pepsi (2).rar
- SHA256 c8e9d09ad447ee95b879b7a55829d94a1aac2ecc6546942b9e08f7e3e5709088
Overview
overview
10Static
static
10[DemonArch...6d.exe
windows7-x64
10[DemonArch...87.exe
windows7-x64
10[DemonArch...4b.exe
windows7-x64
10[DemonArch...9e.exe
windows7-x64
10[DemonArch...ca.exe
windows7-x64
10[DemonArch...8c.exe
windows7-x64
10[DemonArch...1a.exe
windows7-x64
10[DemonArch...4c.exe
windows7-x64
10[DemonArch...c4.exe
windows7-x64
10[DemonArch...68.exe
windows7-x64
10[DemonArch...50.exe
windows7-x64
10[DemonArch...3e.exe
windows7-x64
10[DemonArch...8b.exe
windows7-x64
10[DemonArch...f0.exe
windows7-x64
10[DemonArch...e1.exe
windows7-x64
10[DemonArch...89.exe
windows7-x64
[DemonArch...e5.exe
windows7-x64
10[DemonArch...85.exe
windows7-x64
10[DemonArch...6b.exe
windows7-x64
10[DemonArch...d0.exe
windows7-x64
10[DemonArch...1e.exe
windows7-x64
10[DemonArch...25.exe
windows7-x64
[DemonArch...31.exe
windows7-x64
9[DemonArch...5f.exe
windows7-x64
10[DemonArch...d3.exe
windows7-x64
10[DemonArch...a5.exe
windows7-x64
10[DemonArch...bb.exe
windows7-x64
3[DemonArch...25.exe
windows7-x64
10[DemonArch...49.exe
windows7-x64
10[DemonArch...4c.exe
windows7-x64
10[DemonArch...ec.exe
windows7-x64
10[DemonArch...ae.exe
windows7-x64
10Behavioral task
behavioral1
Sample
[DemonArchives]02602e9283805090b671a783870db86d.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
[DemonArchives]0838231d7fbebe340c0ac71db0ef8c87.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
[DemonArchives]0ad8190f1160f00fc831fb329262724b.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
[DemonArchives]0bcfb8285b7397bcfc2ffb92a6c5ec9e.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
[DemonArchives]0dbf8f84a143e3e446242938dfd288ca.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
[DemonArchives]13bba40208ea1f05d660ffad53c40c8c.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
[DemonArchives]1443a4458c2b4af35c618a327b7c411a.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
[DemonArchives]15282a5c1d8e03a448ebc0b70e702a4c.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
[DemonArchives]156c78364b84a89c8e61f444c3c620c4.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
[DemonArchives]15ff3ff6cb29ac4c66a558d101e37068.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
[DemonArchives]18227e20a5e842198e7271ae54397150.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
[DemonArchives]1d957e984fcd6327f30f7006e2d11f3e.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
[DemonArchives]1e2c3685399d381aa04ba4d70651e38b.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
[DemonArchives]291b00fb921e80b1cf7e8154693947f0.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral15
Sample
[DemonArchives]2b961a5aadff93e0d87b42e530d5a0e1.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
[DemonArchives]2be60b607087d60c5353062345f97789.exe
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
[DemonArchives]2e23d0d084cd18f08897dfe509bdd4e5.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
[DemonArchives]2edac22166e0d82bc1c652e331726c85.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
[DemonArchives]31c25cdf7b77267744cdc37912e48d6b.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral20
Sample
[DemonArchives]3265873dd9d9c29a8b14f69efb8df4d0.exe
Resource
win7-20240419-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral21
Sample
[DemonArchives]34172ec379dab98d177ab7e31d517b1e.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral22
Sample
[DemonArchives]4cf4cbd1bc2ef0ddfe3530541ffdd925.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
[DemonArchives]54b9e4e56454226484e80fd01ca03131.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
[DemonArchives]9a4605cedcda1924728fbe58d429915f.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral25
Sample
[DemonArchives]a2113a088085d07d2d7688ab2b0914d3.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral26
Sample
[DemonArchives]aa18a0770ed7d03bddfb00e126fbbba5.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
[DemonArchives]ac7cf64a560bda15c281c43780b8d5bb.exe
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
[DemonArchives]af6fb7fbf240ae2f6490766919b26325.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral29
Sample
[DemonArchives]b09a0cd1c32edf39308043eed7889449.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral30
Sample
[DemonArchives]b1d6b726bf6ac63749e5eba6b5c7694c.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
[DemonArchives]b3c170550a1efdf268632916e95ad1ec.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral32
Sample
[DemonArchives]b83b3408e6ade0a5c61c5870208000ae.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target pepsi (2).rar
- Size 4.0MB
- Sample240704-vsjxnazeln
- SHA256 c8e9d09ad447ee95b879b7a55829d94a1aac2ecc6546942b9e08f7e3e5709088
- MD5 f350ee1795b1e2cc6394ff72b15d7d95
- SHA1 667405d3c3daeacc3ca576176558f4cdb539fc35
- SHA512 bb6806c8828aa40640519931ce69bbff487e0c97002eb3844de6d1d135d5e50586176b69ab4e6e66b3db94106c7ce514b2bf471604b63c8c41344cd35a6bd799
- SSDEEP 98304:S/lah4iAchEqIZfnSG2h6uwWODZN1vxaMC5tcoEO5Aq:S/ezyqIU+RWuZdaMceoyq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Urelas family
-
resource yara_rule static1/unpack001/[DemonArchives]2be60b607087d60c5353062345f97789.exe upx - Unsigned PE 32 IoCs
Checks for missing Authenticode signature.
