8ed91c8de844e9e8e083719b6a931516902773a7d7f7d5fccb9874180c9a886c
- SHA256 8ed91c8de844e9e8e083719b6a931516902773a7d7f7d5fccb9874180c9a886c
-
Class file contains resources related to AdWind
Password
infected
Overview
overview
10Static
static
100d63eafe7f...99.exe
windows7-x64
80d63eafe7f...99.exe
windows10-2004-x64
8$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
31921502319...4.xlam
windows7-x64
101921502319...4.xlam
windows10-2004-x64
127133b9541...e9.vbs
windows7-x64
827133b9541...e9.vbs
windows10-2004-x64
6304278cfa0...1c.xls
windows7-x64
1304278cfa0...1c.xls
windows10-2004-x64
1365771facf...77.exe
windows7-x64
10365771facf...77.exe
windows10-2004-x64
10397900307d...0c.lnk
windows7-x64
3397900307d...0c.lnk
windows10-2004-x64
83d390249d9...ab.lnk
windows7-x64
33d390249d9...ab.lnk
windows10-2004-x64
840e5adc952...73.xls
windows7-x64
140e5adc952...73.xls
windows10-2004-x64
1746afcd799...69.xls
windows7-x64
1746afcd799...69.xls
windows10-2004-x64
185af8304fd...9f.jar
windows7-x64
185af8304fd...9f.jar
windows10-2004-x64
7984646a5a7...41.vbs
windows7-x64
10984646a5a7...41.vbs
windows10-2004-x64
109c33e83331...ce.exe
windows7-x64
109c33e83331...ce.exe
windows10-2004-x64
109f07c02b13...b4.lnk
windows7-x64
39f07c02b13...b4.lnk
windows10-2004-x64
10c0baec4eb2...f.xlam
windows7-x64
10c0baec4eb2...f.xlam
windows10-2004-x64
1Behavioral task
behavioral1
Sample
0d63eafe7f4eebd3b782dd262da6fa3e562c420e0ecfff540ee1a9c5a76b0f99.exe
Resource
win7-20240508-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d63eafe7f4eebd3b782dd262da6fa3e562c420e0ecfff540ee1a9c5a76b0f99.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
19215023198d9ebe4a626113cc6c001bd4d250ebea69aa25afd483aefd4c0984.xlam
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral8
Sample
19215023198d9ebe4a626113cc6c001bd4d250ebea69aa25afd483aefd4c0984.xlam
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
27133b9541228c135784f7c6c3bb9425975d7e7880ae278fea040b0ffcb8eee9.vbs
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
27133b9541228c135784f7c6c3bb9425975d7e7880ae278fea040b0ffcb8eee9.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
304278cfa0f9f2e81a48c4f23bcb97920b6263c07484b9a0793c2d1b8c65171c.xls
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
304278cfa0f9f2e81a48c4f23bcb97920b6263c07484b9a0793c2d1b8c65171c.xls
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
365771facf4476f03189fbace015a962f6fd021650f4ebd61acd0c675bc85b77.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
365771facf4476f03189fbace015a962f6fd021650f4ebd61acd0c675bc85b77.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
397900307dd4900066b97d9cdbf0e4cdaf145572b84293e1e08c2a15e7963a0c.lnk
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
397900307dd4900066b97d9cdbf0e4cdaf145572b84293e1e08c2a15e7963a0c.lnk
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
3d390249d9ba45f8e6198dde8319ee8ccd5b9b23921472095ed453544ca537ab.lnk
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
3d390249d9ba45f8e6198dde8319ee8ccd5b9b23921472095ed453544ca537ab.lnk
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
40e5adc952e8c472e083a539cd67ac339132f2e41a2c99dd3083dd720c041673.xls
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral20
Sample
40e5adc952e8c472e083a539cd67ac339132f2e41a2c99dd3083dd720c041673.xls
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
746afcd79967881e5a7a21ff847a60c9ef6f1c2dbd796b4ad0c16bc85009d069.xls
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
746afcd79967881e5a7a21ff847a60c9ef6f1c2dbd796b4ad0c16bc85009d069.xls
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral23
Sample
85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
984646a5a7686265df256e88616dc046b8daa6fbc1807ae67d2933caf0e6af41.vbs
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral26
Sample
984646a5a7686265df256e88616dc046b8daa6fbc1807ae67d2933caf0e6af41.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
9c33e83331c4e2e954f355f453bd32add84016d45e6434d568fb56b690de26ce.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
9c33e83331c4e2e954f355f453bd32add84016d45e6434d568fb56b690de26ce.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral29
Sample
9f07c02b13a50bb84630841a7a9876c9ced2ab66d406c54f4673c88e7cd70bb4.lnk
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
9f07c02b13a50bb84630841a7a9876c9ced2ab66d406c54f4673c88e7cd70bb4.lnk
Resource
win10v2004-20240611-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral31
Sample
c0baec4eb2deb38c2f86c250a7aae50a417652429439bb5ecce82e8bac6892ef.xlam
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral32
Sample
c0baec4eb2deb38c2f86c250a7aae50a417652429439bb5ecce82e8bac6892ef.xlam
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
Errors
Reason
office: non-rc4 encrypted document not supported
Reason
office: non-rc4 encrypted document not supported
General
- Target 8ed91c8de844e9e8e083719b6a931516902773a7d7f7d5fccb9874180c9a886c
- Size 7.2MB
- Sample240617-bd377swhrc
- SHA256 8ed91c8de844e9e8e083719b6a931516902773a7d7f7d5fccb9874180c9a886c
- MD5 89886c2edf05ecf1c7bd699afc33b087
- SHA1 0418403f212b5b5f57fec4cbaa37ff12683a4f80
- SHA512 435d58b0338940eafc3eab050eb20838a0c8abc1d0517da40c8cda1117d0e74e368093f945fdffe6910dfb84175c728be3a5ce3ef32e7735b9f111cc081e3ca3
- SSDEEP 196608:mn5gKydXl5j5t4y52QOLX6C4ud1cDFon18Yt3xIrKGq:DrdHVtIQTo1cZo+aBJGq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
yoda2024.sytes.net:43831
Mutex
-
fWQWs5QfpFj07ys9
Attributes
-
install_file
USB.exe
aes.plain
Extracted
Family
-
xworm
Version
-
3.1
C2
-
june9402xw.duckdns.org:9402
Mutex
-
TAtfGa9f0WCjVzn6
Attributes
-
install_file
USB.exe
aes.plain
Extracted
Family
-
remcos
Botnet
-
RemoteHost
C2
-
yoda2024.sytes.net:43833
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-N091BG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Adwind family
- Class file contains resources related to AdWind 1 IoCs
resource yara_rule sample family_adwind2 - Detect Xworm Payload 2 IoCs
resource yara_rule static1/unpack001/365771facf4476f03189fbace015a962f6fd021650f4ebd61acd0c675bc85b77.exe family_xworm static1/unpack001/9c33e83331c4e2e954f355f453bd32add84016d45e6434d568fb56b690de26ce.exe family_xworm - Remcos family
