6f1449121c5a88a5fcfb408a5915543a_JaffaCakes118

resource
unpack001/gpg.exe
unpack001/gpgconf.exe
unpack001/libassuan-0.dll
unpack001/libgcrypt-20.dll
unpack001/libgpg-error-0.dll
unpack001/libnpth-0.dll
unpack001/libsqlite3-0.dll
unpack001/zlib1.dll

SHA256 7bbb458e6579df29118174eb65579f6f02773e8ead9e89b65933191796774617
MD5 6f1449121c5a88a5fcfb408a5915543a
SHA1 e1ead1a83c4356a628fc22142652914e5f5242c4
SHA512 fb1b2b19c190425ce72af8af399534b4b912f7fdc344ab93f595c33eb58fd2812cde4e9fc7c090a0c48de6458615f0b33a7b280aaa5076b86e49bff510ac105a
SSDEEP 24576:uij4cIfWZMDHDGGpjewI3TWacQjDnArnbzywHnlePH3+Ipi6HU:rIfWZM/GKjFuTh+bewFevOI8aU
MD5 SHA1 SHA512 SSDEEP

gpg.exe

IMPHASH 8d17a97aa0c6272cdc09bde220932b9f
SHA256 a30c9de2a1317e9ac9da49bcf6b33c9dbd26724f70d4df6ae8fc4cc3449605ce
MD5 ffed73d78416e68f0af5eb9d539be746
SHA1 c4238312dde349c4f16505abe537e925cfeae1da
SHA512 45aaca162d844c8394c149eb4c272caf596b69c4f5351dc735b58b72e1033bc5ec2a945097ab1c8f13762dec68542d863afbc62b4f86da50bafb21766f594ca1
SSDEEP 24576:O7TNpt9OZUHFqL71sa/aqt95fb3POt49smQ19eFFZ7GrPPwz4baXgQnaFA:6TN8CFqtPrz3POt49ngF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

libassuan-0

assuan_begin_confidential assuan_end_confidential assuan_inquire assuan_new assuan_release assuan_send_data assuan_set_gpg_err_source assuan_set_log_cb assuan_set_malloc_hooks assuan_socket_connect assuan_transact

libgcrypt-20

gcry_calloc gcry_calloc_secure gcry_check_version gcry_cipher_algo_info gcry_cipher_algo_name gcry_cipher_close gcry_cipher_ctl gcry_cipher_decrypt gcry_cipher_encrypt gcry_cipher_get_algo_blklen gcry_cipher_get_algo_keylen gcry_cipher_map_name gcry_cipher_open gcry_cipher_setiv gcry_cipher_setkey gcry_control gcry_create_nonce gcry_free gcry_get_config gcry_is_secure gcry_kdf_derive gcry_malloc gcry_malloc_secure gcry_md_algo_info gcry_md_algo_name gcry_md_close gcry_md_copy gcry_md_ctl gcry_md_debug gcry_md_enable gcry_md_get_algo gcry_md_get_algo_dlen gcry_md_hash_buffer gcry_md_is_enabled gcry_md_is_secure gcry_md_map_name gcry_md_open gcry_md_read gcry_md_write gcry_mpi_aprint gcry_mpi_cmp gcry_mpi_copy gcry_mpi_dump gcry_mpi_get_flag gcry_mpi_get_nbits gcry_mpi_get_opaque gcry_mpi_print gcry_mpi_randomize gcry_mpi_release gcry_mpi_scan gcry_mpi_set_flag gcry_mpi_set_opaque gcry_mpi_set_opaque_copy gcry_mpi_snew gcry_pk_algo_info gcry_pk_algo_name gcry_pk_ctl gcry_pk_encrypt gcry_pk_get_curve gcry_pk_get_keygrip gcry_pk_get_nbits gcry_pk_map_name gcry_pk_testkey gcry_pk_verify gcry_random_bytes gcry_random_bytes_secure gcry_randomize gcry_realloc gcry_set_fatalerror_handler gcry_set_log_handler gcry_set_outofcore_handler gcry_set_progress_handler gcry_sexp_build gcry_sexp_build_array gcry_sexp_cadr gcry_sexp_canon_len gcry_sexp_extract_param gcry_sexp_find_token gcry_sexp_length gcry_sexp_nth gcry_sexp_nth_data gcry_sexp_nth_mpi gcry_sexp_nth_string gcry_sexp_release gcry_sexp_sprint gcry_sexp_sscan gcry_strdup gcry_xcalloc gcry_xcalloc_secure gcry_xmalloc gcry_xmalloc_secure gcry_xrealloc gcry_xstrdup

