blankgrabber | infected2024071401[.]zip

resource	yara_rule
static1/unpack002/1�L�iŚ.pyc	blankgrabber

resource
unpack001/Downloads/1PDF.FaturaDetay_202407.exe
unpack001/Downloads/3e6642f7100bb72137d68b5aa34a2d1f1a75722ab7d2b15987bbdeb84bc3265e.exe
unpack001/Downloads/4c40337094cf0bb86fad86d2ea724ac6e6a499f0acd877839a69d35c354a7792.exe
unpack001/Downloads/644d928a4a942f6ae4c90640103b595941f7a0b557ba49d122d137b1429c0325.exe
unpack001/Downloads/64ec6562b96016699c6ae14166f4d31bde2b160eaa84d34a661fc2943017202e.exe
unpack001/Downloads/7a0395c75ac633d66a7a9f2690cbdb9c90ac5b0fc4f9273b6e0cf16f70eedd8e.exe
unpack001/Downloads/901478668c0d5ecb3b5044dcb3e1744045f7b2a800a7c0c67020d9294470f3d4.exe
unpack001/Downloads/938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe
unpack001/Downloads/96d1bc7dec91a7a4e5fe653853a504e07d17e898fa437cf75e929fa909dd6bb7.exe
unpack001/Downloads/DTLite.exe
unpack001/Downloads/PDF.FaturaDetay_202407.exe
unpack001/Downloads/PDF.exe
unpack001/Downloads/SIP.03746.XSLSX.exe
unpack001/Downloads/a33245a27c02bbb72bf66f6bf1c960affefa8ed2a096dc1d6faa6699fe81c48a.exe
unpack001/Downloads/arwbjuh.exe
unpack001/Downloads/bjutbht.exe
unpack001/Downloads/borlndmm.dll
unpack001/Downloads/ccleaner.exe
unpack001/Downloads/d87e2dcd2eb9763552645a34218696143fa99ac7b5173dcd04889ce9f5ddf96d.exe
unpack001/Downloads/dwvhgtd.exe
unpack001/Downloads/file.exe
unpack001/Downloads/setup.exe

infected2024071401.zip

SHA256 004c59e17178ebbc86da08ea93eb39064a86f5d1be7c18d330c15f80dde8504b
MD5 c0d08dfc184fecc0836a0810f52d3e79
SHA1 beb3320f6251753a7f4b8657e8566b7ee6c79627
SHA512 da8ad599d16144d4584a506c699535bd5612668b3a3fce6e510ab9793ad4c5aff1d72031b313cc41a3dd51e82525e20802fdbac3e3b4532d351f472c9dacb94c
SSDEEP 1572864:qYAaD7qWBjRALvO9aoSquWqH99eiomhvWAB7LrKTC:qpaHqW1RqvqF/uWqdno8F5
MD5 SHA1 SHA512 SSDEEP

Password

infected

Downloads/1PDF.FaturaDetay_202407.exe

SHA256 f5d96127b34730cf3bbbccd1c35098873fc0af897cc5d6dc3dd39a8e64c511d7
MD5 d8bf792f818877bf4848fde9511caeb8
SHA1 a8aea1abb7cf1ddb275584bb5746c97790342e80
SHA512 28292c32d518cecb66ef0a41f583022b6c125ae758fb013dd51896c25625cc23da2a8604d794e2198939f994d15bec09d9b67003bc5bd734d27b15b167e1ebe4
SSDEEP 6144:CZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6BLtsorUC7ggXpTILMYSQpIIQENMshQt:kANwRo+mv8QD4+0V161tTNjkIIFN5c
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

152680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

8B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Downloads/3e6642f7100bb72137d68b5aa34a2d1f1a75722ab7d2b15987bbdeb84bc3265e.exe

IMPHASH f7da029034c60bf8e581bd25aede6122
SHA256 3e6642f7100bb72137d68b5aa34a2d1f1a75722ab7d2b15987bbdeb84bc3265e
MD5 0475d0b51b30bf28599601243c9a9aae
SHA1 7adf31fb8aaa01d94531f9e058e33877e0141ccf
SHA512 92167276fc1688239f252a7101c2082ce6cd1f65f30de3b9b33a22d2fcd58a542faecf308d67c719756b4b504247c1588d159120439d1d2ef1a47612575192d6
SSDEEP 24576:7DseOujx71gWufN62I520/hjlB6iTzKFjiZpWFsZrKp0HqGmyejFykKu9XusD4eq:7DjxSNudSOZpW+wG8nXv0eq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

gdi32

GetBitmapDimensionEx GetMapMode LPtoDP SetBitmapDimensionEx GetBkMode CreateFontIndirectW CreateSolidBrush Escape ExtTextOutW FillRgn DPtoLP SetBrushOrgEx CreatePatternBrush CreatePen GetCurrentObject CreateFontW GetDeviceCaps FillPath EndPath BeginPath GetBkColor RectVisible FrameRgn CreateRoundRectRgn TextOutW GetDIBColorTable StretchBlt GetObjectW SetDIBColorTable DeleteObject CreateDIBSection DeleteDC GetTextExtentPoint32W CreateCompatibleBitmap SelectObject BitBlt PtVisible CreateCompatibleDC

shell32

ord43 ShellExecuteW SHGetSpecialFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW Shell_NotifyIconW ord165 SHGetSpecialFolderLocation CommandLineToArgvW ord701 SHGetDesktopFolder ord716 SHFileOperationW

shlwapi

PathIsDirectoryW StrFormatByteSizeW SHGetValueW SHSetValueW PathIsNetworkPathW PathFindExtensionW StrFormatKBSizeW ord354 PathFileExistsW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

