LOWKEY.zip
- SHA256 315099e7a6e776a11b8c393215ec2dd3143c5a748626061ef384c8b9999c3986
Overview
overview
10Static
static
7LOWKEY/Loa...ed.exe
windows7-x64
7LOWKEY/Loa...ed.exe
windows10-2004-x64
7LOWKEY/Mon...RU.exe
windows7-x64
10LOWKEY/Mon...RU.exe
windows10-2004-x64
10LOWKEY/Mon...rt.exe
windows7-x64
10LOWKEY/Mon...rt.exe
windows10-2004-x64
10LOWKEY/Wif...in.bat
windows7-x64
1LOWKEY/Wif...in.bat
windows10-2004-x64
1LOWKEY/libcurl.dll
windows7-x64
1LOWKEY/libcurl.dll
windows10-2004-x64
1LOWKEY/run...so.exe
windows7-x64
7LOWKEY/run...so.exe
windows10-2004-x64
7LOWKEY/run...st.exe
windows7-x64
7LOWKEY/run...st.exe
windows10-2004-x64
7LOWKEY/zlib1.dll
windows7-x64
1LOWKEY/zlib1.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
LOWKEY/Loader_protected.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
LOWKEY/Loader_protected.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
LOWKEY/Monitor Spoof/CRU.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
LOWKEY/Monitor Spoof/CRU.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
LOWKEY/Monitor Spoof/restart.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
LOWKEY/Monitor Spoof/restart.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
LOWKEY/Wifi & Bluetooth disabler/Disabler_Run_Admin.bat
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
LOWKEY/Wifi & Bluetooth disabler/Disabler_Run_Admin.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
LOWKEY/libcurl.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
LOWKEY/libcurl.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
LOWKEY/run me also.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral12
Sample
LOWKEY/run me also.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
LOWKEY/run me first.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
LOWKEY/run me first.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
LOWKEY/zlib1.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
LOWKEY/zlib1.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target LOWKEY.zip
- Size 32.0MB
- Sample240603-gxea3sfd84
- SHA256 315099e7a6e776a11b8c393215ec2dd3143c5a748626061ef384c8b9999c3986
- MD5 84f066d0041d28110ecc29d7a8dda300
- SHA1 8aa59459ba662ba2f5420ce047ee486723f42642
- SHA512 d7c8c297f5f7101a6662ab2bc012e853ee600c3f30e8303bee0c1a20fc024eef084ba2b52e66240a5c8d8c84b408bfae01b0673a9763abfe8ca5d184b787fc5e
- SSDEEP 786432:lmbIKZMTrp+Ty2SfUfnbu+zMFy/7zYgWXRLTArzttOaaFe:lmkeMnp+Ty2SfWnPzMFO7zYgWBLbFe
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/LOWKEY/Loader_protected.exe themida - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/LOWKEY/Loader_protected.exe unpack001/LOWKEY/Monitor Spoof/CRU.exe unpack001/LOWKEY/Monitor Spoof/restart.exe unpack001/LOWKEY/libcurl.dll unpack001/LOWKEY/zlib1.dll
File Explorer
-
LOWKEY.zip.zip 32.0MB
-
LOWKEY/Loader_protected.exe.exe 5.4MB
-
LOWKEY/Monitor Spoof/CRU.exe.exe 1.4MB
-
LOWKEY/Monitor Spoof/restart.exe.exe 198KB
-
LOWKEY/Wifi & Bluetooth disabler/Disabler_Run_Admin.bat1001B
-
LOWKEY/last_login.txt19B
-
LOWKEY/libcurl.dll.dll 497KB
-
LOWKEY/lowkey reversed.13371KB
-
LOWKEY/run me also.exe.exe 288KB
-
LOWKEY/run me first.exe.exe 24.2MB
-
LOWKEY/zlib1.dll.dll 85KB
LOWKEY/Loader_protected.exe
- SHA256 84ea9e6a8a65b9d653b175b28a50da62469f07e7c5c94a0a7f81b939c3a254a5
- MD5 7294f33e7a488cd4ba10383f0a7a0d89
- SHA1 e280731d441b875d65be9010904925fbd05dac2a
- SHA512 abfafa0c7866adf45b53feea4e036c471e120502cfc29d591d5f87bc5c7251ddf9297a465efb246cc4e68d954ab1339b88e3f35516fc089faa2a9b2a60e8e806
- SSDEEP 98304:xHU+1MNuAmgEWiKsFmiSIRMOrBt3Ks7qXW7dp4vNOP2S+1m7BIESQZnBYT:xHUsjmbIDlKs7EUn4N24mVIitWT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9117784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
620KB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
141KB
Virtual Size
326KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
819KB
Virtual Size
931KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
31KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
6.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=260, version=30795,
count=9, id=253, version=33731,
count=4, id=259, version=33731,
count=10, id=260, version=33731,
count=45, id=261, version=33731,
count=6, id=257, version=33731,
count=2, id=260, version=33523,
count=2, id=261, version=33523,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=26, id=260, version=31107,
count=42, id=257, version=30795,
count=7, id=156, version=21202,
count=529, id=1, productName=Unmarked objects,
count=9, id=265, version=33808,
count=1, id=255, version=33808,
count=1, id=258, version=33808,
LOWKEY/Monitor Spoof/CRU.exe
- IMPHASH 8c16c795b57934183422be5f6df7d891
- SHA256 446c40c07c4474244236bc50b498b2d61c5783bd2206d366ea10b332d0146622
- MD5 2b7a88c558a055878e72d6d96e2561bc
- SHA1 5b5089e85992a32d77dc837f65dbde11c547184c
- SHA512 7de24aafd170bf58b716af7dd27158e444141ed3ecae8001f127d04d6cb103dc38d4db542c8b8c78c30a3174bcfee4886cb664c17a2900e2b06f539ef3b79541
- SSDEEP 24576:PFOapLEWuIj9T0gR1U2vfVD8sA15qkJ1K3mbDQca9L32GYa:tdwfIj9T0ujvTO6L3L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
EVENT_SINK_GetIDsOfNames
ord690
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaLateIdCall
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
ord661
__vbaHresultCheckObj
__vbaNameFile
_adj_fdiv_m32
Zombie_GetTypeInfo
__vbaAryDestruct
ord669
ord593
__vbaExitProc
ord594
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
ord705
__vbaStrFixstr
_CIsin
ord631
ord709
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaStrCmp
ord529
__vbaGet4
__vbaPutOwner3
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord714
ord609
__vbaFPException
ord319
__vbaGetOwner3
__vbaUbound
ord535
__vbaFileSeek
ord537
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
ord570
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
ord689
__vbaAryLock
__vbaVarAdd
ord611
ord320
__vbaVarDup
__vbaStrToAnsi
ord321
__vbaFpI2
__vbaFpI4
ord616
__vbaLateMemCallLd
_CIatan
__vbaStrMove
ord618
__vbaCastObj
__vbaR8IntI4
ord650
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
ord580
ord581
Name
.text
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=8, id=9, version=8041,
count=1, id=13, version=8169,
LOWKEY/Monitor Spoof/restart.exe
- IMPHASH 8c16c795b57934183422be5f6df7d891
- SHA256 611e3f76cd702a3d9f3877304732786001799c5769e70d7e2fc4646aa5e8b124
- MD5 d41f2de16e192aa7f1d3edda64b00100
- SHA1 a7660dc9467035723e383b4e81eb1011a67a905a
- SHA512 763e877ec5d621f76f8b4e517939b6f77acf44389665895c53ba297dacab281725fa48c8e68f836d5e07631bbc42a6bb8ba7c0520ffc313fa3746a6254b57a3b
- SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalQ/HstlC2R7JbQwUxc:UsLqdufVUNDadE2R7Jsjq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
EVENT_SINK_GetIDsOfNames
ord690
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaLateIdCall
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
ord661
__vbaHresultCheckObj
__vbaNameFile
_adj_fdiv_m32
Zombie_GetTypeInfo
__vbaAryDestruct
ord669
ord593
__vbaExitProc
ord594
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
ord705
__vbaStrFixstr
_CIsin
ord631
ord709
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaStrCmp
ord529
__vbaGet4
__vbaPutOwner3
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord714
ord609
__vbaFPException
ord319
__vbaGetOwner3
__vbaUbound
ord535
__vbaFileSeek
ord537
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
ord570
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
ord689
__vbaAryLock
__vbaVarAdd
ord611
ord320
__vbaVarDup
__vbaStrToAnsi
ord321
__vbaFpI2
__vbaFpI4
ord616
__vbaLateMemCallLd
_CIatan
__vbaStrMove
ord618
__vbaCastObj
__vbaR8IntI4
ord650
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
ord580
ord581
Name
.text
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=8, id=9, version=8041,
count=1, id=13, version=8169,
LOWKEY/Wifi & Bluetooth disabler/Disabler_Run_Admin.bat
- SHA256 ff5735d7157d43beaf0ea13eae9dc29619d9384a79c0009c7b0ada9d722f0a30
- MD5 f231be56f8dd034fd9e62fe67b120dec
- SHA1 c0a4b9d91f5934f00a6cc28cdad56dfee45d3116
- SHA512 0da567136e8e24ed1cdcd27633ba2f68c26c9fcc3038d1d7a041516e187d97c9a1fc22eb57552f4a4378e58daeb297991e95f388530fa38e12c67ddcf50b22dd
- MD5 SHA1 SHA512
LOWKEY/last_login.txt
- SHA256 3b48f0ddd234111268456156ca4567f52034318f3f393938850b20343ca89961
- MD5 c797c5ba71a6c5e6b1e5845ea99165f1
- SHA1 7cb693228607894cf407b80b3366a9ba7f4e50f7
- SHA512 0e435f0b318c31e222f5cafee4400a8d46bb54a6d686f98681b3e17c63efc119b2b920ed5f5c592ac1d24d1172a7da5f7b03bc63bd8a1555dbe7385da23d6229
- MD5 SHA1 SHA512
LOWKEY/libcurl.dll
- IMPHASH 8571205d611243f448ca93f8273cd505
- SHA256 b3548dc70f66694e37b10ff26237a0b8d553fe6e1ad55565893878f2455a18bf
- MD5 65fbb7674548d159e5bc1c5bb5dda427
- SHA1 87ae6fe4045bb4d50def309b24c96930b63b89b2
- SHA512 f2f096cde7cd03401f48b947a4dcdb0557de50483e6691bf1b46f20c5029b0b91e625aeb1a1357f195eb6d75cbbfc4b2eb0960a3dc2efd91a4835743783d6655
- SSDEEP 12288:Z+YFNRqjLSbhPgVJlWbSsDU0Eah0KJdHFWW1moH:Z+6hPy2DU0Eah0K/FW7oH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
381728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\KC\Documents\GitHub\vcpkg\buildtrees\curl\x64-windows-rel\lib\libcurl.pdb
ws2_32
__WSAFDIsSet
ntohl
ioctlsocket
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
select
WSACreateEvent
WSACloseEvent
socket
send
recv
closesocket
accept
htonl
WSAGetLastError
WSAStartup
WSACleanup
recvfrom
sendto
listen
getsockopt
getsockname
getpeername
connect
bind
WSAEnumNetworkEvents
htons
ntohs
setsockopt
gethostname
WSASetLastError
WSAIoctl
inet_pton
getaddrinfo
freeaddrinfo
zlib1
zlibVersion
inflate
inflateEnd
inflateInit_
inflateInit2_
advapi32
CryptAcquireContextA
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGenRandom
CryptReleaseContext
crypt32
CertFindCertificateInStore
PFXImportCertStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CryptStringToBinaryA
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateChain
kernel32
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
FormatMessageW
SetLastError
GetLastError
GetStdHandle
Sleep
GetEnvironmentVariableA
WaitForSingleObjectEx
CloseHandle
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
QueryPerformanceCounter
GetTickCount
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
MoveFileExA
InitializeSListHead
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
SleepEx
vcruntime140
memset
__std_type_info_destroy_list
__C_specific_handler
memchr
strstr
memcmp
memmove
strrchr
strchr
memcpy
api-ms-win-crt-stdio-l1-1-0
ftell
fgets
fopen
fread
fseek
fputs
__stdio_common_vsprintf
fputc
feof
fwrite
fflush
_lseeki64
_close
fclose
__acrt_iob_func
_write
_read
__stdio_common_vsscanf
_open
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_time64
api-ms-win-crt-convert-l1-1-0
strtol
atoi
strtoll
wcstombs
strtoul
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
_cexit
_beginthreadex
_getpid
_crt_atexit
strerror
__sys_nerr
_errno
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
api-ms-win-crt-string-l1-1-0
isupper
_strdup
strncmp
strncpy
tolower
strpbrk
strcspn
strspn
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlink
_fstat64
_access
_stat64
api-ms-win-crt-heap-l1-1-0
free
calloc
malloc
realloc
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
_fdopen
curl_dbg_accept
curl_dbg_calloc
curl_dbg_fclose
curl_dbg_fdopen
curl_dbg_fopen
curl_dbg_free
curl_dbg_log
curl_dbg_malloc
curl_dbg_mark_sclose
curl_dbg_memdebug
curl_dbg_memlimit
curl_dbg_realloc
curl_dbg_recv
curl_dbg_sclose
curl_dbg_send
curl_dbg_socket
curl_dbg_strdup
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_perform_ev
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_version
curl_version_info
Name
.text
Size
370KB
Virtual Size
370KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=7, id=253, version=28518,
count=12, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=2, id=257, productName=VS2019 v16.11.1 build 30133, version=30133,
count=9, id=257, version=27412,
count=193, id=1, productName=Unmarked objects,
count=154, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=256, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
LOWKEY/lowkey reversed.1337
- SHA256 a99ac91d06a0f74e911bb639a7186d7ba9e5d61d6abb7ff519b19f435af476ef
- MD5 4fb84ddcaa982b01025b612e44737cff
- SHA1 3c93addcdf6296073bf9368a643c6b8a01fe827d
- SHA512 f80c74765a39c52e9aa0e90a71af45e6934220a50803c2a73424e74bd8d316a97a683020106452c913d91a40a5fe91ea714e42746e69d310e8a60872b2e2b067
- MD5 SHA1 SHA512
LOWKEY/run me also.exe
- IMPHASH 1494de9b53e05fc1f40cb92afbdd6ce4
- SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
- MD5 2cbd6ad183914a0c554f0739069e77d7
- SHA1 7bf35f2afca666078db35ca95130beb2e3782212
- SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
- SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
27:76:a5:a9:c5:b9:5a:43:1b:2c:30:b6:5e:2d:45:20:bf:45:97:ec:05:e8:52:14:50:01:2c:09:4d:ce:b4:84
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 23, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
5
Entry point
23134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA
kernel32
LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpyA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpiA
GetProcAddress
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
CloseHandle
LoadResource
SizeofResource
FindResourceA
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetCurrentDirectoryA
GetTempFileNameA
ExitProcess
CreateFileA
LoadLibraryExA
lstrcpynA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
GetVersionExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
LockResource
LoadLibraryA
GetDiskFreeSpaceA
MulDiv
EnumResourceLanguagesA
FreeLibrary
GlobalFree
gdi32
GetDeviceCaps
user32
ExitWindowsEx
wsprintfA
CharNextA
CharUpperA
CharPrevA
SetWindowLongA
GetWindowLongA
CallWindowProcA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
EndDialog
GetDesktopWindow
MessageBeep
SetDlgItemTextA
LoadStringA
GetSystemMetrics
comctl32
ord17
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
243KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=13, id=25, version=9210,
count=126, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=24, id=28, version=9178,
count=1, id=61, version=9210,
LOWKEY/run me first.exe
- IMPHASH 1a5cdbf711fee14b077e599d13fddab2
- SHA256 4dfe83c91124cd542f4222fe2c396cabeac617bb6f59bdcbdf89fd6f0df0a32f
- MD5 101b0b9f74cdc6cdbd2570bfe92e302c
- SHA1 2e6bae42c2842b4f558bd68099479b929bb7d910
- SHA512 ccf4fd7da2c3440f1bc7fcac67c8a12599eab8d5c015affdc2e439fa30f5c7868ef5f52ede058361faae37ccc4af2c17c0adf30b8e1f852bb7106d0ec7162506
- SSDEEP 786432:urp+Ty2SfUfnbu+zMFy/7zYgWXRLTArzttOaaFC:Sp+Ty2SfWnPzMFO7zYgWBLbFC
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7c:86:d4:06:35:e2:5d:25:8f:f3:ea:ed:cb:68:7a:8b:ad:82:e1:f4:69:da:6f:39:f1:26:95:9f:ba:d4:f9:2f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 23, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
5
Entry point
188525
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\8\s\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DecryptFileW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
GetMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
TranslateMessage
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
gdi32
CreateCompatibleDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
DeleteDC
shell32
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
kernel32
GetCommandLineA
GetCPInfo
GetOEMCP
CloseHandle
CreateFileW
GetProcAddress
LocalFree
HeapSetInformation
GetLastError
GetModuleHandleW
FormatMessageW
lstrlenA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
Sleep
GetLocalTime
GetModuleFileNameW
ExpandEnvironmentStringsW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
GetFullPathNameW
CompareStringW
GetCurrentProcessId
WriteFile
SetFilePointer
LoadLibraryW
GetSystemDirectoryW
CreateFileA
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FindClose
GetCommandLineW
GetCurrentDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
GetCurrentProcess
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
GetEnvironmentStringsW
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetNativeSystemInfo
GetModuleHandleExW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetComputerNameW
VerifyVersionInfoW
GetVolumePathNameW
GetDateFormatW
GetSystemDefaultLangID
GetUserDefaultLangID
GetStringTypeW
ReadFile
SetFilePointerEx
DuplicateHandle
InterlockedExchange
InterlockedCompareExchange
CreateEventW
ProcessIdToSessionId
OpenProcess
GetProcessId
WaitForSingleObject
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
InterlockedIncrement
InterlockedDecrement
ResetEvent
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
MapViewOfFile
UnmapViewOfFile
CreateMutexW
CreateFileMappingW
GetThreadLocale
IsValidCodePage
FreeEnvironmentStringsW
TlsAlloc
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DecodePointer
WriteConsoleW
GetModuleHandleA
GlobalAlloc
GlobalFree
GetFileSizeEx
CopyFileW
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SystemTimeToFileTime
GetSystemInfo
VirtualProtect
VirtualQuery
SetCurrentDirectoryW
FindFirstFileExW
GetFileType
GetACP
ExitProcess
GetStdHandle
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
SetLastError
LoadLibraryExA
rpcrt4
UuidCreate
Name
.text
Size
294KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=124, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=259, version=24123,
count=19, id=260, version=24123,
count=38, id=261, version=24123,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=337, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
LOWKEY/zlib1.dll
- IMPHASH 3e00cc5294fc2fcbabd14c323443ba4e
- SHA256 be93482393ca7d2b440d5559d86268758dadf2f13899978e0271ab1db06b8091
- MD5 6b2cfe74852195fb8187f368b74f7635
- SHA1 e23e54714355b852726e81a17c444059e0d1339c
- SHA512 6f3ffb5baf6d89ecd76fbdd949327ad12bcfc25b973dc81df498033e3dd65e4bb9774d696e4059abd336dff3cb219ed5a36d38e2e0f63dae2db22c96c359ccd6
- SSDEEP 1536:kTHRfzojvOeiRMPrpbAE1ApOal2qk0MGmnToIfUIOcIOYGW3wY:UBzojvOeiRMTtAEepOT0PSTBf6SYfwY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
56188
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\KC\Documents\GitHub\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb
vcruntime140
__std_type_info_destroy_list
__C_specific_handler
memchr
memset
memcpy
api-ms-win-crt-stdio-l1-1-0
_wopen
_write
_read
_close
__stdio_common_vsprintf
_open
_lseeki64
api-ms-win-crt-heap-l1-1-0
malloc
free
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-runtime-l1-1-0
_errno
_cexit
strerror
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
kernel32
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
RtlCaptureContext
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
adler32
adler32_combine
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzfread
gzfwrite
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
uncompress
uncompress2
zError
zlibCompileFlags
zlibVersion
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=30034,
count=4, id=253, version=28518,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=2, id=257, version=27412,
count=48, id=1, productName=Unmarked objects,
count=15, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=256, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,