libgpg-error-0

_gpg_w32_bindtextdomain _gpg_w32_dngettext _gpg_w32_gettext _gpg_w32_gettext_localename _gpg_w32_gettext_use_utf8 _gpg_w32_textdomain _gpgrt_get_std_stream _gpgrt_putc_overflow gpg_err_code_from_errno gpg_err_code_from_syserror gpg_err_init gpg_err_set_errno gpg_strerror gpg_strsource gpgrt_asprintf gpgrt_bsprintf gpgrt_fclose gpgrt_fclose_snatch gpgrt_fdopen gpgrt_fdopen_nc gpgrt_ferror gpgrt_fflush gpgrt_fgets gpgrt_fileno gpgrt_flockfile gpgrt_fopen gpgrt_fopencookie gpgrt_fopenmem gpgrt_fprintf gpgrt_fprintf_unlocked gpgrt_fputc gpgrt_fputs gpgrt_fputs_unlocked gpgrt_fread gpgrt_free gpgrt_funlockfile gpgrt_fwrite gpgrt_printf gpgrt_read gpgrt_rewind gpgrt_set_alloc_func gpgrt_set_binary gpgrt_setvbuf gpgrt_snprintf gpgrt_sysopen gpgrt_vasprintf gpgrt_vfprintf gpgrt_vfprintf_unlocked gpgrt_w32_iconv gpgrt_w32_iconv_close gpgrt_w32_iconv_open gpgrt_write gpgrt_write_hexstring gpgrt_write_sanitized

libsqlite3-0

sqlite3_bind_blob sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_parameter_count sqlite3_bind_text sqlite3_busy_handler sqlite3_busy_timeout sqlite3_close sqlite3_column_count sqlite3_column_name sqlite3_column_text sqlite3_column_type sqlite3_db_handle sqlite3_errmsg sqlite3_errstr sqlite3_exec sqlite3_finalize sqlite3_free sqlite3_malloc sqlite3_open sqlite3_prepare_v2 sqlite3_reset sqlite3_step sqlite3_vmprintf

zlib1

deflate deflateEnd deflateInit2_ deflateInit_ inflate inflateEnd inflateInit2_ inflateInit_

advapi32

CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CreateDirectoryA CreateFileA CreateFileW CreatePipe CreateProcessA DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsA FormatMessageA GetACP GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetFileInformationByHandle GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetPriorityClass GetProcAddress GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemTimeAsFileTime GetTempPathA GetTickCount GetVersionExA InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LockFileEx MultiByteToWideChar OpenProcess QueryPerformanceCounter ReadConsoleA ReadFile ResumeThread SetConsoleMode SetEnvironmentVariableA SetFilePointer SetHandleInformation SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue UnhandledExceptionFilter UnlockFileEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleA WriteFile

msvcrt

__dllonexit __doserrno __getmainargs __initenv __lconv_init __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _exit _filelengthi64 _fileno _fmode _fstati64 _get_osfhandle _initterm _iob _lock _lseeki64 _onexit _open_osfhandle _snwprintf _stati64 time mktime localtime gmtime calloc clearerr exit fclose ferror fflush fgetc fgetpos fgets fopen fprintf fputc fputs fread free fseek fsetpos fwprintf fwrite getc getenv iscntrl isgraph isprint isspace isxdigit malloc memchr memcmp memcpy memmove memset printf putc qsort raise realloc remove rename setlocale signal sprintf sscanf strchr strcmp strcpy strcspn strerror strftime strlen strncmp strncpy strpbrk strrchr strspn strstr strtok strtol strtoul _stricmp _strnicmp _unlock _write abort atoi toupper ungetc vfprintf wcscpy _write _unlink _umask _stricmp _strdup _setmode _rmdir _read _putenv _open _mkdir _memicmp _isatty _getpid _getcwd _fileno _fdopen _dup _close _chdir _access

user32

AllowSetForegroundWindow MessageBoxW

ws2_32

WSAGetLastError WSAStartup closesocket connect htons inet_addr recv send socket

Name

.text

Size

893KB

Virtual Size

892KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

gpgconf.exe

IMPHASH 560cf3b5dbb5cb0d25a624c6d4fb0e98
SHA256 626d1b4bed319a2a158c96a6a0fe147b2ea82566e50374c792c51648806801a2
MD5 dc02c87e65311abdfef34e8724f4e65b
SHA1 cc3d4b60cc98e0d61f4ecca41a227ae5c1cc764e
SHA512 ee67910373081238e07a101568749f14bb3cc61d7fc9d1df71cc1944be74168f7bfe761d96073b6ab4555247bc821ae6b00cc4c39b07e93606399958aae6c93f
SSDEEP 3072:f6/73a4HykdUtKZTAJhyg4z/M1F6rnHlTvLErZspNo:f+OkdVzk1F6blTvL1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

