CipherWare Spoofer 04-29.rar
- SHA256 9f0930c6ccac8f9a6a58b056ce2cfa25da6a4c61ce6bdb31d80b963e911e0adf
Overview
overview
10Static
static
7CipherWare...29.rar
windows7-x64
3CipherWare...29.rar
windows10-2004-x64
3CipherWare...ns.txt
windows7-x64
1CipherWare...ns.txt
windows10-2004-x64
1CipherWare...ol.exe
windows7-x64
7CipherWare...ol.exe
windows10-2004-x64
7out.exe
windows7-x64
out.exe
windows10-2004-x64
CipherWare...gs.vbs
windows7-x64
3CipherWare...gs.vbs
windows10-2004-x64
1CipherWare...ol.ini
windows7-x64
1CipherWare...ol.ini
windows10-2004-x64
1CipherWare...me.url
windows7-x64
1CipherWare...me.url
windows10-2004-x64
1CipherWare.../1.png
windows7-x64
1CipherWare.../1.png
windows10-2004-x64
3CipherWare.../2.png
windows7-x64
1CipherWare.../2.png
windows10-2004-x64
3CipherWare.../3.png
windows7-x64
1CipherWare.../3.png
windows10-2004-x64
3CipherWare...ne.url
windows7-x64
1CipherWare...ne.url
windows10-2004-x64
1CipherWare...32.exe
windows7-x64
3CipherWare...32.exe
windows10-2004-x64
3CipherWare...64.exe
windows7-x64
3CipherWare...64.exe
windows10-2004-x64
3CipherWare...ub.ini
windows7-x64
1CipherWare...ub.ini
windows10-2004-x64
1CipherWare...er.exe
windows7-x64
10CipherWare...er.exe
windows10-2004-x64
10CipherWare...ss.exe
windows7-x64
9CipherWare...ss.exe
windows10-2004-x64
9Behavioral task
behavioral1
Sample
CipherWare Spoofer 04-29.rar
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
CipherWare Spoofer 04-29.rar
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
CipherWare Spoofer 04-29/Instructions.txt
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
CipherWare Spoofer 04-29/Instructions.txt
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
CipherWare Spoofer 04-29/Requirements/Defender Control/Defender Control.exe
Resource
win7-20240215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
CipherWare Spoofer 04-29/Requirements/Defender Control/Defender Control.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
out.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
out.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
CipherWare Spoofer 04-29/Requirements/Defender Control/Defender_Settings.vbs
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
CipherWare Spoofer 04-29/Requirements/Defender Control/Defender_Settings.vbs
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
CipherWare Spoofer 04-29/Requirements/Defender Control/dControl.ini
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
CipherWare Spoofer 04-29/Requirements/Defender Control/dControl.ini
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
CipherWare Spoofer 04-29/Requirements/DirectX End-User Runtime.url
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
CipherWare Spoofer 04-29/Requirements/DirectX End-User Runtime.url
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/1.png
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/1.png
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/2.png
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/2.png
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/3.png
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/3.png
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
CipherWare Spoofer 04-29/Requirements/Visual C++ Redistributable Runtimes All-in-One.url
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
CipherWare Spoofer 04-29/Requirements/Visual C++ Redistributable Runtimes All-in-One.url
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x32.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x32.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x64.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x64.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Wub.ini
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Wub.ini
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
CipherWare Spoofer 04-29/Spoofer.exe
Resource
win7-20240215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral30
Sample
CipherWare Spoofer 04-29/Spoofer.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral31
Sample
CipherWare Spoofer 04-29/TPM Bypass.exe
Resource
win7-20240419-en
windows7-x64
14 signatures
150 seconds
General
- Target CipherWare Spoofer 04-29.rar
- Size 11.4MB
- Sample240611-nf245svdph
- SHA256 9f0930c6ccac8f9a6a58b056ce2cfa25da6a4c61ce6bdb31d80b963e911e0adf
- MD5 353b77804e6ee0c1282787dbd8a99874
- SHA1 ddb2d691e9691b92f15534f0f975f67a1a787ee2
- SHA512 a19b7f24f91f735110d37378006364c2acd6d36330dc0e8c47fd3f1f3e24abc4f423d4c928ac5018fa850b4723d75dfdd7d8d67989289a6338242bf51f6f2867
- SSDEEP 196608:VUROe2gz2r4PGL4kyuE4oeFP5wZ4XG67nmxSwPJ2MfoFhAr5DK18LKuD157wb:W2gze4uL4zG3w+znwRhobArN7Bab
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/CipherWare Spoofer 04-29/Requirements/Defender Control/Defender Control.exe upx - AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe static1/unpack001/CipherWare Spoofer 04-29/Spoofer.exe autoit_exe static1/unpack001/CipherWare Spoofer 04-29/TPM Bypass.exe autoit_exe - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx unpack001/CipherWare Spoofer 04-29/Spoofer.exe unpack001/CipherWare Spoofer 04-29/TPM Bypass.exe
File Explorer
-
CipherWare Spoofer 04-29.rar.rar 11.4MB
-
CipherWare Spoofer 04-29/Instructions.txt1KB
-
CipherWare Spoofer 04-29/Requirements/Defender Control/Defender Control.exe.exe 447KB
-
out.upx.exe 653KB
-
CipherWare Spoofer 04-29/Requirements/Defender Control/Defender_Settings.vbs.vbs 313B
-
CipherWare Spoofer 04-29/Requirements/Defender Control/dControl.ini85KB
-
CipherWare Spoofer 04-29/Requirements/DirectX End-User Runtime.url.url 149B
-
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/1.png.png 8KB
-
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/2.png.png 31KB
-
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/3.png.png 51KB
-
CipherWare Spoofer 04-29/Requirements/Visual C++ Redistributable Runtimes All-in-One.url.url 179B
-
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x32.exe.exe 791KB
-
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x64.exe.exe 939KB
-
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Wub.ini97KB
-
CipherWare Spoofer 04-29/Spoofer.exe.exe 5.9MB
-
CipherWare Spoofer 04-29/TPM Bypass.exe.exe 5.4MB
CipherWare Spoofer 04-29/Instructions.txt
- SHA256 0fdea98c7cdeced3e08d3db43aa8bd33e393f39b6b6b7c2e743dd3b55504ab29
- MD5 471ae022b1d850bcda15be9d3bf391df
- SHA1 f5833546d0a263ec0089cd92c6aa3be9bbd0e566
- SHA512 a6568b51f80ba4a0b39752bef9b8570056e81e6cbe2fb7a1f67892777869ca6a758eea215762100490037c4812cb1e6dbe0f47aabc1c08946b4966d1b84c30a1
- MD5 SHA1 SHA512
CipherWare Spoofer 04-29/Requirements/Defender Control/Defender Control.exe
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- MD5 58008524a6473bdf86c1040a9a9e39c3
- SHA1 cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA512 8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP 6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
13:f6:ef:3f:06:29:49:56:6c:21:59:e0:0c:ac:6f:83:24:95:fa:e4
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Sordum Software
Chains
Jun 10, 2024
Subject
CN=Sordum Software
Serial Number
69:98:6c:80:0a:7c:5b:8e:47:86:45:a0:3e:86:d5:40
Issuer
CN=Sordum Software
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 11, 2021 - Jul 31, 2030
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 31, 2021 - Sep 17, 2029
Subject
CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL
Serial Number
f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Issuer
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 19, 2021 - May 18, 2032
Subject
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 19, 2021 - May 18, 2036
Minor OS version
0
Major OS version
5
Entry point
775760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
492KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
262KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
57KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553
- MD5 6970ea0b6597dcd5b4f5f19f28e958a8
- SHA1 a0130bb7ac03ec4799c90781ca93fd1392c6d54c
- SHA512 bc95cbe9a050e3d3b713745ef399bf2817d38f8e019f6edffdd2bf755badbde766e434e39a7f32356125bba0692b694c18da8dd0762aac0c9430d45acb215e01
- SSDEEP 12288:nkxDoouVA2nxKkhEvdRgQriDJOIlW+yBGQowlNCWS:RRmJkioQrilOIc+yMx
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
CipherWare Spoofer 04-29/Requirements/Defender Control/Defender_Settings.vbs
- SHA256 af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
- MD5 b0bf0a477bcca312021177572311e666
- SHA1 ea77332d7779938ae8e92ad35d6dea4f4be37a92
- SHA512 09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8
- MD5 SHA1 SHA512
CipherWare Spoofer 04-29/Requirements/Defender Control/dControl.ini
- SHA256 8e9a84da243905685ca77b6ef71841e610b88b7963d4de59f6dcbdd1621ecacd
- MD5 05450ff06366ae22654b63a6e27d1624
- SHA1 11453c370f41287fb6339e509bb9d3c91842b379
- SHA512 ee0a9605b566aa89c8c9b260e1d9c15aecbd6cddc2df47fe24ef2cafbe8923b3e025bd5cd3d34499292589a3c094dd796ab4560c8099bad2051a54928c37b4b2
- SSDEEP 768:i/G+NmPfjsxaxdk2akexodULxEQq1wIgC+AEbSr6:1+NyjsxkKdkJdULgbWSO
- MD5 SHA1 SHA512 SSDEEP
CipherWare Spoofer 04-29/Requirements/DirectX End-User Runtime.url
- SHA256 465f8c2b16cfa0f27d6bc39ecda3e7b2c758e2ff19a776246ab48bd328b88875
- MD5 6be6a35a2429c11aed6a971fde50409f
- SHA1 bab3b7812a4e8415039cf968e172f346c1a38b53
- SHA512 b3cb8d43257ae15429147337ffcea247e6241f2cbd5fb0f92d4f5ab7c0e8e6e8bc6087413e116c7f0a2dc9162e55362ed10f2aa778c0b998cdbb4ad58ca18e65
- MD5 SHA1 SHA512
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/1.png
- SHA256 0b366bea05f699f0f5214f73abd3969cb3551042c8dce43c5abdac94a7af376c
- MD5 f4c0cb1da948ef49e9ab9f15e5dcc51b
- SHA1 b6754d4ce40407e5b0a086bf7ed045795dfe25f2
- SHA512 1b466df05fc916001b826fa511184323fa5d8e82dce0b15b1e1f3829f77c60b8483dea87f56cb79953451a21b47d5b0b2624c357e2b6ceb73e0fb54c8feb11b7
- SSDEEP 192:6+beQ6CjISLDW5XJeF1SQUBFGLrrkAEfi5HYPAv8oKB5:6+qQwSaAUurkNiZEzn
- MD5 SHA1 SHA512 SSDEEP
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/2.png
- SHA256 40b4c8011b95df55741388b06110ca0cf56a40bc46a52ddf86a04d7b5180a2d7
- MD5 73d5f10f883fd1cdbfd29d63f16f85f6
- SHA1 a3632b466ece0ee05abb3c85a4817cbcf19cbff9
- SHA512 19a722ccd463d14196ab5b1ef86da7d91146a29f26681ca2bfa9c9801ed234c7a28a5bc6af20c6a021a9937a86eba7707c5fe48e4e7093f743d716605947f0a0
- SSDEEP 768:nqN/lG/2f8HcPahSfqGPX9A5GkzpPRTpwFLa1JXm:nqNtGu5ahSqYXm7RpmLaa
- MD5 SHA1 SHA512 SSDEEP
CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/3.png
- SHA256 d4f4094b0b2e2a66f5d60b35b661986fe6a8954673edae0c8ecd2c4cae9006c7
- MD5 f8d73f45036054f4d5e7d2cc4c16a51d
- SHA1 a24840bef7e4dea01bf16dffea357adec7b65c20
- SHA512 e97074c62fe53d35367183554bfdbfabaaecd70a2c814a87af4c5cff46b861fb5fab44a524c70054ccec98f3beeb8136e26d843957827e18272dc6775ce0645d
- SSDEEP 768:IRuB90w/KZUmi3EKYDCNBLOBmU4b3HcBrFrMlUecF5xE7J5uDbVGpMX6R4osRfdQ:pNCZUTEBDUFb3HkMlSF/oJTZMbaL
- MD5 SHA1 SHA512 SSDEEP
CipherWare Spoofer 04-29/Requirements/Visual C++ Redistributable Runtimes All-in-One.url
- SHA256 30ba4f2828ed80f36c0d4d253d7b9990ea57b354283262792140ea85b3d08024
- MD5 6236fc6a33c4f3932921b379209a73f7
- SHA1 059580fd5b36df55ef0d38a3c61a40f6574a4789
- SHA512 a83645a156ae4a6d9509d6b5299ba9895090fb63b9005491b8a93c9e29dc313c193d07bf50c34ad378488a1e7718e0d8ecb2d9a48b8cc5209992dc8537472338
- MD5 SHA1 SHA512
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x32.exe
- IMPHASH 870b8e75c7190e202e9c6c81dff1040c
- SHA256 aac1123f17f8569a36bf93876cea30e15103fd2379b401a79129a2a6e7285ac2
- MD5 82aff8883099cf75462057c4e47e88ac
- SHA1 68e2939f59b3869e9bd3ecc4aca3947649631bf8
- SHA512 212ac940a1f8bdd805813c279d471efc53b858bc35c5edad182dfde3c29c37854618a507a0a0839e5a383d1ba4fe317c0b3c8275d023c86ecfa36f221560b96d
- SSDEEP 12288:ZaWzgMg7v3qnCiWErQohh0F4YCJ8lnyTQrv2HzAMI3u18:4aHMv6CWrj8nyTQrv2TAMI3ua
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ce:a3:d7:4e:89:0b:26:a8:99:dd:81:85:cf:0e:ee:ee:5d:3b:1e:98
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sordum Software
Chains
Jun 9, 2023
Subject
CN=Sordum Software
Serial Number
79:9e:5f:0f:69:be:cb:93:49:4a:b3:10:ef:62:cc:c3
Issuer
CN=Sordum Software
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 15, 2021 - Jul 31, 2032
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 10, 2014 - Dec 10, 2034
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:48:90:3d:c2:8a:bc:a7:a1:19:4d:0c:1c:57:b8:29
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Minor OS version
0
Major OS version
5
Entry point
90896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
setsockopt
ntohs
recvfrom
sendto
htons
select
listen
WSAStartup
bind
closesocket
connect
socket
send
WSACleanup
ioctlsocket
accept
WSAGetLastError
inet_addr
gethostbyname
gethostname
recv
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
mpr
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WNetUseConnectionW
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetQueryOptionW
InternetQueryDataAvailable
psapi
EnumProcesses
GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcessModules
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile
LoadUserProfileW
kernel32
HeapAlloc
Sleep
GetCurrentThreadId
RaiseException
MulDiv
GetVersionExW
GetSystemInfo
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
FindNextFileW
lstrcmpiW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
OutputDebugStringW
GetLocalTime
CompareStringW
CompareStringA
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
GetTempPathW
GetTempFileNameW
VirtualFree
FormatMessageW
GetExitCodeProcess
SetErrorMode
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
DeviceIoControl
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetComputerNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcessId
GetCurrentThread
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
LoadLibraryExW
HeapFree
WaitForSingleObject
CreateThread
DuplicateHandle
GetLastError
CloseHandle
GetCurrentProcess
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameW
GetFullPathNameW
ExitProcess
ExitThread
GetSystemTimeAsFileTime
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
ResumeThread
GetStartupInfoW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameA
HeapReAlloc
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringW
LCMapStringA
RtlUnwind
SetFilePointer
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetTickCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetModuleHandleA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
EnumResourceNamesW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
ReleaseCapture
SetCapture
WindowFromPoint
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
CheckMenuRadioItem
CopyImage
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
SystemParametersInfoW
PeekMessageW
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
GetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
MessageBoxW
DefWindowProcW
MoveWindow
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
GetMenuItemID
TranslateMessage
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
UnregisterHotKey
CharLowerBuffW
MonitorFromRect
keybd_event
LoadImageW
GetWindowLongW
gdi32
DeleteObject
GetObjectW
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
PolyDraw
BeginPath
Rectangle
GetDeviceCaps
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
SetViewportOrgEx
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegConnectRegistryW
RegEnumKeyExW
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
InitiateSystemShutdownExW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
SetSecurityDescriptorDacl
CopySid
LogonUserW
GetTokenInformation
GetAclInformation
GetAce
AddAce
GetSecurityDescriptorDacl
shell32
DragQueryPoint
ShellExecuteExW
SHGetFolderPathW
DragQueryFileW
SHEmptyRecycleBinW
SHBrowseForFolderW
SHFileOperationW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetMalloc
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
StringFromCLSID
IIDFromString
StringFromIID
OleInitialize
CreateBindCtx
CLSIDFromProgID
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
OleUninitialize
oleaut32
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SysAllocString
OleLoadPicture
SafeArrayGetVartype
SafeArrayDestroyData
SafeArrayAccessData
VarR8FromDec
VariantTimeToSystemTime
VariantClear
VariantCopy
VariantInit
SafeArrayDestroyDescriptor
LoadRegTypeLi
GetActiveObject
SafeArrayUnaccessData
Name
.text
Size
512KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=30, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=178, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=109, productName=VS2005 build 50727, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=525, id=1, productName=Unmarked objects,
count=70, id=143, version=30729,
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x64.exe
- IMPHASH 42b8d4fa3bc2c4336a20de1bdf1422d8
- SHA256 187eeee9e518011de1b87cfb0ed03e12ea551e9011f0c8defdd0e4535e672da2
- MD5 9d6778f7f274f7ecd4e7e875a7268b64
- SHA1 452fa439f1cc0b9fcc37cf4b8cfff96e8cc348aa
- SHA512 d51df55a5f903ec624550e847459bfa52fb19e892a58fe2de41251d9d98890b36f26a4950ad75f900de0311b5330066aaece11ec5e549d5b3867a61a344e0b87
- SSDEEP 24576:12DW/xbqX2YIbzQsu3/PNLIQFHyBvGThpZY9:12EmXGQsW/PN0QNlZI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
22:8c:20:21:a8:7d:2d:05:97:59:54:86:c4:a2:59:bc:a7:2f:99:ef
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sordum Software
Chains
Jun 9, 2023
Subject
CN=Sordum Software
Serial Number
79:9e:5f:0f:69:be:cb:93:49:4a:b3:10:ef:62:cc:c3
Issuer
CN=Sordum Software
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 15, 2021 - Jul 31, 2032
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 10, 2014 - Dec 10, 2034
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:48:90:3d:c2:8a:bc:a7:a1:19:4d:0c:1c:57:b8:29
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Minor OS version
2
Major OS version
5
Entry point
119932
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wsock32
__WSAFDIsSet
setsockopt
ntohs
recvfrom
sendto
htons
select
listen
WSAStartup
bind
closesocket
connect
socket
send
WSACleanup
ioctlsocket
accept
WSAGetLastError
inet_addr
gethostbyname
gethostname
recv
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
mpr
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WNetUseConnectionW
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetQueryOptionW
InternetQueryDataAvailable
psapi
EnumProcesses
GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcessModules
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile
LoadUserProfileW
kernel32
HeapAlloc
Sleep
GetCurrentThreadId
RaiseException
MulDiv
GetVersionExW
GetSystemInfo
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
FindNextFileW
lstrcmpiW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetProcessHeap
CompareStringW
CompareStringA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetStdHandle
CreatePipe
TerminateThread
GetTempPathW
GetTempFileNameW
VirtualFree
FormatMessageW
GetExitCodeProcess
SetErrorMode
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
DeviceIoControl
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetComputerNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcessId
GetCurrentThread
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
LoadLibraryExW
HeapFree
WaitForSingleObject
CreateThread
DuplicateHandle
GetLastError
CloseHandle
GetCurrentProcess
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameW
GetFullPathNameW
ExitProcess
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetStartupInfoW
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
FlsFree
SetLastError
FlsAlloc
HeapSize
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
GetModuleFileNameA
HeapSetInformation
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringW
LCMapStringA
SetFilePointer
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetTickCount
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
GetLocalTime
SetEnvironmentVariableA
user32
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
GetWindowLongW
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongPtrW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
SetWindowLongPtrW
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
ReleaseCapture
SetCapture
WindowFromPoint
DispatchMessageW
TranslateMessage
PeekMessageW
UnregisterHotKey
CharLowerBuffW
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
IsCharAlphaNumericW
GetCursorPos
DeleteMenu
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
IsClipboardFormatAvailable
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongPtrW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
GetUserObjectSecurity
CloseDesktop
CloseWindowStation
IsCharAlphaW
GetKeyboardLayoutNameW
ClientToScreen
RegisterHotKey
GetCursorInfo
SetWindowPos
CopyImage
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
TrackPopupMenuEx
GetClipboardData
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
OpenClipboard
BlockInput
GetMessageW
SystemParametersInfoW
LockWindowUpdate
GetDesktopWindow
gdi32
DeleteObject
GetObjectW
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
PolyDraw
BeginPath
Rectangle
GetDeviceCaps
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
SetViewportOrgEx
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegConnectRegistryW
RegEnumKeyExW
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
InitiateSystemShutdownExW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
CopySid
SetSecurityDescriptorDacl
LogonUserW
GetTokenInformation
GetAclInformation
GetAce
AddAce
GetSecurityDescriptorDacl
shell32
DragQueryPoint
ShellExecuteExW
SHGetFolderPathW
DragQueryFileW
SHEmptyRecycleBinW
SHBrowseForFolderW
SHFileOperationW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetMalloc
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
StringFromCLSID
IIDFromString
StringFromIID
OleInitialize
CreateBindCtx
CLSIDFromProgID
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
OleUninitialize
oleaut32
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SysAllocString
OleLoadPicture
SafeArrayGetVartype
SafeArrayDestroyData
SafeArrayAccessData
VariantInit
VariantCopy
VariantClear
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
LoadRegTypeLi
GetActiveObject
SafeArrayUnaccessData
VarR8FromDec
Name
.text
Size
599KB
Virtual Size
598KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=185, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=128, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=531, id=1, productName=Unmarked objects,
count=70, id=143, version=30729,
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Wub.ini
- SHA256 30eb977d58106050818626b9b556a3badc7b7d012462903120a0663987c74c0b
- MD5 a16bf55cd2ef7d9e56565b0ed1aa208a
- SHA1 19edddaa24f73d9d01150babd58b1bcc0ff5d849
- SHA512 ab87d94620b0d77bfa8ff3e721bbb68a28185245b173be7b62195588e2a3b3d3a9ee085497300c14876118dff4edca7fea202328f3156a76c53f786b8d5b6118
- SSDEEP 3072:/sRhs8Y6aeg3r3wgjkyIFJ6QT3yc8Bi3r/ZpHG:xqJ6T
- MD5 SHA1 SHA512 SSDEEP
CipherWare Spoofer 04-29/Spoofer.exe
- IMPHASH 8e94250c88a6c0e478828f96bcbb1662
- SHA256 c941f6995ef56ab0fa76f5c604c134e86b5df21b45284e78669f3074be2473e7
- MD5 482183f599a399384629aa7deb145b2e
- SHA1 252c735e209efea8f92dafe4c50aea95f60915f2
- SHA512 72eb143ae229041b9d3cd219df7cc54138c9f99f81409a825cdc9741b0483cf4dabfe7b9f410d843263cf665ebc171fbc6168c83ecbb14d123d4a3fe8d565c25
- SSDEEP 98304:RXbIrqdcbu8gacqECpO0zSU8B2lJtc/jXwYUObL4Eyv3ZjmzTm7Sw:VIJbu8jzXyuY0YTf/+jmz5
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
152732
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wsock32
gethostbyname
recv
send
socket
inet_ntoa
setsockopt
ntohs
WSACleanup
WSAStartup
sendto
htons
__WSAFDIsSet
select
accept
listen
bind
inet_addr
ioctlsocket
recvfrom
WSAGetLastError
closesocket
gethostname
connect
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
mpr
WNetGetConnectionW
WNetCancelConnection2W
WNetUseConnectionW
WNetAddConnection2W
wininet
HttpOpenRequestW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
InternetConnectW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpSendEcho
IcmpCloseHandle
IcmpCreateFile
userenv
DestroyEnvironmentBlock
LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile
uxtheme
IsThemeActive
kernel32
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetShortPathNameW
DeleteFileW
FindNextFileW
CopyFileExW
GetFullPathNameW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
LoadResource
LockResource
SizeofResource
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
LoadLibraryW
GetLocalTime
CompareStringW
EnterCriticalSection
DuplicateHandle
GetStdHandle
CreatePipe
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
VirtualAlloc
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
CreateThread
GetCurrentProcess
GetCurrentThread
LeaveCriticalSection
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
SetLastError
TlsAlloc
ResetEvent
WaitForSingleObjectEx
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetACP
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetStringTypeW
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CloseHandle
WriteConsoleW
MoveFileW
RtlCaptureContext
user32
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
GetWindowLongW
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongPtrW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
SetWindowLongPtrW
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
PeekMessageW
GetInputState
UnregisterHotKey
CharLowerBuffW
MonitorFromPoint
MonitorFromRect
LoadImageW
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
IsCharUpperW
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
GetClipboardData
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
IsCharLowerW
IsCharAlphaNumericW
IsCharAlphaW
GetKeyboardLayoutNameW
ClientToScreen
RegisterHotKey
GetCursorInfo
SetWindowPos
CopyImage
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
SetMenuDefaultItem
CloseClipboard
GetWindowRect
SetUserObjectSecurity
IsClipboardFormatAvailable
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
OpenClipboard
GetWindowLongPtrW
gdi32
EndPath
DeleteObject
GetDeviceCaps
ExtCreatePen
StrokePath
SetPixel
CloseFigure
LineTo
AngleArc
MoveToEx
Ellipse
PolyDraw
GetTextExtentPoint32W
CreateCompatibleBitmap
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
GetDIBits
StretchBlt
SelectObject
CreateCompatibleDC
StrokeAndFillPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
RegSetValueExW
GetSecurityDescriptorDacl
GetAclInformation
RegCreateKeyExW
AddAce
SetSecurityDescriptorDacl
InitiateSystemShutdownExW
GetUserNameW
shell32
DragFinish
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
VariantChangeType
DispCallFunc
CreateStdDispatch
CreateDispTypeInfo
UnRegisterTypeLi
UnRegisterTypeLibForUser
RegisterTypeLibForUser
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
VariantTimeToSystemTime
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
VariantInit
VariantClear
VariantCopy
SysAllocString
SafeArrayCreateVector
VarR8FromDec
SafeArrayAllocDescriptorEx
SafeArrayAllocData
SysStringLen
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
SysReAllocString
SafeArrayAccessData
Name
.text
Size
717KB
Virtual Size
716KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=241, version=40116,
count=156, id=243, version=40116,
count=33, id=242, version=40116,
count=1, id=199, version=41118,
count=46, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=557, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
CipherWare Spoofer 04-29/TPM Bypass.exe
- IMPHASH 8e94250c88a6c0e478828f96bcbb1662
- SHA256 2c4bd49d86851a375e3669ee361e1a786d59765eb7dbaeeddc62f5cb18f1c66d
- MD5 226b0aaa3a81ae166681f1b3c41209f5
- SHA1 1e932f41b49428704d2e1ee5cec08a4e61c7d094
- SHA512 290ec6a64f3166e516cdcdde28bb99644902598378a18b867e496e0fb821d6597e202d179653353a4da97c1a94f67fed4340e914306a837be85162c0b023a013
- SSDEEP 98304:ZXbIrqkTdrVLNdMJ6Hz7OFBZqSn+m6mB5CxFwHXDty:9IBTdrhMJ6Hz0kSn+WKuHXDty
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
152732
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wsock32
gethostbyname
recv
send
socket
inet_ntoa
setsockopt
ntohs
WSACleanup
WSAStartup
sendto
htons
__WSAFDIsSet
select
accept
listen
bind
inet_addr
ioctlsocket
recvfrom
WSAGetLastError
closesocket
gethostname
connect
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
mpr
WNetGetConnectionW
WNetCancelConnection2W
WNetUseConnectionW
WNetAddConnection2W
wininet
HttpOpenRequestW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
InternetConnectW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpSendEcho
IcmpCloseHandle
IcmpCreateFile
userenv
DestroyEnvironmentBlock
LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile
uxtheme
IsThemeActive
kernel32
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetShortPathNameW
DeleteFileW
FindNextFileW
CopyFileExW
GetFullPathNameW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
LoadResource
LockResource
SizeofResource
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
LoadLibraryW
GetLocalTime
CompareStringW
EnterCriticalSection
DuplicateHandle
GetStdHandle
CreatePipe
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
VirtualAlloc
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
CreateThread
GetCurrentProcess
GetCurrentThread
LeaveCriticalSection
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
SetLastError
TlsAlloc
ResetEvent
WaitForSingleObjectEx
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetACP
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetStringTypeW
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CloseHandle
WriteConsoleW
MoveFileW
RtlCaptureContext
user32
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
GetWindowLongW
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongPtrW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
SetWindowLongPtrW
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
PeekMessageW
GetInputState
UnregisterHotKey
CharLowerBuffW
MonitorFromPoint
MonitorFromRect
LoadImageW
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
IsCharUpperW
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
GetClipboardData
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
IsCharLowerW
IsCharAlphaNumericW
IsCharAlphaW
GetKeyboardLayoutNameW
ClientToScreen
RegisterHotKey
GetCursorInfo
SetWindowPos
CopyImage
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
SetMenuDefaultItem
CloseClipboard
GetWindowRect
SetUserObjectSecurity
IsClipboardFormatAvailable
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
OpenClipboard
GetWindowLongPtrW
gdi32
EndPath
DeleteObject
GetDeviceCaps
ExtCreatePen
StrokePath
SetPixel
CloseFigure
LineTo
AngleArc
MoveToEx
Ellipse
PolyDraw
GetTextExtentPoint32W
CreateCompatibleBitmap
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
GetDIBits
StretchBlt
SelectObject
CreateCompatibleDC
StrokeAndFillPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
RegSetValueExW
GetSecurityDescriptorDacl
GetAclInformation
RegCreateKeyExW
AddAce
SetSecurityDescriptorDacl
InitiateSystemShutdownExW
GetUserNameW
shell32
DragFinish
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
VariantChangeType
DispCallFunc
CreateStdDispatch
CreateDispTypeInfo
UnRegisterTypeLi
UnRegisterTypeLibForUser
RegisterTypeLibForUser
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
VariantTimeToSystemTime
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
VariantInit
VariantClear
VariantCopy
SysAllocString
SafeArrayCreateVector
VarR8FromDec
SafeArrayAllocDescriptorEx
SafeArrayAllocData
SysStringLen
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
SysReAllocString
SafeArrayAccessData
Name
.text
Size
717KB
Virtual Size
716KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=241, version=40116,
count=156, id=243, version=40116,
count=33, id=242, version=40116,
count=1, id=199, version=41118,
count=46, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=557, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,