r1[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
r1.zip
Size 7.9MB
Sample240513-kl5wfaeg31
SHA256 ae29634c421e7fae872a93c040b896ad770641124691367109255096c87422ba
MD5 2a6db81134c1f64fc9489b3a8b158c30
SHA1 b99f46bbc598583fbfb22d2f9a81bb30fbd78b43
SHA512 e5809d2db6d276981e3223a2a63235fd9d6182047072f85335f0f9bbcc3bbf331ec04c34c5f5202ec8fb1063d94755026d58e5a11414f4e8ec061d34e1d42aa2
SSDEEP 196608:yeEh03KoC1f6Zo4UjPqsKLt4+r4KLdx33+OQhTa+A1gtw2RoJ:yeTaZeNU7yi+N3ohTNAatzRoJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 18 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0c6c2d02897cd3a48d87eb9ffccb7da326368f5af9973827701f7f11a02f33f8
unpack001/149fc3f5cd338e71229ff8913b45efa9eb6bbfaec5ab3b5a441eea234cd6dfc0
unpack001/17abfd1473344da57bce6bc87592d1bd502496e07f9f5f05088113dc5835dfcb
unpack001/17fde5d9ca56c86f7c55a06c86a5f499da4e8be448da902e8bca4b6a2ab62037
unpack001/51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7
unpack001/5edd9114eabff0eab414379df54f27cab95470cfb3b9afacd8d2b0b81cd6c4eb
unpack001/607e9555a1d7b53a7b0df44d97299b13591bb7307f032dbcbe651804b1fe0b15
unpack001/771bceb036dc1bf0625c875d22945c0c97f1c283c24445478fd60b0d1bfc6861
unpack001/86c5796c0950cc5611c0777bec2a9966b39703a3c842019bb54b92d008bf3091
unpack001/8e17ec5c24044e48320486209beaae1614288ec7a5612818e3d0c2ee0e331a4f
unpack001/9d868256e0187fdb9c4a132bf032719805f8777e82d13bb5fe9e43e8477652f2
unpack001/a4fbd5dfa976d2526590065d16e166ae2ba5b58a17bdcc8d1efbaca35ae55cdd
unpack001/ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c
unpack001/b6d80ad1fb778375158ffcec8a66d0ee8975e23dab1c4c954fd439a0cb714961
unpack001/bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2
unpack001/e50229ae810e4ca9fea69dbb2c9c964cfb85ddd1a8bd885bf8beedb496393253
unpack001/e74fd85e9a34e530d0f2821f66b2c0707873528c420366915b22283baf9adc2a
unpack001/f09814000e7cb43d244be02b82ed9e60e120494de3b1919428114f861d94a542

File Explorer

r1.zip

.zip 7.9MB
0c6c2d02897cd3a48d87eb9ffccb7da326368f5af9973827701f7f11a02f33f8

.exe 488KB
149fc3f5cd338e71229ff8913b45efa9eb6bbfaec5ab3b5a441eea234cd6dfc0

.exe 316KB
17abfd1473344da57bce6bc87592d1bd502496e07f9f5f05088113dc5835dfcb

.exe 1.2MB
17fde5d9ca56c86f7c55a06c86a5f499da4e8be448da902e8bca4b6a2ab62037

.exe 316KB
51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7

.exe 315KB
5edd9114eabff0eab414379df54f27cab95470cfb3b9afacd8d2b0b81cd6c4eb

.exe 488KB
607e9555a1d7b53a7b0df44d97299b13591bb7307f032dbcbe651804b1fe0b15

.exe 488KB
771bceb036dc1bf0625c875d22945c0c97f1c283c24445478fd60b0d1bfc6861

.exe 1.2MB
86c5796c0950cc5611c0777bec2a9966b39703a3c842019bb54b92d008bf3091

.exe 769KB
8e17ec5c24044e48320486209beaae1614288ec7a5612818e3d0c2ee0e331a4f

.exe 316KB
9d868256e0187fdb9c4a132bf032719805f8777e82d13bb5fe9e43e8477652f2

.exe 1.2MB
a4fbd5dfa976d2526590065d16e166ae2ba5b58a17bdcc8d1efbaca35ae55cdd

.exe 281KB
ab04398202a474f3e0102a37e709eef11730126eada5cee105c90c4b367107f0

.exe 1.2MB
ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c

.exe 297KB
b6d80ad1fb778375158ffcec8a66d0ee8975e23dab1c4c954fd439a0cb714961

.exe 1.2MB
bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2

.exe 316KB
e50229ae810e4ca9fea69dbb2c9c964cfb85ddd1a8bd885bf8beedb496393253

.exe 488KB
e74fd85e9a34e530d0f2821f66b2c0707873528c420366915b22283baf9adc2a

.exe 1.2MB
f09814000e7cb43d244be02b82ed9e60e120494de3b1919428114f861d94a542

.exe 293KB

r1.zip

SHA256 ae29634c421e7fae872a93c040b896ad770641124691367109255096c87422ba
MD5 2a6db81134c1f64fc9489b3a8b158c30
SHA1 b99f46bbc598583fbfb22d2f9a81bb30fbd78b43
SHA512 e5809d2db6d276981e3223a2a63235fd9d6182047072f85335f0f9bbcc3bbf331ec04c34c5f5202ec8fb1063d94755026d58e5a11414f4e8ec061d34e1d42aa2
SSDEEP 196608:yeEh03KoC1f6Zo4UjPqsKLt4+r4KLdx33+OQhTa+A1gtw2RoJ:yeTaZeNU7yi+N3ohTNAatzRoJ
MD5 SHA1 SHA512 SSDEEP

Password

infected

0c6c2d02897cd3a48d87eb9ffccb7da326368f5af9973827701f7f11a02f33f8

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 0c6c2d02897cd3a48d87eb9ffccb7da326368f5af9973827701f7f11a02f33f8
MD5 6db49a95e667692ec21e46a40379b81f
SHA1 2d4a57435a5ff349ac5b9db8485a4a1e7d4aa700
SHA512 ef16e77b5398ce12031a69603d9a0c8a97661193e88e1d8f3cefd8e6848f7044554feade11190d0b580901894a11aea539d7715156bd91b02c075579a9c53329
SSDEEP 6144:KHy+bnr+ap0yN90QE8japPvZZXrsPZ0zNuxthOHHpHhzv9XDc6WtTcQ7Zlo7s:lMrGy90nj7sZ0zNWIdhRXDcVtTcWHoI
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

GetTokenInformation RegDeleteValueA RegOpenKeyExA RegQueryInfoKeyA FreeSid OpenProcessToken RegSetValueExA RegCreateKeyExA LookupPrivilegeValueA AllocateAndInitializeSid RegQueryValueExA EqualSid RegCloseKey AdjustTokenPrivileges

kernel32

_lopen _llseek CompareStringA GetLastError GetFileAttributesA GetSystemDirectoryA LoadLibraryA DeleteFileA GlobalAlloc GlobalFree CloseHandle WritePrivateProfileStringA IsDBCSLeadByte GetWindowsDirectoryA SetFileAttributesA GetProcAddress GlobalLock LocalFree RemoveDirectoryA FreeLibrary _lclose CreateDirectoryA GetPrivateProfileIntA GetPrivateProfileStringA GlobalUnlock ReadFile SizeofResource WriteFile GetDriveTypeA lstrcmpA SetFileTime SetFilePointer FindResourceA CreateMutexA GetVolumeInformationA ExpandEnvironmentStringsA GetCurrentDirectoryA FreeResource GetVersion SetCurrentDirectoryA GetTempPathA LocalFileTimeToFileTime CreateFileA SetEvent TerminateThread GetVersionExA LockResource GetSystemInfo CreateThread ResetEvent LoadResource ExitProcess GetModuleHandleW CreateProcessA FormatMessageA GetTempFileNameA DosDateTimeToFileTime CreateEventA GetExitCodeProcess FindNextFileA LocalAlloc GetShortPathNameA MulDiv GetDiskFreeSpaceA EnumResourceLanguagesA GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW Sleep FindClose GetCurrentProcess FindFirstFileA WaitForSingleObject GetModuleFileNameA LoadLibraryExA

gdi32

GetDeviceCaps

user32

SetWindowLongA GetDlgItemTextA DialogBoxIndirectParamA ShowWindow MsgWaitForMultipleObjects SetWindowPos GetDC GetWindowRect DispatchMessageA GetDesktopWindow CharUpperA SetDlgItemTextA ExitWindowsEx MessageBeep EndDialog CharPrevA LoadStringA CharNextA EnableWindow ReleaseDC SetForegroundWindow PeekMessageA GetDlgItem SendMessageA SendDlgItemMessageA MessageBoxA SetWindowTextA GetWindowLongA CallWindowProcA GetSystemMetrics

msvcrt

_controlfp ?terminate@@YAXXZ _acmdln _initterm __setusermatherr _except_handler4_common memcpy _ismbblead __p__fmode _cexit _exit exit __set_app_type __getmainargs _amsg_exit __p__commode _XcptFilter memcpy_s _vsnprintf memset

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

149fc3f5cd338e71229ff8913b45efa9eb6bbfaec5ab3b5a441eea234cd6dfc0

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 149fc3f5cd338e71229ff8913b45efa9eb6bbfaec5ab3b5a441eea234cd6dfc0
MD5 1f2f0d7ffa427f1848e4be58812200f3
SHA1 db92dede52bf27679cd478c524bab8fd199c09b8
SHA512 f96e5b7d18ff5848124700b5b84f38f3ae60b4012ba84b68543ca8a3a18461e63182f9495619b2c30658642b5ca504d2d8d0098c48ee229e04c63d28cac39103
SSDEEP 6144:K7y+bnr+Pp0yN90QEs96G62nMNsEdbQFJiqn27Imuh90emN2cq:dMr7y90Yg2MNgUqn0I190E
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

kernel32

gdi32

GetDeviceCaps

user32

msvcrt

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

17abfd1473344da57bce6bc87592d1bd502496e07f9f5f05088113dc5835dfcb

IMPHASH 0d00e7b5922fb5549ed71add897d60ba
SHA256 17abfd1473344da57bce6bc87592d1bd502496e07f9f5f05088113dc5835dfcb
MD5 1d267ce48d4f4de44a562dd00ea333c9
SHA1 e539eb34642045c760a49e6d78709cb2aa796f19
SHA512 c1b080399fe26341ea56e6723e036c63785f4e33b03fd429e7ee210233893f4ead22d651ec71da0e85ecb4a97119597a76846e83fd8add038cd239fc6e7d9e10
SSDEEP 24576:cS3uibPmcOFD6uH/nqDkQMsE1DeD1T8/MiOQ07Is:cS+ZFD6uH/njfnkh7Ms
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\940ylq5y0ubwo\First.pdb

kernel32

WaitForSingleObject ExitProcess CreateThread VirtualAlloc GetModuleHandleA GetProcAddress FreeConsole FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW WriteConsoleW RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread HeapFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW HeapSize SetEndOfFile

Name

.text

Size

752KB

Virtual Size

752KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

379KB

Virtual Size

386KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

17fde5d9ca56c86f7c55a06c86a5f499da4e8be448da902e8bca4b6a2ab62037

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 17fde5d9ca56c86f7c55a06c86a5f499da4e8be448da902e8bca4b6a2ab62037
MD5 700ae249a1b5335cd43a6f464e36e5b1
SHA1 4c23d7d927b6ae4eca55224a77c65e73561140e4
SHA512 48f502da66c47d0a81f0170cf5e4e11e2d496db9fedea3edccedf4711197afde1e63889bc48d82e0fea594af03842160bd3bf57c7f60d399ef26547203ed48a3
SSDEEP 6144:KEy+bnr+Rp0yN90QEh6vZrMgX3eYK41E8OBURKaJct:MMrJy903mN3rKWOmEaet
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

kernel32

gdi32

GetDeviceCaps

user32

msvcrt

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7

IMPHASH 8227b22f62327fabe0f061931b660b88
SHA256 51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7
MD5 290b0115d137ba7f6f75557dea9a3418
SHA1 4fd841d032858a7bc39d598eca329371bc48a118
SHA512 b843b5beea655f803deb8473cb9ed4f06e0d99c46480dcce39d321b1bcb4b4dff4350bd7c41f6ca0f3eaae31e73e9351ec5de920eddfedc809f119effe362a34
SSDEEP 6144:8A9pI60nbM8uPZy3+8KIDJgu+PchgHadTi7ZiEfXHS:H9+60nbnueg3cy6RFEPHS
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

