002.7z
- SHA256 cc65535243dfd3cd54a9c5ecfcb93c7f918a87c725e9c52925017ab92effe278
Overview
overview
10Static
static
1001aabfaa41...50.exe
windows7-x64
301aabfaa41...50.exe
windows10-2004-x64
301c647838c...7f.exe
windows7-x64
1001c647838c...7f.exe
windows10-2004-x64
1002f5c32fa2...d6.exe
windows7-x64
602f5c32fa2...d6.exe
windows10-2004-x64
61a05cba687...a3.exe
windows7-x64
101a05cba687...a3.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows7-x64
1a8f35d0f2...b9.exe
windows10-2004-x64
1af797776e...13.exe
windows7-x64
101af797776e...13.exe
windows10-2004-x64
101b2b369f31...2e.exe
windows7-x64
31b2b369f31...2e.exe
windows10-2004-x64
31b4a0b685c...db.exe
windows7-x64
31b4a0b685c...db.exe
windows10-2004-x64
31b4d73a9a7...89.exe
windows7-x64
101b4d73a9a7...89.exe
windows10-2004-x64
101ba8934b2e...4d.exe
windows7-x64
11ba8934b2e...4d.exe
windows10-2004-x64
31c2a51daa5...5b.exe
windows7-x64
101c2a51daa5...5b.exe
windows10-2004-x64
101c8bc3890f...45.exe
windows7-x64
61c8bc3890f...45.exe
windows10-2004-x64
71ce9fa5304...ef.exe
windows7-x64
1ce9fa5304...ef.exe
windows10-2004-x64
1d51d46e07...cd.exe
windows7-x64
101d51d46e07...cd.exe
windows10-2004-x64
101db9ec5678...e0.exe
windows7-x64
101db9ec5678...e0.exe
windows10-2004-x64
101dbbed25cf...88.exe
windows7-x64
1dbbed25cf...88.exe
windows10-2004-x64
Static task
static1
19 signatures
Behavioral task
behavioral1
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral5
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win7-20240708-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral8
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral9
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win7-20240705-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral12
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral13
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win7-20240729-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral18
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral19
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win7-20240708-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral22
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral23
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral24
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral25
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral28
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral29
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral30
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral31
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 002.7z
- Size 11.2MB
- Sample240805-eee4jszepd
- SHA256 cc65535243dfd3cd54a9c5ecfcb93c7f918a87c725e9c52925017ab92effe278
- MD5 82180da2d9ecde4947a618ff1a37fdad
- SHA1 ae327ea9229498e86afb337b87cf6d6f4caaa309
- SHA512 606ddfb833eb38952403ae10e9eec694d45e3fb2df326d5825f93257d605552868343e80fd6e3a497d690dabe8ed1493b60843118f1aa5412be8cc55a66335a3
- SSDEEP 196608:nYcNyJpHBLBc6gKWYZzbK26sqaddXpgPxydfcNQChzHayMxpJ51LipiFe5TZD0B:n5yJ1pB+KWYtbK26sq25GyxcR6yMt51L
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackcat family
- Chaos Ransomware 6 IoCs
resource yara_rule static1/unpack001/1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe family_chaos static1/unpack001/1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe family_chaos static1/unpack001/1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe family_chaos static1/unpack001/1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be.exe family_chaos static1/unpack001/1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe family_chaos static1/unpack001/2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe family_chaos - Chaos family
- Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule static1/unpack001/1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe family_mafiaware666 - Detect Maui ransomware 1 IoCs
resource yara_rule static1/unpack001/1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe family_maui - Detected Djvu ransomware 1 IoCs
resource yara_rule static1/unpack001/1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe family_djvu - Djvu family
- GandCrab payload 7 IoCs
resource yara_rule static1/unpack001/01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe family_gandcrab static1/unpack001/02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe family_gandcrab static1/unpack001/1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe family_gandcrab static1/unpack001/1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba.exe family_gandcrab static1/unpack001/1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe family_gandcrab static1/unpack001/1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386.exe family_gandcrab static1/unpack001/1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9.exe family_gandcrab - Gandcrab family
- Lockbit family
- Mafiaware666 family
- Maui family
- ModiLoader Second Stage 2 IoCs
resource yara_rule static1/unpack001/1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe modiloader_stage2 static1/unpack001/2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1.exe modiloader_stage2 - Modiloader family
- Njrat family
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule static1/unpack001/1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe family_lockbit - Venus Ransomware 1 IoCs
resource yara_rule static1/unpack001/1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe family_venus - Venus family
- Unsigned PE 32 IoCs
Checks for missing Authenticode signature.
resource unpack001/01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe unpack001/01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe unpack001/02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe unpack001/1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe unpack001/1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe unpack001/1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe unpack001/1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe unpack001/1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe unpack001/1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe unpack001/1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe unpack001/1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe unpack001/1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe unpack001/1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe unpack001/1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe unpack001/1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe unpack001/1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe unpack001/1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe unpack001/1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba.exe unpack001/1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe unpack001/1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe unpack001/1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386.exe unpack001/1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069.exe unpack001/1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9.exe unpack001/1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be.exe unpack001/1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe unpack001/2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1.exe unpack001/2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe unpack001/2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe unpack001/2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc.exe unpack001/2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8.exe unpack001/2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb.exe unpack001/2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7.exe
File Explorer
-
002.7z.7z 11.2MB
-
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe.exe 155KB
-
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe.exe 79KB
-
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe.exe 70KB
-
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe.exe 92KB
-
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe.exe 92KB
-
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe.exe 2.0MB
-
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe.exe 155KB
-
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe.exe 432KB
-
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe.exe 490KB
-
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe.exe 362KB
-
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe.exe 159KB
-
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe.exe 179KB
-
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe.exe 1.2MB
-
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe.exe 6.4MB
-
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe.exe 2.4MB
-
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe.exe 92KB
-
1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe.exe 112KB
-
1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba.exe.exe 16.0MB
-
1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe.exe 155KB
-
1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe.exe 564KB
-
1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386.exe.exe 155KB
-
1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069.exe.exe 17KB
-
1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9.exe.exe 70KB
-
1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be.exe.exe 178KB
-
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe.exe 14.9MB
-
2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1.exe.exe 362KB
-
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe.exe 205KB
-
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe.exe 959KB
-
2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc.exe.exe 432KB
-
2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8.exe.exe 196KB
-
2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb.exe.exe 2.4MB
-
2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7.exe.exe 5.0MB
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
- IMPHASH 7848011b763d00cd02658995847dd30b
- SHA256 01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550
- MD5 7e3b2b10d66955465c12da9f2ab43e36
- SHA1 2ee3d7ce4ec3461026e910fdfcf9d18dd43eb380
- SHA512 ce37aff2e2aba9d6434454e17bafeebc47e9d86a716fcd9732bc03bf6484c4b6428d43322279b9273c3e5386ce924853d3aebf90178b2fa5009d63e1defd47a0
- SSDEEP 3072:l5K/B0toLuSNJilZHQsozTS+SMqqDL2/TrKLOG:lcytw7a1yTS+xqqDL6HKL
- MD5 SHA1 SHA512 SSDEEP
-
GandCrab payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcess
WaitForSingleObject
OpenProcess
Sleep
GetModuleFileNameW
CreateFileW
ExitThread
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleA
CloseHandle
GetCurrentProcessId
GetVersionExW
LoadLibraryA
lstrlenW
TerminateThread
CreateThread
WriteConsoleW
SetFilePointerEx
VirtualProtect
IsWow64Process
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCommandLineA
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
WriteFile
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
user32
SetFocus
SendMessageW
CharUpperBuffW
GetForegroundWindow
GetSystemMetrics
GetMessageW
TranslateMessage
DispatchMessageW
SetForegroundWindow
DefWindowProcW
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
keybd_event
UpdateWindow
SetWindowTextW
GetWindowLongW
SetWindowLongW
SystemParametersInfoW
GetAncestor
ntdll
RtlUnwind
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=18, version=8444,
count=4, id=225, productName=VS2013 build 21005, version=21005,
count=25, id=225, version=20806,
count=18, id=223, version=20806,
count=101, id=224, version=20806,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=138, id=1, productName=Unmarked objects,
count=2, id=228, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
- IMPHASH 202fa14f574c71c2f95878e40a79322d
- SHA256 01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f
- MD5 f9afb31bc17811e5ab4fa406f105b1fe
- SHA1 d1a9449dcc8a3aa0c887bce71f128866175f679a
- SHA512 6feca3dfa221b704208754e67bcdce02a2253961da098b3e376d11217cd00b9f77e42f37f242e1a1f4b759b5fd172c29c9f153fce32eace48e07e802aff40b55
- SSDEEP 1536:SX6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:uhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
43968
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
OpenProcess
GetTickCount
GetModuleHandleA
GetProcAddress
LoadLibraryA
lstrcmpW
lstrlenW
SetVolumeMountPointW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
lstrlenA
GetCommandLineW
FindClose
FindFirstFileW
FindNextFileW
GetFileSizeEx
GetCurrentProcess
ReadFile
SetFileAttributesW
SetFilePointerEx
WaitForSingleObject
CreateMutexA
WaitForMultipleObjects
GetCurrentProcessId
ExitProcess
CreateThread
ExitThread
SetProcessShutdownParameters
GetSystemInfo
lstrcmpiW
lstrcpyW
lstrcatW
OpenMutexA
MoveFileExW
WideCharToMultiByte
HeapAlloc
HeapFree
GetProcessHeap
ReleaseSemaphore
CreateSemaphoreA
TerminateProcess
Sleep
GetLastError
CloseHandle
GetVolumePathNamesForVolumeNameW
GetDriveTypeW
FindVolumeClose
FindNextVolumeW
GetLogicalDrives
FindFirstVolumeW
user32
wsprintfA
advapi32
QueryServiceStatusEx
OpenSCManagerA
EnumDependentServicesA
ControlService
CloseServiceHandle
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
OpenServiceA
shell32
SHEmptyRecycleBinA
CommandLineToArgvW
ShellExecuteW
netapi32
NetShareEnum
NetApiBufferFree
rstrtmgr
RmGetList
RmStartSession
RmEndSession
RmRegisterResources
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
WNetGetConnectionW
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.CRT
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=28920,
count=15, id=257, version=26715,
count=80, id=1, productName=Unmarked objects,
count=10, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=258, productName=VS2019 v16.7.1 build 29111, version=29111,
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
- IMPHASH 8735e6cad23590d9b5b60978db488a28
- SHA256 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6
- MD5 58d6eab3aafd9139a2f1c7606ecd4cef
- SHA1 4152a7431b3d5dd8b0f6ad08148cb166315f41e9
- SHA512 ae92012d8401c886cb898ac0134db1567aaefb467d04d7afdb4e3e6b390b929dc353467d55b8cce5f3c74c942ac79ce565c172e296468ac44b3d8bd730a52c49
- SSDEEP 1536:ZZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:wd5BJHMqqDL2/Ovvdr
- MD5 SHA1 SHA512 SSDEEP
-
GandCrab payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
19232
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ReadFile
SetFilePointer
GetFileAttributesW
GetLastError
MoveFileW
lstrcpyW
SetFileAttributesW
CreateMutexW
GetDriveTypeW
VerSetConditionMask
WaitForSingleObject
GetTickCount
InitializeCriticalSection
OpenProcess
GetSystemDirectoryW
TerminateThread
Sleep
TerminateProcess
VerifyVersionInfoW
WaitForMultipleObjects
DeleteCriticalSection
ExpandEnvironmentStringsW
lstrlenW
SetHandleInformation
lstrcatA
MultiByteToWideChar
CreatePipe
lstrcmpiA
Process32NextW
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
FindFirstFileW
lstrcmpW
FindClose
FindNextFileW
GetNativeSystemInfo
GetComputerNameW
GetDiskFreeSpaceW
GetWindowsDirectoryW
GetVolumeInformationW
LoadLibraryA
lstrcmpiW
VirtualFree
CreateThread
CloseHandle
lstrcatW
CreateFileMappingW
ExitThread
CreateFileW
GetModuleFileNameW
WriteFile
GetModuleHandleW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetEnvironmentVariableW
lstrcpyA
GetModuleHandleA
VirtualAlloc
GetProcAddress
Process32FirstW
GetTempPathW
GetProcessHeap
HeapFree
HeapAlloc
lstrlenA
CreateProcessW
ExitProcess
IsProcessorFeaturePresent
user32
BeginPaint
wsprintfW
TranslateMessage
LoadCursorW
LoadIconW
MessageBoxA
GetMessageW
EndPaint
DestroyWindow
RegisterClassExW
ShowWindow
CreateWindowExW
SendMessageW
DispatchMessageW
DefWindowProcW
UpdateWindow
wsprintfA
GetForegroundWindow
SetWindowLongW
gdi32
TextOutW
advapi32
FreeSid
RegSetValueExW
RegCreateKeyExW
RegCloseKey
CryptExportKey
CryptAcquireContextW
CryptGetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptGenKey
CryptDestroyKey
GetUserNameW
RegQueryValueExW
RegOpenKeyExW
AllocateAndInitializeSid
shell32
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
crypt32
CryptStringToBinaryA
CryptBinaryToStringA
wininet
InternetCloseHandle
HttpAddRequestHeadersW
HttpSendRequestW
InternetConnectW
HttpOpenRequestW
InternetOpenW
InternetReadFile
psapi
EnumDeviceDrivers
GetDeviceDriverBaseNameW
_ReflectiveLoader@0
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=223, version=20806,
count=2, id=224, version=20806,
count=2, id=224, productName=VS2013 build 21005, version=21005,
count=1, productName=Unmarked objects (old),
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=134, id=1, productName=Unmarked objects,
count=20, id=229, version=21005,
count=1, id=220, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
- IMPHASH f86dec4a80961955a89e7ed62046cc0e
- SHA256 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
- MD5 786ce74458720ec55b824586d2e5666d
- SHA1 6f62e7fe75a0876939e0dd95d314b83e25e1e395
- SHA512 083fe6cde08dac05043ecc0fdbc8b26b0764de7f651ad19e96a937bc27de96242f1763b701b308eab7e0b9a8dd88cbc45e9c891de505b5348581acd4e1495c33
- SSDEEP 1536:mBwl+KXpsqN5vlwWYyhY9S4A9eAzVbobr+t+NK1GcoDc50cO2tqpbe:Qw+asqN5aW/hL2UVEnHKIcAtcO2tqpb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
43472
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\crysis\Release\PDB\payload.pdb
kernel32
GetProcAddress
LoadLibraryA
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLastError
EnterCriticalSection
ReleaseMutex
CloseHandle
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=1, productName=Unmarked objects,
count=11, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
- IMPHASH f86dec4a80961955a89e7ed62046cc0e
- SHA256 1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9
- MD5 a23219bddf6b154ca2f5afa89cb2b0c3
- SHA1 0d63eb57023770b53b6b31f669a03bbdb7a2465b
- SHA512 65583cfa9c2d77330e15a5bfce430831b53bf1b018757fa8778618bef44b87b15d20a9bbcd80a1526bb6c582df3b8ff55f0cc7b002c4a1655c3f1ace01d54172
- SSDEEP 1536:tBwl+KXpsqN5vlwWYyhY9S4AYgfEHB0tRYn+9jsGGqbg8IIvoBec5wOmh:Hw+asqN5aW/hLmDHyt0KaIvogn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
43472
Magic Number
267
Subsystem
MAGE_SUBSYSTEM_UNKNOWN
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\crysis\Release\PDB\payload.pdb
kernel32
GetProcAddress
LoadLibraryA
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLastError
EnterCriticalSection
ReleaseMutex
CloseHandle
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=1, productName=Unmarked objects,
count=11, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813
- MD5 fa06e6aadef2365052156f12c92d7b09
- SHA1 82de91795547028be327e75cee0fdf082352bfc9
- SHA512 1629a2d234c70e7f1f5927b5a816c80b9fb2c995b4b334ff994848d3c7fe1c8797b231c4baaa63ca1e837081e9859c3ca138cd76a1db314c6b98685f5489566e
- SSDEEP 24576:a5SndG2iSNjN2w9Os9cRfO/d8mT6c6aVqwPhUMelU+V:aMfJqsgXmgyJPE
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1933934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
152KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
- IMPHASH 7848011b763d00cd02658995847dd30b
- SHA256 1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e
- MD5 f70cabb50328b089d00f82808f7e2563
- SHA1 9fd6765c2a42120042dd437fcb4468a448c64725
- SHA512 baf5abd87d7267d1b89b9779c2781604bbcdba40afab2fe4e43bd6ddb0500c89f3502a879503d6b0303da2aa169420cbd8e3ca7c85efa8604b127171c6234cec
- SSDEEP 3072:S5K/B0toLQSNJwlxwsx89TSdBgjMqqDL2/TOKyRGA:ScytwtLTTSdBgQqqDL6SKNA
- MD5 SHA1 SHA512 SSDEEP
-
GandCrab payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcess
WaitForSingleObject
OpenProcess
Sleep
GetModuleFileNameW
CreateFileW
ExitThread
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleA
CloseHandle
GetCurrentProcessId
GetVersionExW
LoadLibraryA
lstrlenW
TerminateThread
CreateThread
WriteConsoleW
SetFilePointerEx
VirtualProtect
IsWow64Process
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCommandLineA
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
WriteFile
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
user32
SetFocus
SendMessageW
CharUpperBuffW
GetForegroundWindow
GetSystemMetrics
GetMessageW
TranslateMessage
DispatchMessageW
SetForegroundWindow
DefWindowProcW
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
keybd_event
UpdateWindow
SetWindowTextW
GetWindowLongW
SetWindowLongW
SystemParametersInfoW
GetAncestor
ntdll
RtlUnwind
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=18, version=8444,
count=4, id=225, productName=VS2013 build 21005, version=21005,
count=25, id=225, version=20806,
count=18, id=223, version=20806,
count=101, id=224, version=20806,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=138, id=1, productName=Unmarked objects,
count=2, id=228, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
- SHA256 1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db
- MD5 7da83e0a63039ac6aec5b8cbc31d20d6
- SHA1 6b1d7db9600cc88922b9a213f7b30f29fe5bc20e
- SHA512 f988d36e9e67b2c8ef70968edd3de817614cf20a3a6041d77c627501186b36b4a6904e51acce876f772f0593975af1d2e50e882ba562a79c24a2ee6e1b5f0ac6
- SSDEEP 12288:iKPmrLbovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPSi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
43892
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=71, id=93, version=2179,
count=33, id=96, version=3194,
count=17, id=19, version=8124,
count=172, id=1, productName=Unmarked objects,
count=9, id=19, version=8078,
count=19, id=95, version=3349,
count=1, id=95, version=3349,
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89
- MD5 2d23c83d6941cf484da19d4367c02df0
- SHA1 b63dd1f2e35d8944dee745321643f06037dfe95e
- SHA512 28a5d2df80e9a1c5eeb65938479b7b96f754feff28244f91304361bd4c238d533f01d37598eedc95c6549c9066c8f15b2ce16262e02ce944dd47ed6e123ef797
- SSDEEP 12288:wIOfQgbI1D/Tj7MACdotmELTtqGJouy9JtsmRrTNaTI7rERFUZ1K1s9L01:rt0v4yPpS
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
439838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
422KB
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
- SHA256 1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d
- MD5 2e81a8097ac6d1902db1f74863b41c39
- SHA1 4b3a78491246f78566ec444a1c22226746a53a21
- SHA512 bcf78e32b58e559bc06067aa360630e6ac85cb9b1f120580b93c2c1e3ae051590eb406c8650bee122970d105e3359f27e6f85b2dd60da2c69ea762dc2c600b49
- SSDEEP 6144:siW7SDayqQXtokkfP6MyMQZVHewrBtM70H4dy/lrDJYgQ1qUbfc:liwdvmqVxrrlrDygfV
- MD5 SHA1 SHA512 SSDEEP
-
ModiLoader Second Stage
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
317180
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
306KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
18KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
- IMPHASH 89b43582b27abefb2b74684ab12a2f8e
- SHA256 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b
- MD5 ef577a1a486aa3dba1b0acd46b54d3a6
- SHA1 24897bc96bec3126c4a65c96b907fe57bd75359f
- SHA512 9aae8575f067614dc9bb64c3d7ac604693500922780ae81a60d7cbcee91c3c12f9e20c7fdaf9a665a58e9c314cd4c185925719bc29ae2b702879d770a2a39e39
- SSDEEP 3072:JuJ9OlKolUa1U197bzhVsmftsu3ieOfNqv1wxfs3Q0hU:Jufj0zi1dNVsmftSyyxU3Q0e
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
103535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
CreateDIBitmap
TextOutW
SetTextColor
SetPixel
GetTextMetricsW
GetTextColor
GetTextCharset
BitBlt
user32
CreateDialogParamW
CreateMenu
DefWindowProcW
EndDialog
GetDlgItem
GetKeyNameTextW
LoadImageW
kernel32
GetModuleHandleW
SetLastError
LoadLibraryW
LoadLibraryExA
FormatMessageW
GetLastError
GetDateFormatW
GetAtomNameW
Name
.text
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845
- MD5 c2fea37aa19c947614c20fe2ad3aeef2
- SHA1 16834915e3db38b5b954c2099d77bcb700428588
- SHA512 e5d86b7d03c3428c59b0d0bc7e57089abc8dc8baf3dd9dde47852c43ede1e48804851cfb3ed018121b78248f8e75ed7049ea8b2d6ed6303df36514a016e98e59
- SSDEEP 3072:ZTO/rWaQcrcfX25Qs9jRzj/rvV9Yecqj3:tO/rWayXIFVj/rvV9B
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\ConsoleApp2.pdb
mscoree
_CorExeMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
- SHA256 1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef
- MD5 f645b68f97b49c8d120158e7fd7f1460
- SHA1 b8673e2041966ace9d643106ba2aa1e69c3b9cd7
- SHA512 685594d277c7d09649fa5b3b0d363714f524be0116cdedab92b5f617e41c7a40573055f1d20d85eb629feb9e55d324a06e9e6ed7297a78d179108c4f7e57eb36
- SSDEEP 24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/BRPOO8xGKUq7:F0dwAYZt6C31WeT5RPOhxzUq7
- MD5 SHA1 SHA512 SSDEEP
-
Detected Djvu ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
147777
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
809KB
Virtual Size
809KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
247KB
Virtual Size
246KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=327, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=4, id=225, version=20806,
count=1, id=209, version=65501,
count=1, id=199, version=41118,
count=61, id=225, productName=VS2013 build 21005, version=21005,
count=31, id=223, productName=VS2013 build 21005, version=21005,
count=180, id=224, productName=VS2013 build 21005, version=21005,
count=2, id=206, version=65501,
count=2, id=208, version=65501,
count=33, id=203, version=65501,
count=236, id=1, productName=Unmarked objects,
count=8, id=229, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
- IMPHASH 9ecee117164e0b870a53dd187cdd7174
- SHA256 1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd
- MD5 356388cdb4f74188812fa44c0aef000b
- SHA1 59130f7b2e63422da6f620fa29cc6837903584cb
- SHA512 11ba99f6a151675408f76f4c02d10a80a60f74d6c4e0ef794043d36237b002cf8ab577421758f16fe678f1f190782aba7adbdf33c87693c379dd18e3176dae83
- SSDEEP 98304:f/qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8jHI:f/qPe1Cxcxk3ZAEUadzR8jHI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
39446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WaitForSingleObject
InterlockedIncrement
GetCurrentThreadId
GetCurrentThread
ReadFile
GetFileSize
CreateFileA
MoveFileExA
SizeofResource
TerminateThread
LoadResource
FindResourceA
GetProcAddress
GetModuleHandleW
ExitProcess
GetModuleFileNameA
LocalFree
LocalAlloc
CloseHandle
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GlobalAlloc
GlobalFree
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
LockResource
Sleep
GetStartupInfoA
GetModuleHandleA
advapi32
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
ChangeServiceConfig2A
SetServiceStatus
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceA
CryptGenRandom
CryptAcquireContextA
OpenServiceA
ws2_32
closesocket
recv
send
htonl
ntohl
WSAStartup
inet_ntoa
ioctlsocket
select
htons
socket
connect
inet_addr
msvcp60
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
iphlpapi
GetAdaptersInfo
GetPerAdapterInfo
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
msvcrt
__set_app_type
_stricmp
__p__fmode
__p__commode
_except_handler3
__setusermatherr
_initterm
__getmainargs
_acmdln
_adjust_fdiv
_controlfp
exit
_XcptFilter
_exit
_onexit
__dllonexit
free
??2@YAPAXI@Z
_ftol
sprintf
_endthreadex
strncpy
rand
_beginthreadex
__CxxFrameHandler
srand
time
__p___argc
Name
.text
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=4, id=14, version=7299,
count=11, id=10, version=8047,
count=1, id=11, version=8047,
count=4, id=4, version=8047,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=91, id=1, productName=Unmarked objects,
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
- IMPHASH 12fcd3183e0fb67f1e38925ed5c0c47c
- SHA256 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0
- MD5 84e2bf751724e3b0acc70b67ee1b8e96
- SHA1 2e1c9638b022901d67c69ef17c6acd12fd6e493f
- SHA512 56a229897c812cddd7f0b1847cf439f910350aa11138f7165b7c7f697095dfe5ee64e875e4262706c20e7bdbb59a94512386965e83ac9327b0b6967377882aef
- SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCp:eEtl9mRda12sX7hKB8NIyXbacAfe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
380800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcpyA
WritePrivateProfileStringA
WriteFile
WinExec
WaitForSingleObject
VirtualQuery
VirtualAlloc
UnmapViewOfFile
Sleep
SizeofResource
SetThreadLocale
SetFilePointer
SetFileAttributesA
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
MultiByteToWideChar
MulDiv
MoveFileA
MapViewOfFile
LockResource
LocalFree
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetTempPathA
GetSystemInfo
GetSystemDirectoryA
GetStringTypeA
GetStdHandle
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetExitCodeThread
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCPInfo
GetACP
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreateFileA
CreateEventA
CopyFileA
CompareStringA
CloseHandle
Sleep
user32
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WinHelpA
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCursor
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClipboardData
SetClassLongA
SetCapture
SetActiveWindow
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterClipboardFormatA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageA
OpenClipboard
OffsetRect
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
MessageBeep
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
ExitWindowsEx
EqualRect
EnumWindows
EnumThreadWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyCursor
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
SetSecurityInfo
SetEntriesInAclA
GetSecurityInfo
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdi32
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
Rectangle
RectVisible
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPointA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
ole32
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize
CoInitialize
comctl32
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
Name
CODE
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.SCY
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
- IMPHASH f86dec4a80961955a89e7ed62046cc0e
- SHA256 1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788
- MD5 a3435d1839ded089f36516c52e94f5d3
- SHA1 ffa7bf12d73d61c7cd09070f2d680c1b0eec4990
- SHA512 b3bf2296104cff14836cac3391cb12ee1ca9055673f2855bee45f552bcaf085053d1504ad5d141620e7f4a50ee407bbd8db2844cb32747cb5631efd2daaccd86
- SSDEEP 1536:tBwl+KXpsqN5vlwWYyhY9S4AwGOFr82UvQJwK:Hw+asqN5aW/hLe3rrJw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
43472
Magic Number
267
Subsystem
MAGE_SUBSYSTEM_UNKNOWN
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\crysis\Release\PDB\payload.pdb
kernel32
GetProcAddress
LoadLibraryA
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLastError
EnterCriticalSection
ReleaseMutex
CloseHandle
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=1, productName=Unmarked objects,
count=11, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
- IMPHASH a2302015856b1fdd662b0e13775ed544
- SHA256 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1
- MD5 b6cfdefd2ef6bb507cbac8634ec3f6a1
- SHA1 583bbf424a7114586dd48fe57be999cbd750ba56
- SHA512 5b8ea7112f2f5ef2f34ac18b9ce8b3afc0016c4603fe222a02a8fc03e115890bcdb4929db273026aded00aa8a226cd49c2b5cd1279086aea049c13ae7608f5e1
- SSDEEP 1536:R2HSDWrKs9S4AZvJHU4mKQvXqWJLsYfgIXE0FtRhSH0SJE3PpgNmKRUM:RjaWP3vQNJLsUE03RA1eP87
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11712
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\crysis\Release\PDB\payload.pdb
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
ws2_32
connect
socket
closesocket
gethostbyname
send
recv
WSAStartup
htonl
htons
ntohl
kernel32
FindNextFileW
FindClose
MoveFileW
GetFileSizeEx
GetModuleFileNameW
GetFileAttributesW
ExitProcess
GetCommandLineW
GetComputerNameA
CreateMutexW
lstrlenA
CreateProcessW
GetCurrentProcess
SetHandleInformation
WaitForSingleObject
GetComputerNameW
GetLogicalDrives
GetModuleHandleW
GetTickCount
DeleteFileW
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
Sleep
LeaveCriticalSection
ReadFile
CreateFileW
lstrlenW
OpenMutexW
GetProcAddress
EnterCriticalSection
WaitForMultipleObjects
CreatePipe
lstrcmpiW
DeleteCriticalSection
ReleaseMutex
CloseHandle
GetVersion
CreateThread
ExpandEnvironmentStringsW
QueryPerformanceCounter
QueryPerformanceFrequency
SetFileAttributesW
GetVolumeInformationW
WriteFile
SetFilePointerEx
SetEndOfFile
FindFirstFileW
CompareStringW
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
advapi32
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetTokenInformation
OpenProcessToken
user32
SystemParametersInfoW
shell32
ShellExecuteExW
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=74, id=1, productName=Unmarked objects,
count=9, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba.exe
- SHA256 1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba
- MD5 3031071c4a4b9c780bcc794fecf5c62b
- SHA1 8249394839971405c3193a47fa8defdd2f7e6945
- SHA512 1233e6bcb7ae1d6f5d3ea5eac7eab0486728a7a588686b5a40560a4759669d308998c76821db106b9fb22e44fb5448ab2b51c7136498e335ac55dc0bfb19d9e5
- SSDEEP 3072:S5K/B0toLOSNJvlxwsx89TSdBgjMqqDL2/TOKeHXGl:Scytwb+TTSdBgQqqDL6SKS2
- MD5 SHA1 SHA512 SSDEEP
-
GandCrab payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=18, version=8444,
count=4, id=225, productName=VS2013 build 21005, version=21005,
count=25, id=225, version=20806,
count=18, id=223, version=20806,
count=101, id=224, version=20806,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=138, id=1, productName=Unmarked objects,
count=2, id=228, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe
- IMPHASH 7848011b763d00cd02658995847dd30b
- SHA256 1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044
- MD5 bface344d14f9503aab7e59a99db6124
- SHA1 9d4e54f418f78ff7f068aeb80e6fa6dc1ac174d2
- SHA512 71406823116eadc26a3ea3c05f6d19aa0f000cd09fd402861bcf827607ae09bce6315e7572cbfca2e897b1c8962f9628cd3f71ce38a9d3156279b354bea6c0b9
- SSDEEP 3072:l5K/B0toLQSNJklZHQsozTS+SMqqDL2/TrKG+G:lcytwtQ1yTS+xqqDL6HKS
- MD5 SHA1 SHA512 SSDEEP
-
GandCrab payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcess
WaitForSingleObject
OpenProcess
Sleep
GetModuleFileNameW
CreateFileW
ExitThread
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleA
CloseHandle
GetCurrentProcessId
GetVersionExW
LoadLibraryA
lstrlenW
TerminateThread
CreateThread
WriteConsoleW
SetFilePointerEx
VirtualProtect
IsWow64Process
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCommandLineA
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
WriteFile
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
user32
SetFocus
SendMessageW
CharUpperBuffW
GetForegroundWindow
GetSystemMetrics
GetMessageW
TranslateMessage
DispatchMessageW
SetForegroundWindow
DefWindowProcW
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
keybd_event
UpdateWindow
SetWindowTextW
GetWindowLongW
SetWindowLongW
SystemParametersInfoW
GetAncestor
ntdll
RtlUnwind
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=18, version=8444,
count=4, id=225, productName=VS2013 build 21005, version=21005,
count=25, id=225, version=20806,
count=18, id=223, version=20806,
count=101, id=224, version=20806,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=138, id=1, productName=Unmarked objects,
count=2, id=228, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc
- MD5 99cc504910231308cd759c3c0b1a00ac
- SHA1 f884e5fcd3da589a0ee6036cb970e704cf511599
- SHA512 8f35a7c7d7708f8a04755560e0b672bda1744580b2d62337408cac6c3803ea4aa1c8a8894d57c9cf6aba10600456431956e230db07fe4a974ae337fedc08ea8e
- SSDEEP 3072:9Ry5r313/OQi2YcRVm16Pn6h0Hxq1MSp9i2YcRPm16Pn6ckC1jEyE9a5Zt1pDrQs:AJ3XiWm16mW6biym16rtCiym168
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
462110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\User\Desktop\5.2\Builder\CustomWindowsForm\obj\Debug\Chaos Ransomware Builder v5.pdb
mscoree
_CorExeMain
Name
.text
Size
443KB
Virtual Size
443KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386.exe
- IMPHASH 7848011b763d00cd02658995847dd30b
- SHA256 1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386
- MD5 7c693f1b689200dfa293bc59c8d2ad9d
- SHA1 ab7154a7d8e589bb91d19cb40a971667ff1b47f3
- SHA512 03ccde57d1a101508a9e7a55051bdf0869a866085ac1746b54f915883f31c4f371c2f293f068390458ac4b94ccf72bbc5fc9dbdf5e6979cc9276132693739838
- SSDEEP 3072:S5K/B0toL1SNJ5lxwsx89TSdBgjMqqDL2/TOKu5G:ScytwogTTSdBgQqqDL6SKd
- MD5 SHA1 SHA512 SSDEEP
-
GandCrab payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcess
WaitForSingleObject
OpenProcess
Sleep
GetModuleFileNameW
CreateFileW
ExitThread
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleA
CloseHandle
GetCurrentProcessId
GetVersionExW
LoadLibraryA
lstrlenW
TerminateThread
CreateThread
WriteConsoleW
SetFilePointerEx
VirtualProtect
IsWow64Process
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCommandLineA
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
WriteFile
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
user32
SetFocus
SendMessageW
CharUpperBuffW
GetForegroundWindow
GetSystemMetrics
GetMessageW
TranslateMessage
DispatchMessageW
SetForegroundWindow
DefWindowProcW
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
keybd_event
UpdateWindow
SetWindowTextW
GetWindowLongW
SetWindowLongW
SystemParametersInfoW
GetAncestor
ntdll
RtlUnwind
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=18, version=8444,
count=4, id=225, productName=VS2013 build 21005, version=21005,
count=25, id=225, version=20806,
count=18, id=223, version=20806,
count=101, id=224, version=20806,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=138, id=1, productName=Unmarked objects,
count=2, id=228, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069.exe
- IMPHASH 745d7f50636fb2b25f5ec7f180ef6ab7
- SHA256 1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069
- MD5 f956092a030e34b7d7b471383ce7e52a
- SHA1 de678ee647b172c134134ce953ad386f6e5e4021
- SHA512 a557b4ba5da1c964e04601a1de604becd8957c07000a901c04779d956236c7e40de4332bb9473dc0f87be0c417407da1026594202c8d23ac5c69b9002f6a4c71
- SSDEEP 384:1duTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zzWMQhW3WMv5:1du9CaxEovcm/BCvXcO5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
9008
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrStrW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
advapi32
CryptEncrypt
CryptHashData
CloseEventLog
RegSetValueExW
RegCloseKey
ClearEventLogW
CryptAcquireContextW
OpenEventLogW
CryptDeriveKey
CryptReleaseContext
RegDisableReflectionKey
CryptCreateHash
RegOpenKeyExW
CryptDestroyKey
CryptDestroyHash
wtsapi32
WTSDisconnectSession
WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW
WTSLogoffSession
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
kernel32
GetFileTime
GetFileAttributesW
ExpandEnvironmentStringsW
CreateThread
GetVolumeInformationW
SetFileAttributesW
GetCurrentProcessId
DeleteFileW
CloseHandle
FindNextFileW
UpdateResourceW
lstrcatW
WTSGetActiveConsoleSessionId
GetSystemDefaultLangID
ExitProcess
GetFileSize
CreateMutexW
FindFirstFileW
SetFilePointer
FreeResource
lstrlenA
GetDriveTypeW
SetEndOfFile
FindResourceW
LoadResource
CreateProcessW
EndUpdateResourceW
GetLogicalDriveStringsW
GlobalLock
WaitForSingleObject
GetModuleHandleW
GetTickCount
VirtualFree
SetFileTime
WriteFile
GlobalAlloc
Sleep
CopyFileW
SizeofResource
WaitForMultipleObjects
ReadFile
GetModuleFileNameW
CreateFileW
ExitThread
lstrcmpW
MultiByteToWideChar
lstrlenW
GlobalUnlock
GetLastError
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
MoveFileW
GetSystemDefaultLocaleName
GlobalFree
FindClose
ProcessIdToSessionId
LockResource
GetCurrentThreadId
user32
CloseClipboard
GetMessageW
PostQuitMessage
LoadCursorW
wsprintfW
DispatchMessageW
DefWindowProcW
SetWindowTextW
SetClipboardData
GetSystemMetrics
MessageBoxW
OpenClipboard
CreateWindowExW
ShowWindow
EmptyClipboard
GetWindowTextW
GetWindowLongW
LoadIconW
RegisterClassExW
TranslateMessage
gdi32
CreateSolidBrush
shell32
CommandLineToArgvW
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=123, productName=VS2005 build 50727, version=50727,
count=108, id=1, productName=Unmarked objects,
count=1, id=137, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9.exe
- IMPHASH 8735e6cad23590d9b5b60978db488a28
- SHA256 1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9
- MD5 4b1923e619b4a9e1f7a64358a1ac2de3
- SHA1 fa50e0e19dd1dfedcf5fb23c709c60cb8f78accc
- SHA512 c5b96fbfc6a4f0cf29b200a2d9682f51251ecfcc6ebfe12e04393473c57c82b1d08e474db5322d20069f6aef6223db379d114f92e39e403762ab302313c2a6de
- SSDEEP 1536:GZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:1d5BJHMqqDL2/OvvdrH
- MD5 SHA1 SHA512 SSDEEP
-
GandCrab payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
19232
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ReadFile
SetFilePointer
GetFileAttributesW
GetLastError
MoveFileW
lstrcpyW
SetFileAttributesW
CreateMutexW
GetDriveTypeW
VerSetConditionMask
WaitForSingleObject
GetTickCount
InitializeCriticalSection
OpenProcess
GetSystemDirectoryW
TerminateThread
Sleep
TerminateProcess
VerifyVersionInfoW
WaitForMultipleObjects
DeleteCriticalSection
ExpandEnvironmentStringsW
lstrlenW
SetHandleInformation
lstrcatA
MultiByteToWideChar
CreatePipe
lstrcmpiA
Process32NextW
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
FindFirstFileW
lstrcmpW
FindClose
FindNextFileW
GetNativeSystemInfo
GetComputerNameW
GetDiskFreeSpaceW
GetWindowsDirectoryW
GetVolumeInformationW
LoadLibraryA
lstrcmpiW
VirtualFree
CreateThread
CloseHandle
lstrcatW
CreateFileMappingW
ExitThread
CreateFileW
GetModuleFileNameW
WriteFile
GetModuleHandleW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetEnvironmentVariableW
lstrcpyA
GetModuleHandleA
VirtualAlloc
GetProcAddress
Process32FirstW
GetTempPathW
GetProcessHeap
HeapFree
HeapAlloc
lstrlenA
CreateProcessW
ExitProcess
IsProcessorFeaturePresent
user32
BeginPaint
wsprintfW
TranslateMessage
LoadCursorW
LoadIconW
MessageBoxA
GetMessageW
EndPaint
DestroyWindow
RegisterClassExW
ShowWindow
CreateWindowExW
SendMessageW
DispatchMessageW
DefWindowProcW
UpdateWindow
wsprintfA
GetForegroundWindow
SetWindowLongW
gdi32
TextOutW
advapi32
FreeSid
RegSetValueExW
RegCreateKeyExW
RegCloseKey
CryptExportKey
CryptAcquireContextW
CryptGetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptGenKey
CryptDestroyKey
GetUserNameW
RegQueryValueExW
RegOpenKeyExW
AllocateAndInitializeSid
shell32
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
crypt32
CryptStringToBinaryA
CryptBinaryToStringA
wininet
InternetCloseHandle
HttpAddRequestHeadersW
HttpSendRequestW
InternetConnectW
HttpOpenRequestW
InternetOpenW
InternetReadFile
psapi
EnumDeviceDrivers
GetDeviceDriverBaseNameW
_ReflectiveLoader@0
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=223, version=20806,
count=2, id=224, version=20806,
count=2, id=224, productName=VS2013 build 21005, version=21005,
count=1, productName=Unmarked objects (old),
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=134, id=1, productName=Unmarked objects,
count=20, id=229, version=21005,
count=1, id=220, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be.exe
- SHA256 1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be
- MD5 53bd35774b8d36830b5bee75acf375b2
- SHA1 c3a26e55ca87614b1eb94975d73aa39979654322
- SHA512 bcd8e164896972d46ebf325af3d1d10451a897eb3221a8cfc5191023b2b1512034f9945efc2326f21170ce241a46718dda069ce19cce8ecc8af4047cec6346d3
- SSDEEP 3072:b5BZ6q9elWNIG+9tv+9q9tBFKfpYnmig3/Vl0hpVervREDLUYwEx4:lBZ6q9Ju3HFKDi3pOeLb4
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
200798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
188KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
- IMPHASH aa466c044f0d2d2f6270070fe1bddf7b
- SHA256 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e
- MD5 97abffeaa7bdfaa81532bd6028498225
- SHA1 26ab576a0abf7085ecf6321a311a7b3088ee48ae
- SHA512 af271b15a4f64ac4965cc75f7531e28d3ea0abc90d16ae4654251a301d1a3a0b10d80b205dc626b8866c976ffacdace74f71711c73ef1240d867aeb09c47cc75
- SSDEEP 196608:aMygJ9edfbhSo5Kp8qPKlL8QgYVhqhOM8qTsSqwLM:7XJ9e1wo548qSV5VhKOeTsRwLM
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Detect MafiaWare666 ransomware
-
Detect Maui ransomware
-
Venus Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
57804
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\python-dev\porting\cpython\lib\distutils\command\wininst-9.0-amd64.pdb
comctl32
CreatePropertySheetPageA
PropertySheetA
kernel32
FreeLibrary
SetStdHandle
GetStdHandle
LocalFree
FormatMessageA
GetTempFileNameA
GetTempPathA
GetModuleHandleA
GetVersionExA
ResumeThread
SetPriorityClass
GetCurrentProcess
GetCurrentThread
SetThreadPriority
CreateProcessA
GetModuleFileNameA
RemoveDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetModuleFileNameW
SetEndOfFile
CreateFileW
GetFileSize
HeapSize
WriteConsoleW
FlushFileBuffers
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
LCMapStringW
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
LoadLibraryW
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
SetHandleCount
FatalAppExitA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
SetFilePointer
ReadFile
DeleteFileA
LoadLibraryA
GetProcAddress
MultiByteToWideChar
lstrlenA
CompareStringW
UnmapViewOfFile
CreateFileA
GetLastError
DosDateTimeToFileTime
SetFileTime
CloseHandle
CreateFileMappingA
MapViewOfFile
GetFileAttributesA
CreateDirectoryA
SetLastError
Sleep
GetProcessHeap
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteFile
HeapDestroy
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
EnterCriticalSection
LeaveCriticalSection
GetDateFormatA
GetTimeFormatA
HeapReAlloc
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
WideCharToMultiByte
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
user32
wsprintfA
GetFocus
MessageBoxA
SetCursor
GetDlgItem
SendDlgItemMessageA
GetParent
PostMessageA
GetWindowRect
MoveWindow
LoadCursorA
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
DefWindowProcA
BeginPaint
GetSystemMetrics
EndPaint
TranslateMessage
DispatchMessageA
PeekMessageA
GetDC
ReleaseDC
SendMessageA
SetDlgItemTextA
gdi32
CreateFontA
SelectObject
SetBkMode
TextOutA
SetTextColor
DeleteObject
CreateDIBitmap
CreateSolidBrush
advapi32
RegSetValueExA
RegEnumKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueA
shell32
ShellExecuteA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
Name
.text
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=152, version=20115,
count=36, id=171, productName=VS2010 build 30319, version=30319,
count=11, id=158, productName=VS2010 build 30319, version=30319,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=161, id=1, productName=Unmarked objects,
count=141, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1.exe
- SHA256 2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1
- MD5 f9951f5e40c21a78a631ab7b4a60ba89
- SHA1 5d73c066e1ba881f038c049fbafcb28070b4fe26
- SHA512 96a4c3387636971511cc1146fc5e9c9a454a98e3f1cdb52e52127a565171aa4977f041efd15f2eb8f268bf6138c23b0a061025339acb8f66ba5a1f41d3e12024
- SSDEEP 6144:UeyWvDVBSuFPRxMmcAk/eP8ph6sy4oV9bisv9tvX4FO/5VdPFMBWQRq+MCS:RyADhzveeP8p89dvn5VdPacbhR
- MD5 SHA1 SHA512 SSDEEP
-
ModiLoader Second Stage
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
317180
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
306KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
18KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4
- MD5 5e9e6b90b530260d1f6dd462a9a2fa16
- SHA1 3caa6e6d2aed85b9ea046a077a972c2a1718ee7b
- SHA512 2a0e6f2687e3bbb4158ce7bfc46b1c86794cb23fdbb041d0e5735b0e2674a9b27259edee3044e58202528e72e6c1b2ab6c4f7aeabb193f9d7f48b5bb60211f62
- SSDEEP 6144:+B4Fr9NzqHW7V5V9w/UIRZizI1aqebq/lsyp:+B45qHW7nU/pZmiXqy
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
- IMPHASH 216df81b1ef7bc2aa8ec52bbeef137c9
- SHA256 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695
- MD5 2525d5867b27f5ee3949880186c35ed7
- SHA1 8fc6dd893d10eb3f4d7c06fda1d3e05a8c7ba8ad
- SHA512 589b76ae5cddff763af93164eb817cf971a3a137a7d3a6ad6ac8c3dfcb703c49c13afb69c00d1984edbfeecc63cdefa4a6b78e1c70f6b65fb057e0e82c526376
- SSDEEP 24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdRF:Ujrc2So1Ff+B3k796r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
786320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathAppendW
activeds
ord9
ord15
kernel32
CreateProcessW
GetSystemTime
lstrlenW
LocalFree
advapi32
CheckTokenMembership
CreateWellKnownSid
ole32
CoCreateInstance
CoSetProxyBlanket
Name
.text
Size
896KB
Virtual Size
895KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
62KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
470B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26126,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=1, productName=Unmarked objects,
count=8, productName=Unmarked objects (old),
count=60, id=265, version=27043,
count=7, id=259, version=27043,
count=1, id=258, version=27043,
2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc.exe
- SHA256 2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc
- MD5 d600d6c7d26ddb9f4aa0f0474aba5cc4
- SHA1 a0944d3cef8e03dcb71025c1ab5b6c6bfb638789
- SHA512 888602f9b88bfcd99c56bca2d80541f6bf423f5530983360854a9a5bf27bddf6251f5bf9175705eb2898294898dbd0ad79b354c4c7e4f746f84807308c49f510
- SSDEEP 12288:iKPmrLeovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPSV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
43892
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=71, id=93, version=2179,
count=33, id=96, version=3194,
count=17, id=19, version=8124,
count=172, id=1, productName=Unmarked objects,
count=9, id=19, version=8078,
count=19, id=95, version=3349,
count=1, id=95, version=3349,
2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8.exe
- IMPHASH ae80b4ecb14ba8e602aaba0e2180c87d
- SHA256 2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8
- MD5 18c062ae3a545ade59842cafe5b17ea8
- SHA1 0bf7e78f698eabe7811629e12052493401bc7095
- SHA512 480584079e8cb3a6f8d9010c12348d6969a423c667e8576f6f984d3b4395aff163ef0e2a0cb01785ab8bb0d14d8fe22a5b16f55a0907e489af875fb16324e2ef
- SSDEEP 3072:z+PkbTWYtBzNgnbRh6JuB/fnDkjjdqxEIezD91+UB77:6s2cBCbRdB/fnDkjXIuRx7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
16069
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
crypt32
CryptBinaryToStringA
CryptImportPublicKeyInfo
CryptStringToBinaryA
CryptDecodeObjectEx
wininet
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
InternetOpenA
HttpSendRequestA
shlwapi
PathRemoveExtensionW
StrCmpNIA
StrToIntA
StrChrA
StrToInt64ExA
StrSpnA
PathFindFileNameW
StrStrIA
StrCmpNW
StrChrIA
StrCpyNW
PathMatchSpecW
StrCmpNIW
StrPBrkA
PathCombineW
PathSkipRootW
StrStrIW
PathUnquoteSpacesW
StrChrW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoA
mpr
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
imagehlp
CheckSumMappedFile
ws2_32
htons
sendto
socket
WSAStartup
inet_ntoa
inet_addr
htonl
shutdown
closesocket
gethostbyname
kernel32
WaitForSingleObject
SetEvent
OutputDebugStringW
SetFileTime
WriteFile
InitializeCriticalSection
Sleep
LeaveCriticalSection
GetTimeFormatW
GetFileAttributesW
FileTimeToSystemTime
ReadFile
GetFileSizeEx
MoveFileW
EnterCriticalSection
CreateEventW
SizeofResource
GetFileTime
DeleteCriticalSection
CloseHandle
FileTimeToLocalFileTime
lstrcpyW
CreateThread
LoadResource
FindResourceW
FreeResource
LocalFree
ExitProcess
lstrcpynA
MultiByteToWideChar
GetTempFileNameW
GetFileSize
MapViewOfFile
UnmapViewOfFile
FreeLibrary
CreateProcessW
LoadLibraryExW
LoadLibraryW
CopyFileW
ReadProcessMemory
GetSystemWow64DirectoryW
lstrcpynW
TerminateProcess
FlushInstructionCache
SetFilePointerEx
GetTempPathW
VirtualAllocEx
CreateFileMappingW
OpenEventW
WinExec
GetWindowsDirectoryW
DeleteFileW
WriteProcessMemory
ResumeThread
FindFirstFileW
GetModuleFileNameW
FindClose
SetFileAttributesW
WideCharToMultiByte
CreateMutexW
GetCurrentProcess
GetCurrentThreadId
SetFilePointer
SetThreadPriority
WaitForMultipleObjects
SetCurrentDirectoryW
OutputDebugStringA
SetProcessShutdownParameters
GetFileAttributesA
lstrlenA
SearchPathW
lstrcpyA
GetEnvironmentVariableW
IsBadWritePtr
TlsAlloc
GetVersionExW
lstrcmpiA
GetTickCount
GetModuleFileNameA
GetDateFormatW
GetProcAddress
lstrlenW
lstrcatW
MulDiv
GetSystemDirectoryW
CreateToolhelp32Snapshot
LockResource
SetErrorMode
GetSystemWindowsDirectoryW
GetModuleHandleW
GetVolumeInformationW
GetLastError
OpenMutexW
VirtualProtect
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
VirtualAlloc
GetModuleHandleA
QueryDosDeviceW
FindNextFileW
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
GetComputerNameA
lstrcmpiW
ExpandEnvironmentStringsW
CreateDirectoryW
Process32NextW
GetSystemInfo
OpenProcess
GetCurrentThread
IsBadStringPtrA
GetHandleInformation
IsBadCodePtr
IsBadStringPtrW
RtlUnwind
CreateFileW
FlushFileBuffers
Process32FirstW
IsBadReadPtr
advapi32
RegOpenKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetKernelObjectSecurity
LookupPrivilegeValueW
CreateWellKnownSid
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
DuplicateToken
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
GetLengthSid
RegSetValueExW
RegFlushKey
RegOpenKeyW
AdjustTokenPrivileges
RegCreateKeyExW
RegEnumValueW
RegEnumKeyW
CryptDestroyKey
CryptAcquireContextW
CryptGetKeyParam
RegDeleteValueW
CryptEncrypt
RegQueryValueExW
user32
wsprintfW
DispatchMessageW
DefWindowProcW
RegisterClassW
CreateWindowExW
PeekMessageW
TranslateMessage
wsprintfA
CharLowerBuffA
GetSystemMetrics
GetKeyboardLayoutList
ReleaseDC
SystemParametersInfoW
GetDC
DrawTextA
FillRect
GetLastInputInfo
RegisterClassExW
UnregisterClassW
GetForegroundWindow
ole32
CoCreateInstance
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoUninitialize
shell32
ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHChangeNotify
ntdll
ZwOpenSection
RtlFreeUnicodeString
NtDeleteFile
isspace
RtlDosPathNameToNtPathName_U
memmove
ZwOpenProcess
ZwClose
ZwOpenDirectoryObject
ZwQuerySystemInformation
_chkstk
ZwQueryInformationProcess
_allmul
memcpy
_alldiv
memset
_aulldvrm
NtQueryVirtualMemory
oleaut32
SysAllocString
SysFreeString
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject
netapi32
NetUserEnum
NetUserGetInfo
NetApiBufferFree
Name
.text
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=396, id=1, productName=Unmarked objects,
count=83, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb.exe
- IMPHASH 12fcd3183e0fb67f1e38925ed5c0c47c
- SHA256 2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb
- MD5 1aaee486a62300dd74c2d236a4945527
- SHA1 0a22357d6c3ccf5a3a5dbabf6e7ad874e97c1b46
- SHA512 27f681dadcab2646c3e831af145c2faac9b9265a46f3b027f9824519a9ba60912b277b4bfb90aa3d9fe989961667019353af09546bfdd0b850d656323df47643
- SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCG:eEtl9mRda12sX7hKB8NIyXbacAfh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
380800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcpyA
WritePrivateProfileStringA
WriteFile
WinExec
WaitForSingleObject
VirtualQuery
VirtualAlloc
UnmapViewOfFile
Sleep
SizeofResource
SetThreadLocale
SetFilePointer
SetFileAttributesA
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
MultiByteToWideChar
MulDiv
MoveFileA
MapViewOfFile
LockResource
LocalFree
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetTempPathA
GetSystemInfo
GetSystemDirectoryA
GetStringTypeA
GetStdHandle
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetExitCodeThread
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCPInfo
GetACP
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreateFileA
CreateEventA
CopyFileA
CompareStringA
CloseHandle
Sleep
user32
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WinHelpA
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCursor
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClipboardData
SetClassLongA
SetCapture
SetActiveWindow
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterClipboardFormatA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageA
OpenClipboard
OffsetRect
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
MessageBeep
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
ExitWindowsEx
EqualRect
EnumWindows
EnumThreadWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyCursor
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
SetSecurityInfo
SetEntriesInAclA
GetSecurityInfo
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdi32
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
Rectangle
RectVisible
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPointA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
ole32
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize
CoInitialize
comctl32
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
Name
CODE
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.SCY
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7.exe
- IMPHASH 9ecee117164e0b870a53dd187cdd7174
- SHA256 2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7
- MD5 e868a305cfda3903526adc37daf56e6d
- SHA1 11148b1bafb29ffbd30ab3eccc88de9648b756a8
- SHA512 bcb38bdb1faf2ef6a112e2f63c06d8423f649939f074228a78ff72f80abe313e9238801a059a3a931523157ac7ce71b52f49cb30fb7de5f4f3125fa7556c7b15
- SSDEEP 98304:YDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:YDqPe1Cxcxk3ZAEUadzR8yc4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
39446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WaitForSingleObject
InterlockedIncrement
GetCurrentThreadId
GetCurrentThread
ReadFile
GetFileSize
CreateFileA
MoveFileExA
SizeofResource
TerminateThread
LoadResource
FindResourceA
GetProcAddress
GetModuleHandleW
ExitProcess
GetModuleFileNameA
LocalFree
LocalAlloc
CloseHandle
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GlobalAlloc
GlobalFree
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
LockResource
Sleep
GetStartupInfoA
GetModuleHandleA
advapi32
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
ChangeServiceConfig2A
SetServiceStatus
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceA
CryptGenRandom
CryptAcquireContextA
OpenServiceA
ws2_32
closesocket
recv
send
htonl
ntohl
WSAStartup
inet_ntoa
ioctlsocket
select
htons
socket
connect
inet_addr
msvcp60
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
iphlpapi
GetAdaptersInfo
GetPerAdapterInfo
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
msvcrt
__set_app_type
_stricmp
__p__fmode
__p__commode
_except_handler3
__setusermatherr
_initterm
__getmainargs
_acmdln
_adjust_fdiv
_controlfp
exit
_XcptFilter
_exit
_onexit
__dllonexit
free
??2@YAPAXI@Z
_ftol
sprintf
_endthreadex
strncpy
rand
_beginthreadex
__CxxFrameHandler
srand
time
__p___argc
Name
.text
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
156KB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=4, id=14, version=7299,
count=11, id=10, version=8047,
count=1, id=11, version=8047,
count=4, id=4, version=8047,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=91, id=1, productName=Unmarked objects,
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,