- Xworm family
- Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/BgImage.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack001/365771facf4476f03189fbace015a962f6fd021650f4ebd61acd0c675bc85b77.exe unpack001/9c33e83331c4e2e954f355f453bd32add84016d45e6434d568fb56b690de26ce.exe unpack003/$PLUGINSDIR/BgImage.dll unpack003/$PLUGINSDIR/nsDialogs.dll unpack001/dc038c57b308d6bf1ce9a3ef557f9e479b11deff708525160c2863e02546c423.exe unpack001/dc287ad322f50ecf2620c261d2a602426379bd9ff40a03b082d0efe3e2782ea6.exe unpack001/dc8d3ca124b39f73a8517c8edaf52732dc7766f405dda194114e58f8f841778b.exe
File Explorer
-
8ed91c8de844e9e8e083719b6a931516902773a7d7f7d5fccb9874180c9a886c.zip 7.2MB
-
0d63eafe7f4eebd3b782dd262da6fa3e562c420e0ecfff540ee1a9c5a76b0f99.exe.exe 824KB
-
$PLUGINSDIR/BgImage.dll.dll 7KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
Cfh.cil1KB
-
Chachalakas228/serpenticide.per3KB
-
Chachalakas228/sultet.and4KB
-
Chachalakas228/tory.dis4KB
-
Chachalakas228/udkobles.bog3KB
-
Chachalakas228/unomnisciently.mer1KB
-
Flageolettens.Tre52KB
-
Forbindingers187.ind2KB
-
Misrepresenter202.std2KB
-
Tilbunds.amp329KB
-
airtightness.led2KB
-
diphyllous.txt397B
-
gitterpunkter.mas3KB
-
grassmen.maa1KB
-
harddiskenes.unc2KB
-
kaardernes.bun1KB
-
multiphasic.pol3KB
-
ochrejelly.per3KB
-
19215023198d9ebe4a626113cc6c001bd4d250ebea69aa25afd483aefd4c0984.xlsx.xlam .xlsx 653KB
-
27133b9541228c135784f7c6c3bb9425975d7e7880ae278fea040b0ffcb8eee9.vbs.vbs 150KB
-
304278cfa0f9f2e81a48c4f23bcb97920b6263c07484b9a0793c2d1b8c65171c.xls.xls 1.1MB
-
365771facf4476f03189fbace015a962f6fd021650f4ebd61acd0c675bc85b77.exe.exe 36KB
-
397900307dd4900066b97d9cdbf0e4cdaf145572b84293e1e08c2a15e7963a0c.lnk.lnk .js 21KB
-
3d390249d9ba45f8e6198dde8319ee8ccd5b9b23921472095ed453544ca537ab.lnk.lnk .js 21KB
-
40e5adc952e8c472e083a539cd67ac339132f2e41a2c99dd3083dd720c041673.xlsx.xls .xlsx 1.3MB
-
746afcd79967881e5a7a21ff847a60c9ef6f1c2dbd796b4ad0c16bc85009d069.xls.xls 1.1MB
-
85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar.jar 448KB
-
984646a5a7686265df256e88616dc046b8daa6fbc1807ae67d2933caf0e6af41.vbs.vbs 533B
-
9c33e83331c4e2e954f355f453bd32add84016d45e6434d568fb56b690de26ce.exe.exe 34KB
-
9f07c02b13a50bb84630841a7a9876c9ced2ab66d406c54f4673c88e7cd70bb4.lnk.lnk 30KB
-
c0baec4eb2deb38c2f86c250a7aae50a417652429439bb5ecce82e8bac6892ef.xlsx.xlam .xlsx 652KB
-
c9a985aea86448e6770b76c334fbd6a83658df00688bd4e754bde0ec0a12504f.exe.exe 816KB
-
$PLUGINSDIR/BgImage.dll.dll 7KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
Beskeders/Neverne/harddiskenes.unc2KB
-
Beskeders/Neverne/kaardernes.bun1KB
-
Beskeders/Neverne/multiphasic.pol3KB
-
Beskeders/airtightness.led2KB
-
Beskeders/diphyllous.txt397B
-
Beskeders/gitterpunkter.mas3KB
-
Beskeders/grassmen.maa1KB
-
Cfh.cil1KB
-
Hovedpersonernes.Til48KB
-
Samlsninger.Und323KB
-
Symphonization/Forbindingers187.ind2KB
-
Symphonization/Misrepresenter202.std2KB
-
ochrejelly.per3KB
-
serpenticide.per3KB
-
sultet.and4KB
-
tory.dis4KB
-
udkobles.bog3KB
-
unomnisciently.mer1KB
-
dc038c57b308d6bf1ce9a3ef557f9e479b11deff708525160c2863e02546c423.exe.exe 578KB
-
dc287ad322f50ecf2620c261d2a602426379bd9ff40a03b082d0efe3e2782ea6.exe.exe 435KB
-
dc8d3ca124b39f73a8517c8edaf52732dc7766f405dda194114e58f8f841778b.exe.exe 469KB
-
e4bc1b6f2e541e90a1ed736284d2e383fcb739f10466b1fdd390211e01ed4dae.jar.jar 123KB
-
ebe0db47f3d58129ded5690057c586c10adba99f5efea70eb2defd4be879d204.xlsx.xlam .xlsx 743KB
-
f2840d65ddee6a875210f31349e18385cbc9bca229666fc822642b546077e210.lnk.lnk 294KB
0d63eafe7f4eebd3b782dd262da6fa3e562c420e0ecfff540ee1a9c5a76b0f99.exe
- IMPHASH 7ed0d71376e55d58ab36dc7d3ffda898
- SHA256 0d63eafe7f4eebd3b782dd262da6fa3e562c420e0ecfff540ee1a9c5a76b0f99
- MD5 557d44cc5e33ac15ef0b659e5e58433d
- SHA1 389c0e121ee86c95c31915b54489e278a800b76d
- SHA512 ed6cfd791b7367f065c4f278d70288961bd01de010648776be6351aec2822b3080b72343cff5a8ab6d73a5131b73a02d03a3274f8b98cdf2433191a50e8596b4
- SSDEEP 12288:0Y4eAXsAvV7ihwdVUuRhnMLCke0euDme6ocbosxyc:EeAXsmV7Ywk+n0Cz0sEc0cv
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
02:3b:25:7f:a7:13:3b:86:39:39:5a:18:04:67:ae:ec:6d:65:11:fd:23:38:ad:b0:94:41:15:b5:60:62:96:96
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Balsammer,OU=Outfawn Knopsvanens\ ,O=Balsammer,L=Longeault,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c1c4e6f6e6174747269627574696f6e4053656d6968617264792e446568
Chains
Jun 12, 2024
Subject
CN=Balsammer,OU=Outfawn Knopsvanens\ ,O=Balsammer,L=Longeault,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c1c4e6f6e6174747269627574696f6e4053656d6968617264792e446568
Serial Number
70:02:b1:57:15:a6:8d:f2:f4:9b:54:0b:ea:3c:cd:91:d6:d0:04:7a
Issuer
CN=Balsammer,OU=Outfawn Knopsvanens\ ,O=Balsammer,L=Longeault,ST=Bourgogne-Franche-Comté,C=FR,1.2.840.113549.1.9.1=#0c1c4e6f6e6174747269627574696f6e4053656d6968617264792e446568
Timespan
Dec 9, 2023 - Dec 8, 2026
Minor OS version
0
Major OS version
4
Entry point
12818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathW
SetFileTime
CloseHandle
GetShortPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
GetFullPathNameW
CreateDirectoryW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
SetFileAttributesW
ExpandEnvironmentStringsW
LoadLibraryW
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcpyA
lstrcpyW
lstrcatW
GetSystemDirectoryW
GetVersion
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleHandleW
lstrcmpiW
lstrcmpW
WaitForSingleObject
GlobalFree
GlobalAlloc
LoadLibraryExW
GetExitCodeProcess
FreeLibrary
WritePrivateProfileStringW
SetErrorMode
GetCommandLineW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
WriteFile
lstrlenA
WideCharToMultiByte
user32
EndDialog
ScreenToClient
GetWindowRect
RegisterClassW
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
wsprintfW
CreateWindowExW
SystemParametersInfoW
AppendMenuW
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
GetDC
SetWindowLongW
LoadImageW
SendMessageTimeoutW
FindWindowExW
EmptyClipboard
OpenClipboard
TrackPopupMenu
EndPaint
ShowWindow
GetDlgItem
IsWindow
