1[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1.rar
Size 3.4MB
Sample240622-l88fhstcle
SHA256 1144dff41fa0f58fc7cc3d127c07fd02a3052dc6db22d181d9340b6ffe552fa6
MD5 895a5bc00f1742a270044fbfc9913ad9
SHA1 f17c790ef79c80313628309162ca761b423f59c2
SHA512 4e9d4afd64f0bba423a1129be4ec62250ee0fe9ea4982a7292a59124978dda6a291d857f3b3fbea696606ef0399fe4ca62f6f8e7a7aa6d25435ebe201093783a
SSDEEP 98304:H6xwCJxruQzMY0OTeUb/pk5aLHjKQ3VksnYyBV:aNTQY9Ssk5utnJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/UIxMarketPlugin.dll
unpack001/relay.dll

File Explorer

1.rar

.rar 3.4MB
Setup.exe

.exe 2.4MB
UIxMarketPlugin.dll

.dll 1.6MB
aliyah.aspx

63KB
chin.torrent

1.4MB
relay.dll

.dll 1.5MB
vcruntime140.dll

.dll 88KB
vcruntime140_app.dll

.dll 21KB

1.rar

SHA256 1144dff41fa0f58fc7cc3d127c07fd02a3052dc6db22d181d9340b6ffe552fa6
MD5 895a5bc00f1742a270044fbfc9913ad9
SHA1 f17c790ef79c80313628309162ca761b423f59c2
SHA512 4e9d4afd64f0bba423a1129be4ec62250ee0fe9ea4982a7292a59124978dda6a291d857f3b3fbea696606ef0399fe4ca62f6f8e7a7aa6d25435ebe201093783a
SSDEEP 98304:H6xwCJxruQzMY0OTeUb/pk5aLHjKQ3VksnYyBV:aNTQY9Ssk5utnJ
MD5 SHA1 SHA512 SSDEEP

Setup.exe

IMPHASH 7bbd05e7ccc991b148f02f5bc9ff9a97
SHA256 a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
MD5 9fb4770ced09aae3b437c1c6eb6d7334
SHA1 fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA512 140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
SSDEEP 49152:Y8UMSn5cV2N9LNwtQ5gRR+moI1axGbYj6QAl4ImDkg7d5lROCDG5yzlC97W+uJUM:QMS5hN9OtQ5gRjoI8xGbYj6QAl4gg7dF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

81:0e:f2:36:93:98:2f:30:e1:ed:0f:af:94:fe:2d:89:5a:3c:5c:ff

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Canon Inc.,OU=ICP Network Strategy Planning,O=Canon Inc.,L=Ohta-ku,ST=Tokyo,C=JP

Chains

Jun 1, 2015

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Canon Inc.,OU=ICP Network Strategy Planning,O=Canon Inc.,L=Ohta-ku,ST=Tokyo,C=JP

Serial Number

68:aa:a3:0f:65:dd:ed:c6:40:8e:89:ee:2e:7c:0f:ba

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 20, 2014 - Jul 21, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

