files.rar
- SHA256 b2bf3753fffd1c058f60b8c0b9d5be9f165e92e91462729f2707534a4b3b69c2
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target files.rar
- Size 6.1MB
- Sample240618-p5ssfathph
- SHA256 b2bf3753fffd1c058f60b8c0b9d5be9f165e92e91462729f2707534a4b3b69c2
- MD5 47abbc9f5c6239eb1bcc2ebd056ee69c
- SHA1 4043935a2b58d1747555a7c1e3ace24d75f404b2
- SHA512 da46aaeabf9fc117a998b383d60bc6bfa0a32beb741ba5d65b637e64ab650f44a1f11a236970875dd123b2ed5682982457785101841bebeb5448ca01c662bdae
- SSDEEP 98304:p0fdy3TarHa2Odp0BTSLlnZa6Qe+TC/9l8nIgovSj8k4X+eLZMNilM6dYdgMOT9:I8DaafQSLlnZa6B+TavrzvPVMklxfB
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
files.rar.rar 6.1MB
-
ASUS_WMI.dll.dll 224KB
-
ATKEX.dll.dll 84KB
-
AsIO.dll.dll 120KB
-
Setup.exe.exe 446KB
-
churchwoman.tar6.2MB
-
hygristor.torrent13KB
-
vcruntime140.dll.dll 88KB
-
vcruntime140_app.dll.dll 21KB
ASUS_WMI.dll
- IMPHASH 781c0f25a197e324dc4948975987f984
- SHA256 d5d3072da6a4e713fe83952e437f33920a3080d55bf54d6cbff8d97344eca0ca
- MD5 32d31a667cfdd57b931d5332e2de93b6
- SHA1 afd939113a0fa9a4190d3528a5191a8eb1da0a4e
- SHA512 480ccc12369c1f35a413262a45c099296a6d0aa0b35afbc1447500144cfa1fb89cac2ac0f2bee36a2e317141c66a37203941612bd133c6bb1fe4037879fba25e
- SSDEEP 3072:SsuqFgPmBNRP8hXzGvPkW6ZZW8egHS/jiCAg0FubAxZ+051gh9b6q4TQXdO8k:Sst2nho2ZW8edAOAZCqQXY8k
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
dc:9c:41:a9:c2:af:d6:b0:59:84:18:54:dc:2c:92:06:c7:36:31:c8
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,ST=Taipei,C=TW
Chains
Dec 26, 2017
CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,ST=Taipei,C=TW
CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,ST=Taipei,C=TW
Serial Number
08:16:66:29:58:45:15:9f:57:ae:88:f4:41:bf:23:7e
Issuer
CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 27, 2015 - Aug 1, 2018
Subject
CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
6
Entry point
52102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Program Files (x86)\ASUS\AsusFanControlService\2.00.28\ASUS_WMI.pdb
kernel32
WaitForSingleObject
GetExitCodeThread
OutputDebugStringW
CloseHandle
CreateThread
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
FreeLibrary
LoadLibraryExW
InterlockedFlushSList
QueryPerformanceFrequency
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
CreateFileW
user32
wsprintfW
ole32
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
IsSupportASUSWMI
burst_read_ec
burst_read_ec_thread
burst_read_hwm
burst_read_hwm_thread
burst_read_sio
burst_write_ec
burst_write_ec_thread
burst_write_hwm
burst_write_hwm_thread
burst_write_sio
read_cpuid
read_ec
read_ec_thread
read_hwm
read_hwm_thread
read_index_io
read_index_io_thread
read_io_byte
read_io_dword
read_io_word
read_mem
read_msr
read_pci
read_sio
read_sio_thread
read_smbus_block
read_smbus_byte
read_smbus_word
write_ec
write_ec_thread
write_hwm
write_hwm_thread
write_index_io
write_index_io_thread
write_io_byte
write_io_dword
write_io_word
write_mem
write_msr
write_pci
write_sio
write_sio_thread
write_smbus_block
write_smbus_byte
write_smbus_word
Name
.text
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=132, id=243, version=40116,
count=29, id=242, version=40116,
count=1, id=208, version=65501,
count=22, id=259, version=24123,
count=46, id=261, version=24123,
count=32, id=260, version=24123,
count=1, id=206, version=65501,
count=9, id=203, version=65501,
count=105, id=1, productName=Unmarked objects,
count=8, id=265, version=24210,
count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
ATKEX.dll
- IMPHASH 2d0b5b40695cd42fb8b3d5495cd5069f
- SHA256 c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb
- MD5 e68562f63265e1a70881446b4b9dc455
- SHA1 da16ef9367bde3ce892b1a0e33bc179d8acdceb3
- SHA512 6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674
- SSDEEP 1536:C3zQ0q8XqIh06v0UQpTcX+CZntb9lviEossWVcd+u8Nc15TCvOM:UqhIh06vKpTcX+El2+uKc15TCF
- MD5 SHA1 SHA512 SSDEEP
Digest
4e:e3:a2:48:91:70:d4:9c:13:64:ea:f5:79:b5:30:29:50:c4:f8:28:7e:cb:9a:25:07:e3:0e:d7:b6:5c:c3:bf
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
Oct 1, 2021
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
0c:64:96:2e:44:67:ed:cc:15:79:64:6b:73:37:ec:8c
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 1, 2019 - Jan 11, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
6
Entry point
6839
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Jenkins\workspace\atkexComSvc\Release\ATKEX.pdb
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
LCMapStringW
GetProcessHeap
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
DecodePointer
GetBiosItemCollectors
Register
ResetBiosItemCollectors
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=136, id=261, version=26213,
count=18, id=260, version=26213,
count=15, id=260, version=26706,
count=17, id=259, version=26706,
count=32, id=261, version=26706,
count=3, id=257, version=26213,
count=80, id=1, productName=Unmarked objects,
count=2, id=265, version=27045,
count=1, id=256, version=27045,
count=1, id=255, version=27045,
count=1, id=258, version=27045,
AsIO.dll
- IMPHASH 503f24b2f16afaad05eb71ff2cde7fce
- SHA256 e1bb63ccac541b38266228acd3d77a141efc468a69c3f821bfcc06330ce86815
- MD5 3e2c867b129165acdb3a457e131b90bc
- SHA1 f538fa5705229da2c4403830d8c9f13e3a885f73
- SHA512 8a6574138f43e263f045bf5b1f2b0fb495fb0d424c403a0fd5a19959bfc970243b43c46f4dff86091d34980d3be9bf07034d9f3478ac7043ef0bbf5e2ed365bf
- SSDEEP 3072:mLCK0llptaTHfPwr5pm6Qi0ZqnPkNP97bLL:m+bllaborzQtzVbX
- MD5 SHA1 SHA512 SSDEEP
Digest
95:11:4a:31:02:a3:c4:d9:83:e3:f3:a6:ce:30:8f:82:92:4a:0e:52:c6:f7:99:d0:84:ba:a5:c3:18:32:98:e1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
Feb 2, 2021
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
0c:64:96:2e:44:67:ed:cc:15:79:64:6b:73:37:ec:8c
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 1, 2019 - Jan 11, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
6
Entry point
10922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Working\MB\GLCKIO2\AsIO3\Release\AsIO3_32.pdb
kernel32
lstrlenW
WriteFile
DeviceIoControl
K32GetModuleFileNameExW
LocalAlloc
CreateFileW
FormatMessageW
GetLastError
GetCurrentProcess
CreateFileA
CloseHandle
LocalSize
GetProcAddress
LocalFree
WaitNamedPipeW
DecodePointer
GetConsoleMode
GetConsoleCP
SetNamedPipeHandleState
OutputDebugStringW
ReadFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteConsoleW
user32
wsprintfW
MessageBoxW
advapi32
RegOpenKeyExA
RegQueryValueExA
ASIO_CheckReboot
ASIO_Close
ASIO_GetCpuID
ASIO_InPortB
ASIO_InPortD
ASIO_MapMem
ASIO_OPEN_WO_MSG
ASIO_Open
ASIO_OutPortB
ASIO_OutPortD
ASIO_ReadMSR
ASIO_UnmapMem
ASIO_WriteMSR
AllocatePhysMemory
FreePhysMemory
GetPortVal
MapPhysToLin
OC_GetCurrentCpuFrequency
SEG32_CALLBACK
SetPortVal
UnmapPhysicalMemory
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=137, id=261, version=26213,
count=18, id=260, version=26213,
count=15, id=260, version=26706,
count=18, id=259, version=26706,
count=33, id=261, version=26706,
count=7, id=257, version=26213,
count=99, id=1, productName=Unmarked objects,
count=3, id=265, version=27045,
count=1, id=256, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Setup.exe
- IMPHASH fc578e7fba082d59fb16f2832ddd43df
- SHA256 12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
- MD5 485008b43f0edceba0e0d3ca04bc1c1a
- SHA1 55ae8f105af415bb763d1b87f6572f078052877c
- SHA512 402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1
- SSDEEP 12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM
- MD5 SHA1 SHA512 SSDEEP
Digest
74:bf:95:d0:b4:53:d5:74:a3:84:5e:4f:0c:e5:33:06:0b:5a:c1:9f:33:49:e3:2f:03:c3:f5:02:e4:a8:9d:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
Oct 1, 2021
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
0c:64:96:2e:44:67:ed:cc:15:79:64:6b:73:37:ec:8c
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 1, 2019 - Jan 11, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
6
Entry point
159977
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Jenkins\workspace\atkexComSvc\Release\atkexComSvc.pdb
atkex
ord3
ord2
winmm
timeGetTime
kernel32
WriteFile
CloseHandle
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionEx
GetModuleHandleW
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
DeleteFileA
SetFileAttributesA
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateEventW
OpenEventW
GetModuleHandleA
LoadLibraryA
SetDllDirectoryW
GetCommandLineW
CreateThread
GetCurrentThreadId
lstrcpyW
GetCurrentProcess
GetCurrentThread
GetSystemInfo
GetNativeSystemInfo
SetThreadAffinityMask
SetThreadPriority
SuspendThread
ResumeThread
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileSizeEx
GetStringTypeW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
FlushFileBuffers
CreateFileW
CreateFileA
WritePrivateProfileStringW
WritePrivateProfileStringA
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameA
OutputDebugStringW
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameW
FreeLibrary
GetTickCount
LoadLibraryW
GetProcAddress
Sleep
GetCommandLineA
GetCPInfo
GetOEMCP
WriteConsoleW
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
HeapReAlloc
HeapSize
GetFileType
HeapAlloc
HeapFree
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
SetLastError
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
user32
wsprintfW
CharNextW
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
CharUpperW
MessageBoxW
MessageBoxA
advapi32
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegDeleteValueW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
ole32
CoRevokeClassObject
CoInitializeSecurity
CoReleaseServerProcess
CoAddRefServerProcess
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoResumeClassObjects
StringFromGUID2
CoRegisterClassObject
oleaut32
SysAllocString
SysFreeString
SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantCopy
VariantClear
VariantInit
SysStringLen
SafeArrayAccessData
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
SafeArrayUnaccessData
shlwapi
PathFileExistsW
Name
.text
Size
245KB
Virtual Size
245KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=26213,
count=146, id=261, version=26213,
count=18, id=260, version=26706,
count=22, id=259, version=26706,
count=53, id=261, version=26706,
count=22, id=260, version=26213,
count=16, id=257, version=26213,
count=3, id=257, version=27045,
count=218, id=1, productName=Unmarked objects,
count=3, id=260, version=27045,
count=30, id=261, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
churchwoman.tar
- SHA256 fe7270ad7a2dbd1cda2139bbbc6a5b895bde8aab5377eb1fe492a780299fee5f
- MD5 685854e3f13519f0e523220de2fdaffd
- SHA1 4ec9b5830a85efab629ab64631d461859db29ff4
- SHA512 04e983b1019836f91e83efeea2bba5e277d4526c4627659a4d6b7909c4aaa8c05af75c7752d4e8483c37e9f196f2371a461c0aa3392854cf43bc0d8e36fc976b
- SSDEEP 98304:Nfn5qSls9Zs/RPjXNCdd0CNlmD4Yd6NO7zi9j3S08sTtP+5J2t90Kb3mk29qR1gy:N/Rjx96Da3dRnix9Rt90ut29qH7R
- MD5 SHA1 SHA512 SSDEEP
hygristor.torrent
- SHA256 215d93a6f50cb4a52c2b3852d4329a6f8bcaebebdda4f8b534ac7ff3a81aacfa
- MD5 e3d99dc5a8cd178fad0c5f539692b1c6
- SHA1 0ef6b99183e7ed79c24408e43c46f377816f7cdc
- SHA512 f55488627cfe549843ef4b3d3a3f20d7aac9a914b4070935da24134eaee5c919b512f67f4d79481423b610d1e0083a15c67750808bcb9b35f2d1982cd5d09c48
- SSDEEP 384:L3ls5wWKGg6jcRtElVYQdJWJxqra/xBi77:LCzkOAJxqra/niX
- MD5 SHA1 SHA512 SSDEEP
vcruntime140.dll
- IMPHASH 2262054530b5f8bbeb0c4e3a111a37eb
- SHA256 eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829
- MD5 81b11024a8ed0c9adfd5fbf6916b133c
- SHA1 c87f446d9655ba2f6fddd33014c75dc783941c33
- SHA512 e4b1c694cb028fa960d750fa6a202bc3a477673b097b2a9e0991219b9891b5f879aa13aa741f73acd41eb23feee58e3dd6032821a23e9090ecd9cc2c3ec826a1
- SSDEEP 1536:ckch/beb1bBhdXPFSAS7wIVktX8/eZT2G//ecb2Z0X3I+zl3z:ck2+1blXPg7wIVkts/UF/ecb2a5F
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
bc:d2:76:3b:7e:63:a7:ff:42:e9:e4:69:b5:8b:b3:2e:cc:0a:93:7f:c3:0e:20:7b:65:68:e3:88:d9:29:e0:11
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 18, 2024
PE Signature issue
Digest
bc:d2:76:3b:7e:63:a7:ff:42:e9:e4:69:b5:8b:b3:2e:cc:0a:93:7f:c3:0e:20:7b:65:68:e3:88:d9:29:e0:11
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 18, 2024
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:d1:69:66:1c:06:4a:07:c0:1c:00:00:00:00:00:d1
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cf:a0:25:90:e3:13:04:ef:15:00:00:00:00:02:cf
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
61744
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
abort
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
api-ms-win-crt-string-l1-1-0
strcpy_s
strncmp
wcsncmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsprintf_s
api-ms-win-crt-convert-l1-1-0
atol
kernel32
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
RtlUnwind
VirtualQuery
EncodePointer
InterlockedPushEntrySList
InterlockedFlushSList
RaiseException
EnterCriticalSection
TlsGetValue
DeleteCriticalSection
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsSetValue
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_chkesp
_except_handler2
_except_handler3
_except_handler4_common
_get_purecall_handler
_get_unexpected
_global_unwind2
_is_exception_typeof
_local_unwind2
_local_unwind4
_longjmpex
_purecall
_seh_longjmp_unwind
_seh_longjmp_unwind4
_set_purecall_handler
_set_se_translator
_setjmp3
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=29395,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=41, id=1, productName=Unmarked objects,
count=20, id=259, version=31823,
count=21, id=260, version=31823,
count=28, id=261, version=31823,
count=1, id=256, version=31823,
count=1, id=255, version=31823,
count=1, id=258, version=31823,
vcruntime140_app.dll
- IMPHASH d72f37c91b3ba73278f6e6e6efc9239b
- SHA256 813a447192c4fa7d25d0716b769399546f8bf6b31269dd8ad47f9812008d79e6
- MD5 c0f29bd3b0eb4d8795d609a0c52e0926
- SHA1 2f1958696d66edaf38079e370dcc2b41c7474122
- SHA512 02bc56ad129a7d6382ba8d68b68a52fa70ace9bce68aae56d901bc60451982e358805e950ab49ae3d0c052c2ac6d44a6f5ab3679cd4ce2fbb205e4a8c7d7b670
- SSDEEP 384:K0g/dJiHlDoeuczbaj7wTfzvg55dHRN7ooiFWSlGs4kz:w/d8lDoeuczbaj7Cg9jHPs
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
99:82:a9:4e:91:b8:80:0b:1e:44:36:1e:20:20:90:71:c8:89:97:21:12:02:b0:a1:90:e5:08:82:53:9c:2c:e8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 18, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
4896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vcruntime140_app.pdb
vcruntime140
__std_type_info_destroy_list
memset
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
kernel32
UnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
QueryPerformanceCounter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_chkesp
_except_handler2
_except_handler3
_except_handler4_common
_get_purecall_handler
_get_unexpected
_global_unwind2
_is_exception_typeof
_local_unwind2
_local_unwind4
_longjmpex
_purecall
_seh_longjmp_unwind
_seh_longjmp_unwind4
_set_purecall_handler
_set_se_translator
_setjmp3
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=26706,
count=10, id=261, version=26706,
count=10, id=260, version=26706,
count=1, id=259, version=26706,
count=2, id=257, version=26213,
count=29, id=1, productName=Unmarked objects,
count=1, id=265, version=27043,
count=1, id=256, version=27043,
count=1, id=255, version=27043,
count=1, id=258, version=27043,