stormkitty | New folder (8)[.]7z

Target
New folder (8).7z
Size 17.6MB
Sample240803-tpp4tsshqa
SHA256 0e06e9585cc9db33ee999ca4de668ab64ef6e9fa928ae6541b2f1ec68ff09da8
MD5 be23bf21f50efe03646c00428769da08
SHA1 588f68a1f66ee0c689104d9096415b9070838827
SHA512 b3850d8b79c88e5a1ac7d2855f5b03b08c3392629f041474a997f4c9d71e321c24b9a2c5dad79e8fa6a1bb94648a30808dfa37dbb61e1348fd221594beeda8aa
SSDEEP 393216:gTZqJOaXIZoQGPISZpx/0iw+lT+6uxC2JxpG25Bbm:gsJd7ISLW+t+6mCOTdm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx loader 2683308570 themida stormkitty icedid wellmess

Malware Config

Extracted

Family

icedid

Botnet

2683308570

funnymemos.shop
trythisshop.club
shopoholics.best
buytheone.best

Attributes

auth_var
1
url_path
/audio/

Extracted

Family

wellmess

http://178.211.39.6:80
https://141.98.212.55:121

rsa_privkey.plain

rsa_pubkey.plain

Signatures

IcedID Second Stage Loader 1 IoCs

loader

resource	yara_rule
static1/unpack001/654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe	IcedidSecondLoader

Icedid family
icedid

StormKitty payload 2 IoCs

resource	yara_rule
static1/unpack001/611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe	family_stormkitty
static1/unpack001/91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8.exe	family_stormkitty

Stormkitty family
stormkitty
Wellmess family
wellmess

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack003/orihonvp.exe	themida
static1/unpack001/91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8.exe	themida

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496.exe	autoit_exe

Unsigned PE 32 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe
unpack001/15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe
unpack001/1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.exe
unpack001/1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe
unpack002/out.upx
unpack001/22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe
unpack001/24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe
unpack001/2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.exe
unpack001/32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe
unpack001/4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe
unpack001/55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.exe
unpack001/5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe
unpack001/611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe
unpack001/654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe
unpack001/6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UAC.dll
unpack003/$PLUGINSDIR/UserInfo.dll
unpack003/$PLUGINSDIR/nsDialogs.dll
unpack003/$PROGRAMFILES/foler/olader/acledit.dll
unpack003/$PROGRAMFILES/foler/olader/acppage.dll
unpack003/$PROGRAMFILES/foler/olader/adprovider.dll
unpack003/orihonvp.exe
unpack001/7109e67cf655b41ff88903bf1e70cc4efa3e537a38df7df90d8a3ff95c4cab58.exe
unpack001/79fb1d00ef9d85e958a17fd331b23dec507e4f2e2c150fd580d0668b84d29d00.exe
unpack001/7ef9667e73b84b6a031e28b6279e04cd8abe82d69cd836043a7cfe0978cb8a98.exe
unpack001/8264e723a411381a9d837458ec39cbb36c8d582bcba14f7ed7fc45f8154c479d.exe
unpack001/8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496.exe
unpack001/863c612734f5ff0ff0ea3fed7fd790dfb43c47eecdc1417bcd82c0ad866419af.exe
unpack001/942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe
unpack001/95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc.exe
unpack001/99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe

File Explorer

New folder (8).7z

.7z 17.6MB
0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe

.exe 2KB
15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe

.exe 150KB
1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.exe

.dll 38KB
1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe

.exe 1.3MB
out.upx

.exe 3.9MB
22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe

.exe 2KB
24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe

.exe 1.2MB
2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.exe

.dll 179KB
32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe

.exe 844KB
4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe

.exe 787KB
55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.exe

.dll 231KB
5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe

.exe 865KB
611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe

.exe 280KB
654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe

.exe 8KB
6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe

.exe 3.0MB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/UAC.dll

.dll 14KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PROGRAMFILES/foler/olader/acledit.dll

.dll 8KB
$PROGRAMFILES/foler/olader/acppage.dll

.dll 45KB
$PROGRAMFILES/foler/olader/adprovider.dll

.dll 48KB
nasial.exe

.exe 2.8MB
orihonvp.exe

.exe 2.5MB
7109e67cf655b41ff88903bf1e70cc4efa3e537a38df7df90d8a3ff95c4cab58.exe

.exe 708KB
71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.exe

.dll 402KB
79fb1d00ef9d85e958a17fd331b23dec507e4f2e2c150fd580d0668b84d29d00.exe

.exe 5.9MB
7ef9667e73b84b6a031e28b6279e04cd8abe82d69cd836043a7cfe0978cb8a98.exe

.exe 2.3MB
8264e723a411381a9d837458ec39cbb36c8d582bcba14f7ed7fc45f8154c479d.exe

.exe 2KB
8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496.exe

.exe 856KB
863c612734f5ff0ff0ea3fed7fd790dfb43c47eecdc1417bcd82c0ad866419af.exe

.exe 3KB
91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8.exe

.exe 3.6MB
942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe

.exe 732KB
95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc.exe

.exe 6.5MB
99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe

.exe 1.1MB

New folder (8).7z

SHA256 0e06e9585cc9db33ee999ca4de668ab64ef6e9fa928ae6541b2f1ec68ff09da8
MD5 be23bf21f50efe03646c00428769da08
SHA1 588f68a1f66ee0c689104d9096415b9070838827
SHA512 b3850d8b79c88e5a1ac7d2855f5b03b08c3392629f041474a997f4c9d71e321c24b9a2c5dad79e8fa6a1bb94648a30808dfa37dbb61e1348fd221594beeda8aa
SSDEEP 393216:gTZqJOaXIZoQGPISZpx/0iw+lT+6uxC2JxpG25Bbm:gsJd7ISLW+t+6mCOTdm
MD5 SHA1 SHA512 SSDEEP

0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe

IMPHASH d0e384aa95abd36d281a3e456d0e4dbe
SHA256 0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee
MD5 4a6ac8d48c9793c0c852a6ac93ba2002
SHA1 cdc7a9cf8ee36099c823779ac2dd8ffe3a84d723
SHA512 3aacced9817519ae31ed2bc4cf4063b2eb0a1c9e9addbcb9e08b3431f519ca0a8a6a8962e1039835a48e50cb52cd08d21cad642a66822c288d2b0a88541c361e
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe

IMPHASH 6e9e93f43de3e58e0f5a1cb9388f645c
SHA256 15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71
MD5 022f5345cfab4ef75476ffc7f708fcfe
SHA1 81802b0a5f738b7333a60eece96441c1bca19792
SHA512 6595ef6e3e0b65afd0a4f7d5bd5650466a4299df8284180b48ff0e30a537a42616a98c530fa4d39fdbe30eb1cc6c72fd749a98551890a0b488f04fd164b49f53
SSDEEP 1536:YyuipsAiJm4cJI7CweL+eX9kEnOCGzJoQL2VwEeYIsUE4KvVf+boJPtgm4qeYwqN:FlpYU6vqXRPE2VyYIsf4K9ffFSqe72
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ninuw_tadomuyamen100\bohowexehukaci4 bogex73 tevumecus.pdb

kernel32

HeapCompact LoadResource GlobalAddAtomA GetEnvironmentStringsW SetHandleInformation WaitForSingleObject GetConsoleAliasesLengthA GetSystemTimeAsFileTime GlobalAlloc GetLocaleInfoW DeleteVolumeMountPointW GetFileAttributesA GetFileAttributesW GetDevicePowerState GetConsoleAliasesW GetLastError GetThreadLocale GetProcAddress VirtualAlloc GetFirmwareEnvironmentVariableW LoadLibraryA IsWow64Process CreateHardLinkW WaitForMultipleObjects EnumResourceTypesW EnumDateFormatsA SetConsoleCursorInfo FindNextFileW GetConsoleTitleW FillConsoleOutputAttribute CheckRemoteDebuggerPresent EnumCalendarInfoExA LocalFree WriteConsoleW HeapReAlloc IsProcessorFeaturePresent DecodePointer EncodePointer GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW HeapAlloc HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer EnterCriticalSection LeaveCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement CloseHandle LoadLibraryW WriteFile GetModuleFileNameW FreeEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetCPInfo GetACP GetOEMCP IsValidCodePage ReadFile Sleep SetStdHandle RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize RaiseException LCMapStringW MultiByteToWideChar GetStringTypeW CreateFileW

user32

SetCaretPos

ole32

CoGetMalloc

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.exe

IMPHASH 3d51d3fa0835c459058650f717b0a385
SHA256 1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34
MD5 a4017c06209e16b8f47fcf6e5845aba9
SHA1 66d99a1cc92ed316e0d7a2ab6df466c289154ec3
SHA512 52e4df915b3cb6eb60a3f37874b0d8a14646ffadb9aa621cf8ea3fb04b5cbb4250fb9cec3a2ed8722a7eae4b600836b5b7bf72e53e297e464fb844096a9b2f5e
SSDEEP 768:tojIJWP0znqX60+KU6nCVUO2gTjZSXulSJ474fLv/zkSf2Vz:NnqXn+YoQ+lu474zo
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe

SHA256 1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad
MD5 9344afc63753cd5e2ee0ff9aed43dc56
SHA1 ee1fa399ace734c33b77c62b6fb010219580448f
SHA512 6434c212a85180c1af00f5c5fa081a6a6ab66f5633edb74e130a7b9d754a6a65dc973f5e820f6f57a43956c276dbf3721021d1e9bb53fa79ac51ed8cb23f4090
SSDEEP 24576:/U1v3pE+zO9mBt2bdm3EHVXkNA80Jl5IzCxWWDrSBkian7X5:/Qv74bdm3EHEA8UIzm8aj5
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4566784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 66054c753d386b84257061e6cfb01c532215dd61304467ae8eae3ea53ab43721
MD5 a53fb76f7423078bcc1f85fdce151f7e
SHA1 143fb0c11841580f9a38e8f63073f4dc0c1fbb4a
SHA512 a5a4524cbfc1b80511a36373caa36407df4357d00804042fdcf9c1f4ecc5ed2166d2bd5c5bce229c177fa53d33797dc3c6e0410c2c836e9168f2751a8f2b1cf5
SSDEEP 49152:xA4Lugqnlrb/TUvO90dL3BmAFd4A64nsfJTNrmorhOY2XRnd5j3bFD1LIdPPo6gw:x9onGhnvZeuY7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

376KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

78B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe

IMPHASH dfe29094a0a8bf3a447ff0dd263ec010
SHA256 22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7
MD5 af8ae6c1f2859cc139cd176a6656a855
SHA1 161e2d577b418eaa94bf1959a634956b75d7922b
SHA512 a80672ea1f49ebaeaf5b850377ee346e7953bf6379a79db91b826ba2249a66424b0f1be189351dc86088ff9efd72142a46f6d4bff2c5dc7271a4db22c10bcd1e
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe

IMPHASH ad35223e42e488e819f8bab49b2709bc
SHA256 24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7
MD5 39ae3110dc8ee4239811f2a1083e675e
SHA1 f235ea35b4a408a052ec5bc93310adb77b52ecbc
SHA512 cee1b9804a3a3d4f033d8076f66ffd6021a0b017a7588b96749d319d382056847d26aedc2f1fa5b7140c01697407da3c2873d59c78044376b083bc8f0c8494ee
SSDEEP 24576:aG4NAckBXt2Uj3WTNWIcXuDTPyYaOnuhZiOASiN0A:O0shOeDjzagumObiN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8612

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yuyulaj\ruvox28\judihu_20_pife-gibove.pdb

kernel32

FillConsoleOutputCharacterA SetProcessAffinityMask GetConsoleAliasesLengthW GetDefaultCommConfigW ReadConsoleA QueryPerformanceCounter GetEnvironmentStringsW BackupSeek GetTickCount GlobalAlloc GetFirmwareEnvironmentVariableA LoadLibraryW SizeofResource GetSystemWindowsDirectoryA HeapValidate SetConsoleCursorPosition GetAtomNameW LCMapStringA GetLastError GetProcAddress VirtualAlloc SetStdHandle LoadLibraryA WriteConsoleA BeginUpdateResourceA SetSystemTime GetModuleFileNameA SetConsoleCursorInfo UpdateResourceW GetProcessAffinityMask AddConsoleAliasA SetFileValidData FindNextVolumeA lstrcpyW CreateFileW WriteConsoleW HeapAlloc GetModuleHandleW ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapFree IsProcessorFeaturePresent WriteFile GetStdHandle GetModuleFileNameW HeapCreate EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind SetHandleCount GetFileType DeleteCriticalSection SetFilePointer CloseHandle TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsW WideCharToMultiByte GetCurrentProcessId GetSystemTimeAsFileTime Sleep CreateFileA GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize RaiseException HeapReAlloc SetEndOfFile GetProcessHeap MultiByteToWideChar ReadFile LCMapStringW GetStringTypeW

user32

SetCursorPos

2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.exe

IMPHASH 818152acf9b9745a10910998c6f4cf34
SHA256 2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65
MD5 69828a3d5c60eb466c3a62f3389f6f87
SHA1 7b9526f82448d0a1fb59a8125d1de55e3a166d72
SHA512 ce8818f78b62453fb56fcaf98efa7bc52068f7ddf915e1df6841f33a39aff6bd7c60692af16ea361cdf15b3cc79787e4a39bb6648faffc3eaac10ce886b45d5f
SSDEEP 3072:uq3W3hXSPA5aodE8pn6kTDnlBtx6Qg9+Fh3SslsR/dLcEZD6zs:uIuXSPA5aWpn6kTDnjzjFm/1Z+4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