1491443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

PDB paths

C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\UniversalInstaller.pdb

uxtheme

CloseThemeData DrawThemeBackground OpenThemeData

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetProcessHeap SetEnvironmentVariableA GetConsoleMode GetConsoleCP WriteConsoleW InterlockedCompareExchange LCMapStringW LeaveCriticalSection EnterCriticalSection InterlockedExchange lstrlenW CloseHandle Sleep IsDBCSLeadByte MultiByteToWideChar SizeofResource LockResource LoadResource FindResourceW WideCharToMultiByte GetDriveTypeW GetTimeZoneInformation GetCurrentThreadId OpenThread WaitForSingleObject GetFileAttributesW SetFileAttributesW ResetEvent GetLastError GetUserDefaultUILanguage GetLocaleInfoW GetVolumeInformationW SetEvent MulDiv GetCurrentProcess GetDiskFreeSpaceExW OpenMutexW ReleaseMutex CreateFileW GetFileTime LocalAlloc LocalFree GetProcAddress FreeLibrary LoadLibraryA RaiseException GetModuleHandleW GetModuleFileNameW GetWindowsDirectoryW GlobalMemoryStatusEx GetSystemInfo GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter TerminateProcess HeapCreate SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle SetUnhandledExceptionFilter GetFileType SetStdHandle HeapQueryInformation HeapSize ExitProcess RtlUnwind HeapReAlloc GetDateFormatW GetTimeFormatW GetSystemTimeAsFileTime CreateThread ExitThread VirtualQuery VirtualAlloc HeapFree HeapAlloc DecodePointer EncodePointer GetStartupInfoW HeapSetInformation GetCommandLineW FindResourceExW VirtualProtect SearchPathW GetProfileIntW GetTickCount GetTempPathW GetTempFileNameW GetNumberFormatW GetCurrentDirectoryW GetFileSizeEx GetFileAttributesExW GetUserDefaultLCID GetSystemDefaultLCID GetSystemDefaultUILanguage FindFirstFileW SetErrorMode lstrlenA GlobalGetAtomNameW TlsFree LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc TlsGetValue InterlockedIncrement GlobalFlags DeleteCriticalSection InitializeCriticalSectionAndSpinCount FileTimeToLocalFileTime FileTimeToSystemTime ReleaseActCtx CreateActCtxW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW ResumeThread SetThreadPriority lstrcmpA ConvertDefaultLocale CreateEventW GetFullPathNameW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer lstrcmpiW GetThreadLocale FreeResource GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW CompareStringW lstrcmpW GlobalFree GlobalSize GlobalAlloc FormatMessageW ActivateActCtx DeactivateActCtx SetLastError GlobalLock GlobalUnlock GetSystemWow64DirectoryW GetSystemDirectoryW CreateMutexW InterlockedDecrement ReadFile GetFileSize WriteFile lstrcpyW ProcessIdToSessionId GetCurrentProcessId GetCurrentThread VerifyVersionInfoW VerSetConditionMask LoadLibraryW CreateProcessW QueryPerformanceCounter QueryPerformanceFrequency GetLongPathNameW CopyFileW DeleteFileW RemoveDirectoryW FindNextFileW FindClose

user32

InsertMenuItemW TranslateAcceleratorW RegisterClipboardFormatW BringWindowToTop SetCursorPos CreateAcceleratorTableW LoadAcceleratorsW GetKeyboardState GetKeyboardLayout ToUnicodeEx DrawEdge DrawStateW GetSystemMenu SetClassLongW DestroyAcceleratorTable SetParent SetWindowRgn IsZoomed DrawIconEx LoadImageW CopyImage GetIconInfo NotifyWinEvent EnableScrollBar HideCaret DrawFocusRect InvertRect GetAsyncKeyState CreatePopupMenu GetMenuDefaultItem UnregisterClassW DestroyIcon GetNextDlgGroupItem ReleaseCapture SetCapture InvalidateRgn CopyAcceleratorTableW OffsetRect CharNextW SetLayeredWindowAttributes EnumDisplayMonitors SetRectEmpty KillTimer SetTimer DeleteMenu MessageBeep IsClipboardFormatAvailable SystemParametersInfoW DestroyMenu GetMenuItemInfoW LoadCursorW GetSysColorBrush RealChildWindowFromPoint MapVirtualKeyW GetKeyNameTextW ShowOwnedPopups SetCursor GetMessageW TranslateMessage ValidateRect SetWindowContextHelpId MapDialogRect PostQuitMessage CharUpperW IntersectRect GetDesktopWindow GetActiveWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog GetCursorPos WindowFromPoint SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW ReuseDDElParam CheckMenuItem ShowWindow MoveWindow SetWindowTextW IsDialogMessageW CheckDlgButton RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW SetPropW GetPropW RemovePropW GetFocus GetWindowLongW GetLastActivePopup IsWindowEnabled UnpackDDElParam OpenClipboard SetFocus GetWindowTextLengthW GetWindowTextW SetActiveWindow DispatchMessageW BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MonitorFromWindow GetMonitorInfoW MapWindowPoints ScrollWindow TrackPopupMenu GetKeyState SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos ShowScrollBar UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement DefWindowProcW CallWindowProcW SetClipboardData CloseClipboard EmptyClipboard IsCharLowerW MapVirtualKeyExW UnionRect UpdateLayeredWindow MonitorFromPoint IsMenu PostThreadMessageW WaitMessage DefFrameProcW DefMDIChildProcW DrawMenuBar TranslateMDISysAccel CreateMenu GetMenu SetWindowPos GetWindow LoadMenuW GetMenuState GetMenuStringW AppendMenuW GetMenuItemID InsertMenuW GetMenuItemCount GetSubMenu SetMenuDefaultItem FrameRect GetUpdateRect CopyIcon CharUpperBuffW GetDoubleClickTime SubtractRect DestroyCursor GetWindowRgn EnableMenuItem InflateRect IsWindow GetWindowRect MessageBoxW InvalidateRect EnableWindow GetClientRect ReleaseDC GetDC GetParent SendMessageW IsWindowVisible DrawFrameControl PostMessageW GetDlgCtrlID SetRect GetForegroundWindow GetWindowThreadProcessId AttachThreadInput SetForegroundWindow GetSystemMetrics LoadIconW IsIconic DrawIcon CopyRect ExitWindowsEx EnumChildWindows GetClassNameW TrackMouseEvent PtInRect LockWindowUpdate IsRectEmpty RedrawWindow FillRect SetWindowLongW DefDlgProcW TabbedTextOutW DrawTextW DrawTextExW GrayStringW ScreenToClient ClientToScreen GetWindowDC BeginPaint EndPaint GetSysColor RemoveMenu