CallWindowProcA

advapi32

CryptReleaseContext

shell32

ExtractIconExA

kernel32

CreateFileW GetCurrentThreadId HeapSize GetProcessHeap VirtualAlloc WaitForSingleObject GetModuleHandleA FreeConsole CreateThread GetProcAddress MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW WideCharToMultiByte Sleep InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCurrentProcessId WriteConsoleW InitializeSListHead IsDebuggerPresent GetStartupInfoW SetStdHandle RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

5edd9114eabff0eab414379df54f27cab95470cfb3b9afacd8d2b0b81cd6c4eb

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 5edd9114eabff0eab414379df54f27cab95470cfb3b9afacd8d2b0b81cd6c4eb
MD5 23f01cf0bf048e2096c7d36467866f41
SHA1 b5cfde3d76c919ee112f2f79ddea6c81306eb798
SHA512 6d623c0c4a2a752ff3fe2e19b2afa4456c5bd236b70fe44f30ca82dc9a610fdc2524a201e08cbcd2a10959e916024eddd597f5885e7d236167d92adb902af99d
SSDEEP 12288:5MrRy90J+U37EBfCMiEWyWt3FzKlOqEa1KTfDLqmNXP:AyodwBueyBqEa1KTfDGm
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

kernel32

gdi32

GetDeviceCaps

user32

msvcrt

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

607e9555a1d7b53a7b0df44d97299b13591bb7307f032dbcbe651804b1fe0b15

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 607e9555a1d7b53a7b0df44d97299b13591bb7307f032dbcbe651804b1fe0b15
MD5 1f45948eea5057c9c11fc3d67acc108b
SHA1 36488f4f3470bb268a5b615fc31ce5582b33c527
SHA512 93f0ee5c932a8bf91a432f0737cf72b0466e5f5f2230f7b7fd53a410cdb81e180596ee63214bd2b09ce857b0b31916971514ec6fc5c248aa46ad74c7d1ff3fab
SSDEEP 12288:VMrxy90PfMtZcBN+UHnyG/4fG9py9DsZ37WJco:gyofccBifKya37W2o
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

kernel32

gdi32

GetDeviceCaps

user32

msvcrt

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

771bceb036dc1bf0625c875d22945c0c97f1c283c24445478fd60b0d1bfc6861

IMPHASH 0d00e7b5922fb5549ed71add897d60ba
SHA256 771bceb036dc1bf0625c875d22945c0c97f1c283c24445478fd60b0d1bfc6861
MD5 2b38a7d41cb74614ef5f78ce65f78d81
SHA1 1b7131fa000f573df217ac4701fa1fa6092a6e81
SHA512 975b3432c0b145d5f3bacd980f947e5cb72cfd5096536209e31538da03667a265998fd56b4f8919abc62565a896b18e6990c579b9696bdaf6632168d1fba2ad4
SSDEEP 24576:S9LDiCMrdBl9Jacrzhm1UCMskmZHDRMHr6dfeaZFjGs:S9/gl9JacrzhBOeeeaZFjGs
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\j3168d7\First.pdb

kernel32

Name

.text

Size

752KB

Virtual Size

752KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

374KB

Virtual Size

380KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

86c5796c0950cc5611c0777bec2a9966b39703a3c842019bb54b92d008bf3091

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 86c5796c0950cc5611c0777bec2a9966b39703a3c842019bb54b92d008bf3091
MD5 2192e78e226ded3e90153939253bb995
SHA1 eae212316fa4f120c7e25b8e7160d2c1a4dc8dca
SHA512 aff8c63b8d61d4b0a2cca130272529c63dd8061169072e7d85e790ee392a1e245e60a360b3e6eb1b27bed2b70e69efb4b8f78ce2d24c1e8f9935c7877b9ccbfa
SSDEEP 12288:MMrIy90UKF36qwIwHydHGTk/KrONXaTKnqReJaT/S3pI27JsPKqxc:cygAdKnNXaTpwm63SSmPzS
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