Sleep ExitProcess HeapFree lstrcmpiA lstrcpyA HeapAlloc HeapCreate LocalFree LocalAlloc GetModuleHandleA GetWindowsDirectoryA DeviceIoControl GetLastError CloseHandle CreateThread CreateFileA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetCurrentProcess TerminateProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte WriteFile GetConsoleCP GetConsoleMode DeleteFileW LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStdHandle GetFileType GetStringTypeW SetStdHandle FlushFileBuffers CreateFileW SetFilePointerEx WriteConsoleW HeapSize HeapReAlloc SetEndOfFile ReadFile ReadConsoleW

advapi32

CheckTokenMembership AllocateAndInitializeSid StartServiceA OpenServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle FreeSid

shell32

ord680

Name

.text

Size

125KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe

IMPHASH 804961db55ba5c190e654e6d23768444
SHA256 32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08
MD5 a6f049a056e37a65280ddfe17f689b50
SHA1 479e08954d4d58b643ada84da280bd01c71e779a
SHA512 f7effb9a12c0723ed336117e3399940d4fe9e3682eec18cdf19cf074dab27d2ce8b1c14d30f1e3e26b5883732f8b970477a32ca4c12fe36a8fa3bc452586511b
SSDEEP 24576:40bAk9PkFMVNgsbj6d2dXrpcpZBWGyDs1lwBUeF:PEGNgsnHDIZB/yDseB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xuxiy\tuzuc16\punaha\s.pdb

kernel32

FillConsoleOutputCharacterA GetPrivateProfileSectionNamesW EnumResourceNamesW SetVolumeLabelA GetFileSize lstrlenA TlsGetValue CommConfigDialogA SetEndOfFile FindResourceExW FreeLibrary LoadResource ScrollConsoleScreenBufferW GlobalSize GetProfileStringW WaitForSingleObject WriteConsoleInputA SignalObjectAndWait SetVolumeMountPointW OpenSemaphoreA CallNamedPipeW GetTickCount GetCurrentThread GetConsoleAliasesLengthA GetPrivateProfileStringW EnumTimeFormatsA GetUserDefaultLangID SetProcessPriorityBoost GetDriveTypeA GetVolumeInformationA LoadLibraryW GetConsoleMode SetVolumeMountPointA GetVersionExW SetConsoleCursorPosition GetFileAttributesW SetTimeZoneInformation VerifyVersionInfoA SetSystemPowerState WritePrivateProfileSectionW TerminateProcess IsDBCSLeadByte ReadFile CompareStringW SetThreadPriority DeactivateActCtx CreateJobObjectA ReleaseActCtx OpenMutexW FindFirstFileExA GetLastError SetLastError GetProcAddress VirtualAlloc SetStdHandle SetComputerNameA WriteConsoleA OpenWaitableTimerW LocalAlloc DeleteTimerQueue MoveFileA WriteProfileSectionW AddAtomA FindAtomA GetPrivateProfileStructA WaitForMultipleObjects WTSGetActiveConsoleSessionId GetThreadPriority DebugSetProcessKillOnExit GetModuleHandleA RequestWakeupLatency WaitForDebugEvent DuplicateHandle SetProcessShutdownParameters ReleaseMutex AddConsoleAliasA DebugBreak FindActCtxSectionStringW ReadConsoleOutputCharacterW GetProfileSectionW CloseHandle CreateFileW GetCommandLineA HeapSetInformation GetStartupInfoW EncodePointer DecodePointer IsProcessorFeaturePresent HeapValidate IsBadReadPtr SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime InterlockedIncrement InterlockedDecrement GetModuleHandleW ExitProcess GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsSetValue TlsFree HeapCreate GetModuleFileNameW WriteFile RaiseException EnterCriticalSection LeaveCriticalSection HeapAlloc HeapReAlloc HeapSize HeapQueryInformation GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetACP GetOEMCP GetCPInfo IsValidCodePage RtlUnwind OutputDebugStringA WriteConsoleW OutputDebugStringW LCMapStringW MultiByteToWideChar GetStringTypeW SetFilePointer GetConsoleCP FlushFileBuffers

user32

GetMessageTime GetCursorInfo

4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe

IMPHASH ce9705bb401fc9d98960cc1eae900199
SHA256 4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7
MD5 0b862b9c889d4bdc6f0bac7d702d8753
SHA1 fdc030df123e6e6a712cbc960a2e7c63266bf040
SHA512 4f7284a625b4909f9a0d80023c1dbfe3ed2de8a14fdf9a5bd3687d7e2fb21e265ee6cca613e4e6c8cab35f806501b155e6ed70a11530eb1cc78dbc38b22d3e8b
SSDEEP 24576:reKt4RjnJ+wWEr55fRue+cfxiskJM0BPA:rORdGA55fkcJinM0BI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

619815

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\donato\losabexeka\wulug-kaxen.pdb

kernel32

InterlockedPopEntrySList GetConsoleDisplayMode CreateConsoleScreenBuffer GetConsoleCP VerifyVersionInfoA WaitNamedPipeW CreateMutexA WriteConsoleA SetLastError CreateFileW WritePrivateProfileSectionA GetPrivateProfileSectionW EnumDateFormatsExA GetCurrentProcessId LoadLibraryA IsDebuggerPresent SetConsoleCP FindFirstVolumeW WriteFile BuildCommDCBA VerLanguageNameA AreFileApisANSI WriteProcessMemory SetEvent GetExitCodeThread EndUpdateResourceA GetCPInfo GetLastError UpdateResourceA SetConsoleTitleW SetFilePointer LoadLibraryExA CopyFileW ReadConsoleA ActivateActCtx AddRefActCtx GetConsoleAliasW DnsHostnameToComputerNameA ReadConsoleOutputW GetProcessHeaps GetSystemWindowsDirectoryW GetUserDefaultLCID BuildCommDCBAndTimeoutsA HeapAlloc GetAtomNameA GlobalSize HeapSize GetGeoInfoA GetCurrentProcess VirtualProtect GetProcAddress GetModuleHandleA CreateThread GetVersionExA SetProcessAffinityMask WaitForSingleObject SetSystemPowerState VerifyVersionInfoW WriteConsoleOutputCharacterW SetTimeZoneInformation GetMailslotInfo GetCPInfoExA SetEnvironmentVariableA GetFileAttributesExA GetComputerNameW CommConfigDialogW GetConsoleAliasA GetConsoleWindow GetSystemTimeAsFileTime GetDiskFreeSpaceA CreateFileA CreateActCtxW HeapLock GetConsoleAliasesLengthA InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection RaiseException RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA HeapFree TerminateProcess GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId VirtualFree VirtualAlloc HeapReAlloc HeapCreate ExitProcess GetStdHandle GetModuleFileNameA SetHandleCount GetFileType FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount SetStdHandle LCMapStringA LCMapStringW GetConsoleMode FlushFileBuffers CloseHandle GetConsoleOutputCP WriteConsoleW

user32

RealChildWindowFromPoint GetAltTabInfoW

advapi32

AdjustTokenGroups BackupEventLogA

55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.exe

SHA256 55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344
MD5 ee28a178e3aacfa1398ca74a9bc1822e
SHA1 193bc249bac79c0a195e736c62de5ec16e5ef38d
SHA512 3f0dbbbda0cba4a32fe49fd7941d3fa640a8b7aeec56a3f584d519593de68e4acf8036c651cd469e386a32c5465521035dccebb6f3732f7893be552803d48353
SSDEEP 3072:ktkuGh43+xNkZ4I0+NFS1I74Y61cyJDz/+6BjbkJuWg349uoZaOG/mf3vfUgrfQj:FMZ4P+NEc4zYgV9QFhP0grf0dd
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb
MD5 aeccd0447a233ab8f7de5d7df28e9331
SHA1 c9dbaac42e30413f8cdb6ef09cf90ca75d0137a7
SHA512 44bcb72760eacb7c69b30b2835043f11fa47e3c950afc795286317645d92925cc1c7884bd611b4f0df2b74750949401e377c6d4fe5741926a0f720ddf99ca40e
SSDEEP 24576:EejP2Qq5NJf5osyeT2DiqkRD73mOcohh:/jYNp5PTZqkRn3mz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

