ds8F3Jx/6:vQhFUcJrXnaixjrS4FWdUFva9X5qyMAR
- MD5 SHA1 SHA512 SSDEEP
Uninstall.exe
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 87adb0d696cb0e3a3010fe2b3c85620e162ac636669a698d66d37151ce18f299
- MD5 79354fc5e77fc7b3ec10089c99c897d6
- SHA1 37c89b075435a87cacf1cade0dacb8fe7510b930
- SHA512 75593cdd9721c3edb150e36d39f1254bc1df057137124b5b219046f16cc7cfb4ff5be874ebe9e4957d7394cdd230b256c11ded0a0765f91928b89e5e78c3ed1f
- SSDEEP 1536:wLXB65939tY6HBg4sXJJleSGl1VhzDRE9U+idVf:wLk395hYXJ7+Tve9WDf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12491
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/UAC.dll
- IMPHASH 55a6a096df3564193c302728985d6bda
- SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
- MD5 431e5b960aa15af5d153bae6ba6b7e87
- SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
- SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
- SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateProcessA
GlobalAlloc
lstrlenA
GetVersionExA
SetLastError
GetProcAddress
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
UnmapViewOfFile
WaitForSingleObject
GetCurrentProcessId
GetLastError
DuplicateHandle
SetCurrentDirectoryA
MapViewOfFile
Sleep
OpenProcess
GetExitCodeProcess
GetModuleHandleA
GetExitCodeThread
CreateThread
CreateFileMappingA
CreateEventA
MultiByteToWideChar
FormatMessageA
LocalFree
GlobalFree
CloseHandle
GetModuleFileNameA
lstrcatA
GetPrivateProfileIntA
GetPrivateProfileStringA
SetEvent
LoadLibraryA
user32
DialogBoxParamA
CharNextA
CallNextHookEx
SetForegroundWindow
IsWindowVisible
GetClassNameA
SetWindowsHookExA
DispatchMessageA
TranslateMessage
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
DefWindowProcA
PostMessageA
CreateWindowExA
GetWindowThreadProcessId
CallWindowProcA
SetWindowPos
GetWindowRect
UnhookWindowsHookEx
GetClientRect
FindWindowExA
LoadIconA
CreateDialogParamA
GetWindowLongA
SendMessageW
MessageBoxA
EndDialog
SetWindowLongA
DestroyWindow
EnableWindow
ShowWindow
wsprintfA
GetDlgItem
SendMessageA
LoadStringA
LoadImageA
advapi32
GetUserNameA
OpenSCManagerA
CloseServiceHandle
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
QueryServiceStatus
OpenServiceA
shell32
ShellExecuteExA
ole32
CoInitialize
_
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=84, id=1, productName=Unmarked objects,
count=11, id=93, version=2179,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-header.bmp
- SHA256 6f178942b4130dd4c59215f1ce59cd47226f1ac4149f481486e9a652ea9cd1d8
- MD5 173391c2c5228607d99ca65f29c8fb3e
- SHA1 ba23989bda8532abb9e3d191472751c0e855d13e
- SHA512 9c777fabe2fe6133c876e6069d9bc73cdecbc5b71ce0bfc9484dbddfc2e61fc9ac364387792c181bfadc3dafe8461945295ae4583d17646204afdb3f5cc47c0b
- SSDEEP 384:xurmYyM7XYSv7aI2DV9ZHs+8UAdOuSApkjxxr8mD+NYbXcPUe3Xh41kAJXGtZDT3:xSmY9gpj+mJeq1kcU3Fn
- MD5 SHA1 SHA512 SSDEEP
data
- SHA256 602d8f652ef1b9e8eb8ac0689a155bb45e9665fad889d765a51d71c3593512bc
- MD5 4b27ee01d409087fe23497a334374724
- SHA1 bccfe609b90aa887948c1d03de5dde9a64faa68f
- SHA512 201ec645a8c6e201d28cb7d9b6fcc9a0863f9a01dd71fbdb802cf6ec5b8ed845efeb2d7af38bc4d2f90242a2eb7a46e70dba7d3dfbbc4720f342805597118fa6
- MD5 SHA1 SHA512
lzma.exe
- IMPHASH 725d7c328da8b5c7989b84fbe16f738f
- SHA256 f776415281ed68268577142b60839d0937c112be1ba0fb8470f5a387afc3ba62
- MD5 1c4d758c0954e843d2fa22703f653421
- SHA1 d577e6f63cb53f5f68f094b9fbaefe5b0087e933
- SHA512 5b8c02473b8f57d243cac5ae1f5381a9a1dbd55bc976a172f36060b2d0c2ad80d4f956cd38d4ba7434b9b27583e0e753bcdb8b4772c1c54e926b365c90357c3e
- SSDEEP 1536:ax7F8DW6pErklzKbDir++/McTJctWOrLRCIbDO+9a:akDWTrMKb2MFQCRCIe+4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
59404
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
CharUpperW
CharUpperA
msvcrt
_controlfp
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
free
malloc
memmove
strlen
memcpy
memcmp
_CxxThrowException
__CxxFrameHandler
_iob
fprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
_setmode
_purecall
__set_app_type
kernel32
SetEndOfFile
SetFilePointer
GetFileSize
CreateFileA
WriteFile
GetStdHandle
ReadFile
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreA
ResetEvent
SetEvent
CreateEventA
CloseHandle
WaitForSingleObject
VirtualFree
VirtualAlloc
GetModuleHandleA
GetProcAddress
GlobalMemoryStatus
GetSystemInfo
GetLastError
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
GetProcessTimes
GetTickCount
GetVersionExA
Name
.text
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=72, id=1, productName=Unmarked objects,
count=5, id=93, version=2179,
count=10, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=19, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,