Downloads/4c40337094cf0bb86fad86d2ea724ac6e6a499f0acd877839a69d35c354a7792.exe

IMPHASH 417c80dfdc5a9cae821cfd89fd8aeffb
SHA256 4c40337094cf0bb86fad86d2ea724ac6e6a499f0acd877839a69d35c354a7792
MD5 05b8f1d7c18fe35533949d3b3ae5c726
SHA1 581171a5941b4231548331b16b2342b50616dd23
SHA512 f0effe37b6097d286ba67f44da82847a56c0b933166bb4904cc75db074ad11152bd06b80733c927e55ddac84a335ff764ac8cf3d5eccdd11079f2e0162476ea5
SSDEEP 49152:ob33xSNudSRZpWod7tOvJOHdi1PXdFs0KinlZ4PCLRn:ooRRt6udqr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

Downloads/644d928a4a942f6ae4c90640103b595941f7a0b557ba49d122d137b1429c0325.exe

IMPHASH 4f8bf7b275c4aa8b55735ab2c9f76fc4
SHA256 644d928a4a942f6ae4c90640103b595941f7a0b557ba49d122d137b1429c0325
MD5 771eade8ae168734077830344b852624
SHA1 5ac6b79a426a3229adef67508b751815af689f86
SHA512 ec70c99c9c0f608abd25ad614488c5a8adf7170aa29a4204efa5e7d03c0a50a55fdabbbf5758a4a24f9542fd264e98c05b28e99082e5775ca4b3d13614eef3b6
SSDEEP 24576:N2bLgxjx71gWufN62I520/hjlB6iTzKFMiZpWht5YY7tOvkIOTpNsVOt1a42oU+D:NYQxSNudS5ZpWNd7tOvJONNdMboMToL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

gdi32

GetBitmapDimensionEx GetMapMode LPtoDP SetBitmapDimensionEx GetBkMode CreateFontIndirectW CreateSolidBrush Escape ExtTextOutW FillRgn DPtoLP SetBrushOrgEx CreatePatternBrush CreatePen GetCurrentObject CreateFontW GetDeviceCaps FillPath EndPath BeginPath GetBkColor RectVisible FrameRgn CreateRoundRectRgn TextOutW GetDIBColorTable StretchBlt GetObjectW SetDIBColorTable DeleteObject CreateDIBSection DeleteDC GetTextExtentPoint32W CreateCompatibleBitmap SelectObject BitBlt PtVisible CreateCompatibleDC

advapi32

RegEnumKeyW RegOpenKeyW GetUserNameW StartServiceW QueryServiceStatus CloseServiceHandle OpenServiceW OpenSCManagerW RegQueryInfoKeyW RegQueryValueExW RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegEnumValueW RegSetValueExW RegCloseKey

shell32

ord43 ShellExecuteW SHGetSpecialFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW Shell_NotifyIconW ord165 SHGetSpecialFolderLocation CommandLineToArgvW ord701 SHGetDesktopFolder ord716 SHFileOperationW

comctl32

InitCommonControlsEx FlatSB_EnableScrollBar _TrackMouseEvent

shlwapi

PathIsDirectoryW StrFormatByteSizeW SHGetValueW SHSetValueW PathIsNetworkPathW PathFindExtensionW StrFormatKBSizeW ord354 PathFileExistsW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

Downloads/64ec6562b96016699c6ae14166f4d31bde2b160eaa84d34a661fc2943017202e.exe

IMPHASH e8e837d2e90b52e232aba88021bc9c99
SHA256 64ec6562b96016699c6ae14166f4d31bde2b160eaa84d34a661fc2943017202e
MD5 2c9b6dd3a6026fa2c7db268eaea331df
SHA1 fb4c9fe50dfc133895929a96f1f43047a4ced8dd
SHA512 899728690f636ab34e440eb1add2abd16dc3e286fd51608b2d41531ca8c00d79925e8565622185bd35e8cdc0d0c6a1a5c001c4faeba2c36e593f96cde7128856
SSDEEP 24576:ZDgcvIjx71gWufN62I520/hjlB6iTzKFjiZpWOsZrKp0HqGmyejFyogd23TZdG35:ZDFExSNudSOZpWfwG8Xd3Vkk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

shell32

ord43 ShellExecuteW SHGetSpecialFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW Shell_NotifyIconW ord165 SHGetSpecialFolderLocation CommandLineToArgvW ord701 SHGetDesktopFolder ord716 SHFileOperationW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

Downloads/7a0395c75ac633d66a7a9f2690cbdb9c90ac5b0fc4f9273b6e0cf16f70eedd8e.exe

IMPHASH 4f8bf7b275c4aa8b55735ab2c9f76fc4
SHA256 7a0395c75ac633d66a7a9f2690cbdb9c90ac5b0fc4f9273b6e0cf16f70eedd8e
MD5 1e96a6d78465dceadfaedf2c8200a6de
SHA1 8f4569d6233bb9ba161a68527ee9b8e8c04a63bb
SHA512 7a920008616f6b2a2c7abfd272b2e22c471dd68b5d9d6c8bcbb521bb26173d8e06fc0b291964205cdc9347dd6a946fcd2239a8d0ca67bd1adaa0eaeae1722127
SSDEEP 49152:j1YhxSNudS5ZpW5d7tOvJOpE8BIMXxl4IPTRUN33eFvlux4NuAIBq6As/qZrUFju:BYm5Et6OEVS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

gdi32

GetBitmapDimensionEx GetMapMode LPtoDP SetBitmapDimensionEx GetBkMode CreateFontIndirectW CreateSolidBrush Escape ExtTextOutW FillRgn DPtoLP SetBrushOrgEx CreatePatternBrush CreatePen GetCurrentObject CreateFontW GetDeviceCaps FillPath EndPath BeginPath GetBkColor RectVisible FrameRgn CreateRoundRectRgn TextOutW GetDIBColorTable StretchBlt GetObjectW SetDIBColorTable DeleteObject CreateDIBSection DeleteDC GetTextExtentPoint32W CreateCompatibleBitmap SelectObject BitBlt PtVisible CreateCompatibleDC

advapi32

RegEnumKeyW RegOpenKeyW GetUserNameW StartServiceW QueryServiceStatus CloseServiceHandle OpenServiceW OpenSCManagerW RegQueryInfoKeyW RegQueryValueExW RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegEnumValueW RegSetValueExW RegCloseKey

shell32

ord43 ShellExecuteW SHGetSpecialFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW Shell_NotifyIconW ord165 SHGetSpecialFolderLocation CommandLineToArgvW ord701 SHGetDesktopFolder ord716 SHFileOperationW

comctl32

InitCommonControlsEx FlatSB_EnableScrollBar _TrackMouseEvent

shlwapi

PathIsDirectoryW StrFormatByteSizeW SHGetValueW SHSetValueW PathIsNetworkPathW PathFindExtensionW StrFormatKBSizeW ord354 PathFileExistsW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

Downloads/901478668c0d5ecb3b5044dcb3e1744045f7b2a800a7c0c67020d9294470f3d4.exe

IMPHASH 417c80dfdc5a9cae821cfd89fd8aeffb
SHA256 901478668c0d5ecb3b5044dcb3e1744045f7b2a800a7c0c67020d9294470f3d4
MD5 6c155f7b7d10fffc7a31ce4eb5d3a1f8
SHA1 f3483275258b30ab963e672656fd9aaebe814877
SHA512 5a1a94c2b63a683a5281b05b998b5b35a215bab2cc47c74f332783a78a5de107f8bb15ca3c006e1672f4ab4918376f09769fa028a172b68a6ded814e4be0ed65
SSDEEP 49152:qb33xSNudSRZpWXd7tOvJOodL1PXdFs0Ki3lZ4/yARne:qoR2t6ld1Ln
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

Downloads/938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe

IMPHASH e8e837d2e90b52e232aba88021bc9c99
SHA256 938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598
MD5 c318036044f10d288cedac36d81a611b
SHA1 442245535cd0c4876f784a28fdbf6a32bb70e220
SHA512 6043678915f0893b3fbca5633dc1effe2e27d0f25eb1da413b14b93aa4204334b8792fee3e67bbfc905cc0130748afbec6fc6aaf834fe7c168a430bd06d769da
SSDEEP 24576:MDXpgvsPjx71gWufN62I520/hjlB6iTzKF+iZpWWt5YY7tOvkIOTUQvb7Mhh21:MDevYxSNudSrZpWKd7tOvJOpb7K81
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

shell32

ord43 ShellExecuteW SHGetSpecialFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW Shell_NotifyIconW ord165 SHGetSpecialFolderLocation CommandLineToArgvW ord701 SHGetDesktopFolder ord716 SHFileOperationW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

Downloads/96d1bc7dec91a7a4e5fe653853a504e07d17e898fa437cf75e929fa909dd6bb7.exe

IMPHASH 417c80dfdc5a9cae821cfd89fd8aeffb
SHA256 96d1bc7dec91a7a4e5fe653853a504e07d17e898fa437cf75e929fa909dd6bb7
MD5 793083dde2eea5178604a08fb09da307
SHA1 95934b5ce27e6e6460e0eb4d6f6d43f5ee152fde
SHA512 94cf4786a639eca98bfaf553349afae0bd68a905fe73b423399ed3a728aa572baabb08040ca778fc4bb24ce26d3deaf1cb6649e1a674570b0dfb98b205049b5c
SSDEEP 49152:b3BxSNudSRZpWid7tOvJOu1LhCvV1iSvz6qHtBnP8x1NABnNm6z+EknpBASLKbiu:aRrt62T
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

Downloads/Built.exe

IMPHASH 456e8615ad4320c9f54e50319a19df9c
SHA256 92118eac9bf1f5e9cf45e2773f74163202f609125e8f0aa0a077446e6f1cd4d1
MD5 bf496771139b8b76ab7e2e3813ce78a3
SHA1 949686fc9af5710904902044e92b0397b337d814
SHA512 ce9ab86130380ffc378ae3cd14c67c94f6034631821392aba9c8946eec07591311e7942b45cfe2dacfcae6cfe73495937be9b81790ea66824c3212fcb9cd3bc2
SSDEEP 786432:8Nz4CWGpXkqva096PzXf4mWy1DlIF1qqHdbrtTqslFEO:IkCWGJ446rPu/FQqjqwFd
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

44:06:5b:e5:1c:09:03:a4:f9:aa:3e:fb:5f:15:73:59:c5:9d:52:19:ad:35:c0:49:44:4e:a4:a5:8d:4e:65:5d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Chains

Apr 25, 2023

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Serial Number

bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 29, 2021 - Sep 28, 2024

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

49360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetCurrentDirectoryW GetOEMCP GetCPInfo GetModuleHandleW MulDiv GetLastError FormatMessageW GetModuleFileNameW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW GetEnvironmentStringsW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle WaitForSingleObject Sleep GetCurrentProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LoadLibraryExW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile DeleteFileW IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

1�L�iŚ.pyc

SHA256 aa18b36e8260dbfaffe4191216319556ae73c8654f358315aba43e87a9193317
MD5 0d05ea9df13972dc4ded98244e029da4
SHA1 439cc2f447bc7a5ea554279491664e0ba699333d
SHA512 5217184928a86a04b8ce4f5380882ff49ac5aa4bdcbf70090abe8be479038806e5aabcf7fc2c65d35662c77c1776233c90f09a4ff3c41061f981f68db63b778f
MD5 SHA1 SHA512

A stealer written in Python and packaged with Pyinstaller

Downloads/DHL_PT563857935689275783656385FV-GDS3535353.bat

SHA256 b66081b0e5dfe21e03d1043700d7c05e65bda96ad33a6370c374217d5ae84405
MD5 60186cd9a2e82835bc143c1fb4662b7e
SHA1 880c7f14743f9759b30bcc28085949122f54c20e
SHA512 98ca66c502178601cf1d568fb4b5ef122564f548eae2c82c9979207ea69398212f2b35571f3cc0696ec9edb70174a016c00ddd12fc26140d63196188e6f0f8b7
SSDEEP 192:jOJVeUYLAKLt+IS0y+80TJco4Ga5y0p8te:QeAKZZS280FL3aw0aE
MD5 SHA1 SHA512 SSDEEP

Downloads/DTLite.exe

IMPHASH 4f8bf7b275c4aa8b55735ab2c9f76fc4
SHA256 fb26dcd89930afef0012125087704a3564d8ef0a37c3c6c021b42071ad273ceb
MD5 684de18cccab7719057cd4bbfbee16c3
SHA1 a7b956a4aca4624fb466a932d49fb3268a42b7e2
SHA512 a06aefaf05f3011daeb65a34a773e920b868078c3c104982546a6d5a75c3da11cf9988adb1d595264d8d3cf78f340bae2d8242ca3e6090d72e2fce747c7176cb
SSDEEP 49152:/1YhxSNudS5ZpWBd7tOvJOUUFBIMXxl4IPTRUN33eFvlux4NuAIBq6As/qZrUFjk:dYm54t6rUOSW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

gdi32

GetBitmapDimensionEx GetMapMode LPtoDP SetBitmapDimensionEx GetBkMode CreateFontIndirectW CreateSolidBrush Escape ExtTextOutW FillRgn DPtoLP SetBrushOrgEx CreatePatternBrush CreatePen GetCurrentObject CreateFontW GetDeviceCaps FillPath EndPath BeginPath GetBkColor RectVisible FrameRgn CreateRoundRectRgn TextOutW GetDIBColorTable StretchBlt GetObjectW SetDIBColorTable DeleteObject CreateDIBSection DeleteDC GetTextExtentPoint32W CreateCompatibleBitmap SelectObject BitBlt PtVisible CreateCompatibleDC

advapi32

RegEnumKeyW RegOpenKeyW GetUserNameW StartServiceW QueryServiceStatus CloseServiceHandle OpenServiceW OpenSCManagerW RegQueryInfoKeyW RegQueryValueExW RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegEnumValueW RegSetValueExW RegCloseKey

shell32

ord43 ShellExecuteW SHGetSpecialFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW Shell_NotifyIconW ord165 SHGetSpecialFolderLocation CommandLineToArgvW ord701 SHGetDesktopFolder ord716 SHFileOperationW

comctl32

InitCommonControlsEx FlatSB_EnableScrollBar _TrackMouseEvent

shlwapi

PathIsDirectoryW StrFormatByteSizeW SHGetValueW SHSetValueW PathIsNetworkPathW PathFindExtensionW StrFormatKBSizeW ord354 PathFileExistsW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

Downloads/PDF.FaturaDetay_202407.exe

SHA256 7a285458817660143004002c76b1e1457666b1659dfbd35863541f62630430d0
MD5 3a2ba5be087162cfdb5d49ac32edd534
SHA1 879043e2954c4cf7f461c1381ae2a943d71bbaef
SHA512 ba8dba7d1cd39b00cf6ee894809b1c09a3f72484d6dafb4ff2b2663d29247baf0565dfc3e4f0bcccb78138ffca59e9c56579485244d00f5b1bc69cfedb1c024a
SSDEEP 6144:CZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6BLGx1d0RjzV5Pnz63LLHBNy:kANwRo+mv8QD4+0V16xblLPkLLhNy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

152680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

8B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Downloads/PDF.exe

IMPHASH 7182b1ea6f92adbf459a2c65d8d4dd9e
SHA256 ff9b39d07fd6e4a7f98d109664d91de9e318671da6412da85396541722d92799
MD5 34c2047d0b69ba023b700c21431accc0
SHA1 e34c28611707c81565cb73d8a1a46dfc3ab2495a
SHA512 a1566d65beb8135edfcb5c4a09631bc17dff56db672621990a10d0eff37a0290c7e1e9705f1918a7e719cbea4b1cecc29bb8254da946108e9bd5432070cc8ca7
SSDEEP 6144:VbJhs7QW69hd1MMdxPe9N9uA0hu9TBrjJ0Xxne0AqGLj:VbjDhu9TV6xeJqG3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcrt

memset wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc

kernel32

GetModuleHandleW HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetShortPathNameW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetProcAddress GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess RtlLookupFunctionEntry RtlVirtualUnwind RemoveVectoredExceptionHandler AddVectoredExceptionHandler HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject

shell32

ShellExecuteExW SHGetFolderLocation SHGetPathFromIDListW

winmm

timeBeginPeriod

ole32

CoInitialize CoTaskMemFree

shlwapi

PathAddBackslashW PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW

user32

CharUpperW CharLowerW MessageBoxW DefWindowProcW GetWindowLongPtrW GetWindowTextLengthW GetWindowTextW EnableWindow DestroyWindow UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled GetSystemMetrics CreateWindowExW SetWindowLongPtrW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos

gdi32

GetStockObject

comctl32

InitCommonControlsEx

Downloads/SIP.03746.XSLSX.exe

SHA256 a94869345f7f1f3a1bc6cca4aa94cc7bde30dcb0bb18198567ea58cc93ba2c15
MD5 a3e681364daaa68ce0177581573f483f
SHA1 eefb4725622f42019e475aa26439c0cf60dc7cc2
SHA512 a071ae229d39674e53cf0051bde78b792041064a90580ab4ef51c4bec8dd4e7cc19934a3249e45df20cf3bc1aa76b28ba04f954eda9767acd2aa2092c606949b
SSDEEP 6144:RZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6oHGx1d0RjzV5Pnz63LLHBN+:PANwRo+mv8QD4+0V16oHblLPkLLhN+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

152680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

8B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Downloads/a33245a27c02bbb72bf66f6bf1c960affefa8ed2a096dc1d6faa6699fe81c48a.exe

IMPHASH e8e837d2e90b52e232aba88021bc9c99
SHA256 a33245a27c02bbb72bf66f6bf1c960affefa8ed2a096dc1d6faa6699fe81c48a
MD5 2121a055e132df9c2b62d3ad578faa85
SHA1 60439cb5d41f2256eb54bbd1d84d8d04d78272ef
SHA512 55039a343efd737a7488193f777ca0a44dc465f098e51241d8a0699478d72dda9f5eb8bb204e96cc81da14191475e1ff87132680ac4b5956cb1b85d06a4a6c71
SSDEEP 24576:kDLnN/pjx71gWufN62I520/hjlB6iTzKF+iZpWSsZrKp0HqGmyejFyzXYVN4on59:kDLn7xSNudSrZpWLwG8bvn59
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

shell32

ord43 ShellExecuteW SHGetSpecialFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW Shell_NotifyIconW ord165 SHGetSpecialFolderLocation CommandLineToArgvW ord701 SHGetDesktopFolder ord716 SHFileOperationW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

Downloads/arwbjuh.exe

IMPHASH 3e14c881bae1a3bb325eea058df0a11c
SHA256 60bda530b226d63299968670e256a9a2896ab69076e16792436e92f95bc0d0e0
MD5 2b292145e4ec28e8bd8b22c1353543d1
SHA1 d9b9d23b2c320efcaf54ddcba8b42540f3934aa0
SHA512 2b0cd9732b39fb99b37a0a67c091083e31989c9e41a2c9be6da8f3d10382d65d27a79968dc9c9abc55bf659d47898d17f9f4a6873a0046612ca76733cd50ca58
SSDEEP 3072:Dq3vlb4qEAkDhZdrTbLC9VZBjnNgRM6Fh:DybjEXFZd3C9VZ7eF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9679

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsBadStringPtrW SetEndOfFile LocalCompact CreateHardLinkA GetModuleHandleW EnumResourceTypesA LoadLibraryW ReadConsoleInputA IsBadCodePtr CreateEventA GetACP GlobalUnlock GetLastError SetLastError GetProcAddress AttachConsole CreateJobSet LoadLibraryA FindResourceA AddAtomW GetModuleFileNameA EnumResourceNamesA GetFileTime ReleaseMutex GetDiskFreeSpaceExW TerminateJobObject GetWindowsDirectoryW CheckRemoteDebuggerPresent CloseHandle CreateFileW FlushFileBuffers GetStringTypeW LCMapStringW LocalAlloc CreateFileA WriteConsoleW SetStdHandle HeapAlloc ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapFree WriteFile GetStdHandle GetModuleFileNameW HeapCreate ReadFile EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetOEMCP IsValidCodePage MultiByteToWideChar RtlUnwind HeapSize HeapReAlloc RaiseException

user32

GetMessageTime GetKeyboardLayout CharUpperBuffA SetCursorPos LoadMenuW GetCaretPos GetSysColorBrush GetSystemMetrics

advapi32

ClearEventLogW

ole32

CoUnmarshalHresult

Downloads/bjutbht.exe

IMPHASH 7cfb8286d8c232c7967a74ce74b78e07
SHA256 7e0623dbd4975ddc7790c45c9407527c048cb04727ddf757e70f7d5b702703fd
MD5 9442e7f51753f9ef3604a13e459334aa
SHA1 b8ecc6920c4fca9725fbc78d6684359c88b8224a
SHA512 5af0b0653245ebc1a1aac4cca90d2bb53b48bea25a8f104cbd3e410f1374ef86a578fc56b3c7d42fc9bb0a5b22db97b007805da72528c89dca575c8196361cce
SSDEEP 3072:lCHi6zfNNcKW0PNXiWIztAq/czUZrHFdOIMRsSHHi:lezVlPxbKpEqiHH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalCompact CreateHardLinkA GetModuleHandleW EnumResourceTypesA LoadLibraryW ReadConsoleInputA IsBadCodePtr CreateEventA GetACP GlobalUnlock GetLastError SetLastError GetProcAddress AttachConsole CreateJobSet LoadLibraryA LocalAlloc SetEndOfFile GetModuleFileNameA EnumResourceNamesA GetFileTime ReleaseMutex GetDiskFreeSpaceExW TerminateJobObject GetWindowsDirectoryW CheckRemoteDebuggerPresent CloseHandle CreateFileW FlushFileBuffers GetStringTypeW LCMapStringW FindResourceA IsBadStringPtrW AddAtomW CreateFileA WriteConsoleW SetStdHandle HeapAlloc ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapFree WriteFile GetStdHandle GetModuleFileNameW HeapCreate ReadFile EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetOEMCP IsValidCodePage MultiByteToWideChar RtlUnwind HeapSize HeapReAlloc RaiseException

user32

GetMessageTime GetKeyboardLayout CharUpperBuffA SetCursorPos LoadMenuW GetCaretPos GetSysColorBrush GetSystemMetrics

gdi32

GetCharWidthW

advapi32

ClearEventLogW

ole32

CoUnmarshalHresult

Downloads/black.bat

SHA256 8ea56b9b4f79485aedb615161ba64c55950a6970f21dc0f2a7691dd66de91cd2
MD5 1527117f206e85215dc0b306ff303997
SHA1 058297bbc06690c0fc1614a27dccab912acbfd01
SHA512 490de266e4516bee0cc6075ec693cbe53c629a1f9740df94951b780745ea67b452b96b6d4e413d9a144e2f853da4cbd0bfab86638440daf8cc7ac9a1269c4e4f
SSDEEP 192:9y/GNQigY2Nw9GKNCufevytXrrLe57YKRZ280QDdc28eNMqMzDWZ:9EGNrJzsKUufKytXr2OKH0Mi28eNMqM2
MD5 SHA1 SHA512 SSDEEP

Downloads/borlndmm.dll

IMPHASH dd6ba004004c70f4eb3bbd4c9ec97b28
SHA256 18a26f67712f75a9251e8350089fc83d55c33f2fa82c46e5f67f1d6dc5716a4a
MD5 eb6fad4894d0b420b92c00acda8122ae
SHA1 8be6dfa8e216d2f7b68f2ab05e63a78fa51374f6
SHA512 4cbaad723076f539788acca418dcc9234d0c9d2978978a855cd670a6ad2300ebe4bb28c35fc048494df30c9d76bead5b6aae1b26168e6e0b230d34ac8797202e
SSDEEP 49152:1MkOevf30HlhHRPErtXFqVn1P2Rt8fUaRMXA3IloTf7OFk/41NjwT7x7uFh1hz:kY1Un1P2Rt8fUaRMXkuwB7uF5z
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1367216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AdobePIM.pdb

msi

ord147 ord74 ord145

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW GetProcessImageFileNameW EnumProcessModules

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

shlwapi

PathIsFileSpecW PathAddExtensionW PathRemoveFileSpecA PathIsDirectoryA PathIsDirectoryEmptyW PathIsSystemFolderW PathIsRootW PathRenameExtensionW PathIsDirectoryW PathAppendW PathRemoveBackslashW PathStripPathW PathAppendA PathFileExistsW PathFindFileNameW PathRemoveFileSpecW PathFileExistsA PathRemoveExtensionW

shell32

ShellExecuteExW SHCreateDirectoryExW SHGetFolderLocation SHGetSpecialFolderPathW SHGetKnownFolderPath SHGetPathFromIDListW SHGetFolderPathW ord680 CommandLineToArgvW ord51 SHCreateItemFromParsingName

winhttp

WinHttpOpen WinHttpReceiveResponse WinHttpSetTimeouts WinHttpQueryHeaders WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpSetCredentials WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption

kernel32

TlsFree TlsSetValue TlsGetValue CompareStringW SwitchToThread InitializeCriticalSectionAndSpinCount GetStringTypeW EncodePointer TlsAlloc GetLocaleInfoW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwind InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetTimeZoneInformation ExitProcess GetStdHandle GetFileType IsValidLocale EnumSystemLocalesW GetConsoleMode ReadConsoleW GetConsoleCP FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW InitializeCriticalSectionEx GetLastError RaiseException DecodePointer DeleteCriticalSection ReleaseSemaphore CreateMutexW WaitForSingleObject LocalAlloc ReleaseMutex Sleep OpenSemaphoreW CloseHandle LocalFree GetCurrentProcessId CreateSemaphoreW CreateDirectoryW GetTempPathW MultiByteToWideChar SetEvent ResetEvent GetCommandLineW CreateProcessW GetLocalTime GetTimeFormatW GetDateFormatW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW FindFirstFileW FindNextFileW TerminateProcess RemoveDirectoryW FindClose SetEnvironmentVariableW SetFileAttributesW CreateEventW GetDiskFreeSpaceExW CreateThread CopyFileW lstrcmpiW lstrcmpW GetExitCodeProcess AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LockFileEx GetFileSize GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetCurrentProcess GetFileSizeEx lstrlenW GetACP SizeofResource GetModuleFileNameW LockResource LoadResource FindResourceW MoveFileExW GlobalAlloc GlobalFree VerSetConditionMask GetModuleHandleW VerifyVersionInfoW SetLastError DuplicateHandle ProcessIdToSessionId TerminateThread FindResourceExW lstrcpyW QueryFullProcessImageNameW SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetFileTime FileTimeToSystemTime OpenMutexW GetUserDefaultLCID LCMapStringW GetUserDefaultLangID GetUserDefaultUILanguage SetFilePointerEx ResumeThread SetStdHandle WriteConsoleW QueryPerformanceFrequency GetVersionExW CreateFileMappingW

user32

wsprintfW EnumWindows GetWindowThreadProcessId GetShellWindow

advapi32

InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid SetSecurityDescriptorDacl RegQueryValueExW FreeSid RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteKeyExW RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetNamedSecurityInfoW SetNamedSecurityInfoW LookupAccountSidW CreateWellKnownSid EqualSid GetTokenInformation DuplicateTokenEx GetUserNameW ConvertSidToStringSidW ImpersonateLoggedOnUser ConvertStringSidToSidW RevertToSelf CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoTaskMemFree CoInitialize CoCreateGuid StringFromGUID2 CLSIDFromProgID OleRun CLSIDFromString

oleaut32

SysStringLen VariantChangeType VariantInit SysFreeString SysAllocString VariantClear VariantCopy GetErrorInfo

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain

Downloads/ccleaner.exe

IMPHASH e8e837d2e90b52e232aba88021bc9c99
SHA256 ba5067481b31085ae5222f912097d54125dcc97c6551396f11974ae4bec2bd98
MD5 a7e44b01b9f23031067e9032196cc0ba
SHA1 c8c763e9cc7a1eeb724a1c54f92f29e2f5382ce4
SHA512 caa6feb23c2bcdcfd8affafddcf71bd03fbe44a8fa7d197e6643a3609026f1821451f998b3a9c47649c99a0271cbf481e3e47375dd91b562005091ef3706f53f
SSDEEP 24576:RDXpgvsPjx71gWufN62I520/hjlB6iTzKF+iZpWdt5YY7tOvkIOTbNvb7Jhh2:RDevYxSNudSrZpWxd7tOvJOtb7v8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

shell32

ord43 ShellExecuteW SHGetSpecialFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW Shell_NotifyIconW ord165 SHGetSpecialFolderLocation CommandLineToArgvW ord701 SHGetDesktopFolder ord716 SHFileOperationW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

Downloads/d87e2dcd2eb9763552645a34218696143fa99ac7b5173dcd04889ce9f5ddf96d.exe

IMPHASH 417c80dfdc5a9cae821cfd89fd8aeffb
SHA256 d87e2dcd2eb9763552645a34218696143fa99ac7b5173dcd04889ce9f5ddf96d
MD5 b1fb38b2b6032ca248f163aaa5cf8ae6
SHA1 f6dac083cd4762a832371eddcbb94362a31c58b0
SHA512 613e75f96c2bc5d591de36e374313b9ad444fc62126b056d2d62f402dd0182fadba78e04d4602c3dd34445629a3d9f7e1f46d15ab61992c73f1e4371700337a3
SSDEEP 49152:sxSNudSnZpWDd7tOvJOodL1PXdFs0Ki3lZ4q:rn6t6ld1z
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

982560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\Build\QuickSearch\Release\QuickSearch.pdb

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter GetCommandLineW LocalFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetComputerNameW SetFilePointer ReadFile GetCurrentProcessId FreeLibrary GetVersionExW GetDiskFreeSpaceExW GetVolumeInformationW VerifyVersionInfoW VerSetConditionMask LocalFileTimeToFileTime FindNextFileW FindClose FindFirstFileW GetOverlappedResult ReadDirectoryChangesW FileTimeToLocalFileTime CompareFileTime FileTimeToSystemTime CreateFileW WriteFile OutputDebugStringW SetEvent GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GlobalFree ResumeThread DuplicateHandle QueryPerformanceCounter QueryPerformanceFrequency lstrcpyW GlobalUnlock GlobalLock GlobalAlloc CreateMutexW GetPrivateProfileStringW GetLogicalDrives CloseHandle GetLongPathNameW WideCharToMultiByte lstrlenA InterlockedExchange lstrlenW GetTickCount TerminateThread WaitForSingleObject MultiByteToWideChar LoadLibraryW GetFullPathNameA GetLastError SetLastError GetVersion GetModuleFileNameW Sleep GetFileAttributesW GetCurrentThreadId GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetStartupInfoW DeleteFileA AreFileApisANSI GetTempPathA DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA LoadLibraryA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW FlushFileBuffers HeapValidate HeapCreate GetFileAttributesA HeapDestroy FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange HeapFree HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact GetFileSize CreateFileA HeapReAlloc GetFullPathNameW ExpandEnvironmentStringsW

user32

InvalidateRect GetFocus IsWindowVisible GetWindowRect IsWindow SendMessageW GetWindowRgnBox EnumChildWindows GetSysColorBrush TrackPopupMenu CallWindowProcW DestroyMenu DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW InsertMenuW CreateMenu GetMenuItemInfoW UnionRect GetMenuBarInfo CheckMenuItem EnableMenuItem ModifyMenuW GetMenuState SetWindowTextW InsertMenuItemW DrawIconEx GetSysColor GetCursor EnableWindow SetWindowPos SetActiveWindow LoadAcceleratorsW SetCapture ReleaseCapture ClientToScreen FillRect SetMenuDefaultItem GetDlgCtrlID TranslateAcceleratorW GetMenuItemID GetMenuItemCount GetKeyState IsZoomed GetWindow IsIconic GetSystemMetrics GetSubMenu LoadMenuW LoadIconW RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UnregisterHotKey RegisterHotKey SetPropW EnumWindows PostMessageW GetPropW wsprintfW LoadImageW DestroyIcon DrawIcon GetIconInfo GrayStringW DrawTextExW TabbedTextOutW MonitorFromPoint GetMonitorInfoW MonitorFromRect SetForegroundWindow GetLayeredWindowAttributes PtInRect GetForegroundWindow SetRectEmpty IsRectEmpty OffsetRect GetActiveWindow FrameRect GetWindowRgn SetWindowRgn SetLayeredWindowAttributes SystemParametersInfoW TrackMouseEvent EqualRect DrawTextW LoadCursorW SetCursor GetParent CopyRect SetRect ReleaseDC GetDC RedrawWindow LoadBitmapW AppendMenuW CreatePopupMenu ScreenToClient GetCursorPos GetClientRect SetTimer KillTimer SetWindowLongW GetWindowLongW

ole32

CoTaskMemAlloc CLSIDFromString CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoInitialize

Downloads/dwvhgtd.exe

IMPHASH 3e14c881bae1a3bb325eea058df0a11c
SHA256 aac7b251e062ab7269ce69a144a2587b21c054bb166464e23b0cbf9d37d13f59
MD5 846954f6bb92d6152358220de974eadb
SHA1 2c48027755783d35b163a43b62ffafba8345155d
SHA512 a6fc58543c6f6ad62ea73d60790b58ab758e8be2e7300a844f5032e991b8cd9472105eec9ff88035dff7f176f1f838776ed256db618087b6da70e1c332fd56c7
SSDEEP 3072:Vq3vlbw7VtyD3Y8xgpLJuMg9h4XE7mbggyF3cE1VEzLSnhl6AJ:VybGnS6LJuwfgZME1ESniA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9679

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsBadStringPtrW SetEndOfFile LocalCompact CreateHardLinkA GetModuleHandleW EnumResourceTypesA LoadLibraryW ReadConsoleInputA IsBadCodePtr CreateEventA GetACP GlobalUnlock GetLastError SetLastError GetProcAddress AttachConsole CreateJobSet LoadLibraryA FindResourceA AddAtomW GetModuleFileNameA EnumResourceNamesA GetFileTime ReleaseMutex GetDiskFreeSpaceExW TerminateJobObject GetWindowsDirectoryW CheckRemoteDebuggerPresent CloseHandle CreateFileW FlushFileBuffers GetStringTypeW LCMapStringW LocalAlloc CreateFileA WriteConsoleW SetStdHandle HeapAlloc ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapFree WriteFile GetStdHandle GetModuleFileNameW HeapCreate ReadFile EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetOEMCP IsValidCodePage MultiByteToWideChar RtlUnwind HeapSize HeapReAlloc RaiseException

user32

GetMessageTime GetKeyboardLayout CharUpperBuffA SetCursorPos LoadMenuW GetCaretPos GetSysColorBrush GetSystemMetrics

advapi32

ClearEventLogW

ole32

CoUnmarshalHresult

Downloads/file.exe

IMPHASH 7cfb8286d8c232c7967a74ce74b78e07
SHA256 7e0623dbd4975ddc7790c45c9407527c048cb04727ddf757e70f7d5b702703fd
MD5 9442e7f51753f9ef3604a13e459334aa
SHA1 b8ecc6920c4fca9725fbc78d6684359c88b8224a
SHA512 5af0b0653245ebc1a1aac4cca90d2bb53b48bea25a8f104cbd3e410f1374ef86a578fc56b3c7d42fc9bb0a5b22db97b007805da72528c89dca575c8196361cce
SSDEEP 3072:lCHi6zfNNcKW0PNXiWIztAq/czUZrHFdOIMRsSHHi:lezVlPxbKpEqiHH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalCompact CreateHardLinkA GetModuleHandleW EnumResourceTypesA LoadLibraryW ReadConsoleInputA IsBadCodePtr CreateEventA GetACP GlobalUnlock GetLastError SetLastError GetProcAddress AttachConsole CreateJobSet LoadLibraryA LocalAlloc SetEndOfFile GetModuleFileNameA EnumResourceNamesA GetFileTime ReleaseMutex GetDiskFreeSpaceExW TerminateJobObject GetWindowsDirectoryW CheckRemoteDebuggerPresent CloseHandle CreateFileW FlushFileBuffers GetStringTypeW LCMapStringW FindResourceA IsBadStringPtrW AddAtomW CreateFileA WriteConsoleW SetStdHandle HeapAlloc ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapFree WriteFile GetStdHandle GetModuleFileNameW HeapCreate ReadFile EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetOEMCP IsValidCodePage MultiByteToWideChar RtlUnwind HeapSize HeapReAlloc RaiseException

user32

GetMessageTime GetKeyboardLayout CharUpperBuffA SetCursorPos LoadMenuW GetCaretPos GetSysColorBrush GetSystemMetrics

gdi32

GetCharWidthW

advapi32

ClearEventLogW

ole32

CoUnmarshalHresult

Downloads/helper.bat

SHA256 10e4a6b54cc0cf4d18dde8b69e0b305abe487e07ed990c5bff82ce30b217b910
MD5 8d987e2f2fef6f2bd726d392bac46c55
SHA1 64ab8a696b52189d5fd809da924d1dc36e07d7c3
SHA512 a8c48da620cfc0b4ea55efba87a98625e4b1eaf4553006a259fc5915836afcdee413180d1dcfc40ab8830741257f5ab723d4536788b0d751a6ba8a28cbfcdf45
SSDEEP 768:AZWM6xwaPdP30trmRblevg8heVbaEUdLQdy6VTRZE3mn:ZM6xzR30ZmRb4YI2TILQdy6VTRL
MD5 SHA1 SHA512 SSDEEP

Downloads/setup.exe

SHA256 e51f3f998cd7c0783deb68c18c39b6ccf77f5dca0b611ddd23dcf09845ab8b31
MD5 d6dd2275a92bd37adb3a886255a431ef
SHA1 a28933f79041f29a681cfb444fc7b8d63435c510
SHA512 1c303bf3dfc8ba54d02096615cdbf34752a312c2478f16c3fc38a8e75b2ab0619fb46e434b2b96aa89114873c3659db91fb9e0308fe47d91d0b9124e48814ded
SSDEEP 98304:Cf6hoGwhlxoORmkoq6LoTxHVo81F728I/e6KMMj9BZCloOhyNnh+IDQxb:avpeAZILoTFT1s8n9TfhdDQB
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

1

Entry point

39716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

8B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

infected2024071401.zip

Downloads/1PDF.FaturaDetay_202407.exe

generic

Downloads/3e6642f7100bb72137d68b5aa34a2d1f1a75722ab7d2b15987bbdeb84bc3265e.exe

kernel32

user32

gdi32

shell32

shlwapi

ole32

oleaut32

generic

Downloads/4c40337094cf0bb86fad86d2ea724ac6e6a499f0acd877839a69d35c354a7792.exe

kernel32

user32

ole32

generic

Downloads/644d928a4a942f6ae4c90640103b595941f7a0b557ba49d122d137b1429c0325.exe

version

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

generic

Downloads/64ec6562b96016699c6ae14166f4d31bde2b160eaa84d34a661fc2943017202e.exe

kernel32

user32

shell32

ole32

oleaut32

generic

Downloads/7a0395c75ac633d66a7a9f2690cbdb9c90ac5b0fc4f9273b6e0cf16f70eedd8e.exe

version

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

generic

Downloads/901478668c0d5ecb3b5044dcb3e1744045f7b2a800a7c0c67020d9294470f3d4.exe

kernel32

user32

ole32

generic

Downloads/938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe

kernel32

user32

shell32

ole32

oleaut32

generic

Downloads/96d1bc7dec91a7a4e5fe653853a504e07d17e898fa437cf75e929fa909dd6bb7.exe

kernel32

user32

ole32

generic

Downloads/Built.exe

PE Signature issue

user32

comctl32

kernel32

advapi32

gdi32

generic

1�L�iŚ.pyc

Downloads/DHL_PT563857935689275783656385FV-GDS3535353.bat