717026

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47
MD5 284b061036a1e367e41c00235d1b5e6f
SHA1 f6277c4d7a39427e7c86a3f9040729d6b17aff65
SHA512 21733f5d5953a07021536928842bce4be637235b7c1578fa0096c53a546614ecbc172f0e500fddf2611acd2dba94b13152fb1eff75efb0666342183c0f6627c6
SSDEEP 6144:x6DKNllJ4Uc/gqXKq8+RigIWU+Ydm0UAtXbe9bu:sDKNlAUcBaq8+RnWm0UA9b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

StormKitty payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

293342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe

IMPHASH a188f9ca081f5d553d295623012bedb0
SHA256 654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801
MD5 096a19cd1460c87f343444a4740327c2
SHA1 0f55409dbc70927548c2d351185408f7615ee47c
SHA512 259552c2bd72062aa531ea9dac59b6411b64d735c01197dbf0e2943cc8a9ddc37eb1e0be9f22118a48bead99f57a237f9bb986f8ceafc67ed463f9c00a6587bf
SSDEEP 192:/G6OThBwj6k8TqLUh5wCb3py+g2O9Cung9C:/G9hNxh5Zp1i9Cun
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

IcedID Second Stage Loader

loader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5
MD5 07ab47ba492cb4ce3b9255ecbfb543f7
SHA1 b86f8aeddddd245f0198ad92ff6cee605cbe1d4e
SHA512 0f161c751011070eca63baf0d544e35adfb7ae23c7bef6ef21684d93ee81d88fa0a83f5f1cc7be10e5a31c2012711298e599e4264d13f6607c9ce7abc8c5ad3a
SSDEEP 49152:fb1ZTEb66GZQJAaYqh3owdV+xYtb/Khu0Ar51hRzEHgR8wfXhxld4sl9O3/TvHv0:5ZQ+6uQhYEom+mtkQ1hRwH2X9i/vFO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

900KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH 45d25ca52c312b2254c60dbcb30342d1
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PROGRAMFILES/foler/olader/acledit.dll

IMPHASH 4841609d5e7c77c336247e7bb3fc4cef
SHA256 727b96dca0363f7cd5767f94bf72e0655ef1d00f44b27d496deb733eb32be12b
MD5 8d96cb171b4138f43a754317be9e982c
SHA1 3c2975e7904486f39be0455a63afaa063064a93e
SHA512 ab58bd28169042d9502f64410e78aa41d219753d998ad5309699c57b50ce343b50aeb42dda8ef6a52f8057dcd1bc2b4b6e0de52819285dd3517ba3fa032e6ee3
SSDEEP 192:peH8gcV+GQqYTBBBAkvyMQ0F3OWYTWPGP:YH8gcV+GQqyAMD0WYTWPq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

acledit.pdb

$PROGRAMFILES/foler/olader/acppage.dll

IMPHASH 28cc1fb51b5dca83c86f1fa8d16863a4
SHA256 949fd56c5a63d3f1c20769bc2285ac5517c4ca84250c807f18247a2d93efc1a4
MD5 290075961dd4856211078377d14942c8
SHA1 ad7f6dfd89a253daa70d5bbb46e819dae7eb3f61
SHA512 b431198324315e172fafb062fce93c5d5b18e691150e5e26dec30f150622c38ce4342b9e9f5d4d847860a55e7fb75411bb8765a0f0ae87c99e0dc30f1bc42854
SSDEEP 768:ppb1tuabwj1WVIlaFKuIJJPclXkxAc5J9UaXotuM5Uqw2mom:Uj1WelaFczPclwYtuM6qw2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35552

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

acppage.pdb

msvcrt

_lock _unlock sscanf_s _onexit _except_handler4_common ??3@YAXPAX@Z _initterm _amsg_exit _XcptFilter malloc free memset wcscat_s _wcsupr _vsnwprintf wcsstr _wcsnicmp _wcsicmp ??2@YAPAXI@Z _purecall __dllonexit memcmp

ntdll

RtlImageRvaToVa NtCreateSection RtlNtStatusToDosError NtQuerySection RtlAllocateHeap RtlFreeHeap NtQueryInformationToken NtOpenProcessToken NtClose NtOpenThreadToken RtlInitUnicodeString RtlImageDirectoryEntryToData

kernel32

GetModuleFileNameW DeactivateActCtx ActivateActCtx ReleaseActCtx CreateActCtxW MapViewOfFile LoadLibraryExW GetLocalTime CreateFileMappingW SystemTimeToFileTime GetFileTime FileTimeToSystemTime QueryActCtxW GetVersionExW UnmapViewOfFile GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId InitializeCriticalSection LeaveCriticalSection RaiseException EnterCriticalSection DisableThreadLibraryCalls DeleteCriticalSection GetLastError lstrcmpiA EncodePointer CreateProcessW HeapAlloc HeapFree GetModuleHandleW GetProcessHeap GetSystemDirectoryW RegQueryValueExW LoadLibraryW CheckElevationEnabled FormatMessageW CreateFileW GetProcAddress DecodePointer RegOpenKeyExW BasepGetExeArchType CloseHandle RegCloseKey LocalFree ExpandEnvironmentStringsW Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId

user32

GetParent IsWindowEnabled GetWindowLongW SetWindowLongW SendDlgItemMessageW ShowWindow GetSystemMetrics SetDlgItemTextW SendMessageW EnableWindow LoadStringA LoadStringW InsertMenuW GetDlgItem

shlwapi

ord487 PathFindFileNameW PathFindExtensionW ord176 StrCmpIW

shell32

SHParseDisplayName ord155 SHGetPathFromIDListW SHGetNameFromIDList SHChangeNotify SHGetItemFromDataObject

ole32

CoInitializeEx CoTaskMemAlloc CoGetObject StringFromGUID2 CoGetMalloc CoTaskMemFree CoCreateInstance HWND_UserSize HWND_UserFree ObjectStublessClient3 HWND_UserMarshal HWND_UserUnmarshal CoUninitialize

rpcrt4

CStdStubBuffer_Disconnect CStdStubBuffer_IsIIDSupported IUnknown_AddRef_Proxy CStdStubBuffer_QueryInterface CStdStubBuffer_DebugServerQueryInterface IUnknown_Release_Proxy NdrDllCanUnloadNow CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerRelease NdrCStdStubBuffer_Release NdrOleAllocate NdrOleFree IUnknown_QueryInterface_Proxy CStdStubBuffer_AddRef CStdStubBuffer_Invoke CStdStubBuffer_Connect NdrDllGetClassObject

sfc

SfcIsFileProtected

msi

ord173 ord201

apphelp

SdbReleaseDatabase SdbInitDatabase ApphelpDebugPrintf SdbGetMatchingExe SdbQueryFlagMask SdbGetAppPatchDir

$PROGRAMFILES/foler/olader/adprovider.dll

IMPHASH 33aa7b92a68c0c85a98b0049813f29de
SHA256 338287ddb5fdbf0f7540dac8ae8a3f02643f7b45f3b401a9dfa6447e39043049
MD5 f981199c82a40cf638d313c4498ecab9
SHA1 9f2ba1092a90b048aaf51304d139018e13144f3b
SHA512 09b33588e58c50036614e0fa26ccd8d94ae810f63d95c8464ae74cb9169f4ddcbcd8c019d656cd313ed65f8bb92b9782cf319866ce2a9ba1c003bd62a1bed171
SSDEEP 768:Amge8Q4UsMhIrA1pifdlIGHmizKO6EjjKRyGlqesRtgjEDy:AG548IrA1pifdRHmizKiWRPlqPjy
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

adprovider.pdb

msvcrt

??3@YAXPAX@Z _except_handler4_common realloc _vsnwprintf _errno _onexit __dllonexit _unlock _lock _initterm _amsg_exit _XcptFilter memset wcschr _purecall ??2@YAPAXI@Z _atoi64 _wcsicmp _wcsnicmp wcstoul _ultow ??_U@YAPAXI@Z memcpy_s malloc wcscat_s free wcscpy_s wcsncpy_s ??_V@YAXPAX@Z memcmp memcpy

kernel32

DisableThreadLibraryCalls GetThreadLocale SetThreadLocale DeleteCriticalSection RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetLastError GetModuleFileNameW LocalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary lstrcmpiW MultiByteToWideChar SizeofResource LoadResource FindResourceExW GetSystemTimeAsFileTime CompareFileTime Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetTickCount OutputDebugStringA SystemTimeToFileTime LocalFree GetProcAddress GetCurrentThreadId

advapi32

RegQueryValueExW RegDeleteValueW RegCreateKeyExW CryptReleaseContext CryptDestroyKey CryptGetUserKey CryptAcquireContextW RegSetValueExW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegCloseKey UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle RegOpenCurrentUser TraceMessage

wldap32

ord10 ord40 ord190 ord13 ord18 ord118 ord12 ord73 ord88 ord14 ord152 ord145 ord79 ord142 ord41 ord301 ord167 ord147 ord224 ord140 ord127 ord16 ord26 ord208 ord97

ntdsapi

DsReplicaGetInfo2W DsReplicaFreeInfo DsUnBindW DsBindW

netapi32

NetApiBufferFree DsGetDcNameW

crypt32

CertAddSerializedElementToStore CertGetCertificateContextProperty CryptHashCertificate CertFreeCertificateContext

oleaut32

RegisterTypeLi SysFreeString VarUI4FromStr UnRegisterTypeLi LoadTypeLi SysAllocString SysStringLen

ole32

CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2

user32

CharNextW UnregisterClassA

secur32

GetUserNameExW

nasial.exe

SHA256 1aa7778da7aa6b68f649b53c8346a853f598f4c1681cd978bec1cf75ce4accae
MD5 7cbae878c5e7f1ef96d351489e10d756
SHA1 c6117aaa6084399d37f06ab454b7f53470d88b1e
SHA512 133bda116b1488878911090e5708370a7c79296711cc6886dfe249b565682038d57663b6ee513e9171d0ec47379d973c498e149a7b47f0f2c2c659b4e8221b89
SSDEEP 49152:q1Ox2H5JQKV4th1F3151kjli7/Ofyig7pglKIv8Pb438KIoQGUdfB9fGQJGj4NWj:q1Ox2H5JQKV4th1F3151kjli7/Ofyigq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

4c:2d:23:27:ee:94:10:ce:f3:48:65:f6:2a:89:82:c8:bc:d6:e8:1d:4e:41:f1:2d:b4:80:c2:a2:8f:9b:9c:d9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,STREET=Business Central Towers\, Tower A\, Office 2301 2303,L=Dubai,ST=Dubai,C=AE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024145

Chains

Oct 8, 2021

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

Serial Number

1f:32:16:f4:28:f8:50:be:2c:66:ca:a0:56:f6:d8:21

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 7, 2019 - Oct 6, 2022

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

167521

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.interst

Size

512B

Virtual Size

381B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.porti

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.geysera

Size

1024B

Virtual Size

621B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.worrit

Size

1024B

Virtual Size

618B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ravelpr

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.armhoop

Size

512B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.possess

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.misappl

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.risque

Size

1024B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.toolles

Size

1024B

Virtual Size

585B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.uncompa

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.amicici

Size

512B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.logomac

Size

512B

Virtual Size

499B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bani

Size

512B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.calc

Size

1024B

Virtual Size

690B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.subles

Size

512B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.overfai

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.prakrit

Size

512B

Virtual Size

475B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aphaere

Size

512B

Virtual Size

398B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.scutchi

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yo

Size

512B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.omniana

Size

1024B

Virtual Size

646B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cardiaz

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.banc

Size

512B

Virtual Size

377B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.better

Size

1024B

Virtual Size

659B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.medicab

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.acinaci

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gran

Size

512B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.frigidn

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.perispl

Size

1024B

Virtual Size

662B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dittand

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.workmas

Size

1024B

Virtual Size

611B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wis

Size

1024B

Virtual Size

531B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.anemono

Size

1024B

Virtual Size

578B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.triplic

Size

512B

Virtual Size

417B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.autist

Size

1024B

Virtual Size

607B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.thioant

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tribrom

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.viscome

Size

1024B

Virtual Size

561B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cholorr

Size

1024B

Virtual Size

638B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.peshkar

Size

512B

Virtual Size

425B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pochay

Size

512B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.satisfa

Size

1024B

Virtual Size

639B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.unreare

Size

512B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.spagyri

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.liberal

Size

1024B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.logwood

Size

512B

Virtual Size

351B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.hellebo

Size

512B

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.relaxat

Size

326KB

Virtual Size

349KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.chrysob

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.souple

Size

512B

Virtual Size

102B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dubious

Size

512B

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

146KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

orihonvp.exe

SHA256 cfb90bf559d9835c25f8d65f3bc06aeeb7eaf0ff7abf55963622285eb715bd84
MD5 f68d6d9422b5ae428c794f1da144525b
SHA1 2451acebb1cccc35518351b2437b098682fc0143
SHA512 46972a258fadf5fe3c98c9cf45f3149db4e8bf06b883988cab9992cee0303994e1fd6ef14d9aa82b2c057a5cc300a0508736482ef9776f804a4242054f0c454d
SSDEEP 49152:Towd3wUG+5ioe4kFzkmYafm3lCezDip2nOBl2DsZy8evQijSfvzew:TovUmrFzkmMvidBlM2MlDw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4264112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

55KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

13KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

7109e67cf655b41ff88903bf1e70cc4efa3e537a38df7df90d8a3ff95c4cab58.exe

IMPHASH b1583b0de68b5707a7d41293f45591df
SHA256 7109e67cf655b41ff88903bf1e70cc4efa3e537a38df7df90d8a3ff95c4cab58
MD5 6e9fa4e2f22ce3d1a0484820964ca208
SHA1 6c5434cd4cc9305cdba85999f57df405d5a1dfa1
SHA512 5d0516f13c317290e94065da227a8fe93ddb79b7eb89a10e1515259dd48dc8736333ffc93fd458dfd96ef29ddf41a81dd1b135bdd313a41da3d43504b9b0c000
SSDEEP 12288:VE3SNI+zn1K4hsDMsaoUqZQdfcYKKhTXYcGK:NNI+g4ZPWQCxKhTIC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23957

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetPrivateProfileStringA WritePrivateProfileStringA GetCurrentDirectoryA FileTimeToSystemTime FileTimeToLocalFileTime RtlUnwind CreateThread ExitThread HeapAlloc GetStartupInfoA GetCommandLineA RaiseException HeapFree TerminateProcess HeapSize HeapReAlloc GetACP GetTimeZoneInformation GetSystemTime GetLocalTime UnhandledExceptionFilter FatalAppExitA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr GetPrivateProfileIntA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType SetUnhandledExceptionFilter LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW Sleep IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetVersionExA SetConsoleCtrlHandler CompareStringA CompareStringW SetEnvironmentVariableA GetLocaleInfoW SetErrorMode SetFileAttributesA GetProfileStringA SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime GetFileTime GetFileSize GetFileAttributesA GetOEMCP GetCPInfo GetProcessVersion GlobalFlags TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalReAlloc LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalFree LocalAlloc WideCharToMultiByte InterlockedIncrement SuspendThread SetThreadPriority lstrcmpA GetCurrentThread InterlockedDecrement GetModuleFileNameA GetShortPathNameA GetThreadLocale GetStringTypeExA GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose lstrlenA MultiByteToWideChar DeleteFileA MoveFileA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileA GetCurrentProcess DuplicateHandle lstrcpynA GetLastError SetLastError FreeLibrary GetVersion lstrcatA GetCurrentThreadId GlobalGetAtomNameA CreateEventA lstrcmpiA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcpyA GetModuleHandleA GetProcAddress LoadLibraryA ExitProcess SetEvent ResetEvent WaitForSingleObject FindResourceA LoadResource SizeofResource LockResource GlobalAlloc ResumeThread GlobalLock GlobalUnlock MulDiv GlobalFree CloseHandle FreeEnvironmentStringsA

user32

SetDlgItemTextA IsDlgButtonChecked ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow ShowWindow IsWindowEnabled GetNextDlgTabItem EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions CharUpperA ClientToScreen GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA PostQuitMessage ShowOwnedPopups ValidateRect GetActiveWindow TranslateMessage GetMessageA CreateDialogIndirectParamA EndDialog wvsprintfA CharToOemA OemToCharA LoadStringA DestroyMenu GetClassNameA GetDesktopWindow GetSysColorBrush SetCapture ReleaseCapture WaitMessage GetWindowThreadProcessId WindowFromPoint InsertMenuA DeleteMenu GetMenuStringA GetDialogBaseUnits SetRectEmpty LoadAcceleratorsA TranslateAcceleratorA LoadMenuA SetMenu ReuseDDElParam UnpackDDElParam BringWindowToTop MapWindowPoints PeekMessageA DispatchMessageA GetFocus SetActiveWindow IsWindow SetFocus AdjustWindowRectEx EqualRect DeferWindowPos BeginDeferWindowPos EndDeferWindowPos IsWindowVisible ScrollWindow SetDlgItemInt SetScrollInfo UpdateWindow GetScrollRange SetScrollRange GetScrollPos SetScrollPos GetTopWindow MessageBoxA IsChild GetCapture WinHelpA wsprintfA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID TrackPopupMenu SetWindowPlacement GetDlgItem GetWindowTextLengthA GetWindowTextA GetDlgCtrlID GetKeyState DefWindowProcA DestroyWindow CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos GetLastActivePopup GetForegroundWindow SetForegroundWindow GetWindow GetWindowLongA SetWindowLongA SetWindowPos RegisterWindowMessageA OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect GetCursorPos ScreenToClient PtInRect SetCursor IsIconic GetSystemMetrics GetClientRect SetRect EnableWindow UnregisterClassA HideCaret ShowCaret ExcludeUpdateRgn DrawIcon GetSystemMenu AppendMenuA SendMessageA LoadIconA LoadCursorA CopyRect GetSysColor FillRect GetDlgItemTextA GetDlgItemInt CheckRadioButton CheckDlgButton GetScrollInfo PostMessageA InvalidateRect GetDC DrawFocusRect DefDlgProcA ShowScrollBar SendDlgItemMessageA ReleaseDC IsWindowUnicode CharNextA InflateRect GetParent

gdi32

SetBkColor GetObjectA CreateBitmap StartDocA SaveDC RestoreDC GetStockObject SelectPalette SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx SelectClipRgn ExcludeClipRect IntersectClipRect OffsetClipRgn MoveToEx LineTo SetTextAlign SetTextJustification SetTextCharacterExtra SetTextColor GetCurrentPositionEx ArcTo SetArcDirection PolyDraw PolylineTo SetColorAdjustment PolyBezierTo GetClipRgn CreateRectRgn SelectClipPath ExtSelectClipRgn PlayMetaFileRecord GetObjectType EnumMetaFile PlayMetaFile GetViewportExtEx GetWindowExtEx CreatePen ExtCreatePen CreateHatchBrush CreatePatternBrush CreateDIBPatternBrushPt PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextExtentPoint32A GetTextMetricsA CreateFontIndirectA GetClipBox GetDCOrgEx CreateSolidBrush BitBlt CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteDC DeleteObject SetMapperFlags CreateDIBitmap PatBlt GetTextExtentPointA GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter OpenPrinterA DocumentPropertiesA

advapi32

RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegSetValueExA RegQueryValueExA RegCreateKeyExA RegOpenKeyA RegCloseKey

shell32

DragFinish SHGetFileInfoA DragAcceptFiles ShellExecuteA DragQueryFileA

comctl32

ord17

ole32

CreateStreamOnHGlobal

olepro32

ord251

Name

.text

Size

228KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

300KB

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.exe

SHA256 71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e
MD5 74d8ec87fcc6d4fb65dea95cbf0b7ed0
SHA1 0907206e93cbf8492e673c59855965bb6bd9d6aa
SHA512 5fff54384cf81a4fb2b27b25bd574630b85dbf8d1b9a9f94188720e92ee3ba8e9ed0e921922e2bba29748a2d5892330faa3780595c6977ae645170e94fb5438b
SSDEEP 6144:jI80K7rRaixyrkYTj4tO8eptRnyFWo2NZTLmdJdWqF83kdE0WPQ2:N0K7rRaUuTj/8eC6H8JZZdE3
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Digest

96:43:25:ae:64:17:1b:80:2b:6f:22:e8:bf:76:dd:75:32:0a:e0:b2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=OOO Artmarket,O=OOO Artmarket,STREET=d. 32 ofis 7\, ul. Gastello,L=Ekaterinburg,C=RU

Chains

Dec 10, 2020

CN=OOO Artmarket,O=OOO Artmarket,STREET=d. 32 ofis 7\, ul. Gastello,L=Ekaterinburg,C=RU

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=OOO Artmarket,O=OOO Artmarket,STREET=d. 32 ofis 7\, ul. Gastello,L=Ekaterinburg,C=RU

Serial Number

2c:1e:e9:b5:83:31:0b:5e:34:a1:ee:69:45:a3:4b:26

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 10, 2020 - Dec 10, 2021

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 1, 2010 - Jan 18, 2038

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

43121

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

79fb1d00ef9d85e958a17fd331b23dec507e4f2e2c150fd580d0668b84d29d00.exe

IMPHASH f0070935b15a909b9dc00be7997e6112
SHA256 79fb1d00ef9d85e958a17fd331b23dec507e4f2e2c150fd580d0668b84d29d00
MD5 f97d9e4da358b905fb068bcc044573be
SHA1 00905551c0db6102a02ae65c7e202b94e987cb86
SHA512 4936ca488024d81f84192b8ab7bec4500eb4ef71d61d3e4862e8b140f9e887120c9d671882ed442cd1d7699fe4c1235ef90172c0d619be720ef24e842fa3cdc8
SSDEEP 49152:7raLTtbKnm4Rqa1Dy1J9EJIaGNxRHxIZuDufzGo4Mrbf460DHVwggVJm4I6pMT63:Pal+FYa1KyJIaGNPRauDo5PA60tA6/i
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

374768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

255KB

Virtual Size

387KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

914B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

7ef9667e73b84b6a031e28b6279e04cd8abe82d69cd836043a7cfe0978cb8a98.exe

IMPHASH 4035d2883e01d64f3e7a9dccb1d63af5
SHA256 7ef9667e73b84b6a031e28b6279e04cd8abe82d69cd836043a7cfe0978cb8a98
MD5 bd12b3601bd72416d9520e41963125ea
SHA1 de0ce050117639effbce198f6e3d5f72c1978352
SHA512 999dafe0d27d36ddb36591563769a6ae0f7c17c4f1bb25bbe448e6c675639ecd67a3822c206e121bd552a90342e5d2c694a1548e8da840a8f27052e347816336
SSDEEP 49152:kfn0QZ9e7GSUYBGE1siw4y9fvBfQZTowhO+8L0N:uHe7GH54yQVowh8L
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

424800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

797KB

Virtual Size

797KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

780KB

Virtual Size

779KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

107KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

281B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/46

Size

512B

Virtual Size

42B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/65

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/78

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/90

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

8264e723a411381a9d837458ec39cbb36c8d582bcba14f7ed7fc45f8154c479d.exe

IMPHASH 8774ee7d6d9ba528612866f507132661
SHA256 8264e723a411381a9d837458ec39cbb36c8d582bcba14f7ed7fc45f8154c479d
MD5 6adff744d8522b6663dd71dcebc7f43e
SHA1 8ebaedcd7e1b433bc1202ab6aafa5d1c9e7e492d
SHA512 af43e11e159c0b34a61eed0f2b33c77974967a8c4237b935c19ea3b8286fdebfdf27f0b0f1ea1e64a835b753ed43e888b870c2f3c2352802486f7f4817f8f42c
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496.exe

IMPHASH eb97e4fc5518ac300a92a11673825e0b
SHA256 8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496
MD5 20bbb20ab9a373eb5134c977c7ffc05e
SHA1 cff7c57d1eaf0730fd945501dd332dd8693605bb
SHA512 fadd51df5524bc97e90e592107fa3a1d6f578e5534f9cf8b70b274651968525ee59b6ac647254c5123497fc889646ec5f228a49bd3e67fd73ecb4e68aabc38ae
SSDEEP 24576:dAHnh+eWsN3skA4RV1Hom2KXMmHa8/bX5:8h+ZkldoPK8Ya81
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

163850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

WSACleanup socket inet_ntoa setsockopt ntohs recvfrom ioctlsocket htons WSAStartup __WSAFDIsSet select accept listen bind closesocket WSAGetLastError recv sendto send inet_addr gethostbyname gethostname connect

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

InternetQueryDataAvailable InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetConnectW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

DuplicateHandle CreateThread WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW SetCurrentDirectoryW GetLongPathNameW GetShortPathNameW DeleteFileW FindNextFileW CopyFileExW MoveFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW GetCurrentProcess EnterCriticalSection LeaveCriticalSection GetStdHandle CreatePipe InterlockedExchange TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass LoadLibraryW VirtualAlloc IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedDecrement InterlockedIncrement GetCurrentThread CloseHandle GetFullPathNameW EncodePointer ExitProcess GetModuleHandleExW ExitThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode RtlUnwind ReadConsoleW GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW FindClose SetEnvironmentVariableA

user32

AdjustWindowRectEx CopyImage SetWindowPos GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu SetRect GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW MonitorFromRect keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate DispatchMessageW TranslateMessage PeekMessageW UnregisterHotKey CheckMenuRadioItem CharLowerBuffW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon SystemParametersInfoW LoadImageW GetClassNameW

gdi32

StrokePath DeleteObject GetTextExtentPoint32W ExtCreatePen GetDeviceCaps EndPath SetPixel CloseFigure CreateCompatibleBitmap CreateCompatibleDC SelectObject StretchBlt GetDIBits LineTo AngleArc MoveToEx Ellipse DeleteDC GetPixel CreateDCW GetStockObject GetTextFaceW CreateFontW SetTextColor PolyDraw BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush StrokeAndFillPath

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

GetAce RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership RegCreateKeyExW FreeSid GetTokenInformation GetSecurityDescriptorDacl GetAclInformation AddAce SetSecurityDescriptorDacl GetUserNameW InitiateSystemShutdownExW

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoSetProxyBlanket CoCreateInstanceEx CoInitializeSecurity

oleaut32

LoadTypeLibEx VariantCopyInd SysReAllocString SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptorEx SafeArrayCreateVector RegisterTypeLi CreateStdDispatch DispCallFunc VariantChangeType SysStringLen VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype VariantCopy VariantClear OleLoadPicture QueryPathOfRegTypeLi RegisterTypeLibForUser UnRegisterTypeLibForUser UnRegisterTypeLi CreateDispTypeInfo SysAllocString VariantInit

863c612734f5ff0ff0ea3fed7fd790dfb43c47eecdc1417bcd82c0ad866419af.exe

IMPHASH bacb1b451bd198b6224176f15e1822f4
SHA256 863c612734f5ff0ff0ea3fed7fd790dfb43c47eecdc1417bcd82c0ad866419af
MD5 463127c9a2b5eb1bca799aced10e4954
SHA1 df78c1cca98d6f260f744a2b0639e1fff1c11a5e
SHA512 86c01a90941ad53e7d5c77b64c249bb0b4a69d9cc0f3e3971813464312a80ef6b06caef24cec9e9e194a25f0e667eafb445acbe9ce220830e4681312b498d9a4
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8.exe

SHA256 91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8
MD5 beef5daf51dadc2acdbccc37a73ccfec
SHA1 1a49019a42f0a195828bf2a5e7b41013709cc8c9
SHA512 f6021d968f28a2dbf25e58c0bd9b474662de542b9cdf9dc3454bc97ee30e23aa2bd754c455e6fc973f7cf4ead9ca5c9f186e0cb3f9f6dec1e2f9aa3b31f64580
SSDEEP 98304:qbkDpLr5n9Ov7NCnsAAS7QG0owscxF7ZLN:q2pA7NksAASUqwsOLN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

StormKitty payload
Themida packer

Detects Themida, an advanced Windows software protection system.

themida

PE Signature issue

Digest

27:59:8e:54:40:b9:73:36:e9:d0:8c:77:02:88:f2:67:f1:4a:e0:86

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Chains

Jul 26, 2024

Minor OS version

Major OS version

Entry point

5834632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

249KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.sdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

💳NVID

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

vmp0

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe

IMPHASH b3536084cb50b2be3b69aa695eba88f0
SHA256 942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38
MD5 31b1fe0aacf5fcbced44e89252d1d4b8
SHA1 3d56a02e23bbf2f6b3ac86db262391ccd2d06e5a
SHA512 1b49741fab83d12bf0082c9ee070d999ab79860744322d755d7b5a53998ad6827d38306bb7d43763ae487ee64d451de5aec5aaab357422250174c4b8920add60
SSDEEP 12288:UhR9WptAc/LnqJc0LYBlaql0OxymXkDptSwUlq1Y4I+hHfyc:u9gtAcWfLYbOcep+Uyc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

610919

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\simirezahubigo\bev lofakuzaxumu\mi.pdb

kernel32

InterlockedPopEntrySList EnumDateFormatsW GetConsoleAliasesLengthA GetTapePosition GetLongPathNameA GetUserDefaultLangID AddRefActCtx GetCPInfoExA WriteConsoleInputW ReadConsoleInputW GetTapeParameters WaitCommEvent GetNumaNodeProcessorMask GetConsoleCP VerifyVersionInfoA WaitNamedPipeW CreateMutexA WriteConsoleW GetLastError CreateFileA DeleteFileW WritePrivateProfileSectionA GetPrivateProfileSectionW GetLongPathNameW SetStdHandle LoadLibraryW IsDebuggerPresent FindFirstVolumeW WriteFile BuildCommDCBW FindActCtxSectionStringW VerLanguageNameW SetFileShortNameW WriteProcessMemory GetFileAttributesW OpenEventA SetEvent IsBadReadPtr Sleep WaitForSingleObject LoadResource GetProfileIntA FreeConsole SetConsoleCtrlHandler SetConsoleTitleW GetCurrentConsoleFont SetConsoleTextAttribute AttachConsole GetConsoleAliasesLengthW ReadConsoleA ReadConsoleOutputW GetSystemWindowsDirectoryW GetStringTypeW BuildCommDCBAndTimeoutsA HeapUnlock HeapLock GetAtomNameW HeapReAlloc HeapCompact GetGeoInfoW GetCurrentProcess GetProcAddress GetModuleHandleA CreateThread GetVersionExW GetOEMCP WaitForMultipleObjects VerifyVersionInfoW WriteConsoleOutputCharacterA LocalAlloc SetMailslotInfo GetCPInfoExW SetEnvironmentVariableW SetCalendarInfoA CommConfigDialogA GetConsoleWindow FindAtomW SetFileApisToOEM GetStringTypeA HeapSize GetDiskFreeSpaceA GetModuleHandleW ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA HeapAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection TerminateProcess LoadLibraryA InitializeCriticalSectionAndSpinCount SetFilePointer SetHandleCount GetFileType FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc GetCPInfo GetACP IsValidCodePage RtlUnwind GetLocaleInfoA GetConsoleMode FlushFileBuffers MultiByteToWideChar LCMapStringA LCMapStringW WriteConsoleA GetConsoleOutputCP CloseHandle

95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc.exe

SHA256 95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc
MD5 d7817bc8fc539fba6388907223773546
SHA1 505409528cec20ad4744513d83489b7025d23889
SHA512 3f61fd9b1c534ad5a274d700e5ffcbd4901d1b449a49fb2f0c3b81aa0a997e9b6e2c77fa06470730bad3358f7be896a12dec5b6bab3b3a31e7a1d8907fb5e7eb
SSDEEP 49152:D3/n2UcyKARqqRp+KrZs12ai17PgRNWPmfQpPmoFjPnMBFdk3Vk9WqWLNlBDszU:Lf2GTrRE4hPMopfMdk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

351072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

716KB

Virtual Size

857KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

255B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

238KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/30

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/43

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/59

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/75

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/90

Size

970KB

Virtual Size

970KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.symtab

Size

346KB

Virtual Size

345KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe

IMPHASH e13582e50ecb7af95558f57b919f6a34
SHA256 99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e
MD5 18e0d922bead757af754e54cc744eaa0
SHA1 22a03fbc28e0dadf13e1ace67109b1dc3e91d0f5
SHA512 3f9d6ef04fbd56b1b26169c04f754ddca50f802e2dfbaa4344a82f6b724673de36c5b645ce97241eed35d5557ddaf27e20a7c699dfe1f3540010fe207df00f4f
SSDEEP 24576:gQ8nt67av7QEet8tYFKOYZDcdW1PIe+W15X1d:4nt6+vUEetcC7Y5cdW1PIe+GZ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\nuximekiso\resakuyivebuk\dowuki8.pdb

kernel32

lstrlenA EnumDateFormatsExW WriteConsoleOutputW InterlockedIncrement GetConsoleAliasA InterlockedDecrement WritePrivateProfileSectionA GetSystemWindowsDirectoryW GetEnvironmentStringsW GetUserDefaultLCID GetComputerNameW SetEvent GetConsoleAliasesLengthA GetConsoleTitleA CreateActCtxW InitializeCriticalSection GetConsoleCP GetVersionExW DnsHostnameToComputerNameW lstrcpynW SetConsoleCursorPosition GetFileAttributesW VerifyVersionInfoA HeapQueryInformation IsBadWritePtr GetCompressedFileSizeA GetSystemDirectoryA CreateFileW GetACP GetVolumePathNameA FlushFileBuffers InterlockedExchange GetLastError GetProcAddress PeekConsoleInputW CreateTimerQueueTimer LocalLock GetConsoleDisplayMode EnterCriticalSection SetTimerQueueTimer GetLocalTime WriteConsoleA LocalAlloc DeleteTimerQueue CreateTapePartition BeginUpdateResourceA GlobalGetAtomNameW WaitForMultipleObjects SetEnvironmentVariableA GetModuleFileNameA GetModuleHandleA VirtualProtect WriteConsoleOutputAttribute EndUpdateResourceA ReadConsoleInputW FindFirstVolumeW GetCurrentProcessId AreFileApisANSI LCMapStringW lstrcatA GetSystemDefaultLangID UnhandledExceptionFilter SetUnhandledExceptionFilter HeapAlloc GetModuleHandleW Sleep ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle DeleteCriticalSection LeaveCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId TerminateProcess GetCurrentProcess IsDebuggerPresent LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime RaiseException RtlUnwind GetCPInfo GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA

user32

RealGetWindowClassA

advapi32

AdjustTokenGroups

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Signatures

File Explorer

New folder (8).7z

0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe

kernel32

user32

generic

15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe

kernel32

user32

ole32

generic

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.exe

shlwapi

kernel32

user32

gdi32

generic

1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe

generic

out.upx

generic

22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe

kernel32

user32

generic

24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe

kernel32

user32

generic

2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.exe

kernel32

advapi32

shell32

generic

32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe

kernel32

user32

generic

4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe

kernel32

user32

advapi32

generic

55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.exe

generic

5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe

mscoree

dotnet

611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe

mscoree

dotnet

654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe

shell32

advapi32

winhttp

kernel32

user32

generic

6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic