LoaderV6.zip
- SHA256 18b7e51b0f80744208e78cdbdc707e5b8467991af8bdea3c47f3ee25ad864277
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LoaderV6.zip
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral2
Sample
LoaderV6.zip
Resource
win11-20240709-en
windows11-21h2-x64
29 signatures
600 seconds
General
- Target LoaderV6.zip
- Size 15.2MB
- Sample240721-rybaxstdjh
- SHA256 18b7e51b0f80744208e78cdbdc707e5b8467991af8bdea3c47f3ee25ad864277
- MD5 273e74c7c8e4fefcafca7ab2c634fef7
- SHA1 9a01e91e93cef5c77de8c70b8ae80da15a540fff
- SHA512 d3f788e51d165b72ebf9c46a3463dd594df308bc199a8f70db25945450ab0c5da3cb1aeffeb6cf9f46f323150bd4d5d660fefd054fed956a5b491dd21e228277
- SSDEEP 393216:wjdAJ/kHfMO2/w1kBY8l5aFEYF/pAYfxXaI+vQkXLLcDlE610Cgr:wjKsHfMO2/wBFFF/pAYfR0vQk8DlN0Nr
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/LoaderV6/Additions/wmpnetwk.dll unpack001/LoaderV6/Additions/wmpnssci.dll unpack001/LoaderV6/Additions/wmpnssui.dll unpack001/LoaderV6/WMPNSSUI.dll unpack001/LoaderV6/mpvis.DLL unpack001/LoaderV6/wmpnssci.dll
File Explorer
-
LoaderV6.zip.zip 15.2MB
-
LoaderV6/Additions/wmpnetwk.dll.dll 32KB
-
LoaderV6/Additions/wmpnssci.dll.dll 4KB
-
LoaderV6/Additions/wmpnssui.dll.dll 3KB
-
LoaderV6/WMPNSSUI.dll.dll 21KB
-
LoaderV6/loaderV6.exe.exe 52.5MB
-
LoaderV6/mpvis.DLL.dll 186KB
-
LoaderV6/wmpnssci.dll.dll 497KB
LoaderV6/Additions/wmpnetwk.dll
- SHA256 5270f60d90a15ce9d728c328495fb714daa1267a7363a70225badfa252a38ad0
- MD5 8cd455334b6cdd06beeeb898e1e83052
- SHA1 e104ab973744bac982efa50f055a5a45daed2aee
- SHA512 922f329f32d935946490cb7ff409689f2c2610fd09efe7e9e095a6e10aee838dde585aa6cbc4e816c42c7a61aa989daf3633edd553ed4a355d7eed6225091859
- SSDEEP 192:400xT+MOj4Edw+bRFCPkzMTYEwdwbFS33eWTqa2ilecbAvyv/PjxNlMopnTXmCly:400xvnyK9EN5VlVECXIWeF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
31KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
LoaderV6/Additions/wmpnssci.dll
- SHA256 1c443783d20272e22ef0e2acc0d4ca26ad8623c600882354c4849534b6d8737d
- MD5 ceb507d981f24eab435ac247a5493dc2
- SHA1 2224b6607b84063173edece209ded693d6f3471c
- SHA512 53a9de578985de120a886fbfb0d6a883518b302fbe3d2ae3b8cb4f884578ea644083cff9da88502ca74ffebd46804a5d5bdce2e06f28f146354ad7db3d6bbc46
- SSDEEP 48:yLfpRyfGaEXFvHxKgXk4WTPXQ4utDBbZWqC+2zLI634b6tmfx3gr:SHyfGB1HHU4WTfQ4s9Wh34b6yo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
LoaderV6/Additions/wmpnssui.dll
- SHA256 7b7aa6c204b30808b4ae323931bf340c08c3ddeedc10d836a57e80ac3d67e404
- MD5 2644bd70bc685b362cad6e6ab65e038f
- SHA1 46682b4d2fd9e3863c3aaeae000e25ad8ab48825
- SHA512 f95ddf830d9efb0c2eea09d10642a7a144259aa609638b33fb667099021d6676e4e0021e5d32a216cbaa23b35a8ebe25cb99cc5a89a8acb53704a7c79c98eedb
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
LoaderV6/WMPNSSUI.dll
- IMPHASH 7c921fb42cad0a9d69ae2005e213c272
- SHA256 9887affa2d6eac2ae68dda60af3b9b25ba3cedd00e0861e1e57df5d017146f8a
- MD5 95111e3aeba84c3dcf05d3dc25a15d30
- SHA1 1539f1e3e76912d02adaac29f8d83231db62dbd3
- SHA512 7547f83181fa2ef6e51923a1475286f571e8f87db7c893c8f86d249ec34eea71eae8cd224f1c05b172153309f8d507d3ac33ec85a6d14a07f80029890174c6b3
- SSDEEP 384:mAFLVVeK3Xvv3IglWAduY4UczbX4q7zqhsA0+/NWapW:ZpvjXnIGY6Q+/v
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10144
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wmpnssui.pdb
msvcrt
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
memset
kernel32
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentThreadId
DisableThreadLibraryCalls
Sleep
GetLastError
oleaut32
SysFreeString
VariantClear
ole32
CoCreateInstance
shell32
ord16
ord155
SHGetIDListFromObject
SHCreateShellItemArrayFromDataObject
user32
SetMenuDefaultItem
InsertMenuW
LoadStringW
shlwapi
ord219
SHGetValueW
StrChrW
advapi32
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
EventWriteTransfer
EventUnregister
EventRegister
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
540B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=27412,
count=12, id=260, version=27412,
count=101, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=10, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
LoaderV6/loaderV6.exe
- IMPHASH 07361a3a7f515bf56ca93120b2aca73b
- SHA256 88f6b132a2f2f4bee053e521ca9a212bca12ed681b223ad615d4263c976e152c
- MD5 4efe5b34754a7b87e7a2fb46664fb245
- SHA1 7a2ffeac89d92fb0fb987cb6b284133e41a1e666
- SHA512 a090deac29ae7aa7baf6411d1eef6121f5fdf09eb3d14f57f2b7e1f1f56859a70d12019234055c74df6e339081529c670bdf035c728244435ea8830b2d6f6b14
- SSDEEP 393216:3T6KLdGUHM9yCKxECB54r6X9eDQrps7p6Y:3T6edGUs9yLEFy+sY
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
52:94:76:66:05:26:e4:d4:a3:14:86:23:a7:f3:21:f8:8b:05:5e:5e:0b:67:c2:ea:c7:d1:b0:41:7a:24:77:6c
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=BLACKBIRD SECURE BROWSING LTD,O=BLACKBIRD SECURE BROWSING LTD,ST=London,C=GB
Chains
Dec 4, 2023
CN=BLACKBIRD SECURE BROWSING LTD,O=BLACKBIRD SECURE BROWSING LTD,ST=London,C=GB
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=BLACKBIRD SECURE BROWSING LTD,O=BLACKBIRD SECURE BROWSING LTD,ST=London,C=GB
Serial Number
12:1c:77:48:63:e3:ba:8e:7b:8b:f7:55:97:87:47:ae
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 6, 2022 - Sep 5, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
505920
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetThreadPriority
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateWaitableTimerA
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
22.3MB
Virtual Size
22.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27.6MB
Virtual Size
27.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.6MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
620KB
Virtual Size
619KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
364KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
LoaderV6/mpvis.DLL
- IMPHASH f3f615ca71f6738391d50074e8501505
- SHA256 6edf856747573fc15433c0923efb93c3ebc29bb5957b373cbb798998381d9d4d
- MD5 e7dd6c9ed6db46b3d35cafaa4b7f640e
- SHA1 2d65eefdfa5e71afb82c78bf4b264e87db91b958
- SHA512 828cf56539c5d2a8e10564c02cdef3a34781787e9414747ad87472b98997843be4e2007ed1aa22f013de0c445b5a9e8fcac8ef85a51df7bed5725f3881cea50d
- SSDEEP 3072:eGGQ8wInYIcRSqMnAzvJC8KBoOGefHFcYBqI1r0flW/9YzG6:eC1InY9UqMAz4brxo4U
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
117568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mpvis.pdb
msvcrt
_finite
wcschr
wcspbrk
memcpy_s
_vsnwprintf
__CxxFrameHandler3
_onexit
sqrt
sinf
sin
memset
memcmp
memcpy
__dllonexit
_unlock
cosf
cos
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
rand
_wcsicmp
time
srand
wcscpy_s
realloc
wcscat_s
malloc
free
__C_specific_handler
acosf
atan2
atan2f
sqrtf
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
kernel32
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
DisableThreadLibraryCalls
HeapDestroy
lstrcpyW
LoadLibraryW
SetEvent
WaitForSingleObject
CloseHandle
VirtualFree
QueryPerformanceFrequency
QueryPerformanceCounter
HeapFree
GetCurrentProcess
LoadLibraryExA
EncodePointer
HeapAlloc
DecodePointer
GetProcessHeap
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
lstrlenW
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
DeleteCriticalSection
RaiseException
IsProcessorFeaturePresent
lstrlenA
GetVersionExW
LockResource
FindResourceW
GetModuleHandleA
LoadLibraryA
OutputDebugStringA
MultiByteToWideChar
lstrcpynW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
TraceMessage
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExA
RegQueryValueExA
ole32
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
oleaut32
LoadRegTypeLi
LoadTypeLi
SysStringLen
RegisterTypeLi
VarUI4FromStr
SysAllocString
SysFreeString
SysAllocStringLen
user32
DefWindowProcW
SetCursor
CallNextHookEx
RegisterClassW
IsWindowUnicode
ShowWindow
UpdateWindow
PostMessageW
SetWindowsHookExW
DestroyWindow
UnhookWindowsHookEx
CallWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
LoadCursorW
GetSysColor
CharNextW
CharPrevW
GetWindowRect
GetClientRect
GetDC
ReleaseDC
GetAsyncKeyState
IsWindow
GetSystemMetrics
MonitorFromWindow
IsRectEmpty
FillRect
SetRectEmpty
CopyRect
CreateWindowExW
gdi32
StretchBlt
TextOutW
SetTextAlign
SetTextColor
SetStretchBltMode
GetStockObject
DeleteObject
SetBkColor
gdiplus
GdipDrawRectangleI
GdipDrawLineI
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetPathGradientCenterPointI
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipFillRectangleI
GdipCreatePathGradientFromPath
GdipAddPathEllipseI
GdipStartPathFigure
GdipDeletePath
GdipCreatePath
GdipDeletePen
GdipCreatePen2
GdipCreatePen1
GdipCreateLineBrushFromRectI
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipFree
GdipSetPathGradientCenterColor
GdipSetPathGradientFocusScales
GdipAlloc
winmm
timeBeginPeriod
timeGetTime
timeEndPeriod
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
117KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=259, version=27412,
count=18, id=260, version=27412,
count=298, id=1, productName=Unmarked objects,
count=21, id=257, version=27412,
count=8, id=261, version=27412,
count=1, id=256, version=27412,
count=80, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
LoaderV6/wmpnssci.dll
- IMPHASH e0e3379116ca05dddb5fa91e126bbb12
- SHA256 86cdcc390dd5deace354910bb5ef02843068fdea29a6552b2b0b3737b1f632dd
- MD5 e4c5664db410d83a28413aaf29103c5d
- SHA1 3c46a8465acd8ed799e0bfe772b4b3f40cb5a2ce
- SHA512 a8564ed391be37b3bc046e57ccfb1e66c1bf95b6d2b0c7607636452dc69501888759316e3c0385042017617c7c8aec47bb2975e384057f2f7f0010866a11e02d
- SSDEEP 12288:BdTAIUINc5k+JF1JuN4ULTua1BDllfMo88s9Of4:BCIcW+J/+TF1Honr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
212240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wmpnssci.pdb
msvcrt
_purecall
calloc
memmove_s
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy
memset
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
?terminate@@YAXXZ
_initterm
_amsg_exit
towupper
wcschr
iswdigit
iswalpha
wcsncmp
_wcsnicmp
_wcslwr_s
wcstol
_XcptFilter
__C_specific_handler
_callnewh
wcscmp
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtDeleteKey
NtQueryKey
api-ms-win-core-registry-l1-1-0
RegGetKeySecurity
RegDeleteKeyExW
RegSetKeySecurity
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegEnumValueW
user32
DrawTextW
DrawFocusRect
FillRect
CharUpperBuffW
GetWindowTextW
GetDlgCtrlID
GetWindowTextLengthW
GetClassNameW
IsWindowEnabled
GetFocus
UnregisterClassA
GetCapture
ScreenToClient
GetCursorPos
UpdateWindow
SetFocus
SetCapture
ReleaseCapture
CreateWindowExW
ShowWindow
GetActiveWindow
GetIconInfo
SendDlgItemMessageW
GetWindowLongW
SetWindowLongW
SetWindowPos
GetClientRect
OffsetRect
SetRectEmpty
PtInRect
SetCursor
CallWindowProcW
DefWindowProcW
SetWindowTextW
EnableWindow
GetDlgItem
GetParent
SendMessageW
LoadCursorW
ReleaseDC
GetDC
EndPaint
BeginPaint
GetWindowLongPtrW
DestroyWindow
SetWindowLongPtrW
IsWindow
TrackMouseEvent
wvsprintfW
CharNextW
GetSysColor
InvalidateRect
sspicli
GetUserNameExW
ws2_32
InetPtonW
gdi32
SelectObject
SetBkMode
SetTextColor
GetDeviceCaps
GetTextExtentPoint32W
GetObjectW
DeleteObject
CreateFontIndirectW
GetStockObject
gdiplus
GdipGetImageGraphicsContext
GdipDisposeImage
GdipSetImageAttributesWrapMode
GdipSetInterpolationMode
GdipCreateImageAttributes
GdipAlloc
GdipFree
GdipDrawImageRectRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHICON
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipDeleteGraphics
GdiplusStartup
GdipDisposeImageAttributes
kernel32
GetModuleFileNameW
FindResourceExW
LoadResource
GetProcAddress
IsWow64Process
OpenEventW
ResetEvent
LocalFree
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
DelayLoadFailureHook
ResolveDelayLoadedAPI
ReleaseSRWLockExclusive
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
GetLastError
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
CompareStringOrdinal
LockResource
SetLastError
GetCurrentThreadId
lstrlenW
MulDiv
CompareStringW
CloseHandle
Sleep
CreateEventW
CreateThread
WaitForSingleObject
SetEvent
WaitForMultipleObjects
HeapSize
HeapReAlloc
HeapFree
GetModuleHandleW
HeapAlloc
GetProcessHeap
HeapDestroy
lstrcmpiW
LoadLibraryExW
RaiseException
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
SizeofResource
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
216KB
Virtual Size
215KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
221KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=20, id=260, version=27412,
count=314, id=1, productName=Unmarked objects,
count=21, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=33, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,