resource unpack001/[DemonArchives]02602e9283805090b671a783870db86d.exe unpack001/[DemonArchives]0838231d7fbebe340c0ac71db0ef8c87.exe unpack001/[DemonArchives]0ad8190f1160f00fc831fb329262724b.exe unpack001/[DemonArchives]0bcfb8285b7397bcfc2ffb92a6c5ec9e.exe unpack001/[DemonArchives]0dbf8f84a143e3e446242938dfd288ca.exe unpack001/[DemonArchives]13bba40208ea1f05d660ffad53c40c8c.exe unpack001/[DemonArchives]1443a4458c2b4af35c618a327b7c411a.exe unpack001/[DemonArchives]15282a5c1d8e03a448ebc0b70e702a4c.exe unpack001/[DemonArchives]156c78364b84a89c8e61f444c3c620c4.exe unpack001/[DemonArchives]15ff3ff6cb29ac4c66a558d101e37068.exe unpack001/[DemonArchives]18227e20a5e842198e7271ae54397150.exe unpack001/[DemonArchives]1d957e984fcd6327f30f7006e2d11f3e.exe unpack001/[DemonArchives]1e2c3685399d381aa04ba4d70651e38b.exe unpack001/[DemonArchives]291b00fb921e80b1cf7e8154693947f0.exe unpack001/[DemonArchives]2b961a5aadff93e0d87b42e530d5a0e1.exe unpack001/[DemonArchives]2be60b607087d60c5353062345f97789.exe unpack001/[DemonArchives]2e23d0d084cd18f08897dfe509bdd4e5.exe unpack001/[DemonArchives]2edac22166e0d82bc1c652e331726c85.exe unpack001/[DemonArchives]31c25cdf7b77267744cdc37912e48d6b.exe unpack001/[DemonArchives]3265873dd9d9c29a8b14f69efb8df4d0.exe unpack001/[DemonArchives]34172ec379dab98d177ab7e31d517b1e.exe unpack001/[DemonArchives]4cf4cbd1bc2ef0ddfe3530541ffdd925.exe unpack001/[DemonArchives]54b9e4e56454226484e80fd01ca03131.exe unpack001/[DemonArchives]9a4605cedcda1924728fbe58d429915f.exe unpack001/[DemonArchives]a2113a088085d07d2d7688ab2b0914d3.exe unpack001/[DemonArchives]aa18a0770ed7d03bddfb00e126fbbba5.exe unpack001/[DemonArchives]ac7cf64a560bda15c281c43780b8d5bb.exe unpack001/[DemonArchives]af6fb7fbf240ae2f6490766919b26325.exe unpack001/[DemonArchives]b09a0cd1c32edf39308043eed7889449.exe unpack001/[DemonArchives]b1d6b726bf6ac63749e5eba6b5c7694c.exe unpack001/[DemonArchives]b3c170550a1efdf268632916e95ad1ec.exe unpack001/[DemonArchives]b83b3408e6ade0a5c61c5870208000ae.exe
File Explorer
-
pepsi (2).rar.rar 4.0MB
-
[DemonArchives]02602e9283805090b671a783870db86d.exe.exe 401KB
-
[DemonArchives]0838231d7fbebe340c0ac71db0ef8c87.exe.exe 398KB
-
[DemonArchives]0ad8190f1160f00fc831fb329262724b.exe.exe 391KB
-
[DemonArchives]0bcfb8285b7397bcfc2ffb92a6c5ec9e.exe.exe 398KB
-
[DemonArchives]0dbf8f84a143e3e446242938dfd288ca.exe.exe 391KB
-
[DemonArchives]13bba40208ea1f05d660ffad53c40c8c.exe.exe 398KB
-
[DemonArchives]1443a4458c2b4af35c618a327b7c411a.exe.exe 398KB
-
[DemonArchives]15282a5c1d8e03a448ebc0b70e702a4c.exe.exe 400KB
-
[DemonArchives]156c78364b84a89c8e61f444c3c620c4.exe.exe 395KB
-
[DemonArchives]15ff3ff6cb29ac4c66a558d101e37068.exe.exe 395KB
-
[DemonArchives]18227e20a5e842198e7271ae54397150.exe.exe 397KB
-
[DemonArchives]1d957e984fcd6327f30f7006e2d11f3e.exe.exe 396KB
-
[DemonArchives]1e2c3685399d381aa04ba4d70651e38b.exe.exe 391KB
-
[DemonArchives]291b00fb921e80b1cf7e8154693947f0.exe.exe 396KB
-
[DemonArchives]2b961a5aadff93e0d87b42e530d5a0e1.exe.exe 397KB
-
[DemonArchives]2be60b607087d60c5353062345f97789.exe.exe 400KB
-
[DemonArchives]2e23d0d084cd18f08897dfe509bdd4e5.exe.exe 405KB
-
[DemonArchives]2edac22166e0d82bc1c652e331726c85.exe.exe 398KB
-
[DemonArchives]31c25cdf7b77267744cdc37912e48d6b.exe.exe .ps1 397KB
-
[DemonArchives]3265873dd9d9c29a8b14f69efb8df4d0.exe.exe 398KB
-
[DemonArchives]34172ec379dab98d177ab7e31d517b1e.exe.exe 397KB
-
[DemonArchives]4cf4cbd1bc2ef0ddfe3530541ffdd925.exe.exe 400KB
-
[DemonArchives]54b9e4e56454226484e80fd01ca03131.exe.exe 398KB
-
[DemonArchives]9a4605cedcda1924728fbe58d429915f.exe.exe 400KB
-
[DemonArchives]a2113a088085d07d2d7688ab2b0914d3.exe.exe 399KB
-
[DemonArchives]aa18a0770ed7d03bddfb00e126fbbba5.exe.exe 400KB
-
[DemonArchives]ac7cf64a560bda15c281c43780b8d5bb.exe.exe 397KB
-
[DemonArchives]af6fb7fbf240ae2f6490766919b26325.exe.exe 391KB
-
[DemonArchives]b09a0cd1c32edf39308043eed7889449.exe.exe 397KB
-
[DemonArchives]b1d6b726bf6ac63749e5eba6b5c7694c.exe.exe 394KB
-
[DemonArchives]b3c170550a1efdf268632916e95ad1ec.exe.exe 398KB
-
[DemonArchives]b83b3408e6ade0a5c61c5870208000ae.exe.exe 391KB
[DemonArchives]02602e9283805090b671a783870db86d.exe
- SHA256 c8ebb05354f37d413f536bb5d9250f18ee2344eae41512152e02d75961226f0d
- MD5 02602e9283805090b671a783870db86d
- SHA1 809ec688610224990ca878201ecbfec4ea38234e
- SHA512 bfadd5d36d8c469851ae08aad0ab4aff901d96a0db7127eca9f5e534707a09577cdd28e850b95ff2cd0c00faccccce0f5537ce93273ceb5767530464c4969aa9
- SSDEEP 6144:nNCRjh1Gndpui6yYPaIGckfru5xyDpui6yYPaIGckSU05836PGyA7:n6jh8ndpV6yYP4rbpV6yYPg058KrY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204803
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.rsrc
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ajelhf
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
[DemonArchives]0838231d7fbebe340c0ac71db0ef8c87.exe
- SHA256 3dc24aee494aa1c25f33d147f3d508a2562b1306b6c2e6b68a3aab8d0b55d1f3
- MD5 0838231d7fbebe340c0ac71db0ef8c87
- SHA1 7ddacab2065a07b3cc15891d019eb6bbfaebb926
- SHA512 45d3702efe177ee6262105bb7e54d60e7bf4e418899f03f3f1d3cad4af9a9290b1a44e24edf77859fbd0c46012875f7dcf82b1d326496015ea486f3e4d38cb3d
- SSDEEP 12288:s0gB6t3XGCByvNv54B9f01ZmHByvNv5imipWf0Aq:9gB6t3XGpvr4B9f01ZmQvrimipWf0Aq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.text
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
[DemonArchives]0ad8190f1160f00fc831fb329262724b.exe
- IMPHASH 26babd76bbb7f9c516a338b0601b4c9f
- SHA256 a8919549aaa06216b5b2040ea46e739a034439dae3d7f12e8acb3eba03cba2e3
- MD5 0ad8190f1160f00fc831fb329262724b
- SHA1 e6e1da6fadf4c91643426744f8b3d58741094d11
- SHA512 f87bcfbe9b56b51037fd524adb0a575d16a008c4aad9c11088837f90af2d947a1cf8ba99c7a8f6fd6d6f3c6907834bd2facbfefad6eb322d33a0aa4531a91441
- SSDEEP 6144:dcmnugfO/4Zdf69CaAfbAfNtTAfMAfFAfNPUmKyIxLfYeOO9UmKyIxL:dcmuMO/8df6MmNtuhUNP3cOK3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
208896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
htonl
htons
inet_addr
ioctlsocket
listen
recv
select
send
socket
ole32
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
gdi32
GetStockObject
DeleteObject
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
_itoa
__GetMainArgs
_sleep
_strcmpi
_stricmp
atoi
exit
memcpy
memset
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.flh
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
rpUrErbd
Size
6KB
Virtual Size
6KB
Characteristics
Name
pEnXDayu
Size
10KB
Virtual Size
10KB
Characteristics
Name
yYWNRtWL
Size
36KB
Virtual Size
36KB
Characteristics
Name
UeBpIIBU
Size
512B
Virtual Size
36B
Characteristics
Name
MErlHrhe
Size
1024B
Virtual Size
823B
Characteristics
Name
ZmReTqVu
Size
1024B
Virtual Size
814B
Characteristics
Name
tVVYuapu
Size
9KB
Virtual Size
8KB
Characteristics
Name
skxfXvQV
Size
512B
Virtual Size
353B
Characteristics
Name
fPFTSSpq
Size
6KB
Virtual Size
5KB
Characteristics
Name
SHrakIKn
Size
30KB
Virtual Size
29KB
Characteristics
generic
[DemonArchives]0bcfb8285b7397bcfc2ffb92a6c5ec9e.exe
- SHA256 998a90c34cb83856eadfece5c0052715f77fc63fdce2eac18f1b77b2fbfb57a6
- MD5 0bcfb8285b7397bcfc2ffb92a6c5ec9e
- SHA1 3c4856f8589081268a4a61d8dce1a54fe199485d
- SHA512 92dbc3b60abacae0d5c6cda45d90c8f1b2918506961dc51c40dca6cdff19ffb86c9b3e799372856ac34a62bbdf6aedf093800bdabb3cf1ade0d19655e5e59c62
- SSDEEP 12288:Yxvkwde6t3XGCByvNv54B9f01ZmHByvNv5imipWf0Aq:YxPe6t3XGpvr4B9f01ZmQvrimipWf0Aq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.text
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
[DemonArchives]0dbf8f84a143e3e446242938dfd288ca.exe
- SHA256 2fcf2ca874d5d9c7b199efeb90f4fb7d49a2530c814a223bd09d0709bf77bb2a
- MD5 0dbf8f84a143e3e446242938dfd288ca
- SHA1 a4b18e5656d80811ec155f3c1a2058bf1a56a05f
- SHA512 870701aaec92bc893eccf519f5ccf88fdd6e19a4b0db466b9f09ad4cd3d7275b8545ef8cf9283af24ea13e5354724843223f202db26b7b2a8af0d3216dfbcede
- SSDEEP 12288:6KlT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:R99XvEhdfJkKSkU3kHyuaRB5t6k0IJon
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ajelhf
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
[DemonArchives]13bba40208ea1f05d660ffad53c40c8c.exe
- SHA256 e270f7d80f0999adf9faec7b4420296162720cbd4eaf1565469637b22449c2c0
- MD5 13bba40208ea1f05d660ffad53c40c8c
- SHA1 9673bf830c65e3c4de175b2900f219278747be0d
- SHA512 c6fdb3391488d0fe113dd7ec15b88dd403c6ba8f6d70ea93da12ef03a25403581a4ca5ed03d7533ae20685584c514cefeb12952546ffb9fa78b1a4fde1efb69c
- SSDEEP 12288:UTz6t3XGCByvNv54B9f01ZmHByvNv5imipWf0Aq:Wz6t3XGpvr4B9f01ZmQvrimipWf0Aq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.text
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
[DemonArchives]1443a4458c2b4af35c618a327b7c411a.exe
- SHA256 d7fdceb79120af55c3f7a741d91ad26107724b4e2811489d698e23abcf8ee2eb
- MD5 1443a4458c2b4af35c618a327b7c411a
- SHA1 f1305ec2fd753181bf7c46ad4f158eda7792abf2
- SHA512 32e90a0a9797db215261706e7e92417c42ee87cf8390a8a622c9418b886bd6b2e6ef9e5ad104615525e7f2cce4bf2eaf734d7226544d3091f26d235b9db91571
- SSDEEP 12288:tgLRC6t3XGCByvNv54B9f01ZmHByvNv5imipWf0Aq:tr6t3XGpvr4B9f01ZmQvrimipWf0Aq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.text
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
[DemonArchives]15282a5c1d8e03a448ebc0b70e702a4c.exe
- IMPHASH 26babd76bbb7f9c516a338b0601b4c9f
- SHA256 f6375abc46dcbce112a1e3ba861c41334dba32a4957dc4d7ef8b46da979ffadd
- MD5 15282a5c1d8e03a448ebc0b70e702a4c
- SHA1 b0ace68b21297d0e28d9be701ec587f9e0de0cb3
- SHA512 1bde2938591cb4eda5e1718b28c69aab9f7b7f978fb583183dafe2a5b630231b13c26f695f510d7a3dd61a53ea843ae8a27bac3967e58b38f5c5a7e306ef2091
- SSDEEP 6144:6u/L2rwCO+xqtDyB8LoedCFJ369BJ369vpui6yYPaIGckvNP9T9pui6yYPaIGckv:7uYtyWUedCv2EpV6yYPaNFZpV6yYPo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
htonl
htons
inet_addr
ioctlsocket
listen
recv
select
send
socket
ole32
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
gdi32
GetStockObject
DeleteObject
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
_itoa
__GetMainArgs
_sleep
_strcmpi
_stricmp
atoi
exit
memcpy
memset
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ajelhf
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
lPOCqABm
Size
5KB
Virtual Size
4KB
Characteristics
Name
yARqkWQr
Size
2KB
Virtual Size
1KB
Characteristics
Name
qUjjudvo
Size
6KB
Virtual Size
5KB
Characteristics
Name
efsAfkwy
Size
2KB
Virtual Size
2KB
Characteristics
Name
HsBbJtJx
Size
2KB
Virtual Size
1KB
Characteristics
Name
vPGHfwSD
Size
512B
Virtual Size
215B
Characteristics
Name
vCpwFSDL
Size
106KB
Virtual Size
105KB
Characteristics
Name
YKgLLlzh
Size
2KB
Virtual Size
1KB
Characteristics
Name
KSmeDRAK
Size
7KB
Virtual Size
7KB
Characteristics
Name
yphQIOrR
Size
2KB
Virtual Size
1KB
Characteristics
generic
[DemonArchives]156c78364b84a89c8e61f444c3c620c4.exe
- IMPHASH 95e6f8741083e0c7d9a63d45e2472360
- SHA256 3b88c2f43976374821ba11bb4bba5a2efded13646486213538787e44f10ac3bf
- MD5 156c78364b84a89c8e61f444c3c620c4
- SHA1 261feb74784a16e1e874344ba7b58a2147d010c1
- SHA512 c39b598f8d762dd1326c87c6b78fb4f837fb9f713e9f3adc22dcdfe589b94cb984baa289974dfc3887b3815832017738515e41f9e332e917fb7752aa89381e74
- SSDEEP 6144:v44OG5zs4y70u4HXs4yr0u490u4Ds4yvW8lM:3W4O0dHc4i0d90dA4X
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
188416
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ole32
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
gdi32
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
__GetMainArgs
_sleep
_stricmp
atoi
exit
memcpy
memset
printf
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
vsprintf
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.embm
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
nfPkwtvc
Size
512B
Virtual Size
487B
Characteristics
Name
uwWrxqiH
Size
98KB
Virtual Size
98KB
Characteristics
Name
gmrzWSsQ
Size
12KB
Virtual Size
12KB
Characteristics
Name
eRKmqCRi
Size
3KB
Virtual Size
2KB
Characteristics
Name
gXNIVLrm
Size
512B
Virtual Size
171B
Characteristics
Name
PCCaMLTv
Size
512B
Virtual Size
258B
Characteristics
Name
ZPDtsBwo
Size
132KB
Virtual Size
132KB
Characteristics
Name
SPhmSLev
Size
5KB
Virtual Size
5KB
Characteristics
Name
fvKywPSi
Size
41KB
Virtual Size
41KB
Characteristics
Name
VODroDxF
Size
9KB
Virtual Size
8KB
Characteristics
generic
[DemonArchives]15ff3ff6cb29ac4c66a558d101e37068.exe
- IMPHASH 95e6f8741083e0c7d9a63d45e2472360
- SHA256 b211748821d6be18fc724ae54016810bda9468556d40dd5e96c4d76b17ed296a
- MD5 15ff3ff6cb29ac4c66a558d101e37068
- SHA1 5a54059011cd20ef3415fba73ce637231f5995aa
- SHA512 d0820a86e48798e34472bbb9fc3c8434d72955ae3ddb9a86314c077c8c65b8afe65e84e94e08c3b2731b400bd861f3a21c46a8c16a0b99376929002229147d46
- SSDEEP 6144:97Cuz8x0s4y70u4HXs4yr0u490u4Ds4yvW8lM:973AR4O0dHc4i0d90dA4X
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
188416
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ole32
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
gdi32
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
__GetMainArgs
_sleep
_stricmp
atoi
exit
memcpy
memset
printf
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
vsprintf
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.embm
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
nfPkwtvc
Size
512B
Virtual Size
487B
Characteristics
Name
uwWrxqiH
Size
98KB
Virtual Size
98KB
Characteristics
Name
gmrzWSsQ
Size
12KB
Virtual Size
12KB
Characteristics
Name
eRKmqCRi
Size
3KB
Virtual Size
2KB
Characteristics
Name
gXNIVLrm
Size
512B
Virtual Size
171B
Characteristics
Name
PCCaMLTv
Size
512B
Virtual Size
258B
Characteristics
Name
ZPDtsBwo
Size
132KB
Virtual Size
132KB
Characteristics
Name
SPhmSLev
Size
5KB
Virtual Size
5KB
Characteristics
Name
fvKywPSi
Size
41KB
Virtual Size
41KB
Characteristics
Name
VODroDxF
Size
9KB
Virtual Size
8KB
Characteristics
generic
[DemonArchives]18227e20a5e842198e7271ae54397150.exe
- IMPHASH 62ec3dce1eba1b68f6a4511bb09f8c2c
- SHA256 c5bf90a46a2e67b19a200697a81e38071ec90031c6f1131af0d89d4ba2f662e2
- MD5 18227e20a5e842198e7271ae54397150
- SHA1 c14df7a52d6e72bd4dececf81070a32bb0929881
- SHA512 4b22ed37f205bede421f462e2497488c09b926b2d68af6442bb88118c63ca36627145d7f854f15ec555be0b3c4c99534d2e864be99f7f37ade4bdee5f9938a0b
- SSDEEP 6144:HbdZN30jAWRD2jvosK6mUzW96mFBuRFzWlH:xgLx67u6quRFzWlH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
196608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ole32
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
gdi32
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
advapi32
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
__GetMainArgs
_sleep
_stricmp
atoi
exit
memcpy
memset
printf
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
vsprintf
msvcrt
memchr
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.kofbl
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.l1
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
[DemonArchives]1d957e984fcd6327f30f7006e2d11f3e.exe
- IMPHASH c2a87fabf96470db507b2e6b43bd92eb
- SHA256 6f5b438e345b6829c40e96e7a0e1e54d9a0125651606a075d415d5c83f13ab4c
- MD5 1d957e984fcd6327f30f7006e2d11f3e
- SHA1 2bb0d753dbf15cc2bc77ddb65a19af172a2e5719
- SHA512 44e5ca8fec50a0526645bdb34e23adfc997ba19675912436435dc6f402993ef6021bda0848a41a2f4ab982f4631b1c7ad7dd8022c215837e4180308aad92c54c
- SSDEEP 6144:WQevw9LshaiB00Bsn4X4s+ZKv3yr4X4743t5P6yC:uwELB+nisK3+i485P5C
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
200704
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ole32
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
gdi32
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
advapi32
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
__GetMainArgs
_sleep
_stricmp
atoi
exit
memcpy
memset
printf
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
vsprintf
msvcrt
_wgetcwd
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfcd
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.l1
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
[DemonArchives]1e2c3685399d381aa04ba4d70651e38b.exe
- IMPHASH 26babd76bbb7f9c516a338b0601b4c9f
- SHA256 0486b9913363db77c3fda63520eb8b6259036f3a9a0b005af80a35b6993e17f9
- MD5 1e2c3685399d381aa04ba4d70651e38b
- SHA1 7965ffc8c592b2ca14a7739343611c5b8fd3e70f
- SHA512 585b7ecad6a0d9a9ac0ed601b957a09073e52771f4e094b4dbf98ac2ad5a65f291ba87efd8520c11c24a1072bf135735697a9e3fb9d472405d908a664f5604e9
- SSDEEP 6144:65ExJPBIbhJaAfbAfNtTAfMAfFAfNPUmKyIxLfYeOO9UmKyIxL:66kbmNtuhUNP3cOK3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
208896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
htonl
htons
inet_addr
ioctlsocket
listen
recv
select
send
socket
ole32
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
gdi32
GetStockObject
DeleteObject
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
_itoa
__GetMainArgs
_sleep
_strcmpi
_stricmp
atoi
exit
memcpy
memset
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.flh
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
rpUrErbd
Size
6KB
Virtual Size
6KB
Characteristics
Name
pEnXDayu
Size
10KB
Virtual Size
10KB
Characteristics
Name
yYWNRtWL
Size
36KB
Virtual Size
36KB
Characteristics
Name
UeBpIIBU
Size
512B
Virtual Size
36B
Characteristics
Name
MErlHrhe
Size
1024B
Virtual Size
823B
Characteristics
Name
ZmReTqVu
Size
1024B
Virtual Size
814B
Characteristics
Name
tVVYuapu
Size
9KB
Virtual Size
8KB
Characteristics
Name
skxfXvQV
Size
512B
Virtual Size
353B
Characteristics
Name
fPFTSSpq
Size
6KB
Virtual Size
5KB
Characteristics
Name
SHrakIKn
Size
30KB
Virtual Size
29KB
Characteristics
generic
[DemonArchives]291b00fb921e80b1cf7e8154693947f0.exe
- IMPHASH c2a87fabf96470db507b2e6b43bd92eb
- SHA256 ad23e414994b3fd0b5301e15835aab30c7e39af7b53d9f51d354f514c76ee3de
- MD5 291b00fb921e80b1cf7e8154693947f0
- SHA1 e3cf2526ddb2ef16a0b17f353f1a45e235262fc4
- SHA512 45c2145b0a1260e55734117651f237767d08a759c2b0932ba25bef37b81a95ef977b9ace820fba650f924d44b4dba3412d9f74e3fe920652525cb667ee353e28
- SSDEEP 6144:FGBN2DSpwTQVDshaiB00Bsn4X4s+ZKv3yr4X4743t5P6yC:FGBN2S2QkLB+nisK3+i485P5C
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
200704
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ole32
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
gdi32
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
advapi32
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
__GetMainArgs
_sleep
_stricmp
atoi
exit
memcpy
memset
printf
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
vsprintf
msvcrt
_wgetcwd
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfcd
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.l1
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
[DemonArchives]2b961a5aadff93e0d87b42e530d5a0e1.exe
- IMPHASH 26babd76bbb7f9c516a338b0601b4c9f
- SHA256 173aba5362bfe1265f0056ba2fa0eceb40018001e468a58fecf0a06bc9fcd5bd
- MD5 2b961a5aadff93e0d87b42e530d5a0e1
- SHA1 6737ce510d0e77b726b9d248aee80653b6c5febb
- SHA512 55a963f65639da9c13a88482d02a766942ba6cce7b5c02de69a3c2fc09d90128a1eb0667d21e577d04621021f8e9c13940efdcc516950ef000b3bed56f0e1380
- SSDEEP 6144:8r5B8rguKyjJFDmV3cWLFM6234lKm3mo8Yvi4KsLTFM6234lKm3pT11Tgkz15814:45BczKlFB24lwR45FB24lzx1skz15L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
htonl
htons
inet_addr
ioctlsocket
listen
recv
select
send
socket
ole32
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
gdi32
GetStockObject
DeleteObject
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
_itoa
__GetMainArgs
_sleep
_strcmpi
_stricmp
atoi
exit
memcpy
memset
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ajelhf
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
[DemonArchives]2be60b607087d60c5353062345f97789.exe
- SHA256 2e6d6a7e4e003f5ea683bc45820bb3b7649cdaa2cfbdfc429d3781374144a2d3
- MD5 2be60b607087d60c5353062345f97789
- SHA1 a34ef8d301141e34c5a87d731885fa338e938665
- SHA512 41333a52ed6565221ae8c10c1def3490c10f56b0e1e09f980cb43e0b3e1a0dbcefeed44bde107e7e7e751498b19e8bafec1baba1de4f4f36f97935a43251d3be
- SSDEEP 6144:BcaJuc4qMyfnp7xPxcs2/5zxxYT52MZM1d:fLrMOnpNPNy5zIM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
401184
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
336KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
52KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
[DemonArchives]2e23d0d084cd18f08897dfe509bdd4e5.exe
- SHA256 9ac3d17d3a16de7d5891380d0bbf8bec802a07bcba4d5cc4922ddcd76dd4d705
- MD5 2e23d0d084cd18f08897dfe509bdd4e5
- SHA1 42d66c425b52b032341ab9674142b43f3cded2ce
- SHA512 4e15b32c8ee0a4aa0e07423ccc246b848fc7762ba1cb27d175a764a6b2c81660575bdd24ae6ecb6edb638ee0fa8bd20a58f26d23f3524bdb61e3490c1264c32d
- SSDEEP 6144:mEPNrnound3J/oHeN+uqljd3rKzwN8Jlljd3njPX9ZAk3fig:mGrn/ZQ4+XjpKXjtjP9Ztx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
196608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.pdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.l1
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
[DemonArchives]2edac22166e0d82bc1c652e331726c85.exe
- SHA256 fe7136141c1a5cac32597cac8580756f43a121a7114382c77e96be3acc574d08
- MD5 2edac22166e0d82bc1c652e331726c85
- SHA1 eac2fcc7fe1516294d174c0e69ca4fb374eedfd8
- SHA512 06fb5014eeea70eba927e72bf5de2b64134a477a0963f351e72db7acca171ada5ab946cccfbcfe92f5492fa0a1cfc0764fd61800b33ebbef3c72ab40de777656
- SSDEEP 12288:HEBGdH6t3XGCByvNv54B9f01ZmHByvNv5imipWf0Aq:h6t3XGpvr4B9f01ZmQvrimipWf0Aq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.text
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
[DemonArchives]31c25cdf7b77267744cdc37912e48d6b.exe
- IMPHASH 26babd76bbb7f9c516a338b0601b4c9f
- SHA256 7d0361afdbc94a5949ad691e84ecc6e21ff0cde3c0b46583a24d08b2df3907a4
- MD5 31c25cdf7b77267744cdc37912e48d6b
- SHA1 def43e68f721917ff16efcc4b24cf49762a8a5c2
- SHA512 9f5ff1c7de947d5646bf810ae6fe35b25dda4d9d51c31b857829e3cad00c59c5b7699d4e406f31e5abb2e49487bd2e61b36549c6f281486b889ed653994a4212
- SSDEEP 6144:+yKbeGItFM6234lKm3mo8Yvi4KsLTFM6234lKm3pT11Tgkz1581hW:+yJGYFB24lwR45FB24lzx1skz15L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
htonl
htons
inet_addr
ioctlsocket
listen
recv
select
send
socket
ole32
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
gdi32
GetStockObject
DeleteObject
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
_itoa
__GetMainArgs
_sleep
_strcmpi
_stricmp
atoi
exit
memcpy
memset
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ajelhf
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
[DemonArchives]3265873dd9d9c29a8b14f69efb8df4d0.exe
- IMPHASH 8c16c795b57934183422be5f6df7d891
- SHA256 14d9335a629e2e50d998c7f4c5862f7dec22ac63ec183f190d243b4b20bf4838
- MD5 3265873dd9d9c29a8b14f69efb8df4d0
- SHA1 2c27d280d1b104deaf861a2801477719faa5dc82
- SHA512 83502b9f428402c89ffc759aa7337a0779da48c4c72f1271d510cd22657e89ff5aab55b24cb226dba99cc6f7fa7b6b6ad7babbe1c7dd98072be616eaba17142d
- SSDEEP 6144:5sLqdufVUNDanfz/LLvmpjE3EaICePt2lcx0vCuV61lhJrNGx39PIW:2FUNDabPupjbaNcx0vCSaZJsd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
EVENT_SINK_GetIDsOfNames
ord690
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaLateIdCall
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
ord661
__vbaHresultCheckObj
__vbaNameFile
_adj_fdiv_m32
Zombie_GetTypeInfo
__vbaAryDestruct
ord669
ord593
__vbaExitProc
ord594
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
ord705
__vbaStrFixstr
_CIsin
ord631
ord709
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaStrCmp
ord529
__vbaGet4
__vbaPutOwner3
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord714
ord609
__vbaFPException
ord319
__vbaGetOwner3
__vbaUbound
ord535
__vbaFileSeek
ord537
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
ord570
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
ord689
__vbaAryLock
__vbaVarAdd
ord611
ord320
__vbaVarDup
__vbaStrToAnsi
ord321
__vbaFpI2
__vbaFpI4
ord616
__vbaLateMemCallLd
_CIatan
__vbaStrMove
ord618
__vbaCastObj
__vbaR8IntI4
ord650
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
ord580
ord581
Name
.text
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
96KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=8, id=9, version=8041,
count=1, id=13, version=8169,
[DemonArchives]34172ec379dab98d177ab7e31d517b1e.exe
- IMPHASH 26babd76bbb7f9c516a338b0601b4c9f
- SHA256 51975163f93595f49c8e3860d5dc1aadd0c2a1e343670caf06414f2c0fb8a15a
- MD5 34172ec379dab98d177ab7e31d517b1e
- SHA1 2c40d53f85657f7c156aaf571d89e7955dff5b6a
- SHA512 e88ee582e0f8e53566ac1bc5158c13862f0f89a092e8af00db6a93213fb5bf30c56a3d10a37b51e5b0d1419bfecb0b043c7aeed2a64a6a84d366cbfd8534a414
- SSDEEP 6144:mtzlkGFM6234lKm3mo8Yvi4KsLTFM6234lKm3pT11Tgkz1581hW:URHFB24lwR45FB24lzx1skz15L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
htonl
htons
inet_addr
ioctlsocket
listen
recv
select
send
socket
ole32
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
gdi32
GetStockObject
DeleteObject
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
_itoa
__GetMainArgs
_sleep
_strcmpi
_stricmp
atoi
exit
memcpy
memset
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ajelhf
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
[DemonArchives]4cf4cbd1bc2ef0ddfe3530541ffdd925.exe
- SHA256 33af4f8085d1bc3f6a8e96ac99e78d44fb84bb24ba578f7baf61619873ca4f4c
- MD5 4cf4cbd1bc2ef0ddfe3530541ffdd925
- SHA1 9f59a2b9e007cd1dca5d802409f69f7bc51ba5b0
- SHA512 d4ee5a896770370ec519c0da12cbdf2fe15aa7995cf324bdc196444bf3caa017c20e6f0a518b458b8ce5fb41823558ef9bab85c526de81d71f213884919d3f90
- SSDEEP 3072:EVMfMIbIyw3J9U58ZhwwlW+BC3K5eqU+BC3K5eqYroGQd:hfMmc88ZhIK70K7P
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10785
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
266KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=171, productName=VS2010 build 30319, version=30319,
count=8, id=158, productName=VS2010 build 30319, version=30319,
count=56, id=170, productName=VS2010 build 30319, version=30319,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=2, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
[DemonArchives]54b9e4e56454226484e80fd01ca03131.exe
- IMPHASH 8abecba2211e61763c4c9ffcaa13369e
- SHA256 2f04032d41572a957bab7fcb8f2162af3497e6433d1f3ee196aee53e5ef1b85f
- MD5 54b9e4e56454226484e80fd01ca03131
- SHA1 4fe51686f1184796896952a837006d6a71973c59
- SHA512 4b401335e5e3e6ee409e44b6cef18023a2c70459fdab52f877e4b60793f9fc2a47551fa9ffc93f754fd4d0a1642fb8cfcc60ef8e79a7a71c0fc29b2c21324c66
- SSDEEP 6144:AonzSJT/4DO/B52pRr3zmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jJ:XnOJj4DO/B52nZP5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8496
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mfc42
ord2770
ord356
ord2781
ord4058
ord3181
ord2764
ord1980
ord668
ord926
ord924
ord941
ord4129
ord537
ord540
ord6282
ord825
ord6283
ord5683
ord5710
ord858
ord800
ord535
ord859
msvcrt
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_beginthread
rand
fgetc
fputc
fwrite
rename
fopen
fseek
fread
fclose
_stat
__CxxFrameHandler
_mbscmp
kernel32
GetCurrentThread
GetCurrentProcess
SetPriorityClass
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
GetFileAttributesA
DeleteFileA
SetFileAttributesA
GetSystemDirectoryA
WaitForSingleObject
CreateProcessA
Sleep
GetLogicalDrives
GetModuleHandleA
GetStartupInfoA
SetThreadPriority
user32
LoadIconA
MessageBoxA
shell32
ShellExecuteExA
SHChangeNotify
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=6, id=19, version=8034,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=74, id=1, productName=Unmarked objects,
count=3, id=4, version=9782,
count=3, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
[DemonArchives]9a4605cedcda1924728fbe58d429915f.exe
- IMPHASH 26babd76bbb7f9c516a338b0601b4c9f
- SHA256 09f8125958d3ce3b61ee0dea070ddb56c68c0fe00aa390f978aa9eab17c79e68
- MD5 9a4605cedcda1924728fbe58d429915f
- SHA1 eac143f67589a900234876fb0e5c2df34e76412e
- SHA512 af85eb441e8cc8adcd641cb974320b870ce5ac9e2ed642dbbfba34de548548a32e4e02e30d8e0e62cb11d7b3d4bf04e17d1e5b4fa8162868498a508c4ede6784
- SSDEEP 12288:2OjlYV9qtyWUedCv2EpV6yYPaNFZpV6yYPo:24l89fWUSAWQZWo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
htonl
htons
inet_addr
ioctlsocket
listen
recv
select
send
socket
ole32
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
gdi32
GetStockObject
DeleteObject
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
_itoa
__GetMainArgs
_sleep
_strcmpi
_stricmp
atoi
exit
memcpy
memset
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ajelhf
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
lPOCqABm
Size
5KB
Virtual Size
4KB
Characteristics
Name
yARqkWQr
Size
2KB
Virtual Size
1KB
Characteristics
Name
qUjjudvo
Size
6KB
Virtual Size
5KB
Characteristics
Name
efsAfkwy
Size
2KB
Virtual Size
2KB
Characteristics
Name
HsBbJtJx
Size
2KB
Virtual Size
1KB
Characteristics
Name
vPGHfwSD
Size
512B
Virtual Size
215B
Characteristics
Name
vCpwFSDL
Size
106KB
Virtual Size
105KB
Characteristics
Name
YKgLLlzh
Size
2KB
Virtual Size
1KB
Characteristics
Name
KSmeDRAK
Size
7KB
Virtual Size
7KB
Characteristics
Name
yphQIOrR
Size
2KB
Virtual Size
1KB
Characteristics
generic
[DemonArchives]a2113a088085d07d2d7688ab2b0914d3.exe
- IMPHASH c2a87fabf96470db507b2e6b43bd92eb
- SHA256 a55fe6993340d8be732d319c53e0605173924f3496b139d17804802e4b2c8bbb
- MD5 a2113a088085d07d2d7688ab2b0914d3
- SHA1 d782d1f3fac232b34cdde024b8bbfe2284f7ffe6
- SHA512 8e5620596d0a998ecefd01a7ac37925590f5c327952d8da209a3a6d27f602cd673777740cc39a83ddab522752e346aeb59d0845319d47ed848ce9c773ee97cd5
- SSDEEP 6144:pBQmrW2tgBdgzDEXE6NJsjwszqjwszeXwNJsjwszIjwszeXtjwszeXm:pBdc8sajMjejCjaj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
200704
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ole32
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
gdi32
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
advapi32
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
__GetMainArgs
_sleep
_stricmp
atoi
exit
memcpy
memset
printf
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
vsprintf
msvcrt
_wgetcwd
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfcd
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.l1
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
mjiYUxKf
Size
6KB
Virtual Size
6KB
Characteristics
Name
smOHOzbZ
Size
48KB
Virtual Size
47KB
Characteristics
Name
fuYLhSwW
Size
12KB
Virtual Size
11KB
Characteristics
Name
ZVBUlnNb
Size
2KB
Virtual Size
1KB
Characteristics
Name
yNehYqPw
Size
2KB
Virtual Size
1KB
Characteristics
Name
sQZaQtqi
Size
512B
Virtual Size
434B
Characteristics
Name
MoOQzups
Size
7KB
Virtual Size
6KB
Characteristics
Name
rUJLTuoJ
Size
4KB
Virtual Size
3KB
Characteristics
Name
QjRftias
Size
199KB
Virtual Size
198KB
Characteristics
Name
eApXcLKc
Size
6KB
Virtual Size
5KB
Characteristics
generic
[DemonArchives]aa18a0770ed7d03bddfb00e126fbbba5.exe
- IMPHASH 62ec3dce1eba1b68f6a4511bb09f8c2c
- SHA256 f22e843420fcffffc6b326d0118c0c909546e851a60e85b67e54dfdbac74dedd
- MD5 aa18a0770ed7d03bddfb00e126fbbba5
- SHA1 937eaa6a706491848d08e8dd5754819a21643719
- SHA512 5b4b7560937a33aa7f1c31fee21db306ff14bd33cddf833ce354dcae8d5cba753feb8ad82bccae5ffdd80df214f344efd8704aae69e76fb248a176462a029de8
- SSDEEP 6144:V9OfIvx7qP+o9vPHOVd2/UZdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cj:VAU7cHXSRrgryg426RQagrkj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
196608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ole32
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
gdi32
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
advapi32
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
__GetMainArgs
_sleep
_stricmp
atoi
exit
memcpy
memset
printf
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
vsprintf
msvcrt
memchr
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.kofbl
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.l1
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
EfKOrkCl
Size
3KB
Virtual Size
2KB
Characteristics
Name
NYEYokHq
Size
39KB
Virtual Size
38KB
Characteristics
Name
XNFmhLlC
Size
26KB
Virtual Size
25KB
Characteristics
Name
mEeCLDNi
Size
4KB
Virtual Size
4KB
Characteristics
Name
xFQhobok
Size
1024B
Virtual Size
696B
Characteristics
Name
XlxmWjPM
Size
512B
Virtual Size
353B
Characteristics
Name
ijIVuFmU
Size
20KB
Virtual Size
19KB
Characteristics
Name
XeKGUSWD
Size
4KB
Virtual Size
4KB
Characteristics
Name
ePvxxogy
Size
512B
Virtual Size
56B
Characteristics
Name
cijMsNNH
Size
6KB
Virtual Size
5KB
Characteristics
generic
[DemonArchives]ac7cf64a560bda15c281c43780b8d5bb.exe
- IMPHASH 26babd76bbb7f9c516a338b0601b4c9f
- SHA256 7b8c5eb7df9f7235af19cbcf5d00d5945eea155032200ba421095dfda77b4a57
- MD5 ac7cf64a560bda15c281c43780b8d5bb
- SHA1 ad0ef6ef2bc2566014dcb3f4e003afb13ea000fd
- SHA512 a0b92facc10e0f20bab202393339e088160694449be8ad840784be7c0eb6b81ed5527885512ebdc2903f096bb3c84e1b4396fad3b5c6d14bd6ed58272cfe7649
- SSDEEP 6144:nZENBxOFM6234lKm3mo8Yvi4KsLTFM6234lKm3pT11Tgkz1581hW:3FB24lwR45FB24lzx1skz15L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
htonl
htons
inet_addr
ioctlsocket
listen
recv
select
send
socket
ole32
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
gdi32
GetStockObject
DeleteObject
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
_itoa
__GetMainArgs
_sleep
_strcmpi
_stricmp
atoi
exit
memcpy
memset
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ajelhf
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
[DemonArchives]af6fb7fbf240ae2f6490766919b26325.exe
- SHA256 862eb8913c23ba5677c8263f1d4196a98668990eb4a9549a211a56e39df0f29c
- MD5 af6fb7fbf240ae2f6490766919b26325
- SHA1 7db749d16a09da11159a977a3984362a8e7ec5a6
- SHA512 510bee24e2ea35bc7380cb17f39717666b4ded4b905a2619b3612897e3a09fbd478be3d61fca5bd423797051280d43d9d5c5854c3b5c508066ded4e3a7349154
- SSDEEP 12288:kQoKT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:kQr9XvEhdfJkKSkU3kHyuaRB5t6k0IJm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ajelhf
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
[DemonArchives]b09a0cd1c32edf39308043eed7889449.exe
- IMPHASH 62ec3dce1eba1b68f6a4511bb09f8c2c
- SHA256 749cbb97fc4049f021acb18c42e0845361a2a7d7fae50f3c9fe9aba87bbf492f
- MD5 b09a0cd1c32edf39308043eed7889449
- SHA1 f7d71b9e34e82a4514574952b118581e9c27da6a
- SHA512 d1d1f7178a7961711d0c9145ff498ca5f77b6f751705c7681b88ad308279dd455e167975abf52bbda398f5d500689281b72df034b3f8820fad5976068135fcdb
- SSDEEP 6144:kz2Y30jAWRD2jvosK6mUzW96mFBuRFzWlH:YCLx67u6quRFzWlH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
196608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ole32
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
oleaut32
SysAllocString
wininet
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
kernel32
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
user32
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
gdi32
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
advapi32
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
crtdll
__GetMainArgs
_sleep
_stricmp
atoi
exit
memcpy
memset
printf
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
vsprintf
msvcrt
memchr
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.kofbl
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.l1
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
[DemonArchives]b1d6b726bf6ac63749e5eba6b5c7694c.exe
- IMPHASH d321d21d32e96638b07768beb0741790
- SHA256 8ffef1554685604bf346da838d7d7477f9a9eecec52ce86a29e5db6c5cf6cc75
- MD5 b1d6b726bf6ac63749e5eba6b5c7694c
- SHA1 277f12fb1583b2996f67dd8276df3f5db79cd1a6
- SHA512 62d271e31c9bd3fcc1708202d636ae3635afc1b922d048cdfe41c0f2fe509d2ba8c7f3586c1738a6ee7bfd8dce0910496104177b4239218d9c9960386e64d362
- SSDEEP 6144:pzwArTEDSCs5wL0DKlpn/URBudL7qRBpkvfsModogZ/SvnDTH9QRO:pMmQDSCs5wo0e8L7qRbQUugennHGO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
42687
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CreateEventW
Sleep
GetTickCount
GetSystemDirectoryW
CreateFileW
DeviceIoControl
ReadFile
GetTempPathA
GetModuleFileNameA
CreateFileA
WriteFile
CreateThread
MultiByteToWideChar
ExitProcess
GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
GetFileSizeEx
SetFileAttributesW
GetLastError
SetFilePointer
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
WideCharToMultiByte
CloseHandle
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
OpenEventW
DeleteFileW
GetFileAttributesW
GetTempPathW
GetModuleFileNameW
LoadLibraryA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapSize
FlushFileBuffers
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetModuleHandleA
GetVersionExW
HeapAlloc
HeapFree
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
user32
LoadCursorW
RegisterClassExW
CreateWindowExW
DefWindowProcW
LoadStringW
LoadIconW
wsprintfW
PostQuitMessage
EndPaint
BeginPaint
advapi32
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
shell32
ShellExecuteW
ShellExecuteA
ws2_32
WSAStartup
htonl
gethostbyaddr
socket
gethostbyname
inet_addr
htons
connect
closesocket
send
recv
WSAGetLastError
iphlpapi
GetAdaptersInfo
Name
.text
Size
364KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=50, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=22, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=141, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=147, id=1, productName=Unmarked objects,
count=6, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
[DemonArchives]b3c170550a1efdf268632916e95ad1ec.exe
- SHA256 f0add0560585cc43f7f5b6d538cd293a06e6e7cc2367b79ad9bffa39a3c20637
- MD5 b3c170550a1efdf268632916e95ad1ec
- SHA1 22fbb9a132f0535d7ec18981f2bc573802fb714f
- SHA512 be4af3dfeae639d1bf746825a5a66e34606d141964983c857e78ca54223e3b5fb1233b1a4da2dd64dbfce1e74c52ba86e6cf4b57e1a764160ca0b0439f2567f6
- SSDEEP 12288:reK06t3XGCByvNv54B9f01ZmHByvNv5imipWf0Aq:rg6t3XGpvr4B9f01ZmQvrimipWf0Aq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.text
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
[DemonArchives]b83b3408e6ade0a5c61c5870208000ae.exe
- SHA256 13e98d38990b7a1891123acc6b118f3ad99ae2ef56951708efbf28f631b74b46
- MD5 b83b3408e6ade0a5c61c5870208000ae
- SHA1 7115cde4432a9c08c8258e628dbfb58c7ebe30d3
- SHA512 3bdd7624b24ebbae887d1a095c48f3646277210b0cfaea6b6f1b592b574fd5fe4a6919b120681f37f256185dddbe8f809cec9e6ed98cdcde6a77daca6fc97994
- SSDEEP 12288:V4xGIbcT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:VxyU9XvEhdfJkKSkU3kHyuaRB5t6k0Io
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ajelhf
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