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
426KB
Virtual Size
425KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/BgImage.dll
- IMPHASH 32b0f5880a0efd258c6be2f7a14f4a9f
- SHA256 a45f294137e2b0f6092eee8fdd2e19334f34ff3640d865a810b70f2104e92c21
- MD5 ee255bdf426349e1caa8f1b71de9fd22
- SHA1 d589773826620046df1d77dd148f819a88dd35ec
- SHA512 71eeb41b5816b7d0f9517264aaf026da878561b6a222064c8100e47c383de9ac369800b734468322f3a6fc3eedb1a23d3c5ca6874bd7bf84af08f395248872cc
- SSDEEP 96:8ePik1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTc4j7J3kWyy/:tPdTJa2roqJyA2EN8diuTJje
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
lstrcpyW
lstrcpynW
GlobalFree
lstrcmpiW
EnterCriticalSection
GlobalAlloc
LeaveCriticalSection
user32
UnregisterClassW
CallWindowProcW
LoadImageW
DestroyWindow
BeginPaint
IsWindow
SendMessageW
DefWindowProcW
RedrawWindow
ShowWindow
LoadCursorW
RegisterClassW
CreateWindowExW
SetWindowLongW
GetSystemMetrics
SetWindowPos
DrawTextW
EndPaint
FillRect
gdi32
GetObjectW
DeleteDC
DeleteObject
CreateSolidBrush
CreateCompatibleDC
SelectObject
SetMapMode
GetMapMode
CreateCompatibleBitmap
CreateBitmap
SetBkMode
BitBlt
DPtoLP
SetBkColor
SetTextColor
winmm
PlaySoundW
AddImage
AddText
Clear
Destroy
Redraw
SetBg
SetReturn
Sound
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
630B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=1, productName=Unmarked objects,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=48, version=9044,
count=1, id=49, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsDialogs.dll
- IMPHASH ec5fddc407d2b4e0a16fc4d786afc555
- SHA256 be60a00f32924ccbe03f9914e33b8e1ad8c8a1ca442263a69896efba74925b36
- MD5 dbdbf4017ff91c9de328697b5fd2e10a
- SHA1 b597a5e9a8a0b252770933feed51169b5060a09f
- SHA512 3befc15aab0a5dbe7fde96155b0499d385f2799b1a2d47ce04f37b5804006b1c6c4fff93d3cedb56a2a8172b23752b6f9dc6168cfce3596b91def3247836cf10
- SSDEEP 96:33YnIxFkDUGZpKSmktse3GpmD8pevbE9cxSgB5PKtAtYE9v5E9KntrmfVEB3YdkS:33YIvGZDdtP8pevbg0PuAYK56NyoIFI
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7424
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc
user32
DestroyWindow
CallWindowProcW
SetCursor
GetPropW
CharPrevW
MapWindowPoints
DrawFocusRect
GetWindowLongW
GetClientRect
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
LoadCursorW
RemovePropW
DrawTextW
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
626B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=55, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Cfh.cil
- SHA256 ea6ae371659002025cf976468034fd21c23f66d91461391b2cd43b9a8bdb6cb0
- MD5 1c16e637171f7414ad2eb442471433b2
- SHA1 0e61e19e6872696b89324364365c1fe549855411
- SHA512 20ae444965d972cf6f12d1af17ddc94391078cc52b7094b084895c431a77d1d75fa99852231bbab6d1c73a59780963439fe5390041e466a67479909094b63c3d
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Chachalakas228/serpenticide.per
- SHA256 f9d6fda9ca03fecacae8285d16ee8ccc2d2c92dfdd72d0b0b987dae7886374bf
- MD5 332a4713583767b93fbd77ed08540db7
- SHA1 5fc66a02c859594c96bf12180d67e2898feda3ee
- SHA512 c4bade0341e15382b6324676623e724c79e7c87f4038653929e0f21caec3e52b00b76e6ae0ccca7d2a1cbd4404a579986026490122bd99b3cf4ca5cb20536e4d
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Chachalakas228/sultet.and
- SHA256 334def0e2fca8fba537716e1aa2556d987dab915be5d0f4ece6c3e1ebf8e5115
- MD5 fd4b6ac7d763ed5d216f52c033230d8b
- SHA1 8111fede52f9448ff6b8cb97fad50b7b4f457a37
- SHA512 eeaa7f7471f78aa0ef7162c3e90b1f92e160053fe37f80587bef1d684151afe43f0571a55d8d6890696e3397a0f3b30a9590910fd4b862abb138a8d1e8c91b71
- SSDEEP 96:8ioppvqKKfyyCJOVIxMqdUOqJ4ljh6APF6f3L1:8iopcKsVIeqiOquljhBF03B
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
Chachalakas228/tory.dis
- SHA256 ab30b6d7f0eaaaee27cef4b2be4fb7dff3dbcc43fcae3989075bfd7ef285bbde
- MD5 1493ac0622ae6f1b9ad0294101f87398
- SHA1 8bfb78952215f4b94e99a7af0938c3e91b0198be
- SHA512 d1a488b692d423290a74d435284f9895522fc16571c2f34a9ee2733026f16f5342fe25f596bd77a632b1f58b97d5d49cc26be26085b0fd1fcd93aa7d1435e78e
- SSDEEP 96:u7qaVW2HG32gR5VLpe2RiB/lhGYOLAIxP7KlKFErQBtx5C:napGf5W//nTBeKul5c
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
Chachalakas228/udkobles.bog
- SHA256 4f2e0dca9882a0eeecf6baace3e5f597c96d55611260d9ee1aa2c109bacd1da9
- MD5 f7b0c69b54c0689f47c64a29b0eadb39
- SHA1 27c5220f281ef7e5a0032b08402bf69ef9f603bb
- SHA512 8803344596f900f06f5766e7867203e4824c03003cdc95bac5f91d5e0d047c31fb271861db8b00f2c0130fd4023b4fb3bab5ce14a57808e3545c7d6092af180a
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Chachalakas228/unomnisciently.mer
- SHA256 c8a5b9edf558659c60d08a04e222989f5d3272cf2b637da9ceaaff8777e7ce28
- MD5 90d4e41561c0a80f4df7c29ccb5f0460
- SHA1 b219fc5678fe23183cc378d687b3e239675770a6
- SHA512 282246180b49ab94b5f96c3df6567f742ab1f61d51e0bc16423bbf69b6f9c65ebab7e18cea3f5ef35c1808ff5048e2771e8079410d9e26b3434a80ad066b9b93
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Flageolettens.Tre
- SHA256 e7e1e59adc2b7e891bcbb99e4b173cbee68faddae8552e38d6fcfc2030768a0b
- MD5 ca42ddceff86dee876c99f9822f7d7db
- SHA1 56cb3ae7a062e05284377ff65d394e374c3ed3cc
- SHA512 81a653e49dc29aeeff30fc0f1175352d947159516f48734f8f228025ac1d7b4cf01ec02e272f34b518fbc921bd3d0fc9928713b60d6489040ed364464b09470b
- SSDEEP 1536:SVZ4tNXjuTVjC7GYMy/gM1cjmLwzv1TjmwqseTNOLe:SZ6NzEV0T9W7BmwreTNOLe
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
Forbindingers187.ind
- SHA256 83ac8fe458f875d4463931f5218749e5801ddf7ddf3802e5830397ba00d3ef21
- MD5 8e3884cdb3ca76f3251c4c41fb30e312
- SHA1 e8ef71e5914d8a135373313684f958f395edde97
- SHA512 c72728ddd3097a4a65c4bd749760802247f8491c5c788b43f80a7037411e128eea0f07a470ad2598cfe058c8da4980e2490af0c0573fa47e6ad83ff4d4dc3a17
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Misrepresenter202.std
- SHA256 35497bc5c2d920b8218514c99cac0aa4114902aa6b1aedc61bc1471af6d73053
- MD5 1d6e4603cb5147f71191df104d60c690
- SHA1 ddf4626a0aaf8f0b9b3b59e0a3881b4c038b95a2
- SHA512 5e6020fe52de906c622d6777e0f0a9d35d47afd483e0cc4dd4e7bd195495729848378d438843ba2f13f9b3287170750cb223345746868e08d64bd9bf881888ee
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Tilbunds.amp