kernel32

gdi32

GetDeviceCaps

user32

msvcrt

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

8e17ec5c24044e48320486209beaae1614288ec7a5612818e3d0c2ee0e331a4f

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 8e17ec5c24044e48320486209beaae1614288ec7a5612818e3d0c2ee0e331a4f
MD5 213ff3feb0af96e19a3e8ec718d69a27
SHA1 c98fa1e6179f2c20e1a1a1056e0863997e70ea7a
SHA512 9ddccbc36cd0618ef951866a76c15156c48fc6d67b8519a19360c7684ec154902a520b25f93bd8cfe2607dcd67431d04200ba731e3b4d74a0606af9518a8cb1a
SSDEEP 6144:KFy+bnr+Lp0yN90QEX6vZrMgX3eYK41E8OBURKaJV:jMrny905mN3rKWOmEaX
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

kernel32

gdi32

GetDeviceCaps

user32

msvcrt

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

9d868256e0187fdb9c4a132bf032719805f8777e82d13bb5fe9e43e8477652f2

IMPHASH 0d00e7b5922fb5549ed71add897d60ba
SHA256 9d868256e0187fdb9c4a132bf032719805f8777e82d13bb5fe9e43e8477652f2
MD5 224f753c63bfb5417069040eef0a56ee
SHA1 b35d6b49344b0db211371f97a731a11b17a6dc8d
SHA512 03912eadf017471b080803fa96419e8ae1cabd1608439e41b8d0113f9c768aae383b7fce7735fb995c3a4780077b7f1015d6e0178bbebb806afe919997231489
SSDEEP 24576:BMrDSiyJIK8luK3932JQ9bMsYpZSDnFuc+eiNNMlAts:BMiCluK3932m6Y47NMlAts
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\5dpn824mxq\First.pdb

kernel32

Name

.text

Size

752KB

Virtual Size

752KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

375KB

Virtual Size

382KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

a4fbd5dfa976d2526590065d16e166ae2ba5b58a17bdcc8d1efbaca35ae55cdd

IMPHASH 64f172a8d6c228ad08f7ecbb9b6b2001
SHA256 a4fbd5dfa976d2526590065d16e166ae2ba5b58a17bdcc8d1efbaca35ae55cdd
MD5 224ebb289e52c9f3a4c2bd583dab2d7c
SHA1 8cc0b7dd2fad4fac37cb87ab3c5027a061fdebb5
SHA512 ea21feaa211f24f25106c5ec7825f575ad9a2e1d582a9908107d9a9b866db2baeedfc6fd4c6034d492c61491bc06d7c5cda14a31bce6e59c24a9c9537d7d2e2f
SSDEEP 6144:Wk65a4mpI1TJe8makPXbhaEW1MvBf5rXweiV/:uMVAJ8PX1aEWapxjm/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetDlgItem SendDlgItemMessageA AppendMenuA CreatePopupMenu DestroyMenu ClientToScreen TrackPopupMenu GetCursorPos SendMessageA GetDlgItemTextA wsprintfA MessageBoxA LoadCursorA GetActiveWindow CheckDlgButton SetWindowTextA IsDlgButtonChecked KillTimer SetWindowLongA CallWindowProcA GetClassInfoA CloseClipboard GetClipboardData EnumClipboardFormats SetDlgItemTextA EndDialog RegisterClassA DefDlgProcA SetActiveWindow SetMenuItemInfoA CheckMenuItem GetMenu InsertMenuItemA SetWindowPlacement SetTimer GetSystemMenu MoveWindow GetClientRect PostQuitMessage DestroyWindow DestroyIcon GetWindowLongA GetSysColor CheckMenuRadioItem EnableMenuItem CharLowerBuffA GetWindowPlacement SetDlgItemInt GetSubMenu IsMenu GetWindowRect CreateDialogParamA DestroyCursor PostMessageA ChildWindowFromPoint InvalidateRect RemoveMenu LoadAcceleratorsA GetMessageA TranslateAcceleratorA IsDialogMessageA OpenClipboard CharUpperA SetFocus SetClipboardData EmptyClipboard LoadIconA TranslateMessage DispatchMessageA DestroyAcceleratorTable DialogBoxParamA GetSysColorBrush SetCursor UnregisterClassA CheckRadioButton IsWindow GetSystemMetrics EnableWindow GetWindowTextA RedrawWindow FindWindowA SetWindowPos wvsprintfA

gdi32

SetTextColor SetBkMode DeleteObject SelectObject CreateFontIndirectA

kernel32

SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW CompareStringW GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc GetCommandLineW GetCommandLineA ExitProcess GetModuleFileNameW WriteFile GetStdHandle RaiseException EncodePointer LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter FreeConsole GetProcAddress GetModuleHandleA CreateFileW CloseHandle WriteConsoleW DecodePointer GetModuleHandleExW

ab04398202a474f3e0102a37e709eef11730126eada5cee105c90c4b367107f0

IMPHASH 6ba3dc6c76522b49c5ecdb4d22c4531e
SHA256 ab04398202a474f3e0102a37e709eef11730126eada5cee105c90c4b367107f0
MD5 25baf8fe36b6dafbe1e57f1ce0222ab1
SHA1 369d57e7fb1537133d0974e7a4bed0ef6caca4cf
SHA512 2a6f32e78da14369f0e8318abe61f45b267d22fea0670e5b97463541ae6a5bc3546cb685a1b2a8a3045cc063a2e1110d2ee2ccf3c39b8e298f8c1aa3eab797c8
SSDEEP 24576:ZMRqNUuIoPlMdHs8fvIvv2qJCLHPu4CNXeHZST:Zm/oPlMdHs8fvqD4PONuE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

89:1a:de:aa:4b:77:30:fd:d8:2c:8c:7b:01:be:2b:1a:e8:71:86:20:79:4a:01:8d:0c:6e:6a:d4:55:ae:52:f6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Jul 25, 2023

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Serial Number

0c:98:38:f6:73:f9:b1:cc:e3:95:cf:ab:2b:66:84:e4

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 8, 2020 - Oct 12, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

274461

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\djppi4\Body.pdb

shell32

DragFinish

kernel32

LoadLibraryExW CreateFileW VirtualProtectEx FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess TerminateProcess HeapSize RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress WriteConsoleW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread HeapAlloc HeapFree GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap ReadConsoleW

ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c

IMPHASH f578d161341ba8161650c97fe866d0ab
SHA256 ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c
MD5 6c3d589c8083af8f03b50d3e5cb3028b
SHA1 893c4bbb2be8ebba54c18345a0c2c8b512da69b9
SHA512 aa11105f5a68a13ccc391ebbd11cd60965979ac40fd50b692a2aada85daf8444c31f69f6c434e91fd4e6dc608b9c27c2d1bbb908dfa1e367366890aa99dbbef1
SSDEEP 6144:tk87zE8yF+JnF/1VVsNxnXW0+scVpoAcyyTdgYK9djWvCoCe:287zE5iwNFWKKC4OdU9dnoCe
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24433

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObjectEx CloseHandle FreeConsole VirtualProtectEx CreateRemoteThread MultiByteToWideChar GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW CreateFileW RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap ReadConsoleW HeapSize WriteConsoleW

b6d80ad1fb778375158ffcec8a66d0ee8975e23dab1c4c954fd439a0cb714961

IMPHASH 0d00e7b5922fb5549ed71add897d60ba
SHA256 b6d80ad1fb778375158ffcec8a66d0ee8975e23dab1c4c954fd439a0cb714961
MD5 21d03a07515c5a571236972c15624dfb
SHA1 eaa64143d8752cb82a1fea178b87c2a516839593
SHA512 53c0f4e6362ec9334a7c794cb49a5387e0e49484e62450839793a944b388db9bf1f10a200a5c1f030d6a24092952a30b08af08faa06e86dfa067c33d405c669b
SSDEEP 24576:aT7wiAeljlFpyjlHKhhu7MsCEkmDkApjmURdNvSmWjiMwHBs:aTcYFpyjlHKOV6i9RXFWghs
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\25s9gzmj\First.pdb

kernel32

Name

.text

Size

752KB

Virtual Size

752KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

372KB

Virtual Size

379KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 bdc8be1708b12d406d76b4c6d9cb66fc47101b1a34bef22f58bdec7f873b12f2
MD5 6d7aae742f92b9d7649d006bbb032d43
SHA1 ddeff69dfbdf10903d566b3ad0a3d06681a81df7
SHA512 4ab76eec7f2841f516ff6ce930abb2004431c9ee9cb307ec437391c47a0a3843c0fba7b4b4b5163e462fb1f55ed55fd19c14da45df90a90577c93b8a4cadcaf3
SSDEEP 6144:KPy+bnr+4p0yN90QEW96G62nMpfj3uXN9RUMuaozOKV0:VMrwy90ig2Mhj+baR3X0
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

kernel32

gdi32

GetDeviceCaps

user32

msvcrt

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

e50229ae810e4ca9fea69dbb2c9c964cfb85ddd1a8bd885bf8beedb496393253

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 e50229ae810e4ca9fea69dbb2c9c964cfb85ddd1a8bd885bf8beedb496393253
MD5 247f9586f4eb5afd06c97ca283661ab6
SHA1 9614ca472a7578dbaf82123454cc7f3ec227d631
SHA512 68f235922e3de20809160638b3acefaf02c0b260925ced641bb041cf8aa758077fad048fd4c06c54edbe3563b0ba96a6d86c7b763985501b7ea5a9bab89e6470
SSDEEP 12288:TMr+y90PCPEiP0fFrupWSXsb4fuRpbjFXSXQj:xypLP8FoIEfYbRCXQj
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

kernel32

gdi32

GetDeviceCaps

user32

msvcrt

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

e74fd85e9a34e530d0f2821f66b2c0707873528c420366915b22283baf9adc2a

IMPHASH 0d00e7b5922fb5549ed71add897d60ba
SHA256 e74fd85e9a34e530d0f2821f66b2c0707873528c420366915b22283baf9adc2a
MD5 6d8795ea727723893087cbeeae415422
SHA1 1ee878cc7c49d0c395ea8b37261eb4038be2349b
SHA512 9e9dbecacaa791dd4ad7393635420bc423dde8fada60f9b733ec926e363ecb0642c700fa4fe73611440f6b2e2bdc849869ca7f1a1418666635f3fc33c610f6c8
SSDEEP 24576:WzRSiJH28+VpdGfVDeJJmJMsGM5aDEJe+qX6UXMqa5s:WzUfVpdGfVDe2PlqpMqa5s
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dlzlo9hbo8\First.pdb

kernel32

Name

.text

Size

752KB

Virtual Size

752KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

335KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

f09814000e7cb43d244be02b82ed9e60e120494de3b1919428114f861d94a542

IMPHASH 19233e39149f52fdb71945647d5026f4
SHA256 f09814000e7cb43d244be02b82ed9e60e120494de3b1919428114f861d94a542
MD5 211600fc9d7a1bf494c8192d479934b7
SHA1 fab67178bc9529a5abdd33647028ca9d7d3a61ae
SHA512 d23e060d62722bad4d258e0742d23e17ba375e930a23e3a6323735944b07f4f26ab74abaaf81b41f1f0fcbe3fb8f0a02097e45df40ff606c1100c9ad7f272aac
SSDEEP 6144:eVwlC1u/z2xPFdGXz3F/CpFbrCl1vdewk4VY1naO0:I1u/z2xt8Qp5G1vdxk4VYQO0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23380

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetUpdateRgn

kernel32

FreeLibrary CreateFileW WaitForSingleObject CloseHandle FreeConsole CreateThread VirtualProtectEx WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW HeapSize RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree WriteConsoleW GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap

Sharing

General

Malware Config

Signatures

File Explorer

r1.zip

0c6c2d02897cd3a48d87eb9ffccb7da326368f5af9973827701f7f11a02f33f8

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

generic

149fc3f5cd338e71229ff8913b45efa9eb6bbfaec5ab3b5a441eea234cd6dfc0

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

generic

17abfd1473344da57bce6bc87592d1bd502496e07f9f5f05088113dc5835dfcb

kernel32

generic

17fde5d9ca56c86f7c55a06c86a5f499da4e8be448da902e8bca4b6a2ab62037

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

generic

51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7

user32

advapi32

shell32

kernel32

generic

5edd9114eabff0eab414379df54f27cab95470cfb3b9afacd8d2b0b81cd6c4eb

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

generic

607e9555a1d7b53a7b0df44d97299b13591bb7307f032dbcbe651804b1fe0b15

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

generic

771bceb036dc1bf0625c875d22945c0c97f1c283c24445478fd60b0d1bfc6861

kernel32

generic

86c5796c0950cc5611c0777bec2a9966b39703a3c842019bb54b92d008bf3091

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

generic

8e17ec5c24044e48320486209beaae1614288ec7a5612818e3d0c2ee0e331a4f

advapi32