libgcrypt-20

gcry_calloc gcry_check_version gcry_create_nonce gcry_free gcry_malloc gcry_malloc_secure gcry_realloc gcry_strdup gcry_xmalloc gcry_xstrdup

libgpg-error-0

_gpg_w32_bindtextdomain _gpg_w32_gettext _gpg_w32_gettext_use_utf8 _gpg_w32_textdomain _gpgrt_get_std_stream _gpgrt_putc_overflow gpg_err_code_from_errno gpg_err_code_from_syserror gpg_err_init gpg_err_set_errno gpg_strerror gpgrt_fclose gpgrt_fdopen gpgrt_feof gpgrt_ferror gpgrt_fflush gpgrt_fgetc gpgrt_fileno gpgrt_flockfile gpgrt_fopen gpgrt_fopencookie gpgrt_fprintf gpgrt_fprintf_unlocked gpgrt_fputc gpgrt_fputs gpgrt_fputs_unlocked gpgrt_fread gpgrt_funlockfile gpgrt_fwrite gpgrt_read_line gpgrt_set_alloc_func gpgrt_setvbuf gpgrt_snprintf gpgrt_sysopen gpgrt_vasprintf gpgrt_vfprintf gpgrt_vfprintf_unlocked gpgrt_w32_iconv gpgrt_w32_iconv_close gpgrt_w32_iconv_open

advapi32

CopySid GetLengthSid GetTokenInformation GetUserNameA IsValidSid OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CreateDirectoryA CreateFileA CreateFileW CreatePipe CreateProcessA DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsA FormatMessageA GetACP GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetFileInformationByHandle GetLastError GetModuleFileNameW GetModuleHandleA GetPriorityClass GetProcAddress GetStartupInfoA GetSystemDirectoryA GetSystemTimeAsFileTime GetTempPathA GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA MultiByteToWideChar OpenProcess QueryPerformanceCounter ResumeThread SetEnvironmentVariableA SetHandleInformation SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WideCharToMultiByte

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _exit _fmode _fstati64 _get_osfhandle _initterm _iob _lock _onexit _open_osfhandle _snwprintf time mktime localtime gmtime calloc exit ferror fflush fprintf fputs free fwprintf fwrite getc getenv isspace malloc memcmp memcpy memmove raise realloc remove rename signal sprintf strchr strcmp strcpy strcspn strerror strftime strlen strncmp strncpy strpbrk strrchr strtol strtoul _unlock abort atoi toupper vfprintf wcscpy _write _unlink _rmdir _putenv _open _mkdir _isatty _getpid _getcwd _fdopen _dup _close _chdir _access

user32

AllowSetForegroundWindow MessageBoxW

ws2_32

WSAStartup closesocket connect htons inet_addr send socket

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

lebenslauf_2019_5_6.jpe

SHA256 dad4776d9458167fb081256b90273df5ac24ff6a99fb51718b08e6faba1b0691
MD5 359c2a7a47821aa531403f64f43082c8
SHA1 0df988198a19560efd8d93a0be08658e52d273a4
SHA512 7bb7a271da41dd038ab62be4f9831b5a6c28e5a7f2b1e4e16de9e3549c54f63af4f5d9cd6cc9d3b9748c6144708309429a824bf56223910361c210cf1ab1d406
SSDEEP 384:dsNWKdzp4c+7lpx7q7umhUi6FQz6lkFJ+2q0o2/RTSBJ/hVhJQ6Oc:dsNW4zpn+XJhsUFQo2q0b4j/Xw6h
MD5 SHA1 SHA512 SSDEEP

libassuan-0.dll

IMPHASH 1f4705c612c22f5b8d6acb36e898c5e6
SHA256 fc7a9a77d6bccb993185ebc71e8d223e698132f761aec65ab7590a7f028fb90b
MD5 baf6dcfd5eb06852939681f5209e9cdb
SHA1 36c6eb5e401d2c21fcbcb7bf833a41422e668469
SHA512 4bab1bad23df95c520dc40f6ccf9f11974aa895f0cfe7c9fb320caad5a2237aca695d23d0a06195325c4c3e19dc75d5aec7ee34a36bd7839a9c79bf3bdf95853
SSDEEP 1536:Atznsf5Dko+qtyNMoj6LXaq+FjCrBCBxYfJjvlbN+AL:AFgk0eMm62dcrBCvYfJlbNZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

libgpg-error-0

gpg_err_code_from_syserror gpg_err_set_errno gpg_strerror gpg_strerror_r gpg_strsource gpgrt_asprintf gpgrt_free gpgrt_vasprintf