- SHA256 ab6ad2369f212629869d9b0ba6cb9602e32cec457e1266fc73bef1c398c32e68
- MD5 af56a13a60cae1e8cf95042f22f8a5db
- SHA1 aa0b52d897b65f79b853fdf31ad4501d098ab3a7
- SHA512 bc438848ddb7f69bc3a6b4f6461900add6780d8daab9d0691e8e86268b1535e0d185979397e434e931247dbb43afd640d192d6045b397a87216b26015551d854
- SSDEEP 6144:nRgCBjMSUnbPEWV+J7eMCLR4lu3kxQrl5gjWbMJ4uOFHxgzRH0NHTeKTiiN:L9SbPEWEZS4luDZAWb/LFRgzN01xTiC
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
airtightness.led
- SHA256 565eea03984f8b87a515889c9ef462058fbd541fbdff685ee9d9a940b9203587
- MD5 ca40f2466434089041b55920394d2fc4
- SHA1 69afccea7fa564fc526cead00a1dcf9d9fd1db61
- SHA512 4c732042be100e15b0d07412c36c6733bf87ddddeea83aa6b871222368ba5b0801d3c4a46dc5478505348dec4f01a77002f756cfa38b32527a8491e6e09f771d
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
diphyllous.txt
- SHA256 eb81ba0e80ff7bfc2ab9bfebecbbb9be22c3f1c32f90f25b784b5c6ce8798d35
- MD5 60b85da9eb5eac417cddbc536f7f1775
- SHA1 dd999b3e817d4fd6177f2d880b58976a582dd640
- SHA512 4f8262dea75098b5ffe3374dc9f8f7094bf9b1153f5fdacc358543e418592d38118d8c6a3eb6e838d1df52f83355ca948e9e55d8a944d59ac5f010342f311083
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
gitterpunkter.mas
- SHA256 92e42fe08eb7d7743ca549055458d65d3a74a1c63ba10b5bd32d1312dc85c055
- MD5 f5c9712d768f16dd3484b4e8aa193a84
- SHA1 8516963c5a2f517b471a323fca7ca8622037f138
- SHA512 ab32acc0026e12d0a4042895c95738ce51d5e015ecf9c71df5e5903fd667bd3b0ec8a55b8b2f2161aecc5f3819527aa859bb6fcd388a3e052a8102afc84acd4d
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
grassmen.maa
- SHA256 e4e7a0fd594088a1ddefa32a6d42c4a7cda0b36216421ad07b185f44ec651992
- MD5 67aa7a10ddb594bb6bfb024f9dad107b
- SHA1 3d84a65ba46eb2332ac7224afe4d1faa7a9a6c4c
- SHA512 3e1cf141273085a5fcd575deeb785b60c41b977bfda8f8288dfa52da17c28e18d3109c86aeec092a4b14d3b2961f41b03cb9d3ef38b68af3d53594da46b15ae7
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
harddiskenes.unc
- SHA256 5026ca81ddd09f1fc6ee23de5d49b6532daec337638a2b2951e89da05cd3dc50
- MD5 4d9028d268808d78832e4f550105fcf5
- SHA1 74401268b48d94685f1d01b8e66cd18f6f5da832
- SHA512 7baf24d3bab3b9e8a579fe1f80719703135802e495f24a7daa3e55a3f56652c2f60e5924b5eb7f5240286f81307a445ece922a1b2b5c7c689480d36aed91cb9e
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
kaardernes.bun
- SHA256 8657a575be836dc4993b4179f747f031eabeab20ab8901d38256dcee60648bb7
- MD5 afebc0b01ae3921607a3b2d3a6648464
- SHA1 4b9bb9003090a05c6097129cebe5537f4c238435
- SHA512 b9204000ec8d20752f62b61ff9ba16a9a6df38ac06ce8063856dbfa2ea782a6e9e7448295e63649e3d5c22f70eb6f8685592b63f1dc65048c9f2f3c835966cdd
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
multiphasic.pol
- SHA256 0659920404c1f3accbe61b7ac34b0dcdc4dcfda94c5d1038c8807c7ef10e35d1
- MD5 99ecb35c320eecaba4c34885532dc983
- SHA1 1e4d761f718299571e848460a5cdd8b682b22965
- SHA512 cdc559eb8eb29cfd105834b144f0bdd4f734cdcce5c894a9857424361b15f68f70a9cbc9d894ab4c21c06355ad388474e4a27fe55e5dfdbcfdb91ca55dae4f3b
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
ochrejelly.per
- SHA256 d30bc80ccc04dd48ee492b351e3982449af7796a426258ac4e818204732006f1
- MD5 71976a28d85f716e338d7b56d68cd4e0
- SHA1 bf80a19bd9011ec6a4372db3b65d4120ecb2ae49
- SHA512 87f0656b9061f48f1c16ca39a95feb5c73d1b437489b6f1e63dee775779c898a58496c930d72888aeaf4fabe4c57fb8b0826f7be50c251145d3ccb318a74d1af
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
19215023198d9ebe4a626113cc6c001bd4d250ebea69aa25afd483aefd4c0984.xlsx
- SHA256 19215023198d9ebe4a626113cc6c001bd4d250ebea69aa25afd483aefd4c0984
- MD5 ddfba93d516fe962fc785056189afea7
- SHA1 65197b03ded95c0664179c1f28637d5799ece267
- SHA512 4954799467218948b955697827b98d7b9681b1608bc2472c57fa4c218a6d9f38491b7df10f60e66a69c699c8352d6a0392d059114c0c2be59e6fc254fa1e8b62
- SSDEEP 12288:NLnWI4DNnXcSKJ/icWmLyzuCuMeOFC0180gzLuh1Y+5NIj6nSuP3T1sHOGJ65e:F0DNXcX0cWm+zLFWdLcK+TDx3pZs
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
27133b9541228c135784f7c6c3bb9425975d7e7880ae278fea040b0ffcb8eee9.vbs
- SHA256 27133b9541228c135784f7c6c3bb9425975d7e7880ae278fea040b0ffcb8eee9
- MD5 4986a0bfa6ae968632439e36e76bba38
- SHA1 e63b5c00a3dc1211252836437b87817a8ab270fb
- SHA512 346c1e13857bda390277152cb0bee0874f61acc06c34f666e26e7450a4d3f88aaab75a345a25bcaf9ca522e51e0a4ed774545f6ae625a803dabe8d7bf7604f09
- SSDEEP 1536:jrUd99CObi/SXcfGdaJK6Uo6phGW0/5JJd0Pc1Ug0BjbUZlu9gISsRz:vUdqRJK6l/oc6g0Bjcc
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
304278cfa0f9f2e81a48c4f23bcb97920b6263c07484b9a0793c2d1b8c65171c.xls
- SHA256 304278cfa0f9f2e81a48c4f23bcb97920b6263c07484b9a0793c2d1b8c65171c
- MD5 1e6c9f990dd7202566b2cba4c001ff0f
- SHA1 ff67a2ca8b98bbf075034dc8e7c08c7a4e0e25ea
- SHA512 c7e81ce0fe310ac97088ab256af3d3d7e8237b376b3527184a62db12fc9fede04ebf64ffc96651caa1b1c64f407d00dcffa6792c021a9e6b7106963362fe7b9d
- SSDEEP 24576:7tzu4Lr5tn0GZ476hEP4da/z9Ji99Ch4XsIvJcV4JshP2AkJ2blC9wEBA:FlFzZ476hEP4E/g9CssNeJauJ2hyBB
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
365771facf4476f03189fbace015a962f6fd021650f4ebd61acd0c675bc85b77.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 365771facf4476f03189fbace015a962f6fd021650f4ebd61acd0c675bc85b77
- MD5 8c7a27e350f94889345cefb72d79ff68
- SHA1 edafc407ad4dc2e4a66f0259edbb696cd0aca4f5
- SHA512 305147d51a2656d51d2c2b1bbb15418774837cf69218e6afbe5a22e17a0686aa63f796d81e054eba599d5f91df4f4dfdc33f5eaba25eba1d9b9a05d224c56076
- SSDEEP 768:uoLtt3QI2/yQJVZU1eo8icH+1WbFb9YWIOMhbQLvj:u2b3QI2/yQBIeNicH+1SFb9YWIOMZij
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
397900307dd4900066b97d9cdbf0e4cdaf145572b84293e1e08c2a15e7963a0c.lnk
- SHA256 397900307dd4900066b97d9cdbf0e4cdaf145572b84293e1e08c2a15e7963a0c
- MD5 eaf0d2fbd918a0d2f86d1e99ddb590a1
- SHA1 83785e53eff3ca9530d0a25bcadd2ad68e65a211
- SHA512 1d265dbaa11e2b50ac9fe53da146ce522f76ccf16fcb969f01ba61ad084a4520a37c70a254f03606633ab9cd129c9383db39d519517af94f1542a8ed1da04d8b
- SSDEEP 384:jYteQXSNty2asQw4tgyqh8CJhqbk/0RF+npET8a8TPHr75CrFXgddoM:DptOdS7hzhqbKnAmPpCKn
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
3d390249d9ba45f8e6198dde8319ee8ccd5b9b23921472095ed453544ca537ab.lnk
- SHA256 3d390249d9ba45f8e6198dde8319ee8ccd5b9b23921472095ed453544ca537ab
- MD5 4415243fcb9203beae1702aa26910196
- SHA1 ebc113a171e9c71cbf632e675f7406df4df1a56a
- SHA512 1ab29ca95a4027999b955dceb0a0f8f9150c5ad0648448d9d9d856b65ce371751d02335c8efab0f2b5b19fec25ac34f0b0d78d39230752ad608d0b49961e37c1
- SSDEEP 384:Fk3cdmHBOYmMKWSTaYwxEzyj1MjqJ6mEbjYaRe+7zia83XBDCmTMWE0jf0lXiT63:yCmcYmMKFmYvzyiZbsM9FwxGgcUmrr
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
40e5adc952e8c472e083a539cd67ac339132f2e41a2c99dd3083dd720c041673.xlsx
- SHA256 40e5adc952e8c472e083a539cd67ac339132f2e41a2c99dd3083dd720c041673
- MD5 9b57a1c10146136ab07052d49c75bf76
- SHA1 23d56976bbc90ecd3c00581ba7cd379c2b0b6c9c
- SHA512 36c6b33d454b3c6a7a4c8f97dbb62ea36a28ec2bfe6f4002a743baea7817cf644fd07dfa1b84a8f5621939e7d25106939fd16c18772a3b968dfbd93d94c62490
- SSDEEP 24576:N9vAixudwuVjUzskic7aIPAmH/JeGUwQKI:PvHxIwSIAk
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
746afcd79967881e5a7a21ff847a60c9ef6f1c2dbd796b4ad0c16bc85009d069.xls
- SHA256 746afcd79967881e5a7a21ff847a60c9ef6f1c2dbd796b4ad0c16bc85009d069
- MD5 55889fbacc64b00d2effbf215bd9b3ec
- SHA1 16774debb9af5a3df4f947aacccf3224f6dc3473
- SHA512 46bbc23892af173d7e99489a9da4a3a3a6b454ab7bfba2954ea60136971731119cdde1c287f3b15cb63022418824f82fb48e0ec053db3102a73f1fe5e8d6aede
- SSDEEP 24576:utzu4Lr5tn0Gi6hEP4da/z9Ji99Ch4XsIvJcFt7RP+T4AWWtzENTN6C:QlFzi6hEP4E/g9CssNL7RPYmT6C
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar
- SHA256 85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f
- MD5 5f44aa92cda88f8b88f783f5ce2df636
- SHA1 f791bc786571bfb36e94ed6a293fa22304a5df78
- SHA512 446a86271230343e77530136293ff29467d4166f0b812fc6cc99f53a516e492b21f0fe48fdb033f78db8e7a1620c32c00264d995f948f023ea608cdc2ccb5559
- SSDEEP 12288:c75igiDyZEO28Cabb5Je8wUYFkGnwce4U:8EyWO28CaRJVwdFk2Yh
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
984646a5a7686265df256e88616dc046b8daa6fbc1807ae67d2933caf0e6af41.vbs
- SHA256 984646a5a7686265df256e88616dc046b8daa6fbc1807ae67d2933caf0e6af41
- MD5 402691d239f5bfd22b3937d842ab50e5
- SHA1 8f4562a7bfbd6d496b48454b595cef058fe1e9ad
- SHA512 0f44b1004b20533ddc4edfe59c2278a2954db4022058e49365af65c9fb68ba86cbf0359f31bffc0d65d94dcf15c38e5fe713a1ef5299dc4388ff37045b097abc
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
9c33e83331c4e2e954f355f453bd32add84016d45e6434d568fb56b690de26ce.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9c33e83331c4e2e954f355f453bd32add84016d45e6434d568fb56b690de26ce
- MD5 63e46b6425db8622626f0094a49fc323
- SHA1 fedfcddc9659ec171f40661ad7e375af9be071cc
- SHA512 7af3aa00041ec7a77abc45624973b24b747539c3fd8ecefbadc0fc7191d7cd18735a7f77b3f55cfa14d702c6c237722662daa5f4dbdece4f442e4bc41443e807
- SSDEEP 768:N4fK1pDGkptwyZScCBSUapNgqtRU/kZB+Bcg4tlTF5923UO9hASURJ:NDGkptwyZScCkU4rPUsZIB54HF592kOe
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
39934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
9f07c02b13a50bb84630841a7a9876c9ced2ab66d406c54f4673c88e7cd70bb4.lnk
- SHA256 9f07c02b13a50bb84630841a7a9876c9ced2ab66d406c54f4673c88e7cd70bb4
- MD5 3deb98c1970c8ed0d95086d79e579231
- SHA1 bc8b9ae3e0e278c69d100d30333dc380fc7fe57a
- SHA512 e25073a88ac942f2aee7f57de6bd51b3b0dbf9caa0c5b569f603315cae5de2ce9308fa974f44b8a24b5cc661f8f152cdfc5ee985f7e388319d2ec4059cc28630
- SSDEEP 24:8l/BHYVKVWuMs4ds+/CWLC7SfW8g/kwCYmaHKPeFI:815aTDds7S7gzTmE
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
c0baec4eb2deb38c2f86c250a7aae50a417652429439bb5ecce82e8bac6892ef.xlsx
- SHA256 c0baec4eb2deb38c2f86c250a7aae50a417652429439bb5ecce82e8bac6892ef
- MD5 d32ebf59d912022ad03be9f1a79d1622
- SHA1 70e185fcd828497aea47489ebd84feb70ed21983
- SHA512 f463d70e2773a9b27c43ff24a2fdfc242e55050ba81ea5af34b9984b8aae7697ce0d38135dfefb507efc89c7ca0aba1b6be7040092dd98ce8811b9ab5bb474a5
- SSDEEP 12288:eOnWEibaQbA8GS3zY4uKhbO6ZvRM98HaN6N2hN1JAQYVu5RGE41Gw57bhRw:5vQlcfKhrZvRZa42hNKuHGES/O
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
c9a985aea86448e6770b76c334fbd6a83658df00688bd4e754bde0ec0a12504f.exe
- IMPHASH 7ed0d71376e55d58ab36dc7d3ffda898
- SHA256 c9a985aea86448e6770b76c334fbd6a83658df00688bd4e754bde0ec0a12504f
- MD5 35ad880f5b37f694d5d9fc7d750cad14
- SHA1 262f9712da9fb80700481b28b539f52f3ce9fa98
- SHA512 491cfb154b71f7b3b25306e0abf8ccff3532149ece79b4be827e5b5c5ad8913ed9bdca09edb6976755ff6c3e1bf1024e7ce5e89061326443fba32759a7ee5a60
- SSDEEP 12288:JY4e1029uZQEzSp4b5N1kC2Dg0A9INKLdzReocbosx:FereQEG4b5N1kC4gpINqdc0c
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
PE Signature issue
Digest
66:f2:80:7c:33:d8:61:32:52:e3:81:32:5d:59:4d:5f:24:d2:48:0d:47:a0:ff:e7:a9:1b:9b:2e:5e:83:89:c6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Dolk,OU=Louey Domspraksissene Wannabe\ ,O=Dolk,L=Hoffman,ST=Minnesota,C=US,1.2.840.113549.1.9.1=#0c2953696b6b6572686564736166646b6e696e6765724054656b73746b6f6d6d656e74617265722e47656e
Chains
Jun 12, 2024
Subject
CN=Dolk,OU=Louey Domspraksissene Wannabe\ ,O=Dolk,L=Hoffman,ST=Minnesota,C=US,1.2.840.113549.1.9.1=#0c2953696b6b6572686564736166646b6e696e6765724054656b73746b6f6d6d656e74617265722e47656e
Serial Number
02:09:05:94:ae:2b:bd:54:d8:15:d8:58:11:53:5c:75:9e:7a:a2:9b
Issuer
CN=Dolk,OU=Louey Domspraksissene Wannabe\ ,O=Dolk,L=Hoffman,ST=Minnesota,C=US,1.2.840.113549.1.9.1=#0c2953696b6b6572686564736166646b6e696e6765724054656b73746b6f6d6d656e74617265722e47656e
Timespan
Apr 13, 2024 - Apr 13, 2027
Minor OS version
0
Major OS version
4
Entry point
12818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathW
SetFileTime
CloseHandle
GetShortPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
GetFullPathNameW
CreateDirectoryW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
SetFileAttributesW
ExpandEnvironmentStringsW
LoadLibraryW
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcpyA
lstrcpyW
lstrcatW
GetSystemDirectoryW
GetVersion
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleHandleW
lstrcmpiW
lstrcmpW
WaitForSingleObject
GlobalFree
GlobalAlloc
LoadLibraryExW
GetExitCodeProcess
FreeLibrary
WritePrivateProfileStringW
SetErrorMode
GetCommandLineW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
WriteFile
lstrlenA
WideCharToMultiByte
user32
EndDialog
ScreenToClient
GetWindowRect
RegisterClassW
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
wsprintfW
CreateWindowExW
SystemParametersInfoW
AppendMenuW
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
GetDC
SetWindowLongW
LoadImageW
SendMessageTimeoutW
FindWindowExW
EmptyClipboard
OpenClipboard
TrackPopupMenu
EndPaint
ShowWindow
GetDlgItem
IsWindow
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
426KB
Virtual Size
425KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/BgImage.dll
- IMPHASH 32b0f5880a0efd258c6be2f7a14f4a9f
- SHA256 a45f294137e2b0f6092eee8fdd2e19334f34ff3640d865a810b70f2104e92c21
- MD5 ee255bdf426349e1caa8f1b71de9fd22
- SHA1 d589773826620046df1d77dd148f819a88dd35ec
- SHA512 71eeb41b5816b7d0f9517264aaf026da878561b6a222064c8100e47c383de9ac369800b734468322f3a6fc3eedb1a23d3c5ca6874bd7bf84af08f395248872cc
- SSDEEP 96:8ePik1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTc4j7J3kWyy/:tPdTJa2roqJyA2EN8diuTJje
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
lstrcpyW
lstrcpynW
GlobalFree
lstrcmpiW
EnterCriticalSection
GlobalAlloc
LeaveCriticalSection
user32
UnregisterClassW
CallWindowProcW
LoadImageW
DestroyWindow
BeginPaint
IsWindow
SendMessageW
DefWindowProcW
RedrawWindow
ShowWindow
LoadCursorW
RegisterClassW
CreateWindowExW
SetWindowLongW
GetSystemMetrics
SetWindowPos
DrawTextW
EndPaint
FillRect
gdi32
GetObjectW
DeleteDC
DeleteObject
CreateSolidBrush
CreateCompatibleDC
SelectObject
SetMapMode
GetMapMode
CreateCompatibleBitmap
CreateBitmap
SetBkMode
BitBlt
DPtoLP
SetBkColor
SetTextColor
winmm
PlaySoundW
AddImage
AddText
Clear
Destroy
Redraw
SetBg
SetReturn
Sound
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
630B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=1, productName=Unmarked objects,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=48, version=9044,
count=1, id=49, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsDialogs.dll
- IMPHASH ec5fddc407d2b4e0a16fc4d786afc555
- SHA256 be60a00f32924ccbe03f9914e33b8e1ad8c8a1ca442263a69896efba74925b36
- MD5 dbdbf4017ff91c9de328697b5fd2e10a
- SHA1 b597a5e9a8a0b252770933feed51169b5060a09f
- SHA512 3befc15aab0a5dbe7fde96155b0499d385f2799b1a2d47ce04f37b5804006b1c6c4fff93d3cedb56a2a8172b23752b6f9dc6168cfce3596b91def3247836cf10
- SSDEEP 96:33YnIxFkDUGZpKSmktse3GpmD8pevbE9cxSgB5PKtAtYE9v5E9KntrmfVEB3YdkS:33YIvGZDdtP8pevbg0PuAYK56NyoIFI
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7424
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc
user32
DestroyWindow
CallWindowProcW
SetCursor
GetPropW
CharPrevW
MapWindowPoints
DrawFocusRect
GetWindowLongW
GetClientRect
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
LoadCursorW
RemovePropW
DrawTextW
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
626B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=55, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Beskeders/Neverne/harddiskenes.unc
- SHA256 5026ca81ddd09f1fc6ee23de5d49b6532daec337638a2b2951e89da05cd3dc50
- MD5 4d9028d268808d78832e4f550105fcf5
- SHA1 74401268b48d94685f1d01b8e66cd18f6f5da832
- SHA512 7baf24d3bab3b9e8a579fe1f80719703135802e495f24a7daa3e55a3f56652c2f60e5924b5eb7f5240286f81307a445ece922a1b2b5c7c689480d36aed91cb9e
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Beskeders/Neverne/kaardernes.bun
- SHA256 8657a575be836dc4993b4179f747f031eabeab20ab8901d38256dcee60648bb7
- MD5 afebc0b01ae3921607a3b2d3a6648464
- SHA1 4b9bb9003090a05c6097129cebe5537f4c238435
- SHA512 b9204000ec8d20752f62b61ff9ba16a9a6df38ac06ce8063856dbfa2ea782a6e9e7448295e63649e3d5c22f70eb6f8685592b63f1dc65048c9f2f3c835966cdd
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Beskeders/Neverne/multiphasic.pol
- SHA256 0659920404c1f3accbe61b7ac34b0dcdc4dcfda94c5d1038c8807c7ef10e35d1
- MD5 99ecb35c320eecaba4c34885532dc983
- SHA1 1e4d761f718299571e848460a5cdd8b682b22965
- SHA512 cdc559eb8eb29cfd105834b144f0bdd4f734cdcce5c894a9857424361b15f68f70a9cbc9d894ab4c21c06355ad388474e4a27fe55e5dfdbcfdb91ca55dae4f3b
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Beskeders/airtightness.led
- SHA256 565eea03984f8b87a515889c9ef462058fbd541fbdff685ee9d9a940b9203587
- MD5 ca40f2466434089041b55920394d2fc4
- SHA1 69afccea7fa564fc526cead00a1dcf9d9fd1db61
- SHA512 4c732042be100e15b0d07412c36c6733bf87ddddeea83aa6b871222368ba5b0801d3c4a46dc5478505348dec4f01a77002f756cfa38b32527a8491e6e09f771d
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Beskeders/diphyllous.txt
- SHA256 eb81ba0e80ff7bfc2ab9bfebecbbb9be22c3f1c32f90f25b784b5c6ce8798d35
- MD5 60b85da9eb5eac417cddbc536f7f1775
- SHA1 dd999b3e817d4fd6177f2d880b58976a582dd640
- SHA512 4f8262dea75098b5ffe3374dc9f8f7094bf9b1153f5fdacc358543e418592d38118d8c6a3eb6e838d1df52f83355ca948e9e55d8a944d59ac5f010342f311083
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Beskeders/gitterpunkter.mas
- SHA256 92e42fe08eb7d7743ca549055458d65d3a74a1c63ba10b5bd32d1312dc85c055
- MD5 f5c9712d768f16dd3484b4e8aa193a84
- SHA1 8516963c5a2f517b471a323fca7ca8622037f138
- SHA512 ab32acc0026e12d0a4042895c95738ce51d5e015ecf9c71df5e5903fd667bd3b0ec8a55b8b2f2161aecc5f3819527aa859bb6fcd388a3e052a8102afc84acd4d
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Beskeders/grassmen.maa
- SHA256 e4e7a0fd594088a1ddefa32a6d42c4a7cda0b36216421ad07b185f44ec651992
- MD5 67aa7a10ddb594bb6bfb024f9dad107b
- SHA1 3d84a65ba46eb2332ac7224afe4d1faa7a9a6c4c
- SHA512 3e1cf141273085a5fcd575deeb785b60c41b977bfda8f8288dfa52da17c28e18d3109c86aeec092a4b14d3b2961f41b03cb9d3ef38b68af3d53594da46b15ae7
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Cfh.cil
- SHA256 ea6ae371659002025cf976468034fd21c23f66d91461391b2cd43b9a8bdb6cb0
- MD5 1c16e637171f7414ad2eb442471433b2
- SHA1 0e61e19e6872696b89324364365c1fe549855411
- SHA512 20ae444965d972cf6f12d1af17ddc94391078cc52b7094b084895c431a77d1d75fa99852231bbab6d1c73a59780963439fe5390041e466a67479909094b63c3d
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Hovedpersonernes.Til
- SHA256 64b44c5656ec52010fa89f61e6989ff0da8a1086234d521a3efaf29b0d2d2dba
- MD5 70d08f321239063f95d063cf97d92b54
- SHA1 c1cbde3a80a68f45f176b908bc038fe6bb9f976b
- SHA512 66485b9ad7b1e002ec3c96bf43ca577939598ae1d1c20e803800a2d798d4e8a41dc137329d142e5fd44f485c43a2d3d506037e1c10342d83464f328e150ee8c4
- SSDEEP 1536:NaQ45yyIGTqbE+5pcXjE670aXgnAsSwPELUz:05bfObE+p8EGgJ8LE
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
Samlsninger.Und
- SHA256 6b4976f6b5434ccd43e67ff8cb4d8e1dcf6e83023019a11dbd924e07a8d78ee5
- MD5 f073bd2d22d562066ab8462d2db25d78
- SHA1 c1dff7239cbc46d602413477006586f9fd8a0337
- SHA512 74bf272942d4608d3839695d2ab9d60f3cee752e08010e8ba7fd4943b21b809fb709770eb79a8fe12ed0bd9019db5ad6f18877635122c78f267e635ec5964fc9
- SSDEEP 6144:4qTcVokus2wjxV4W5YBy14RYEkp1pwaQ5M2eLczqAervdMGd:4icVo8fjxV15T4RYEkVwpM2eLUfeSGd
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
Symphonization/Forbindingers187.ind
- SHA256 83ac8fe458f875d4463931f5218749e5801ddf7ddf3802e5830397ba00d3ef21
- MD5 8e3884cdb3ca76f3251c4c41fb30e312
- SHA1 e8ef71e5914d8a135373313684f958f395edde97
- SHA512 c72728ddd3097a4a65c4bd749760802247f8491c5c788b43f80a7037411e128eea0f07a470ad2598cfe058c8da4980e2490af0c0573fa47e6ad83ff4d4dc3a17
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
Symphonization/Misrepresenter202.std
- SHA256 35497bc5c2d920b8218514c99cac0aa4114902aa6b1aedc61bc1471af6d73053
- MD5 1d6e4603cb5147f71191df104d60c690
- SHA1 ddf4626a0aaf8f0b9b3b59e0a3881b4c038b95a2
- SHA512 5e6020fe52de906c622d6777e0f0a9d35d47afd483e0cc4dd4e7bd195495729848378d438843ba2f13f9b3287170750cb223345746868e08d64bd9bf881888ee
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
ochrejelly.per
- SHA256 d30bc80ccc04dd48ee492b351e3982449af7796a426258ac4e818204732006f1
- MD5 71976a28d85f716e338d7b56d68cd4e0
- SHA1 bf80a19bd9011ec6a4372db3b65d4120ecb2ae49
- SHA512 87f0656b9061f48f1c16ca39a95feb5c73d1b437489b6f1e63dee775779c898a58496c930d72888aeaf4fabe4c57fb8b0826f7be50c251145d3ccb318a74d1af
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
serpenticide.per
- SHA256 f9d6fda9ca03fecacae8285d16ee8ccc2d2c92dfdd72d0b0b987dae7886374bf
- MD5 332a4713583767b93fbd77ed08540db7
- SHA1 5fc66a02c859594c96bf12180d67e2898feda3ee
- SHA512 c4bade0341e15382b6324676623e724c79e7c87f4038653929e0f21caec3e52b00b76e6ae0ccca7d2a1cbd4404a579986026490122bd99b3cf4ca5cb20536e4d
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
sultet.and
- SHA256 334def0e2fca8fba537716e1aa2556d987dab915be5d0f4ece6c3e1ebf8e5115
- MD5 fd4b6ac7d763ed5d216f52c033230d8b
- SHA1 8111fede52f9448ff6b8cb97fad50b7b4f457a37
- SHA512 eeaa7f7471f78aa0ef7162c3e90b1f92e160053fe37f80587bef1d684151afe43f0571a55d8d6890696e3397a0f3b30a9590910fd4b862abb138a8d1e8c91b71
- SSDEEP 96:8ioppvqKKfyyCJOVIxMqdUOqJ4ljh6APF6f3L1:8iopcKsVIeqiOquljhBF03B
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
tory.dis
- SHA256 ab30b6d7f0eaaaee27cef4b2be4fb7dff3dbcc43fcae3989075bfd7ef285bbde
- MD5 1493ac0622ae6f1b9ad0294101f87398
- SHA1 8bfb78952215f4b94e99a7af0938c3e91b0198be
- SHA512 d1a488b692d423290a74d435284f9895522fc16571c2f34a9ee2733026f16f5342fe25f596bd77a632b1f58b97d5d49cc26be26085b0fd1fcd93aa7d1435e78e
- SSDEEP 96:u7qaVW2HG32gR5VLpe2RiB/lhGYOLAIxP7KlKFErQBtx5C:napGf5W//nTBeKul5c
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
udkobles.bog
- SHA256 4f2e0dca9882a0eeecf6baace3e5f597c96d55611260d9ee1aa2c109bacd1da9
- MD5 f7b0c69b54c0689f47c64a29b0eadb39
- SHA1 27c5220f281ef7e5a0032b08402bf69ef9f603bb
- SHA512 8803344596f900f06f5766e7867203e4824c03003cdc95bac5f91d5e0d047c31fb271861db8b00f2c0130fd4023b4fb3bab5ce14a57808e3545c7d6092af180a
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
unomnisciently.mer
- SHA256 c8a5b9edf558659c60d08a04e222989f5d3272cf2b637da9ceaaff8777e7ce28
- MD5 90d4e41561c0a80f4df7c29ccb5f0460
- SHA1 b219fc5678fe23183cc378d687b3e239675770a6
- SHA512 282246180b49ab94b5f96c3df6567f742ab1f61d51e0bc16423bbf69b6f9c65ebab7e18cea3f5ef35c1808ff5048e2771e8079410d9e26b3434a80ad066b9b93
- MD5 SHA1 SHA512
-
Class file contains resources related to AdWind
dc038c57b308d6bf1ce9a3ef557f9e479b11deff708525160c2863e02546c423.exe
- IMPHASH 16aa8fb006c8d2658da0ba12de3aafa2
- SHA256 dc038c57b308d6bf1ce9a3ef557f9e479b11deff708525160c2863e02546c423
- MD5 b01a10b3dd8b9a3b16cf5faa96e85f30
- SHA1 8361190b4c9542d7f092834484c55156f4234a65
- SHA512 53e452df6251680f123da1d07268728b036a045f72edd77d4eaf8253b3b88208f84fa95c1f8d9abb7ca0cdf6e41e97b12bb21345359f70d118d1d75c01f28d62
- SSDEEP 12288:/fvegH8ADA3u7vHQb7xVN491PNf0iaGKc/4tBn:/egcHM48jX4tBn
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
9170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetConsoleAliasA
GetComputerNameW
GetModuleHandleW
GetTickCount
GetConsoleAliasesA
GetConsoleAliasesLengthA
FormatMessageA
LoadLibraryW
SetVolumeMountPointA
WriteConsoleOutputA
GetStringTypeExW
lstrcpynW
GetTimeFormatW
FindNextVolumeW
SetTimeZoneInformation
FileTimeToSystemTime
CompareStringW
RaiseException
CreateJobObjectA
SetThreadLocale
EnumCalendarInfoW
GetProcAddress
SetVolumeLabelW
VerLanguageNameW
BuildCommDCBW
LoadLibraryA
LocalAlloc
GetModuleFileNameA
SetConsoleCursorInfo
SetConsoleTitleW
lstrcatW
GetProcessAffinityMask
PurgeComm
EnumDateFormatsW
DeleteCriticalSection
DeleteAtom
OpenFileMappingA
EnumCalendarInfoExA
SetLastError
InterlockedIncrement
GetLastError
HeapReAlloc
HeapAlloc
GetStartupInfoW
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
EnterCriticalSection
LeaveCriticalSection
HeapCreate
VirtualFree
VirtualAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
HeapSize
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
ReadFile
CreateFileA
CloseHandle
GetModuleHandleA
user32
LoadIconA
advapi32
SetThreadToken
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
446KB
Virtual Size
445KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
23.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=20, id=149, productName=VS2008 build 21022, version=21022,
count=122, id=131, productName=VS2008 build 21022, version=21022,
count=45, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=118, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
dc287ad322f50ecf2620c261d2a602426379bd9ff40a03b082d0efe3e2782ea6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dc287ad322f50ecf2620c261d2a602426379bd9ff40a03b082d0efe3e2782ea6
- MD5 c9e6f74054b8cd8726ab37054e7aa538
- SHA1 1d436e8957e464b8d6500b190779bc72044a8814
- SHA512 31eaf5850955464453fbb73d404ac1f594542feac62f0ac4eb49b7bfb59d38a364965ebb59598c54d456f4e65d2f29cf369cef0d1042446676d6289e338109bd
- SSDEEP 12288:ph+qhMoMVXpzFKQzsF3PWyM2qdBbIMaJJrWNJjv:psvZ8T3+v2qdBA7aL
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
433KB
Virtual Size
432KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dc8d3ca124b39f73a8517c8edaf52732dc7766f405dda194114e58f8f841778b.exe
- IMPHASH 5d354883fe6f15fcf48045037a99fb7a
- SHA256 dc8d3ca124b39f73a8517c8edaf52732dc7766f405dda194114e58f8f841778b
- MD5 401385fe13c9dd61ef5fa9ac9bb823f8
- SHA1 6157ff7dd30faa8a06b53db7c5a7f204041550ff
- SHA512 3b493b92deb82d8513a0f0db102243f8c7b67e8cbe8db149067d7ad81280f75a6e6a924777afb5dbe9ec7ba7052fde459e405cd1ede50bd56e76ec26dbc2fc92
- SSDEEP 12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSRn9:uiLJbpI7I2WhQqZ7R9
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
206756
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CopyFileW
CreateMutexA
GetLocaleInfoA
CreateToolhelp32Snapshot
OpenMutexA
Process32NextW
Process32FirstW
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetTempPathW
OpenProcess
lstrcatW
GetCurrentProcessId
GetTempFileNameW
GetCurrentProcess
GetSystemDirectoryA
GlobalAlloc
GlobalLock
GetTickCount
GlobalUnlock
WriteProcessMemory
ResumeThread
GetThreadContext
ReadProcessMemory
CreateProcessW
SetThreadContext
LocalAlloc
GlobalFree
MulDiv
SizeofResource
SetFilePointer
FindResourceA
LockResource
LoadResource
LocalFree
FormatMessageA
AllocConsole
GetModuleFileNameA
lstrcpynA
QueryPerformanceFrequency
GetLongPathNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetACP
GetStdHandle
GetModuleHandleExW
MoveFileExW
RtlUnwind
RaiseException
LoadLibraryExW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
ExpandEnvironmentStringsA
FindNextFileA
FindFirstFileA
GetFileSize
TerminateThread
GetLastError
SetFileAttributesW
GetModuleHandleA
RemoveDirectoryW
MoveFileW
CreateDirectoryW
SetFilePointerEx
GetLogicalDriveStringsA
DeleteFileW
DeleteFileA
GetFileAttributesW
FindClose
lstrlenA
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindFirstFileW
ExitProcess
GetProcAddress
LoadLibraryA
CreateProcessA
PeekNamedPipe
CreatePipe
TerminateProcess
ReadFile
HeapFree
HeapCreate
CreateEventA
GetLocalTime
CreateThread
SetEvent
CreateEventW
WaitForSingleObject
Sleep
GetModuleFileNameW
CloseHandle
ExitThread
CreateFileW
WriteFile
QueryPerformanceCounter
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
SetEndOfFile
user32
CallNextHookEx
GetKeyboardLayoutNameA
GetKeyState
GetWindowTextLengthW
GetWindowThreadProcessId
SetForegroundWindow
SetClipboardData
EnumWindows
ExitWindowsEx
TranslateMessage
DispatchMessageA
GetMessageA
GetWindowTextW
wsprintfW
GetClipboardData
UnhookWindowsHookEx
GetForegroundWindow
ToUnicodeEx
GetKeyboardLayout
SetWindowsHookExA
CloseClipboard
OpenClipboard
GetKeyboardState
DrawIcon
GetSystemMetrics
GetIconInfo
SystemParametersInfoW
GetCursorPos
RegisterClassExA
AppendMenuA
mouse_event
CreateWindowExA
DefWindowProcA
TrackPopupMenu
CreatePopupMenu
EnumDisplaySettingsW
SendInput
CloseWindow
EmptyClipboard
ShowWindow
SetWindowTextW
MessageBoxW
IsWindowVisible
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDIBits
DeleteDC
DeleteObject
CreateDCA
GetObjectA
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegEnumKeyExA
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegDeleteKeyA
shell32
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
ShellExecuteW
shlwapi
StrToIntA
PathFileExistsW
PathFileExistsA
winmm
waveInPrepareHeader
waveInStop
waveInUnprepareHeader
mciSendStringA
PlaySoundW
waveInOpen
waveInStart
waveInAddBuffer
waveInClose
mciSendStringW
ws2_32
WSAGetLastError
recv
connect
socket
send
WSAStartup
closesocket
inet_ntoa
gethostbyname
WSASetLastError
inet_addr
gethostbyaddr
getservbyport
ntohs
getservbyname
htons
htonl
urlmon
URLDownloadToFileW
URLOpenBlockingStreamW
gdiplus
GdiplusStartup
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipLoadImageFromStream
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
Name
.text
Size
337KB
Virtual Size
336KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=241, version=40116,
count=167, id=243, version=40116,
count=30, id=242, version=40116,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=199, version=41118,
count=26, id=259, version=24237,
count=58, id=261, version=24237,
count=34, id=260, version=24237,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=300, id=1, productName=Unmarked objects,
count=97, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
e4bc1b6f2e541e90a1ed736284d2e383fcb739f10466b1fdd390211e01ed4dae.jar
- SHA256 e4bc1b6f2e541e90a1ed736284d2e383fcb739f10466b1fdd390211e01ed4dae
- MD5 6a6bcf5dbe9ee0e68969958ca3565122
- SHA1 c515cd6309bdff8f1b7b996f0846eae3ea27b768
- SHA512 2dc5021ce4e033a1ae67ec2905b3acb7b237c3a00bebe54b030f461675ceb570e738743348a889ea3400b7d01e6261edb5d835c4759914960ae29cbba98a00a6
- SSDEEP 3072:4+1ksmuRo+BmpH7Rx/inqhzlE0EP5vdRGXVIJeouw:2sHbmpRgnqhzPEP5vbGXiuw
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
ebe0db47f3d58129ded5690057c586c10adba99f5efea70eb2defd4be879d204.xlsx
- SHA256 ebe0db47f3d58129ded5690057c586c10adba99f5efea70eb2defd4be879d204
- MD5 0bae405b6cbbd6f2a51b6c8f3d3229d4
- SHA1 c883182707d44204007d65a270f4f5794dd9328b
- SHA512 98b5371a3e3dfd61e190db23a0fe246b2b2073eaa3f13424f6690cdeed48bc04e661bf361144968b028b72bdd47f68cdab4d56a0816128aa0f27db06c24d8c0f
- SSDEEP 12288:k2nWqZIWl17AxZ1AibfuOXwLeLCmBeJmxZIjza2rVHIaKLdGfT3wxWv0gONA+/:R3BAxFrvIQLesDIjzEaKhiUhNL
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind
f2840d65ddee6a875210f31349e18385cbc9bca229666fc822642b546077e210.lnk
- SHA256 f2840d65ddee6a875210f31349e18385cbc9bca229666fc822642b546077e210
- MD5 6b077822e20c14af987bf869836dd89b
- SHA1 3ec0f825ba649dabcd1b2b09f63ed46be0c31579
- SHA512 9448704f63c7038d4644a4f4120d17d0f9f9fb8b0ab12eb4c0fe5dbbeb65d28ac57666e60a5ac4ace4fb3d977f888cf49ea822d28cc3ba48e023714b71ac8640
- SSDEEP 24:8l/BHYVKVW+/4ds+/CW6C7pQ7NaHKPeFI:815a+AdR7oE
- MD5 SHA1 SHA512 SSDEEP
-
Class file contains resources related to AdWind