gdi32

SelectClipRgn GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutW ExtTextOutW Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn CreatePatternBrush CreateBitmap SelectPalette GetObjectType CreateHatchBrush CopyMetaFileW CreateDCW SetRectRgn GetMapMode DPtoLP CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetRgnBox CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries CreateRoundRectRgn CreatePolygonRgn CreateEllipticRgn Polyline Ellipse Polygon SetPixel Rectangle OffsetRgn EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries SetPixelV GetTextFaceW SetLayout GetLayout SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect GetClipBox SetTextColor SetROP2 SetPolyFillMode SetBkColor CreatePen GetCurrentObject CreateSolidBrush RoundRect CombineRgn GetPixel CreateRectRgn CreateRectRgnIndirect GetTextExtentPoint32W SetBkMode SetMapMode PtInRegion RestoreDC GetDeviceCaps SaveDC CreateFontIndirectW GetStockObject PatBlt CreateCompatibleBitmap GetTextMetricsW GetTextColor BitBlt GetTextExtentExPointW DeleteObject DeleteDC SelectObject SetDIBColorTable CreateCompatibleDC GetObjectW CreateDIBSection GetObjectA GetBkColor GetDIBColorTable StretchBlt

msimg32

TransparentBlt GradientFill AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

CryptDeriveKey LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameW InitializeSecurityDescriptor RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW OpenProcessToken CryptHashData CryptCreateHash CryptAcquireContextW CryptDecrypt CryptEncrypt CryptReleaseContext CryptDestroyKey CryptDestroyHash SetSecurityDescriptorDacl

shell32

SHGetSpecialFolderPathW SHGetMalloc SHGetSpecialFolderLocation SHBrowseForFolderW SHGetPathFromIDListW SHCreateDirectoryExW SHGetFolderPathW SHGetFileInfoW SHAppBarMessage DragQueryFileW DragFinish ShellExecuteW SHGetDesktopFolder

comctl32

InitCommonControlsEx ImageList_GetIconSize

shlwapi

PathIsDirectoryW StrRetToBufW PathIsRootW PathFileExistsW PathRemoveFileSpecW PathCanonicalizeW AssocQueryStringW PathStripToRootW PathIsUNCW PathFindExtensionW PathFindFileNameW UrlUnescapeW

ole32

ReleaseStgMedium CoTaskMemAlloc OleDuplicateData CoCreateGuid CLSIDFromProgID CLSIDFromString CoGetClassObject OleRun CoCreateInstance OleUninitialize CoTaskMemFree CoInitializeEx CoUninitialize CoInitialize StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoFreeUnusedLibraries CreateStreamOnHGlobal OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleLockRunning OleIsCurrentClipboard OleFlushClipboard DoDragDrop CoRevokeClassObject CoRegisterMessageFilter RevokeDragDrop CoLockObjectExternal RegisterDragDrop OleGetClipboard OleInitialize

oleaut32

VariantChangeType VariantCopy SysAllocStringLen SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen VarBstrFromDate OleCreateFontIndirect VariantClear VariantInit SysFreeString SysAllocString

oledlg

OleUIBusyW

gdiplus

GdipCreateBitmapFromStream GdipDrawImageRectI GdipCreateBitmapFromHBITMAP GdipCreateFontFromLogfontW GdipSetStringFormatTrimming GdipMeasureString GdipSetStringFormatLineAlign GdipSetWorldTransform GdipScaleMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipSetStringFormatAlign GdipDrawString GdipSetCompositingQuality GdipSetStringFormatFlags GdiplusShutdown GdipDrawImageI GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipFree GdipAlloc GdipCloneImage GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipBitmapLockBits GdipGetImagePalette GdipGetImagePaletteSize GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipCreateBitmapFromFile GdiplusStartup GdipSetInterpolationMode GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipCreateStringFormat GdipDeleteStringFormat GdipSetTextRenderingHint GdipSetSmoothingMode GdipCreateFromHDC

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

imm32

ImmGetOpenStatus ImmGetContext ImmReleaseContext

winmm

PlaySoundW

wininet

InternetSetOptionExW InternetCanonicalizeUrlW InternetCrackUrlW HttpOpenRequestW InternetConnectW HttpSendRequestW InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallbackW InternetOpenW InternetGetLastResponseInfoW InternetCloseHandle HttpQueryInfoW InternetQueryDataAvailable

netapi32

NetApiBufferFree NetUserGetInfo

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

UIxMarketPlugin.dll

IMPHASH 12fbd1bc75de00e13e4da8fd25e68e9a
SHA256 cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15
MD5 d1ba9412e78bfc98074c5d724a1a87d6
SHA1 0572f98d78fb0b366b5a086c2a74cc68b771d368
SHA512 8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f
SSDEEP 49152:/7Q2CH7FiYk7q8wOP2nyh9VgFdJYZL6MsQv4Pvg3KIA8wuSgKacXTT3Kos2lpm:sZH7FZk7LP2nyh9VgFdJYZL6NQgPVIAv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1023891

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_DLL

PDB paths

C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\UIxMarketPlugin.pdb

kernel32

VerifyVersionInfoW VerSetConditionMask GetConsoleMode GetConsoleCP LCMapStringW GetTimeZoneInformation GetStringTypeW QueryPerformanceCounter GetEnvironmentStringsW WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo HeapDestroy HeapCreate GetStdHandle IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetFileType SetStdHandle VirtualQuery GetSystemInfo VirtualAlloc GetSystemTimeAsFileTime ExitProcess HeapQueryInformation HeapSize CreateThread ExitThread HeapReAlloc RaiseException RtlUnwind HeapFree GetCommandLineA EncodePointer DecodePointer HeapAlloc FindResourceExW VirtualProtect SearchPathW Sleep GetProfileIntW GetTickCount InitializeCriticalSectionAndSpinCount GetTempPathW GetTempFileNameW GetNumberFormatW GetWindowsDirectoryW lstrcpyW GetCurrentDirectoryW GetFileTime GetFileSizeEx GetFileAttributesW FileTimeToLocalFileTime GetFileAttributesExW GetUserDefaultUILanguage GetLocaleInfoW InterlockedExchange GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileW lstrcmpiW GlobalFlags FreeResource GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW LoadLibraryW lstrcmpW FileTimeToSystemTime lstrlenA lstrcmpA GlobalGetAtomNameW CompareStringW InterlockedIncrement GetModuleHandleW GetProcAddress WaitForSingleObject GetCurrentThreadId ResumeThread SetThreadPriority CloseHandle MultiByteToWideChar CopyFileW GlobalSize FormatMessageW MulDiv lstrlenW WideCharToMultiByte GetCurrentProcessId FreeLibrary FindResourceW LoadResource LockResource SizeofResource InterlockedDecrement GetModuleFileNameW ActivateActCtx ReleaseActCtx DeactivateActCtx TlsFree GlobalFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc GetLastError SetLastError

user32

SetCapture MapVirtualKeyW IsRectEmpty CreatePopupMenu GetMenuDefaultItem RedrawWindow SetLayeredWindowAttributes EnumDisplayMonitors KillTimer SetTimer DeleteMenu ShowOwnedPopups SetCursor IntersectRect InvalidateRect SetRectEmpty IsIconic PostQuitMessage EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect SystemParametersInfoW DestroyMenu GetMenuItemInfoW InflateRect CharUpperW DestroyIcon GetDesktopWindow RealChildWindowFromPoint ClientToScreen ShowWindow MoveWindow SetWindowTextW IsDialogMessageW CheckDlgButton RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow SetFocus GetForegroundWindow SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MonitorFromWindow GetMonitorInfoW MapWindowPoints ScrollWindow TrackPopupMenu IsZoomed SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow GetAsyncKeyState UpdateWindow GetClientRect PostMessageW CreateWindowExW SetWindowRgn SetParent ReleaseCapture InvertRect DrawFocusRect GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetWindowRect ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo CopyRect PtInRect SetWindowPlacement GetWindowPlacement GetDlgCtrlID DefWindowProcW CallWindowProcW HideCaret EnableScrollBar NotifyWinEvent MessageBeep GetNextDlgTabItem OffsetRect GetIconInfo CopyImage LoadImageW GetNextDlgGroupItem DrawIconEx EndDialog CreateDialogIndirectParamW TranslateAcceleratorW UnhookWindowsHookEx MessageBoxW EnableWindow IsWindowEnabled GetLastActivePopup GetWindowLongW GetParent SendMessageW GetWindowThreadProcessId RemoveMenu GetSubMenu GetMenuItemCount InsertMenuW PostThreadMessageW GetMenuItemID AppendMenuW GetMenuStringW GetMenuState ValidateRect GetCursorPos PeekMessageW GetKeyState IsWindowVisible GetActiveWindow DispatchMessageW TranslateMessage GetMessageW CallNextHookEx SetWindowsHookExW GetSysColorBrush GetSysColor ReleaseDC GetDC GetSystemMetrics DestroyAcceleratorTable SetClassLongW GetSystemMenu LoadCursorW GetWindowTextW GetWindowTextLengthW CheckMenuItem EnableMenuItem ModifyMenuW GetFocus LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps GetWindow SetWindowPos SetWindowLongW GetMenu DrawStateW DrawEdge DrawFrameControl CopyAcceleratorTableW ToUnicodeEx GetKeyboardLayout GetKeyboardState BringWindowToTop InsertMenuItemW LoadAcceleratorsW LoadMenuW ReuseDDElParam UnpackDDElParam SetRect ShowScrollBar WindowFromPoint CreateAcceleratorTableW SetCursorPos LockWindowUpdate GetKeyNameTextW OpenClipboard SetClipboardData CloseClipboard EmptyClipboard IsCharLowerW MapVirtualKeyExW UnionRect UpdateLayeredWindow MonitorFromPoint IsMenu GetWindowRgn DestroyCursor DrawIcon MapDialogRect SubtractRect GetDoubleClickTime CharUpperBuffW CopyIcon RegisterClipboardFormatW GetUpdateRect FrameRect IsClipboardFormatAvailable SetMenuDefaultItem CreateMenu TranslateMDISysAccel DrawMenuBar DefMDIChildProcW DefFrameProcW WaitMessage SetMenu

gdi32

PtVisible RectVisible TextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC CreatePatternBrush GetStockObject SelectPalette GetObjectType CreatePen CreateSolidBrush CreateHatchBrush CreateCompatibleBitmap CreateRectRgnIndirect SetRectRgn CombineRgn PatBlt DPtoLP CreateDIBitmap GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo GetBkColor GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries CreateDIBSection CreateRoundRectRgn GetWindowExtEx GetTextColor CreateEllipticRgn Polyline Ellipse Polygon SetDIBColorTable StretchBlt SetPixel Rectangle OffsetRgn GetRgnBox EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries SetPixelV GetTextFaceW CreatePalette GetPixel SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect GetClipBox SetMapMode SetROP2 GetViewportExtEx CreateRectRgn SelectClipRgn SetLayout CreatePolygonRgn GetLayout GetDeviceCaps SetPolyFillMode SetBkMode RestoreDC SaveDC GetTextExtentPoint32W ExtTextOutW BitBlt CreateCompatibleDC CreateFontIndirectW DeleteObject GetObjectW SetBkColor SetTextColor CreateBitmap CreateDCW GetPaletteEntries CopyMetaFileW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

comdlg32

GetFileTitleW

advapi32

RegQueryValueExW RegEnumKeyExW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegCloseKey

shell32

SHGetFileInfoW SHGetDesktopFolder SHGetPathFromIDListW SHGetSpecialFolderLocation SHAppBarMessage SHBrowseForFolderW DragQueryFileW DragFinish ShellExecuteW

ole32

OleRun OleGetClipboard RegisterDragDrop CoLockObjectExternal RevokeDragDrop DoDragDrop OleLockRunning IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CreateStreamOnHGlobal CoInitializeEx CoInitialize CoUninitialize CoCreateInstance OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree

oleaut32

VariantChangeType VariantClear SysFreeString VarBstrFromDate VariantInit SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysAllocStringLen

shlwapi

PathRemoveFileSpecW PathFindExtensionW PathIsUNCW PathStripToRootW PathFindFileNameW

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

gdiplus

GdipDrawImageI GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipFree GdipAlloc GdipDeleteGraphics GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat

msimg32

TransparentBlt AlphaBlend

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

comctl32

ImageList_GetIconSize

relay.dll

IMPHASH b621df906e0394d025a0242c6a967904
SHA256 5445b90053ca9c5c57ce4955bcc2a8b25da581cef94a69dad57404f6c3a89a0b
MD5 af8da0b55ec2a9a7f3b92ff3b8129556
SHA1 4a8acc4418fc6460511593919e7def2e40742381
SHA512 9f83b6914f08b5f592f4fd425f894966da35e604f766706ec554b68af931d8b1a0060387776c336794fede86a1d21a544458613de6f3bb695dfff777647e6f0b
SSDEEP 49152:L2gm39uH+I5/GxEoadcqX7Q9F7r40YB+eTcq+PDXx1lWz09x:3mtuH+e/RoadcqX7Qz7rDY8vq+Pbx1lc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

995460

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_DLL

PDB paths

C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\relay.pdb

kernel32

InterlockedExchange GetLocaleInfoW GetUserDefaultUILanguage GetFileAttributesExW GetFileSizeEx GetCurrentDirectoryW GetWindowsDirectoryW GetNumberFormatW GetTempFileNameW GetTempPathW InitializeCriticalSectionAndSpinCount GetTickCount GetProfileIntW SearchPathW VirtualProtect FindResourceExW DecodePointer GetCommandLineA ExitThread CreateThread HeapAlloc HeapFree EncodePointer RtlUnwind RaiseException HeapReAlloc HeapSize HeapQueryInformation ExitProcess GetSystemTimeAsFileTime VirtualAlloc GetSystemInfo VirtualQuery SetStdHandle GetFileType TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent SetHandleCount GetStdHandle GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetTimeZoneInformation GetStringTypeW GetConsoleCP GetConsoleMode WriteConsoleW SetEnvironmentVariableA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetFileSize lstrcmpiW GlobalFlags FreeResource GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW lstrcmpW lstrlenA lstrcmpA GlobalGetAtomNameW CompareStringW InterlockedIncrement SetErrorMode GetCurrentThreadId ResumeThread SetThreadPriority TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection InterlockedDecrement ActivateActCtx ReleaseActCtx CreateActCtxW DeactivateActCtx WideCharToMultiByte GlobalFree GlobalSize GlobalAlloc GlobalLock GlobalUnlock FormatMessageW MulDiv lstrlenW SetLastError FileTimeToLocalFileTime FileTimeToSystemTime MultiByteToWideChar GetFileTime CreateFileW GetProcAddress FreeLibrary LoadLibraryW VerifyVersionInfoW VerSetConditionMask GetFileAttributesW CopyFileW FindClose FindFirstFileW lstrcpyW ProcessIdToSessionId GetCurrentProcessId LocalFree LocalAlloc GetCurrentProcess GetCurrentThread CreateProcessW GetLastError FindResourceW LoadResource LockResource SizeofResource GetModuleFileNameW GetModuleHandleW Sleep GetFullPathNameW GetVolumeInformationW DuplicateHandle GetExitCodeProcess WaitForSingleObject GetProcessId CloseHandle

user32

GetKeyboardState CreateAcceleratorTableW SetCursorPos LockWindowUpdate GetKeyNameTextW OpenClipboard SetClipboardData CloseClipboard EmptyClipboard IsCharLowerW MapVirtualKeyExW UnionRect UpdateLayeredWindow MonitorFromPoint IsMenu PostThreadMessageW WaitMessage DefFrameProcW DefMDIChildProcW DrawMenuBar TranslateMDISysAccel CreateMenu SetMenuDefaultItem IsClipboardFormatAvailable FrameRect GetUpdateRect RegisterClipboardFormatW CopyIcon CharUpperBuffW GetDoubleClickTime SubtractRect MapDialogRect DrawIcon DestroyCursor GetWindowRgn CopyImage GetIconInfo OffsetRect GetNextDlgTabItem MessageBeep NotifyWinEvent EnableScrollBar HideCaret DrawFocusRect InvertRect ReleaseCapture GetAsyncKeyState SetCapture MapVirtualKeyW IsRectEmpty CreatePopupMenu GetMenuDefaultItem RedrawWindow SetLayeredWindowAttributes EnumDisplayMonitors KillTimer DeleteMenu ShowOwnedPopups SetCursor InvalidateRect SetRectEmpty IsIconic IntersectRect SystemParametersInfoW DestroyMenu GetMenuItemInfoW InflateRect CharUpperW DestroyIcon EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect GetDesktopWindow RealChildWindowFromPoint ClientToScreen ShowWindow MoveWindow SetWindowTextW IsDialogMessageW CheckDlgButton RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetKeyboardLayout GetClassLongW SetPropW GetPropW RemovePropW IsWindow SetFocus GetForegroundWindow SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MonitorFromWindow GetMonitorInfoW MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar UpdateWindow GetClientRect GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetWindowRect ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo CopyRect PtInRect SetWindowPlacement GetWindowPlacement GetDlgCtrlID CallWindowProcW GetMenu SetWindowLongW SetWindowPos GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush UnregisterClassW SetWindowsHookExW CallNextHookEx GetActiveWindow IsWindowVisible SendMessageW FindWindowExW PostMessageW RegisterClassExW CreateWindowExW GetSystemMetrics GetKeyState PeekMessageW GetCursorPos ValidateRect UnhookWindowsHookEx GetMenuState GetMenuStringW AppendMenuW GetMenuItemID InsertMenuW GetMenuItemCount GetSubMenu RemoveMenu GetClassNameW GetMessageW TranslateMessage DispatchMessageW PostQuitMessage DefWindowProcW ToUnicodeEx CopyAcceleratorTableW DrawFrameControl DrawEdge DrawStateW GetSystemMenu SetClassLongW DestroyAcceleratorTable SetWindowRgn SetParent IsZoomed WindowFromPoint SetRect UnpackDDElParam ReuseDDElParam LoadMenuW LoadAcceleratorsW InsertMenuItemW BringWindowToTop TranslateAcceleratorW CreateDialogIndirectParamW EndDialog DrawIconEx GetNextDlgGroupItem GetCapture LoadImageW SetTimer

msimg32

TransparentBlt AlphaBlend

comctl32

ImageList_GetIconSize

shlwapi

PathStripToRootW PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW PathIsUNCW

oleacc

CreateStdAccessibleObject LresultFromObject AccessibleObjectFromWindow

gdiplus

GdipDrawImageI GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipFree GdipAlloc GdipDeleteGraphics GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePaletteSize

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

netapi32

NetUserGetInfo NetApiBufferFree

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

gdi32

SetLayout SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx BitBlt GetPixel PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx GetLayout SetTextAlign MoveToEx LineTo GetClipBox SetMapMode ExtSelectClipRgn SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetROP2 SetPolyFillMode SetBkMode DeleteDC CreatePatternBrush CreateCompatibleDC RestoreDC SelectPalette GetObjectType CreatePen CreateSolidBrush IntersectClipRect CreateFontIndirectW GetTextExtentPoint32W CreateRectRgnIndirect SetRectRgn CombineRgn PatBlt DPtoLP CreateCompatibleBitmap CreateDIBitmap GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo GetBkColor CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries CreateDIBSection CreateRoundRectRgn CreatePolygonRgn GetTextColor CreateEllipticRgn Polyline Ellipse Polygon SetDIBColorTable StretchBlt SetPixel Rectangle OffsetRgn GetRgnBox EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries SetPixelV GetTextFaceW ExcludeClipRect CreateHatchBrush SaveDC DeleteObject GetObjectW SetBkColor SetTextColor CreateBitmap CreateDCW CopyMetaFileW ScaleWindowExtEx SetWindowExtEx GetStockObject GetDeviceCaps OffsetWindowOrgEx

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

comdlg32

GetFileTitleW

advapi32

FreeSid IsValidSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl GetLengthSid InitializeSecurityDescriptor AllocateAndInitializeSid DuplicateToken OpenProcessToken OpenThreadToken AccessCheck RegCloseKey RegOpenKeyExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegEnumKeyExW RegQueryValueExW

shell32

SHAppBarMessage DragQueryFileW DragFinish ShellExecuteW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetDesktopFolder SHGetFileInfoW ShellExecuteExW SHBrowseForFolderW

ole32

OleGetClipboard CoLockObjectExternal RevokeDragDrop DoDragDrop OleLockRunning IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx CoInitialize CoUninitialize CoCreateInstance OleDuplicateData CoTaskMemAlloc ReleaseStgMedium RegisterDragDrop

oleaut32

VariantClear VariantChangeType SysFreeString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysAllocStringLen VarBstrFromDate VariantInit SysAllocString

vcruntime140.dll

IMPHASH 2262054530b5f8bbeb0c4e3a111a37eb
SHA256 eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829
MD5 81b11024a8ed0c9adfd5fbf6916b133c
SHA1 c87f446d9655ba2f6fddd33014c75dc783941c33
SHA512 e4b1c694cb028fa960d750fa6a202bc3a477673b097b2a9e0991219b9891b5f879aa13aa741f73acd41eb23feee58e3dd6032821a23e9090ecd9cc2c3ec826a1
SSDEEP 1536:ckch/beb1bBhdXPFSAS7wIVktX8/eZT2G//ecb2Z0X3I+zl3z:ck2+1blXPg7wIVkts/UF/ecb2a5F
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

bc:d2:76:3b:7e:63:a7:ff:42:e9:e4:69:b5:8b:b3:2e:cc:0a:93:7f:c3:0e:20:7b:65:68:e3:88:d9:29:e0:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 21, 2024

PE Signature issue

Digest

bc:d2:76:3b:7e:63:a7:ff:42:e9:e4:69:b5:8b:b3:2e:cc:0a:93:7f:c3:0e:20:7b:65:68:e3:88:d9:29:e0:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 21, 2024

Minor OS version

Major OS version

Entry point

61744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb

_CreateFrameInfo _CxxThrowException _EH_prolog _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __intrinsic_setjmp __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __telemetry_main_invoke_trigger __telemetry_main_return_trigger __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_InitializeCriticalSectionEx __vcrt_LoadLibraryExW _chkesp _except_handler2 _except_handler3 _except_handler4_common _get_purecall_handler _get_unexpected _global_unwind2 _is_exception_typeof _local_unwind2 _local_unwind4 _longjmpex _purecall _seh_longjmp_unwind _seh_longjmp_unwind4 _set_purecall_handler _set_se_translator _setjmp3 longjmp memchr memcmp memcpy memmove memset set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

vcruntime140_app.dll

IMPHASH d72f37c91b3ba73278f6e6e6efc9239b
SHA256 813a447192c4fa7d25d0716b769399546f8bf6b31269dd8ad47f9812008d79e6
MD5 c0f29bd3b0eb4d8795d609a0c52e0926
SHA1 2f1958696d66edaf38079e370dcc2b41c7474122
SHA512 02bc56ad129a7d6382ba8d68b68a52fa70ace9bce68aae56d901bc60451982e358805e950ab49ae3d0c052c2ac6d44a6f5ab3679cd4ce2fbb205e4a8c7d7b670
SSDEEP 384:K0g/dJiHlDoeuczbaj7wTfzvg55dHRN7ooiFWSlGs4kz:w/d8lDoeuczbaj7Cg9jHPs
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

99:82:a9:4e:91:b8:80:0b:1e:44:36:1e:20:20:90:71:c8:89:97:21:12:02:b0:a1:90:e5:08:82:53:9c:2c:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 21, 2024

Minor OS version

Major OS version

Entry point

4896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vcruntime140_app.pdb

Sharing

General

Malware Config

Signatures

File Explorer

1.rar

Setup.exe

PE Signature issue

uxtheme

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

oleacc

imm32

winmm

wininet

netapi32

wtsapi32

generic

UIxMarketPlugin.dll

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

oleacc

gdiplus

msimg32

imm32

winmm

comctl32

generic

aliyah.aspx

chin.torrent

relay.dll

kernel32

user32

msimg32

comctl32

shlwapi

oleacc

gdiplus

imm32

winmm

netapi32

wtsapi32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

generic

vcruntime140.dll

PE Signature issue

PE Signature issue

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

kernel32