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext

kernel32

CloseHandle CreateFileA CreateFileW CreatePipe CreateProcessA DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetNamedPipeInfo GetPriorityClass GetProcAddress GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter ReadFile ResumeThread SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WriteFile

msvcrt

__dllonexit _amsg_exit _environ _errno _exit _get_osfhandle _initterm _iob _lock _onexit _snwprintf _vsnprintf calloc fclose fflush fopen fprintf fputs fread free fwprintf fwrite getenv iscntrl isprint malloc memchr memcmp memcpy memset putc raise realloc sprintf sscanf strcat strchr strcmp strcpy strcspn strerror strlen strncmp strncpy strpbrk strtoul _unlock abort atoi vfprintf wcscpy _getpid _fileno

user32

MessageBoxW

ws2_32

WSACleanup WSAGetLastError WSAStartup accept bind closesocket connect getsockname htonl htons inet_addr ntohs recv recvfrom select send sendto socket

__assuan_close __assuan_connect __assuan_pipe __assuan_read __assuan_recvmsg __assuan_sendmsg __assuan_socket __assuan_socketpair __assuan_spawn __assuan_usleep __assuan_waitpid __assuan_write _assuan_w32ce_create_pipe _assuan_w32ce_finish_pipe _assuan_w32ce_prepare_pipe assuan_accept assuan_begin_confidential assuan_check_version assuan_client_parse_response assuan_client_read_response assuan_close_input_fd assuan_close_output_fd assuan_command_parse_fd assuan_ctx_set_system_hooks assuan_end_confidential assuan_fdopen assuan_free assuan_get_active_fds assuan_get_assuan_log_prefix assuan_get_command_name assuan_get_data_fp assuan_get_flag assuan_get_gpg_err_source assuan_get_input_fd assuan_get_log_cb assuan_get_malloc_hooks assuan_get_output_fd assuan_get_peercred assuan_get_pid assuan_get_pointer assuan_init_pipe_server assuan_init_socket_server assuan_inquire assuan_inquire_ext assuan_new assuan_new_ext assuan_pending_line assuan_pipe_connect assuan_process assuan_process_done assuan_process_next assuan_read_line assuan_receivefd assuan_register_bye_notify assuan_register_cancel_notify assuan_register_command assuan_register_input_notify assuan_register_option_handler assuan_register_output_notify assuan_register_post_cmd_notify assuan_register_pre_cmd_notify assuan_register_reset_notify assuan_release assuan_send_data assuan_sendfd assuan_set_assuan_log_prefix assuan_set_assuan_log_stream assuan_set_error assuan_set_flag assuan_set_gpg_err_source assuan_set_hello_line assuan_set_io_monitor assuan_set_log_cb assuan_set_log_stream assuan_set_malloc_hooks assuan_set_okay_line assuan_set_pointer assuan_set_sock_nonce assuan_set_system_hooks assuan_sock_bind assuan_sock_check_nonce assuan_sock_close assuan_sock_connect assuan_sock_connect_byname assuan_sock_deinit assuan_sock_get_flag assuan_sock_get_nonce assuan_sock_init assuan_sock_new assuan_sock_set_flag assuan_sock_set_sockaddr_un assuan_sock_set_system_hooks assuan_socket_connect assuan_socket_connect_fd assuan_transact assuan_write_line assuan_write_status

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libgcrypt-20.dll

IMPHASH f8b2130d8495f2d334f8aed0a9ed26ec
SHA256 9f2862f520943aff5a1825a0fb92a4e98757dabe557c89e92cb24d0523905df4
MD5 e7f12f3680f5150e29994a500d7c022f
SHA1 b0021e21d16c0dd5fcd7e067d828e7372d164873
SHA512 d7cd75ee6a7d16a6a16eff446ccecd60ed531903ddacae10081835f803ba69c9ed10cbcb2e17e262960e156b407b844cba3c5890a56f633c0b84d5e0ff005e62
SSDEEP 12288:PdETpCAy8RMKOsF0zIcG8GxEruMWkVyc25lPSd/uCf:1AQlsOzIcGJuruMWrc2XPSdt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

libgpg-error-0

gpg_err_code_from_errno gpg_err_code_from_syserror gpg_err_set_errno gpg_strerror gpg_strsource gpgrt_fclose gpgrt_fclose_snatch gpgrt_ferror gpgrt_fopenmem gpgrt_fprintf gpgrt_get_syscall_clamp gpgrt_lock_destroy gpgrt_lock_init gpgrt_lock_lock gpgrt_lock_unlock gpgrt_rewind

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CreateFileA DeleteCriticalSection DeviceIoControl EnterCriticalSection FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetProcessTimes GetProcessWorkingSetSize GetStartupInfoA GetSystemTimeAsFileTime GetThreadTimes GetTickCount GetTimeZoneInformation GetVersionExA GlobalMemoryStatus InitializeCriticalSection LeaveCriticalSection LoadLibraryA MapViewOfFile OpenFileMappingA QueryPerformanceCounter SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery

msvcrt

__dllonexit _amsg_exit _errno _exit _initterm _iob _lock _onexit _snwprintf _vsnprintf calloc clock fclose feof ferror fflush fgets fopen fprintf fputs fread free fwprintf fwrite getenv iscntrl isspace isxdigit malloc memcmp memcpy memmove memset raise realloc strchr strcmp strcpy strcspn strerror strlen strncmp strpbrk strtoul _unlock abort atoi time vfprintf wcscpy _fstat _write _stricmp _read _open _getpid _close _access

user32

GetActiveWindow GetCapture GetCaretPos GetClipboardOwner GetClipboardViewer GetCursorPos GetDesktopWindow GetFocus GetInputState GetMessagePos GetMessageTime GetOpenClipboardWindow GetProcessWindowStation MessageBoxW

_gcry_mpi_get_const gcry_calloc gcry_calloc_secure gcry_check_version gcry_cipher_algo_info gcry_cipher_algo_name gcry_cipher_authenticate gcry_cipher_checktag gcry_cipher_close gcry_cipher_ctl gcry_cipher_decrypt gcry_cipher_encrypt gcry_cipher_get_algo_blklen gcry_cipher_get_algo_keylen gcry_cipher_gettag gcry_cipher_info gcry_cipher_map_name gcry_cipher_mode_from_oid gcry_cipher_open gcry_cipher_setctr gcry_cipher_setiv gcry_cipher_setkey gcry_control gcry_create_nonce gcry_ctx_release gcry_err_code_from_errno gcry_err_code_to_errno gcry_err_make_from_errno gcry_error_from_errno gcry_free gcry_get_config gcry_is_secure gcry_kdf_derive gcry_log_debug gcry_log_debughex gcry_log_debugmpi gcry_log_debugpnt gcry_log_debugsxp gcry_mac_algo_info gcry_mac_algo_name gcry_mac_close gcry_mac_ctl gcry_mac_get_algo gcry_mac_get_algo_keylen gcry_mac_get_algo_maclen gcry_mac_map_name gcry_mac_open gcry_mac_read gcry_mac_setiv gcry_mac_setkey gcry_mac_verify gcry_mac_write gcry_malloc gcry_malloc_secure gcry_md_algo_info gcry_md_algo_name gcry_md_close gcry_md_copy gcry_md_ctl gcry_md_debug gcry_md_enable gcry_md_extract gcry_md_get_algo gcry_md_get_algo_dlen gcry_md_hash_buffer gcry_md_hash_buffers gcry_md_info gcry_md_is_enabled gcry_md_is_secure gcry_md_map_name gcry_md_open gcry_md_read gcry_md_reset gcry_md_setkey gcry_md_write gcry_mpi_abs gcry_mpi_add gcry_mpi_add_ui gcry_mpi_addm gcry_mpi_aprint gcry_mpi_clear_bit gcry_mpi_clear_flag gcry_mpi_clear_highbit gcry_mpi_cmp gcry_mpi_cmp_ui gcry_mpi_copy gcry_mpi_div gcry_mpi_dump gcry_mpi_ec_add gcry_mpi_ec_curve_point gcry_mpi_ec_decode_point gcry_mpi_ec_dup gcry_mpi_ec_get_affine gcry_mpi_ec_get_mpi gcry_mpi_ec_get_point gcry_mpi_ec_mul gcry_mpi_ec_new gcry_mpi_ec_set_mpi gcry_mpi_ec_set_point gcry_mpi_ec_sub gcry_mpi_gcd gcry_mpi_get_flag gcry_mpi_get_nbits gcry_mpi_get_opaque gcry_mpi_invm gcry_mpi_is_neg gcry_mpi_lshift gcry_mpi_mod gcry_mpi_mul gcry_mpi_mul_2exp gcry_mpi_mul_ui gcry_mpi_mulm gcry_mpi_neg gcry_mpi_new gcry_mpi_point_copy gcry_mpi_point_get gcry_mpi_point_new gcry_mpi_point_release gcry_mpi_point_set gcry_mpi_point_snatch_get gcry_mpi_point_snatch_set gcry_mpi_powm gcry_mpi_print gcry_mpi_randomize gcry_mpi_release gcry_mpi_rshift gcry_mpi_scan gcry_mpi_set gcry_mpi_set_bit gcry_mpi_set_flag gcry_mpi_set_highbit gcry_mpi_set_opaque gcry_mpi_set_opaque_copy gcry_mpi_set_ui gcry_mpi_snatch gcry_mpi_snew gcry_mpi_sub gcry_mpi_sub_ui gcry_mpi_subm gcry_mpi_swap gcry_mpi_test_bit gcry_pk_algo_info gcry_pk_algo_name gcry_pk_ctl gcry_pk_decrypt gcry_pk_encrypt gcry_pk_genkey gcry_pk_get_curve gcry_pk_get_keygrip gcry_pk_get_nbits gcry_pk_get_param gcry_pk_map_name gcry_pk_sign gcry_pk_testkey gcry_pk_verify gcry_prime_check gcry_prime_generate gcry_prime_group_generator gcry_prime_release_factors gcry_pubkey_get_sexp gcry_random_add_bytes gcry_random_bytes gcry_random_bytes_secure gcry_randomize gcry_realloc gcry_set_allocation_handler gcry_set_fatalerror_handler gcry_set_gettext_handler gcry_set_log_handler gcry_set_outofcore_handler gcry_set_progress_handler gcry_sexp_alist gcry_sexp_append gcry_sexp_build gcry_sexp_build_array gcry_sexp_cadr gcry_sexp_canon_len gcry_sexp_car gcry_sexp_cdr gcry_sexp_cons gcry_sexp_create gcry_sexp_dump gcry_sexp_extract_param gcry_sexp_find_token gcry_sexp_length gcry_sexp_new gcry_sexp_nth gcry_sexp_nth_buffer gcry_sexp_nth_data gcry_sexp_nth_mpi gcry_sexp_nth_string gcry_sexp_prepend gcry_sexp_release gcry_sexp_sprint gcry_sexp_sscan gcry_sexp_vlist gcry_strdup gcry_strerror gcry_strsource gcry_xcalloc gcry_xcalloc_secure gcry_xmalloc gcry_xmalloc_secure gcry_xrealloc gcry_xstrdup

Name

.text

Size

746KB

Virtual Size

746KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libgpg-error-0.dll

IMPHASH 4c2d4ac6b18c464e41c970c7913ffc89
SHA256 2aef5c58f9454174d816729fce925919d8c5994a37f129288357bf8ec2b26783
MD5 f00d0500d0e18f9cbbf24df4c867447f
SHA1 930c42e51296f9c706b683973d36b32401adea88
SHA512 71f9d683ab1bbfe3ff247cdd2da99c29fdaf7c55489773aad58004ef853709d962de3f08f63b01bda3467366bf49eab4e86634e10837473446e9788df6d9682c
SSDEEP 3072:1VLFn1do/If9mvLJmVj+JP2xxFTTa6MpVf1JJKDo7wvQGxm8uNIW2A:vFn1db9mvLJmAurTaxVf1JJKDo7wvzxQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CreateDirectoryA CreateEventA CreateFileA CreateFileW CreatePipe CreateProcessA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsA GetACP GetCPInfo GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetPriorityClass GetProcAddress GetSystemTimeAsFileTime GetTempPathA GetThreadLocale GetTickCount InitializeCriticalSection IsDBCSLeadByteEx IsValidCodePage LeaveCriticalSection LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter ReadFile ResetEvent ResumeThread SetEnvironmentVariableA SetEvent SetFilePointerEx SetHandleInformation SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__dllonexit _amsg_exit _errno _exit _get_osfhandle _initterm _iob _lock _lseeki64 _onexit _open_osfhandle _snwprintf _vsnprintf time localtime calloc exit fclose ferror fflush fopen fprintf fputc fputs fread free fseek ftell fwprintf fwrite getenv isspace malloc memchr memcpy memset raise realloc sprintf strchr strcmp strcpy strcspn strerror strlen strncmp strncpy strpbrk strrchr strspn strtol strtoul _stricmp _strnicmp _unlock abort atoi vfprintf wcscpy _write _setmode _read _putenv _open _mkdir _isatty _getpid _getcwd _fileno _dup _close _chdir _access

user32

AllowSetForegroundWindow MessageBoxW

ws2_32

closesocket connect htons inet_addr send socket

_gpg_w32_bindtextdomain _gpg_w32_dgettext _gpg_w32_dngettext _gpg_w32_gettext _gpg_w32_gettext_localename _gpg_w32_gettext_use_utf8 _gpg_w32_textdomain _gpgrt_get_std_stream _gpgrt_getc_underflow _gpgrt_log_assert _gpgrt_pending _gpgrt_pending_unlocked _gpgrt_putc_overflow _gpgrt_set_std_fd gpg_err_code_from_errno gpg_err_code_from_syserror gpg_err_code_to_errno gpg_err_deinit gpg_err_init gpg_err_set_errno gpg_error_check_version gpg_strerror gpg_strerror_r gpg_strsource gpgrt_argparse gpgrt_asprintf gpgrt_b64dec_finish gpgrt_b64dec_proc gpgrt_b64dec_start gpgrt_b64enc_finish gpgrt_b64enc_start gpgrt_b64enc_write gpgrt_bsprintf gpgrt_calloc gpgrt_chdir gpgrt_check_version gpgrt_clearerr gpgrt_clearerr_unlocked gpgrt_fclose gpgrt_fclose_snatch gpgrt_fdopen gpgrt_fdopen_nc gpgrt_feof gpgrt_feof_unlocked gpgrt_ferror gpgrt_ferror_unlocked gpgrt_fflush gpgrt_fgetc gpgrt_fgets gpgrt_fileno gpgrt_fileno_unlocked gpgrt_flockfile gpgrt_fname_get gpgrt_fname_set gpgrt_fopen gpgrt_fopencookie gpgrt_fopenmem gpgrt_fopenmem_init gpgrt_fpopen gpgrt_fpopen_nc gpgrt_fprintf gpgrt_fprintf_unlocked gpgrt_fputc gpgrt_fputs gpgrt_fputs_unlocked gpgrt_fread gpgrt_free gpgrt_freopen gpgrt_fseek gpgrt_fseeko gpgrt_ftell gpgrt_ftello gpgrt_ftrylockfile gpgrt_funlockfile gpgrt_fwrite gpgrt_get_errorcount gpgrt_get_nonblock gpgrt_get_syscall_clamp gpgrt_getcwd gpgrt_getenv gpgrt_getline gpgrt_inc_errorcount gpgrt_lock_destroy gpgrt_lock_init gpgrt_lock_lock gpgrt_lock_trylock gpgrt_lock_unlock gpgrt_log gpgrt_log_bug gpgrt_log_clock gpgrt_log_debug gpgrt_log_debug_string gpgrt_log_error gpgrt_log_fatal gpgrt_log_flush gpgrt_log_get_fd gpgrt_log_get_prefix gpgrt_log_get_stream gpgrt_log_info gpgrt_log_printf gpgrt_log_printhex gpgrt_log_set_pid_suffix_cb gpgrt_log_set_prefix gpgrt_log_set_sink gpgrt_log_set_socket_dir_cb gpgrt_log_string gpgrt_log_test_fd gpgrt_logv gpgrt_logv_prefix gpgrt_malloc gpgrt_mkdir gpgrt_mopen gpgrt_onclose gpgrt_opaque_get gpgrt_opaque_set gpgrt_poll gpgrt_printf gpgrt_printf_unlocked gpgrt_read gpgrt_read_line gpgrt_realloc gpgrt_rewind gpgrt_set_alloc_func gpgrt_set_binary gpgrt_set_fixed_string_mapper gpgrt_set_nonblock gpgrt_set_strusage gpgrt_set_syscall_clamp gpgrt_set_usage_outfnc gpgrt_setbuf gpgrt_setenv gpgrt_setvbuf gpgrt_snprintf gpgrt_strconcat gpgrt_strdup gpgrt_strusage gpgrt_syshd gpgrt_syshd_unlocked gpgrt_sysopen gpgrt_sysopen_nc gpgrt_tmpfile gpgrt_ungetc gpgrt_usage gpgrt_vasprintf gpgrt_vbsprintf gpgrt_vfprintf gpgrt_vfprintf_unlocked gpgrt_vsnprintf gpgrt_w32_iconv gpgrt_w32_iconv_close gpgrt_w32_iconv_open gpgrt_w32_reg_query_string gpgrt_write gpgrt_write_hexstring gpgrt_write_sanitized gpgrt_yield

Name

.text

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libnpth-0.dll

IMPHASH 6e5535e60ee560e808ead377dc8e3f53
SHA256 30362bd4c6d7d2bf23f76b2d23a64dfdb79f3dd3f32478e6247d31cf1de78fc7
MD5 e132eccf9a1eac741c9e9806a143c475
SHA1 e5420ea0a935e32a6b4634756345aa3d2174cac5
SHA512 3ea415452dd3ee9d0571c3ecad32cac2f24895cfaf8756bb3543a9e193deb46edee8fd73c38b188b44dd296fabe7013d74dfd4ca02e3a4485f339e6c49a1ff05
SSDEEP 384:S4Io6T8B6ShjRWuU4JfSZ1kUMqurUfc1ckt+w0WhGGdBAVXIZTmGiWmrzsgWlsAb:FRxYkUJE0WdBAVXIriDrzw/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

812B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libsqlite3-0.dll

IMPHASH 761819ef29ce76fc66708b9a4421ee9a
SHA256 9d5d08972b624e5ef9cd9cef6e9fed21cca7972df624c3248992b96974afa3ae
MD5 3cdc28af73770e4a3068a47c094c73df
SHA1 f2ee14b5bd6f156a16def829e85fe4d5ad791dfd
SHA512 a055d712f4874d6239107e2ccbd751fd2de3d6a5db5e5f510e1e51b0a28591f60c56b0d0c11074308ad2afb6edae65d76c8318cbd8eac9278fe472fedc4479a6
SSDEEP 12288:58LF0+BcKh68H8vMwHvF/Jkbh84dQ64Jns0xmQak/lVTNRGwhP444dZIEqGw6KQc:KdBZ84Wq0xda4jhAZZzZtn/giGbfAK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

AreFileApisANSI CloseHandle CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexW DeleteCriticalSection DeleteFileA DeleteFileW EnterCriticalSection FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetTickCount GetVersionExA GetVersionExW HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection InterlockedCompareExchange LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter ReadFile SetEndOfFile SetFilePointer SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile

msvcrt

__dllonexit _amsg_exit _beginthreadex _endthreadex _initterm _iob _lock _onexit calloc free fwrite localtime malloc memcmp memcpy memmove memset qsort realloc strcmp strlen strncmp _unlock abort vfprintf

sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_blob64 sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_text64 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_bind_zeroblob64 sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_data_directory sqlite3_db_cacheflush sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_malloc64 sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_msize sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_realloc64 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_blob64 sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_subtype sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_text64 sqlite3_result_value sqlite3_result_zeroblob sqlite3_result_zeroblob64 sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_rtree_query_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_status64 sqlite3_step sqlite3_stmt_busy sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strglob sqlite3_stricmp sqlite3_strlike sqlite3_strnicmp sqlite3_system_errno sqlite3_table_column_metadata sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_dup sqlite3_value_free sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_subtype sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_is_nt sqlite3_win32_mbcs_to_utf8 sqlite3_win32_set_directory sqlite3_win32_sleep sqlite3_win32_utf8_to_mbcs sqlite3_win32_write_debug

Name

.text

Size

712KB

Virtual Size

712KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

trkop.vbs

SHA256 101f060edf89f4362ee6657acc110f88d3140090fb676620049a2407b503b837
MD5 e709fe17f4e7f99292b8685ddd0a0a7c
SHA1 f7f05bd5b2b4c134577a375f4d3d29fda36fc146
SHA512 58a3df44e7123d84abe59be6af06587845157f3e75132c0c55b891cd911c77ab0fa958eb1c395c17d34fec02fc07af93b57aa3188cb4bb9f66a251a9b23b9647
SSDEEP 96:UgWBAP2GmFP5AI2IYAvk4yZxIe2H132Tes2X2nj2jW32p2eR2p52pvc272nRgu/b:UAPbmFPrKlZxLk3uesceKso2eRo5okGY
MD5 SHA1 SHA512 SSDEEP

yin1abtn.cq124aqq

SHA256 cca91cc9bcf32f8bd9e2dddd0c001b4b4c4a83b812d4b30512fcb40f09b07403
MD5 8f260118233c1160085c735ada76c681
SHA1 327e1709588a9a896b3125b0675d354760017c44
SHA512 56f1b7ebd15a411e218e0631f7e421f0831c22a5dbfd581d7879071ed1b15cf8004db77b2c5770495ecb8f22aed5f2d2e370ecfbe316fd935fee556951f17a29
MD5 SHA1 SHA512

zapa.bat

SHA256 7ce948f3b772b1829bf86cde37fa2f52916c5b1b5065b5207f7e1c2a423dd24e
MD5 ef99b93eced6ca4bb4e1ea3406c46c8e
SHA1 2d5f1f4ce603a608ad709796dc94558a9d896d46
SHA512 4ed77ef571aa7e5ba87e93e8bd7268026e78eccc5480c4fff787129c9ff273857b47986dea04273534d52ed99ec32a32d5bcbe131efbe768c6436eefd7ee6f08
MD5 SHA1 SHA512

zlib1.dll

IMPHASH 14fd1c643e4c2b92b5a6b5bd6e498f67
SHA256 249221a372e83580fa03e789714117c709fc1ce55cb7372640895833916b9f04
MD5 caa9c3b04efe83d93a9e4cac94b8e4a9
SHA1 95499536603ea18daf9be781bd927908d8327ac4
SHA512 faf16f7941e7a4f8a1caa144b0f845c704d38420e3bf549cb8961089dc380d7b08ebf347934366a2ec9b42c69d32e5ac675d56dbed6ebe029cafc2c23410b3b3
SSDEEP 1536:bON+QZJpRJ1glrdXOW0nTEDIptmwRh4p1nToIf6IOqIOqIF4qY+O:0HpRkXOlsIpkwYdTBfI4qIF4qY+O
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer