saved from malware.7z
- SHA256 1c4b4534f2cc5f8ce484d9fc8330294254bb617af8c9ba893d23b0e7e72c3872
Static task
static1
22 signatures
Behavioral task
behavioral1
Sample
saved from malware.7z
Resource
win11-20240802-en
windows11-21h2-x64
41 signatures
1800 seconds
General
- Target saved from malware.7z
- Size 221.2MB
- Sample240816-h87x7swfml
- SHA256 1c4b4534f2cc5f8ce484d9fc8330294254bb617af8c9ba893d23b0e7e72c3872
- MD5 4bbc54320807c97bc1877e27381ab2bc
- SHA1 7c140610d8c4534929e2ae46192647b3fcc0a0c8
- SHA512 729e425896aea8397c38be27b02b1db4e88908982b44ed0a7f32e247b277602ebfc57ea41b8ab64923b20c69688c5d5d05e823a86ad54a55c0fed3ac217fdd11
- SSDEEP 3145728:LPuwsv1jkJkEIHQYOXk3DfvTQc2wAYfjqJV1RnCQ0DDzwJg1nGkciRWgenMpkTX6:LPuwsv1wgfzvTLMYfjqVkRGtnykTXBU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
cobaltstrike
Botnet
-
391144938
C2
-
http://123.207.55.181:80/match
Attributes
-
access_type
512
-
host
123.207.55.181,/match
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVbfK+aNqW68J4Ay8nuTPwy/YyzgEWgKb15Nlriq/m6jzu4pl/djNPmAw/hxNxanb6RunI1tnl0c97uAJ8JX7W535XzES5Vq6HLKbMGw6bCAh90FsfHLkllLJ1ytX1ALKEF7tCAtFFg1u+MLBQbnMNGnszM82Ce2Djv51ux3lIVQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space)
-
watermark
391144938
Extracted
Family
-
phorphiex
C2
-
http://185.215.113.66/
-
http://77.91.77.92/
-
http://91.202.233.141/
Wallets
-
0xCa90599132C4D88907Bd8E046540284aa468a035
-
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
-
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
-
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
-
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
-
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
-
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
-
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
-
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
-
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
-
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
-
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
-
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
-
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
-
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
-
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
-
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
Attributes
-
mutex
x66x54x66x
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Extracted
Family
-
redline
C2
-
38.180.203.208:14238
-
185.215.113.9:12617
Extracted
Family
-
metasploit
Version
-
windows/reverse_tcp
C2
-
103.42.55.251:8080
Extracted
Family
-
redline
Botnet
-
kir
C2
-
147.45.44.73:6282
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
91.92.240.41:7575
Mutex
-
7029ef73-6025-47e5-b0d0-fb5b27c261b8
Attributes
-
activate_away_mode
false
-
backup_connection_host
91.92.240.41
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-05-23T20:48:22.996317836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
7575
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
7029ef73-6025-47e5-b0d0-fb5b27c261b8
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
91.92.240.41
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
5000
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
127.0.0.1:1604
-
127.0.0.1:22253
-
eu-central-7075.packetriot.net:6606
-
eu-central-7075.packetriot.net:7707
-
eu-central-7075.packetriot.net:8808
-
eu-central-7075.packetriot.net:1604
-
eu-central-7075.packetriot.net:22253
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/saved from malware/a/stub.exe family_asyncrat - Asyncrat family
- Cobaltstrike family
- Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/saved from malware/a/msedge.exe family_xworm - Metasploit family
- Mimikatz family
- Nanocore family
- Phorphiex family
- Phorphiex payload 16 IoCs
resource yara_rule static1/unpack001/saved from malware/Files/1.exe family_phorphiex static1/unpack001/saved from malware/Files/11.exe family_phorphiex static1/unpack001/saved from malware/Files/a.exe family_phorphiex static1/unpack001/saved from malware/Files/m.exe family_phorphiex static1/unpack001/saved from malware/Files/newtpp.exe family_phorphiex static1/unpack001/saved from malware/Files/o.exe family_phorphiex static1/unpack001/saved from malware/Files/pi.exe family_phorphiex static1/unpack001/saved from malware/Files/pp.exe family_phorphiex static1/unpack001/saved from malware/Files/r.exe family_phorphiex static1/unpack001/saved from malware/Files/s.exe family_phorphiex static1/unpack001/saved from malware/Files/t.exe family_phorphiex static1/unpack001/saved from malware/Files/t1.exe family_phorphiex static1/unpack001/saved from malware/Files/t2.exe family_phorphiex static1/unpack001/saved from malware/Files/tdrpload.exe family_phorphiex static1/unpack001/saved from malware/Files/tt.exe family_phorphiex static1/unpack001/saved from malware/Files/twztl.exe family_phorphiex - RedLine payload 3 IoCs
resource yara_rule static1/unpack001/saved from malware/Files/4ck3rr.exe family_redline static1/unpack001/saved from malware/a/cookie250.exe family_redline static1/unpack001/saved from malware/a/exec.exe family_redline - Redline family
- SectopRAT payload 1 IoCs
resource yara_rule static1/unpack001/saved from malware/a/authenticator.exe family_sectoprat - Sectoprat family
- XMRig Miner payload 2 IoCs
resource yara_rule static1/unpack001/saved from malware/Files/xmrig.exe xmrig static1/unpack001/saved from malware/Files/xmrig.exe family_xmrig - Xmrig family
- Xworm family
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule static1/unpack001/saved from malware/Files/mimikatz.exe mimikatz -
resource yara_rule static1/unpack001/saved from malware/Files/%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe upx static1/unpack001/saved from malware/Files/Crack.exe upx static1/unpack001/saved from malware/Files/DelHosts.exe upx static1/unpack001/saved from malware/Files/DownSysSoft.exe upx static1/unpack001/saved from malware/Files/Downaqzh.exe upx static1/unpack001/saved from malware/Files/Downdd.exe upx static1/unpack001/saved from malware/Files/Downggzh.exe upx static1/unpack001/saved from malware/Files/Downty.exe upx static1/unpack001/saved from malware/Files/clear.exe upx static1/unpack001/saved from malware/Files/firefox.exe upx static1/unpack001/saved from malware/Files/pocketrar350sc.exe upx static1/unpack001/saved from malware/a/OpenArk32.exe upx static1/unpack001/saved from malware/a/OpenArk64.exe upx - AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack004/out.upx autoit_exe static1/unpack007/out.upx autoit_exe static1/unpack008/out.upx autoit_exe static1/unpack009/out.upx autoit_exe - Detects Pyinstaller 2 IoCs
resource yara_rule static1/unpack001/saved from malware/Files/pered.exe pyinstaller static1/unpack001/saved from malware/a/networks_profile.exe pyinstaller - Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule static1/unpack001/saved from malware/Files/66b09d7d34310_DefragManager.exe embeds_openssl - Unsigned PE 125 IoCs
Checks for missing Authenticode signature.
resource unpack001/saved from malware/Files/%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe unpack001/saved from malware/Files/%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe unpack002/out.upx unpack001/saved from malware/Files/1.exe unpack001/saved from malware/Files/11.exe unpack001/saved from malware/Files/1111.exe unpack001/saved from malware/Files/4ck3rr.exe unpack001/saved from malware/Files/66ab1b27ae40b_BotClient.exe5wDUFGqU3QeuQlEX unpack001/saved from malware/Files/66ae9b239854c_crypto.exe unpack001/saved from malware/Files/66b1c36969eae_main.exe unpack001/saved from malware/Files/66b7a2aef1283_doz.exe unpack001/saved from malware/Files/Crack.exe unpack003/out.upx unpack001/saved from malware/Files/DelHosts.exe unpack004/out.upx unpack001/saved from malware/Files/DownSysSoft.exe unpack001/saved from malware/Files/Downaqzh.exe unpack001/saved from malware/Files/Downdd.exe unpack007/out.upx unpack001/saved from malware/Files/Downggzh.exe unpack008/out.upx unpack001/saved from malware/Files/Downty.exe unpack009/out.upx unpack001/saved from malware/Files/JQMain.exe unpack001/saved from malware/Files/L.exe unpack001/saved from malware/Files/M5traider.exe unpack001/saved from malware/Files/Meredrop.exe unpack001/saved from malware/Files/PXHMAIN.exe unpack001/saved from malware/Files/Project_8.exe unpack001/saved from malware/Files/SvCpJuhbT.exe unpack001/saved from malware/Files/a.exe unpack001/saved from malware/Files/aaa.exe unpack001/saved from malware/Files/abc.exe unpack001/saved from malware/Files/amadey.exe unpack001/saved from malware/Files/build_2024-07-27_00-41.exe unpack001/saved from malware/Files/clear.exe unpack001/saved from malware/Files/cmd/uninstall.exe unpack001/saved from malware/Files/ds.exe unpack001/saved from malware/Files/guardservice.exe unpack001/saved from malware/Files/m.exe unpack001/saved from malware/Files/mimikatz.exe unpack001/saved from malware/Files/nc.exe unpack001/saved from malware/Files/newtpp.exe unpack001/saved from malware/Files/npp.exe unpack001/saved from malware/Files/nxmr.exe unpack001/saved from malware/Files/o.exe unpack001/saved from malware/Files/pei.exe unpack001/saved from malware/Files/peinf.exe unpack001/saved from malware/Files/pered.exe unpack001/saved from malware/Files/pi.exe unpack001/saved from malware/Files/pimer_bbbcontents7.exe unpack001/saved from malware/Files/pocketrar350sc.exe unpack001/saved from malware/Files/pp.exe unpack001/saved from malware/Files/ps.exe unpack001/saved from malware/Files/r.exe unpack001/saved from malware/Files/random.exe unpack001/saved from malware/Files/request.exe unpack001/saved from malware/Files/s.exe unpack001/saved from malware/Files/sthealthclient.exe unpack001/saved from malware/Files/t.exe unpack001/saved from malware/Files/t1.exe unpack001/saved from malware/Files/t2.exe unpack001/saved from malware/Files/tdrpload.exe unpack001/saved from malware/Files/tools.exe unpack001/saved from malware/Files/tpeinf.exe unpack001/saved from malware/Files/tt.exe unpack001/saved from malware/Files/twztl.exe unpack001/saved from malware/Files/v.exe unpack001/saved from malware/Files/xmrig.exe unpack001/saved from malware/a/1111.exe unpack001/saved from malware/a/66ae9b239854c_crypto.exe unpack001/saved from malware/a/66af4e35e761b_doz.exe unpack001/saved from malware/a/66af531b832ee_main.exe unpack001/saved from malware/a/66af9bdbf0f60_Team.exe unpack001/saved from malware/a/66afa0d3934d8_ultfix.exe unpack001/saved from malware/a/66b09f01e0030_dozkey.exe unpack001/saved from malware/a/66b0ba4420669_main.exe unpack001/saved from malware/a/66b0ee142cf8f_PhotosExifEditor.exe unpack001/saved from malware/a/66b1b02a20b5a_cry.exe unpack001/saved from malware/a/66b331646d2cd_123p.exe unpack001/saved from malware/a/66b331997e05e_main21.exe unpack001/saved from malware/a/66b382f122c02_stk.exe unpack001/saved from malware/a/66b38609432fa_sosusion.exe unpack001/saved from malware/a/66b4ed2ceb0d7_stealc.exe unpack001/saved from malware/a/66b5ac1092454_otraba.exe unpack001/saved from malware/a/66b5ac957cc65_crypta.exe unpack001/saved from malware/a/66b5b75106ac6_stealc.exe unpack001/saved from malware/a/66b5d9d3adbaa_defaultr.exe unpack001/saved from malware/a/66b74da9b163e_1234.exe unpack001/saved from malware/a/66b7d12b3a8ea_5k.exe unpack001/saved from malware/a/66b7d3a2e7a4d_deepweb.exe unpack001/saved from malware/a/66b85f47d1f63_stealc.exe unpack001/saved from malware/a/Extreme%20Injector%20v3.exe unpack001/saved from malware/a/GGWS.exe unpack001/saved from malware/a/GGWSUpdate.exe unpack001/saved from malware/a/Identifications.exe unpack001/saved from malware/a/NJTCFVIV.exe unpack001/saved from malware/a/OpenArk32.exe unpack001/saved from malware/a/OpenArk64.exe unpack001/saved from malware/a/STHealthUpdate.exe unpack001/saved from malware/a/T7.exe unpack001/saved from malware/a/T9.exe unpack001/saved from malware/a/TTF.exe unpack001/saved from malware/a/U.exe unpack001/saved from malware/a/WE.exe unpack001/saved from malware/a/asusns.exe unpack001/saved from malware/a/authenticator.exe unpack001/saved from malware/a/backdoor.exe unpack001/saved from malware/a/build2.exe unpack001/saved from malware/a/c7.exe unpack001/saved from malware/a/cookie250.exe unpack001/saved from malware/a/exec.exe unpack001/saved from malware/a/keylogger.exe unpack001/saved from malware/a/msedge.exe unpack001/saved from malware/a/mservice64.exe unpack001/saved from malware/a/nano.exe unpack001/saved from malware/a/networks_profile.exe unpack001/saved from malware/a/out_test_sig.exe unpack001/saved from malware/a/pimer_bbbcontents7.exe unpack001/saved from malware/a/regasm.exe unpack001/saved from malware/a/request.exe unpack001/saved from malware/a/robotic.exe unpack001/saved from malware/a/sthealthclient.exe unpack001/saved from malware/a/stub.exe unpack001/saved from malware/a/wahost.exe
File Explorer
-
saved from malware.7z.7z 221.2MB
-
saved from malware/Files/%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe.exe 4.1MB
-
saved from malware/Files/%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe.exe 5.7MB
-
out.upx.exe 15.6MB
-
saved from malware/Files/-.exe2KB
-
saved from malware/Files/02.08.2022.exe218KB
-
saved from malware/Files/1.exe.exe 79KB
-
saved from malware/Files/11.exe.exe 83KB
-
saved from malware/Files/1111.exe.exe 2.8MB
-
saved from malware/Files/4ck3rr.exe.exe 304KB
-
saved from malware/Files/66ab1b27ae40b_BotClient.exe.exe 6.0MB
-
saved from malware/Files/66ab1b27ae40b_BotClient.exe5wDUFGqU3QeuQlEX.exe 556KB
-
saved from malware/Files/66ae9b239854c_crypto.exe.exe 4.5MB
-
saved from malware/Files/66b09d7d34310_DefragManager.exe.exe 7.0MB
-
saved from malware/Files/66b1c36969eae_main.exe.exe 4.0MB
-
saved from malware/Files/66b7a2aef1283_doz.exe.exe 4.5MB
-
saved from malware/Files/ChatLife.exe.exe 2.4MB
-
saved from malware/Files/Crack.exe.exe 4.9MB
-
out.upx.exe 14.7MB
-
saved from malware/Files/DelHosts.exe.exe 328KB
-
out.upx.exe 694KB
-
saved from malware/Files/DownSysSoft.exe.exe 373KB
-
saved from malware/Files/Downaqzh.exe.exe 1.6MB
-
saved from malware/Files/Downdd.exe.exe 1.1MB
-
out.upx.exe 694KB
-
saved from malware/Files/Downggzh.exe.exe 1.2MB
-
out.upx.exe 1.6MB
-
saved from malware/Files/Downty.exe.exe 1.2MB
-
out.upx.exe 1.6MB
-
saved from malware/Files/JQMain.exe.exe 2.6MB
-
saved from malware/Files/L.exe.exe 315KB
-
saved from malware/Files/M5traider.exe.exe 4.6MB
-
saved from malware/Files/Meredrop.exe.exe 32KB
-
saved from malware/Files/PXHMAIN.exe.exe 3.9MB
-
saved from malware/Files/Project_8.exe.exe 311KB
-
saved from malware/Files/SvCpJuhbT.exe.exe 1.7MB
-
saved from malware/Files/a.exe.exe 92KB
-
saved from malware/Files/aaa.exe.exe 23KB
-
saved from malware/Files/abc.exe.exe 72KB
-
saved from malware/Files/amadey.exe.exe 260KB
-
saved from malware/Files/build_2024-07-27_00-41.exe.exe 255KB
-
saved from malware/Files/clear.exe.exe 329KB
-
saved from malware/Files/cmd/pocketrar.chm.chm 21KB
-
saved from malware/Files/cmd/rar.ini139B
-
saved from malware/Files/cmd/rar.ppc_arm.cab.cab 312KB
-
saved from malware/Files/cmd/uninstall.exe.exe 8KB
-
saved from malware/Files/cmd/whatsnew.htm.html 951B
-
saved from malware/Files/ds.exe.exe 3.2MB
-
saved from malware/Files/firefox.exe.exe 393KB
-
saved from malware/Files/guardservice.exe.exe 304KB
-
saved from malware/Files/m.exe.exe 92KB
-
saved from malware/Files/mimikatz.exe.exe 1.0MB
-
saved from malware/Files/nc.exe.exe 30KB
-
saved from malware/Files/newtpp.exe.exe 96KB
-
saved from malware/Files/npp.exe.exe 13KB
-
saved from malware/Files/nxmr.exe.exe 5.4MB
-
saved from malware/Files/o.exe.exe 88KB
-
saved from malware/Files/pei.exe.exe 9KB
-
saved from malware/Files/peinf.exe.exe 20KB
-
saved from malware/Files/pered.exe.exe 10.9MB
-
saved from malware/Files/pi.exe.exe 79KB
-
saved from malware/Files/pimer_bbbcontents7.exe.exe 5.8MB
-
saved from malware/Files/pocketrar350sc.exe.exe 381KB
-
saved from malware/Files/pp.exe.exe 88KB
-
saved from malware/Files/ps.exe.exe 19KB
-
saved from malware/Files/r.exe.exe 88KB
-
saved from malware/Files/random.exe.exe 1.8MB
-
saved from malware/Files/request.exe.exe 307KB
-
saved from malware/Files/s.exe.exe 88KB
-
saved from malware/Files/sthealthclient.exe.exe 2.9MB
-
saved from malware/Files/t.exe.exe 79KB
-
saved from malware/Files/t1.exe.exe 88KB
-
saved from malware/Files/t2.exe.exe 88KB
-
saved from malware/Files/tdrpload.exe.exe 88KB
-
saved from malware/Files/tools.exe.exe 316KB
-
saved from malware/Files/tpeinf.exe.exe 6KB
-
saved from malware/Files/tt.exe.exe 88KB
-
saved from malware/Files/twztl.exe.exe 88KB
-
saved from malware/Files/v.exe.exe 11KB
-
saved from malware/Files/xmrig.exe.exe 7.9MB
-
saved from malware/a/1111.exe.exe 2.8MB
-
saved from malware/a/66ae96cb3d23b_crypted.exe.exe 932KB
-
saved from malware/a/66ae9b239854c_crypto.exe.exe 4.5MB
-
saved from malware/a/66af4e35e761b_doz.exe.exe 4.5MB
-
saved from malware/a/66af531b832ee_main.exe.exe 4.4MB
-
saved from malware/a/66af9bdbf0f60_Team.exe.exe 14.4MB
-
saved from malware/a/66afa0d3934d8_ultfix.exe.exe 16.3MB
-
saved from malware/a/66b09f01e0030_dozkey.exe.exe 4.0MB
-
saved from malware/a/66b0ba4420669_main.exe.exe 3.9MB
-
saved from malware/a/66b0ee142cf8f_PhotosExifEditor.exe.exe 7.9MB
-
saved from malware/a/66b1b02a20b5a_cry.exe.exe 338KB
-
saved from malware/a/66b331646d2cd_123p.exe.exe 10.3MB
-
saved from malware/a/66b331997e05e_main21.exe.exe 8.3MB
-
saved from malware/a/66b382f122c02_stk.exe.exe 6.5MB
-
saved from malware/a/66b38609432fa_sosusion.exe.exe 2.8MB
-
saved from malware/a/66b38b9ae0da3_palnet_new.exe.exe 2.8MB
-
saved from malware/a/66b4af430a0a1_files.exe.exe 6.2MB
-
saved from malware/a/66b4b5e40dbf6_template832components.exe.exe 6.0MB
-
saved from malware/a/66b4ed2ceb0d7_stealc.exe.exe 6.2MB
-
saved from malware/a/66b5ac1092454_otraba.exe.exe 6.4MB
-
saved from malware/a/66b5ac957cc65_crypta.exe.exe 6.7MB
-
saved from malware/a/66b5ace3a06b0_dozkey.exe.exe 6.1MB
-
saved from malware/a/66b5b75106ac6_stealc.exe.exe 6.0MB
-
saved from malware/a/66b5d9d3adbaa_defaultr.exe.exe 11.1MB
-
saved from malware/a/66b74da9b163e_1234.exe.exe 5.9MB
-
saved from malware/a/66b7a2aef1283_doz.exe.exe 4.5MB
-
saved from malware/a/66b7a4a075311_AsianAsp.exe.exe 1.1MB
-
saved from malware/a/66b7d12b3a8ea_5k.exe.exe 411KB
-
saved from malware/a/66b7d3a2e7a4d_deepweb.exe.exe 104KB
-
saved from malware/a/66b837290469c_vidar.exe.exe 9.3MB
-
saved from malware/a/66b85f47d1f63_stealc.exe.exe 7.0MB
-
saved from malware/a/ApertureLab.exe.exe 2.1MB
-
saved from malware/a/Extreme%20Injector%20v3.exe.exe 1.9MB
-
saved from malware/a/GGWS.exe.exe 6.1MB
-
saved from malware/a/GGWSUpdate.exe.exe 34KB
-
saved from malware/a/Identifications.exe.exe 9.2MB
-
saved from malware/a/InstallerPack_20.1.23770_win64.exe.exe 3.2MB
-
saved from malware/a/NJTCFVIV.exe.exe 6.6MB
-
saved from malware/a/OpenArk32.exe.exe 9.9MB
-
saved from malware/a/OpenArk64.exe.exe 2.3MB
-
saved from malware/a/STHealthUpdate.exe.exe 237KB
-
saved from malware/a/T7.exe.exe 13KB
-
saved from malware/a/T9.exe.exe 13KB
-
saved from malware/a/TTF.exe.exe 13KB
-
saved from malware/a/U.exe.exe 13KB
-
saved from malware/a/Update/server.txt10B
-
saved from malware/a/WE.exe.exe 13KB
-
saved from malware/a/asusns.exe.exe 701KB
-
saved from malware/a/authenticator.exe.exe 768KB
-
saved from malware/a/backdoor.exe.exe 68KB
-
saved from malware/a/build2.exe.exe 481KB
-
saved from malware/a/c7.exe.exe 316KB
-
saved from malware/a/cookie250.exe.exe 304KB
-
saved from malware/a/exec.exe.exe 304KB
-
saved from malware/a/keylogger.exe.exe 51KB
-
saved from malware/a/l2.exe.exe 4.4MB
-
saved from malware/a/msedge.exe.exe 271KB
-
saved from malware/a/mservice64.exe.exe 668KB
-
saved from malware/a/nano.exe.exe 552KB
-
saved from malware/a/networks_profile.exe.exe 6.6MB
-
saved from malware/a/out_test_sig.exe.exe 5.0MB
-
saved from malware/a/pimer_bbbcontents7.exe.exe 5.8MB
-
saved from malware/a/regasm.exe.exe 593KB
-
saved from malware/a/request.exe.exe 307KB
-
saved from malware/a/robotic.exe.exe 538KB
-
saved from malware/a/sahost.exe.exe 499KB
-
saved from malware/a/settings.xml2KB
-
saved from malware/a/sthealthclient.exe.exe 3.8MB
-
saved from malware/a/stub.exe.exe 48KB
-
saved from malware/a/wahost.exe.exe 712KB
saved from malware/Files/%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
- IMPHASH a18c466a89c034cf01801b0439542035
- SHA256 cc856459a4e59536f5276a5407ae5d11f483f66833a3a2b83f2dd5212046411d
- MD5 ebfd3e0c316f18e67b677afbc1f5f1a8
- SHA1 756759c8fca0c398ffe1a7b95fe7050494481fcf
- SHA512 669158d4f0949db4937f241e3112e157cdfd88c809c5aa94774b37e963037b514afe8f862cf19428f6b83bd8e51a2f7ecd3acd4ce649b0e21257dcb3f4548f45
- SSDEEP 98304:nuW2HbA6WrHDvQZfuMquT8xYxliMdQjAypljr+iX3oN:uW2H8ZjcllqgB9ijAUl3JM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6619136
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
GetKeyboardType
gdi32
UnrealizeObject
version
VerQueryValueA
mpr
WNetGetConnectionA
ole32
CreateStreamOnHGlobal
comctl32
_TrackMouseEvent
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
wsock32
WSACleanup
gdiplus
GdipSetStringFormatLineAlign
Name
.text
Size
2.7MB
Virtual Size
6.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
saved from malware/Files/%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe
- SHA256 efc9e08763b007f9c9d3e6b36cd612539a54e058a6dcd488edcff4e214ca40be
- MD5 dc481056e65328f44e332a878d9e2064
- SHA1 6af46d6dd1c17362e545306f623e68fee8b3f98b
- SHA512 eea05fa6a5456be2c2730dbf3c8fe3b1bff78cdd9883b81b1df4fff5ccff5bdb3b3f4d0a766b0e9e99361270c37b92805fd7408e0fcbe8cf6c9f028a1c02372c
- SSDEEP 98304:8M+1abNYfH8kcAjW1tmmSCRaaj0iVwOC+H+BIiw37sPZ4n6VVSDtGWJkifj+7dOB:qaC3jWTaaB5C0DdrEZpQDtb7+7Q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
16928416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
10.5MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
5.7MB
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 770a49c99922e2bd20e6cd7bcc34ceb6bde5c596576661c61853e350b60fb80c
- MD5 5a4640adfcd1d2df44e8755e9b7b9f60
- SHA1 48cc619e39035b5eb9b99944a2dfb5dd26eb9d16
- SHA512 1a6f22e17f4cf8da8b8d990e9bcd37807ccf29c8b40f7d62abbac0e4c483a44b56e58867520011e77d0198a35317351bb859262f55923387afbeefb037de4686
- SSDEEP 98304:m0W8Hi5tIvW3+WjaQbVNnn8Z17VJhmuXhEiZGZBRA5RApraQyW:m0W8u1+WmQZNnu1HhmuXiiI/C5C
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
375584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
7.8MB
Virtual Size
7.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7.5MB
Virtual Size
7.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
232KB
Virtual Size
668KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
146KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/Files/-.exe
- SHA256 0747d310fa7eb38b745e66c4bc4e3880aeb33b233c50178917fee78104a27250
- MD5 365d861496ac2e1e2a55eb7f980493ab
- SHA1 2a9289d5ed69393673d3649961de1e8f442e0bfa
- SHA512 26c0ac4d30dcb946aa0fe584b4414a52c7bdcd768b80a6cddbee4539428b2e577ab0c18bb640bbcbb4ff637e925fe9b7205e59231f6d93bc16eef434acbf84dc
- MD5 SHA1 SHA512
saved from malware/Files/02.08.2022.exe
- SHA256 a2815d50847da2b50ae77545eb82b167e190dfa2c25bfa975a07961be75cc185
- MD5 250807bf0ec850b6f3e58546afa885ba
- SHA1 6184ab13f436dc2d4ace7b3e4ebb4bc61ad6f82f
- SHA512 a1f66ea51f2ed71e595c5468591e42deaa625452813f22557ce707e8b1f89c0f8dd5af526b64dde22981a46c07deee09f89a2264dbb2758c4fd7681d6859491d
- SSDEEP 6144:IY5BXNyvhjB/awqe+web+KJjKKTC6duA9r:/5BXNKh1+91NJjKydl9r
- MD5 SHA1 SHA512 SSDEEP
saved from malware/Files/1.exe
- IMPHASH e3b708193fe03ba1bfd096b4ae42f3b9
- SHA256 d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3
- MD5 e2e3268f813a0c5128ff8347cbaa58c8
- SHA1 4952cbfbdec300c048808d79ee431972b8a7ba84
- SHA512 cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc
- SSDEEP 1536:W9mw4/inFmav82TmKtj+5qUPsY3BCHYJhcWPA4G9kj3K1:CmwohOBiPsWMH4ogj3K
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29968
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
_vscprintf
srand
rand
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/11.exe
- IMPHASH e3b708193fe03ba1bfd096b4ae42f3b9
- SHA256 e0fed327dff0a36790efc0db5ecd4a5ceac7fbb0291c64acf426f568bbbd2533
- MD5 e9176f13f2c475d855a63c6b4a08fec6
- SHA1 fb1a4067560bafdfebfba3cca44e1e779deac221
- SHA512 0d4c9fee369437c1756d1e25b1aa3513bef7bb0a921341e6f22ceb746ab360fc9287919fa20c71764d354b2aeeb396531fccb56cd530c5bebc32e6184388f84e
- SSDEEP 1536:/9mw4/inFmav82TmKtj+5qUPsY3BCHYJhcWPA4G9kj3K1I:VmwohOBiPsWMH4ogj3K+
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
94208
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
_vscprintf
srand
rand
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/1111.exe
- IMPHASH 74aaf0b5a0230a863603c8c6bcd8756b
- SHA256 da96b85bb04c797fd30df884ec895f8a03c7dc98c9e188733a4ee1d8754fec70
- MD5 2055eb0fa5dfccef0c68146527b0c4f4
- SHA1 9a04941b835e1f13d96a3b4fcd137038689105a3
- SHA512 8aa28d3febc2c2aeeed19f75cb871ef5f5e5e105108b7f210c54dcf9c9aafb193a9287be99bacea3e713807a89fd9c8f637b45c849e2336e6397844187a643e4
- SSDEEP 49152:54sOIb6IN32aRdB3c9dhawmxMGkzLhwGiPYm4+Zniq:54dHINGaRdB3cThawmUr+8q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetTempPathA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrlenA
msvcrt
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_assert
_cexit
_errno
_chsize
_filelengthi64
_fileno
_initterm
_iob
_lock
_onexit
_unlock
abort
atoi
calloc
exit
fclose
fflush
fgetpos
fopen
fputc
fread
free
freopen
fsetpos
fwrite
getc
islower
isspace
isupper
isxdigit
localeconv
malloc
memcmp
memcpy
memmove
memset
mktime
localtime
difftime
_mkdir
perror
printf
realloc
remove
setlocale
signal
strchr
strcmp
strerror
strlen
strncmp
strncpy
strtol
strtoul
tolower
ungetc
vfprintf
time
wcslen
wcstombs
_stat
_utime
_fileno
_chmod
main
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
66B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/80
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/91
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/102
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/Files/4ck3rr.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 428a020f9446f1f98d0152101b1f8cbd2697ac32d7d47e27ea7e2622f3d4de46
- MD5 d6a034f75349665f43aa35dee0230379
- SHA1 57bca9aa6f19985aff446f81b3c2058a817501f0
- SHA512 c22405136e9018cd707a1a4e80c858f65cadd465dca77b8bbb2135aebf474df4e037251012553bb484d94300314b968be35e90220e6b257524f880f5f7a7ed39
- SSDEEP 3072:Xq6EgY6iorUj6uYIwPoE5kQgnKyyDSTAVtWSi6RcZqf7D34VeqiOLibBO4:aqY6iRwPTkx7yeTAbWMRcZqf7DI/L
- MD5 SHA1 SHA512 SSDEEP
-
RedLine payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
178586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/Files/66ab1b27ae40b_BotClient.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6ccb73967f66acd2af71b4d41a7b5f3755f04d1adba41bafc573f8c1cc14c26a
- MD5 a14e062d5ddb947dd490cd3956c7de8a
- SHA1 1a55234d22f14e88d27cfdcd9512abf1a02d1e61
- SHA512 da887bfbf53f8a2945d740114d111602292923fd884cac3157d77d74a03c31891bbd167271ed4f71c77bbac133b42f2dc3414447e3aa200d9f0427d1ceebb0e8
- SSDEEP 49152:mVYXpGY8n5aL8P4hH4lhGtNfVkiC9H+xeUpw16cXqSOgvB6OGcP4NBgF5WIWPVv6:cu84hYlUfVkoSOgJRGcPMvOVHVKD3e
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
06:a8:46:88:ec:e8:80:3b:51:0a:58:f5:b4:e8:7d:ab:79:65:f5:f1:22:b1:93:03:cd:82:32:c2:95:bb:e9:b8
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
Chains
Sep 18, 2016
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
a9:31:e0:2f:0b:b5:80:db:f3:ca:97:33:2c:e9:ec:6f:87:5d:4d:7b
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
Chains
Sep 18, 2016
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
Serial Number
26:18:1c:ed:f2:c1:13:e1:6a:c7:48:20:df:7a:38:a3
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 31, 2015 - Jan 27, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US
Serial Number
5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 11, 2015 - Dec 29, 2020
Subject
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Serial Number
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Timespan
Jan 1, 1997 - Dec 31, 2020
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
Serial Number
26:18:1c:ed:f2:c1:13:e1:6a:c7:48:20:df:7a:38:a3
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 31, 2015 - Jan 27, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US
Serial Number
55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 11, 2015 - Dec 29, 2020
Subject
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Serial Number
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Timespan
Jan 1, 1997 - Dec 31, 2020
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Minor OS version
0
Major OS version
4
Entry point
6128702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Botsoft.pdb
mscoree
_CorExeMain
Name
.text
Size
5.8MB
Virtual Size
5.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/Files/66ab1b27ae40b_BotClient.exe5wDUFGqU3QeuQlEX
- IMPHASH b855a851b141e89d180e7702048417ce
- SHA256 d71e6536f07cb4e40237cf7132dd01b9d93ee06c07767f108cc1929f1f5b5b9c
- MD5 d9a30725d248756dd74badb45d1b3171
- SHA1 bbe75a6e3e756a76d69ee07c4222b1eba70c6e3f
- SHA512 62e3d0f2d4c9ef1b4d2fb36ba634da533e6e0eef92a51d5e6a3f2a9bbd48a7f1bf856d132bc06728a6ff9fd051ce3985805fafe6037ee2badce1b1fb275853e5
- SSDEEP 6144:4zvcvxA1ykWjtgP+xZfs7Ey6tIQFSqBagsH+DlYZE/KlR+fh6iu2e3QIicI+Oa6O:43Wj9aXUYZMKlRosrhOa6lTYYiXQC0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
277468
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CopyFileA
GetLastError
GetFileAttributesA
DeleteFileA
CloseHandle
CreateThread
CreateProcessA
CreateDirectoryA
SetUnhandledExceptionFilter
ReadFile
WriteFile
Sleep
CreateFileW
FindClose
GetProcessHeap
MultiByteToWideChar
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetCurrentProcess
GetModuleFileNameA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
FlushFileBuffers
SetEndOfFile
SetStdHandle
OutputDebugStringW
GetTimeZoneInformation
QueryPerformanceCounter
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetStringTypeW
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
TerminateProcess
RtlUnwind
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
SetFilePointerEx
ExitProcess
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
MoveFileExW
GetFileSizeEx
HeapSize
advapi32
GetUserNameA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
GetTokenInformation
RegCloseKey
shell32
ShellExecuteA
SHGetFolderPathA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
ws2_32
send
socket
connect
WSAStartup
freeaddrinfo
setsockopt
WSAGetLastError
getaddrinfo
closesocket
WSACleanup
recv
Name
.text
Size
439KB
Virtual Size
438KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=194, id=261, version=30795,
count=4, id=253, version=33218,
count=18, id=260, version=33218,
count=22, id=259, version=33218,
count=84, id=261, version=33218,
count=23, id=260, version=30795,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=156, id=1, productName=Unmarked objects,
count=24, id=265, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
saved from malware/Files/66ae9b239854c_crypto.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 10f1ea0c6154e61af5be55c6e79de07ab3df91d10515004a8395b52e41417286
- MD5 d6ef7693d2c323305a62db85c85f42cd
- SHA1 0e80caa10a525ec9a9d08fa82b538d72ec117a41
- SHA512 20df1464361c6f3de4eb591bab2a14adc75cb333cd92bddbcbad0bbf9e948768a9082c5ec87b5c5fa1d21f2bddbeed73b2024a576ad75a52f5252badb36eb5cd
- SSDEEP 49152:Bhv5pWzxTTUL2XdAKdB96KcOpP0i1bloi+UGTf2kOKnr6byw6edJDn108F4aSyz3:BhvAfbp6qJjR+yz/YaNrobTVRxwU2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4636798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
fastconverter.pdb
mscoree
_CorExeMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/Files/66b09d7d34310_DefragManager.exe
- IMPHASH 30af0fe2c05b84c5732b235ff670af9b
- SHA256 f2e31778bc042827e79f1768da0f252bcd002ba1f392f9fe8ef6aa3459cc035a
- MD5 72f119a51ed452aaa3dcfa4f980f7d76
- SHA1 df6472d058a43f8c5e9cccaad52003be152279c8
- SHA512 1f674eb3c7992d212661ebffc42345f02ed6ba79ab9eef1c9088f16a054c72b00762fb7e00645016aa3f73f4f46156bf87f1ce83d270cbf9a9bb8e061c639a2b
- SSDEEP 98304:IGq0eRb5YO5PyFyblrMJ39YUJladJvuUNLjwAst3:w0egF0+J324UerB
- MD5 SHA1 SHA512 SSDEEP
-
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
PE Signature issue
Digest
c2:91:46:6a:a6:bf:09:8b:53:fd:3d:54:99:7f:1d:0e:ac:d0:73:d7:79:40:85:b2:20:73:00:dc:15:3c:cf:4e
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=AOMEI International Network Limited,O=AOMEI International Network Limited,ST=Hong Kong,C=HK
Chains
Mar 8, 2024
CN=AOMEI International Network Limited,O=AOMEI International Network Limited,ST=Hong Kong,C=HK
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
7e:b0:d9:f1:a1:48:d8:54:5a:36:09:a2:2c:f0:c6:ff:61:75:f1:dd
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=AOMEI International Network Limited,O=AOMEI International Network Limited,ST=Hong Kong,C=HK
Chains
Mar 8, 2024
CN=AOMEI International Network Limited,O=AOMEI International Network Limited,ST=Hong Kong,C=HK
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=AOMEI International Network Limited,O=AOMEI International Network Limited,ST=Hong Kong,C=HK
Serial Number
e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 3, 2022 - Nov 2, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=AOMEI International Network Limited,O=AOMEI International Network Limited,ST=Hong Kong,C=HK
Serial Number
e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 3, 2022 - Nov 2, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
5026440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
QueueUserAPC
SetEvent
GlobalAlloc
CloseHandle
LocalFree
DeleteCriticalSection
WideCharToMultiByte
lstrcpyW
SleepEx
GetTempFileNameW
FormatMessageA
TerminateThread
CreateIoCompletionPort
WriteConsoleW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
SetEnvironmentVariableW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
GetLastError
FormatMessageW
Sleep
CreateEventW
PostQueuedCompletionStatus
WaitForSingleObject
FindClose
GetTempPathW
GetEnvironmentVariableW
GetQueuedCompletionStatus
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
CreateWaitableTimerW
lstrlenW
EnterCriticalSection
SetLastError
SetWaitableTimer
FindFirstFileW
CreateDirectoryW
GetModuleFileNameW
GetTimeZoneInformation
DeleteFileW
GetFileAttributesW
CreateFile2
MultiByteToWideChar
IsValidCodePage
GetACP
GetOEMCP
CreateFileA
CreateFileW
GetFileAttributesA
GetFileInformationByHandle
GetFileType
GetFullPathNameW
ReadFile
WriteFile
PeekNamedPipe
GetExitCodeProcess
GetStdHandle
SearchPathA
DuplicateHandle
SetHandleInformation
CreatePipe
GetCurrentProcess
CreateProcessA
OpenProcess
GetProcAddress
LoadLibraryA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetModuleHandleW
InitializeCriticalSection
ReleaseSemaphore
GetExitCodeThread
CreateSemaphoreA
VirtualFree
GetCurrentProcessId
GetSystemTimeAsFileTime
GetSystemTime
SystemTimeToFileTime
GetSystemDirectoryA
FreeLibrary
LoadLibraryW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionEx
QueryPerformanceFrequency
GetSystemDirectoryW
GetModuleHandleA
MoveFileExW
WaitForSingleObjectEx
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
GetFileSizeEx
SetEndOfFile
SetFilePointer
LoadLibraryExA
ExpandEnvironmentStringsA
LockFileEx
UnlockFileEx
GetProcessTimes
FindFirstFileA
FindNextFileA
RaiseException
GetLocaleInfoEx
GetStringTypeW
GetCurrentDirectoryW
FindFirstFileExW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
EncodePointer
DecodePointer
LCMapStringEx
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
CompareStringEx
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
LoadLibraryExW
ExitProcess
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
SetStdHandle
SetFilePointerEx
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FlushFileBuffers
GetConsoleOutputCP
GetVersion
user32
GetSystemMetrics
GetCursorPos
MessageBoxA
ChangeDisplaySettingsW
DestroyIcon
CreateIcon
LoadCursorW
GetWindowThreadProcessId
SetWindowLongW
GetWindowLongW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
EnumDisplaySettingsW
CreateWindowExA
DestroyWindow
ShowWindow
GetDC
ReleaseDC
TrackMouseEvent
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageW
RegisterDeviceNotificationW
DefWindowProcW
CallWindowProcW
RegisterClassW
UnregisterClassW
CreateWindowExW
FlashWindowEx
SetWindowPos
GetKeyState
MapVirtualKeyW
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
SetForegroundWindow
SetWindowTextW
GetClientRect
GetWindowRect
AdjustWindowRect
SetCursor
ScreenToClient
MapWindowPoints
ClipCursor
shell32
ShellExecuteW
ws2_32
WSAWaitForMultipleEvents
getpeername
shutdown
socket
setsockopt
listen
connect
closesocket
bind
accept
send
recv
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
WSAResetEvent
htons
htonl
WSAGetLastError
gethostbyname
select
ntohs
getsockopt
getsockname
ioctlsocket
WSACleanup
WSAStartup
inet_pton
inet_ntop
WSAEventSelect
WSAIoctl
__WSAFDIsSet
getaddrinfo
freeaddrinfo
gethostname
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
sendto
inet_addr
recvfrom
bcrypt
BCryptGenRandom
shlwapi
PathFileExistsW
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreW
CryptStringToBinaryW
CertOpenStore
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
winmm
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
joyGetPosEx
joyGetDevCapsW
gdi32
ChoosePixelFormat
GetPixelFormat
SetPixelFormat
SwapBuffers
GetDeviceCaps
DescribePixelFormat
advapi32
CryptGenRandom
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGetHashParam
CryptHashData
CryptImportKey
CryptEncrypt
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
CryptReleaseContext
CryptCreateHash
DeregisterEventSource
opengl32
wglShareLists
wglCreateContext
wglDeleteContext
wglGetProcAddress
wglMakeCurrent
Name
.text
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
475KB
Virtual Size
474KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
367KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=259, version=30795,
count=217, id=261, version=30795,
count=30, id=260, version=30795,
count=11, id=253, version=33731,
count=26, id=259, version=33731,
count=20, id=260, version=33731,
count=96, id=261, version=33731,
count=30, id=261, version=33523,
count=23, productName=Unmarked objects (old),
count=1217, id=260, version=33523,
count=54, id=260, version=33811,
count=23, id=257, version=30795,
count=372, id=1, productName=Unmarked objects,
count=1, id=265, version=33811,
count=1, id=255, version=33811,
count=1, id=258, version=33811,
saved from malware/Files/66b1c36969eae_main.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 414d432c45e1a2ff1d55b0f342b8e0503a9dd8180e81f597b06e29d36fee8cef
- MD5 3d04dfed5185e2f62819f0951249e391
- SHA1 528f55d6bb9b2a23da94800641957136add271a5
- SHA512 916381af6ab9b3edacb48703cd54ee681dd3b72da950e3e19e01ef1266f75842bc8ef892420c746313b0c54af15e4333b0c442ec9b7fbcfecf32f083c88af756
- SSDEEP 49152:nZPP0i5bNv26aN1CoDNgQ2mON8qBvaRmVI/wmsGjAaJWJCL3PItIkUAsqBwOGIL2:C1CoDCN8M+yI/xjAk3PIq6wIa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4122734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
electrycsoft.pdb
mscoree
_CorExeMain
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
118KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/Files/66b7a2aef1283_doz.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d7a378758c39dc30df10b0c46ddf6fbe4395892d110691fa377e4fdaaebef7ef
- MD5 d6578fb285f1a9adb12d3597517776ee
- SHA1 50eaaff1be97c8e4994cd56f21ef64b36fa8cb48
- SHA512 3f05385f6ec1d35b0118a6b8cfb2617383f78e80c78cf549113cd08d2fc04cdeaaa4bb67bdc80390071a26de74d40487289a16897bb49a673ce4324e026928f0
- SSDEEP 98304:lbz071DT8eKHsJ5MZux2G/rKJnMLEsrlIev:h071DeHo5SGeJMosxIy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4718592
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
drowsoft.pdb
mscoree
_CorExeMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.zero
Size
8KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/Files/ChatLife.exe
- IMPHASH be41bf7b8cc010b614bd36bbca606973
- SHA256 eea496eda72f4bf440a32676ba4437a635cdc3aea28a4174e9495ce4949a15fe
- MD5 4ad6e6fbd0a09ac214baa2f2b64a8d37
- SHA1 d8c137b31c85ab70e5b41fe9e7e3ca32d4614dc7
- SHA512 8a17406d02033b084fb32d5c39e03a24e5015446d0a3a318fbc3ed63374296c406879a5d5815aeee9e2c5e61f4084c718c74c83597eb56f36ff570cd3b28e930
- SSDEEP 49152:eWJ8voaN5Qz+lN4k8nIzHO0TcZxkYNdhN1vTLhczB17wIOmeG0Kw:ecEoaNpN4/WHRTcZxkO7BcFBImMK
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR
Serial Number
09:be:bd:8f:ba:e0:11:98:c5:52:55:0b:a6:80:f1:7b
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 6, 2023 - May 15, 2025
Minor OS version
0
Major OS version
5
Entry point
1077248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW
user32
GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation
advapi32
RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=172, id=1, productName=Unmarked objects,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
saved from malware/Files/Crack.exe
- SHA256 eefe4186b76670dd5d2a0e69ff14d4833333cd4b047a3f2260a736fd69da4a79
- MD5 7dad2c4407957ac063b27b5dbbe8e596
- SHA1 9309ba525bd5486667017d84a15a94f18616c125
- SHA512 f7ee96644ca686dde3686cc7c920c2ce43b6d8e81458d3f24fa38cb1f33a04c079097caaa7847c4b00b25e6115c7ac619caa50a70840020103dc59ab96f9c2e6
- SSDEEP 98304:cHq30uZ1rpxCcHiU7g/iftzaGS107AJ121Ghl8LcFRrgDn7LgckWofmgC/g:czuFxCSx7gKJS10UT2Cl8APsTV4fmPY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
15777472
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
10.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 8da92eefa4a01f887a67e71cef7a928c5b688cefd5fc6899d292c9d30cc67c97
- MD5 13c847619efa5640c88bd7b266ed98c2
- SHA1 ed2430038c34c7e24908fd22846bd30d9bf40fd0
- SHA512 2773da1ab810ee4e116382db7930c4fc0d53d1f66eec83f6a947c8a87edad9bab077a3aca18aee1738c740d33f5dfbfa767ca31486591eec8a3bcfc46c77f4b1
- SSDEEP 98304:EWeFdbhqaY6ZLJyCvNjwwmNrxnFWvhZeffqUYJAGCsZ2:Zeb9XvZV/HmxGZwff5AA
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
364880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
7.6MB
Virtual Size
7.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6.6MB
Virtual Size
6.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
201KB
Virtual Size
439KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
988B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
267KB
Virtual Size
266KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/Files/DelHosts.exe
- SHA256 e53630de39937a263e8e87652569cb0815adfc700a42956ff960b8a18fc5a086
- MD5 b0283aa6cc06b0880a1681f2c9802f05
- SHA1 868fb3493c2a71a3c6613733a1f603d82ae43fed
- SHA512 43ebc7699c09408c96eb7ae6541b89800442723306e6839eb0592a0a1d999c6e0278689b8ae5c16a8bcc8285261bdbf52e7df234138b857a335a93df43ec9b04
- SSDEEP 6144:x68oipnnK9jqXEX52Ums+Tbxzbx9SmIqQyPodMUf8Dkzel6R8zHe1It:3fnnK9zABs+TbFx9SXOPCf8DkqAR8zHz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
816960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
298KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 b7b3a3b9208d2c0e7f823fb8e24b0fec267ea6eb8517b46ed16cef96d67a7fd0
- MD5 c02962465d3e71b383fc5866bbe0e86d
- SHA1 61cdefb20ed1c781f41a2ee14fce67c0217af618
- SHA512 5efc8c151880bb531ea89c81860fd0b911f019eaa8d1a3efd858c4b953ab6cdecb32ece123872c26062a5aea9c1d3b5265bbd45dbf28d7152e38446891bad290
- SSDEEP 12288:ai+ETezCHQkZPhprhmH6ukWAljnQlnl2OdpbxZymR:aiQsFhBhmAWAdnQxlfjx
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
95520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
532KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
saved from malware/Files/DownSysSoft.exe
- SHA256 d9fb4a78e09ef3a7d8dc61bbe0ede49139d5861101d1fc048c1ef28e16654296
- MD5 52c46a887fae78030e6ca39090b8840f
- SHA1 62e3438867da75c2eef0b7e12f835de1e2cb02a8
- SHA512 9510bde5f49bc4624bad03969efe66677afff48cc9af50b168f928f37bb6d5e209b43195554c5e2b3c629b7922b7d6419e7e5c96ac97bd18773db9a45d980e1e
- SSDEEP 6144:bMJt6tTmWjp1P4xm0ovCs2Rh68815xYasf5eIltnaToecFHzpPoPWsbfaMv:a6tyWjX4LovCsYi5xYZheILnhXFTpqD/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
937984
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
540KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
341KB
Virtual Size
344KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=542, id=1, productName=Unmarked objects,
count=78, id=234, version=30501,
count=1, id=223, productName=VS2013 UPD2 build 30501, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,
saved from malware/Files/Downaqzh.exe
- SHA256 db5373d0d737d59e59c3dafbd3551e6c4eadd23ba1de01e369b8f34f8b724a6e
- MD5 7172a9affcacd70df46a7580f8a73800
- SHA1 46376f22149c3f69e0ee3d32d953432147a7a384
- SHA512 7588f14d1894cd68788c6e5f9b53bb14fde4ac81d045fb3d3c8b20d5fca2f8410049d18dfa6a16ddbf420ff835684ae4fd6967d404eb6882f696072f197fa432
- SSDEEP 49152:ZmmPLnI3RdnsTqVCdpG+7nfxFKlCYVTYd++3bmBnC:NPDcRdnsTqVCbG+7nfxglCYVCJqBnC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2215936
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
492KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=542, id=1, productName=Unmarked objects,
count=78, id=234, version=30501,
count=1, id=223, productName=VS2013 UPD2 build 30501, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,
saved from malware/Files/Downdd.exe
- SHA256 6db6a1f73e471e2068a0a420fe6134327171e9a11bbd1a5b360298c5b6a1b069
- MD5 f6be85b0254a308f77189fc96fa6f38e
- SHA1 a6a1290a95533f8aa7b0baa73fb66921c175bbc8
- SHA512 29966fde807d4e685a73af764a51a900122df814b10301194112a4c44c5f16230616e04d1bfa4b47758ee794334de346a30f0bacfe9ed13fa73daf1846ba4332
- SSDEEP 24576:ofK9zUHFpi8/cVt692Qbp9EPXcHJCOoMmBorv9CYmVzsuY:ofKtqFpiucf6zxsOFyorv9FJuY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
816960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
298KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 b7b3a3b9208d2c0e7f823fb8e24b0fec267ea6eb8517b46ed16cef96d67a7fd0
- MD5 c02962465d3e71b383fc5866bbe0e86d
- SHA1 61cdefb20ed1c781f41a2ee14fce67c0217af618
- SHA512 5efc8c151880bb531ea89c81860fd0b911f019eaa8d1a3efd858c4b953ab6cdecb32ece123872c26062a5aea9c1d3b5265bbd45dbf28d7152e38446891bad290
- SSDEEP 12288:ai+ETezCHQkZPhprhmH6ukWAljnQlnl2OdpbxZymR:aiQsFhBhmAWAdnQxlfjx
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
95520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
532KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
saved from malware/Files/Downggzh.exe
- SHA256 69d768a7c979af4acb8e423babcb3fa5fe4df3587a4f430a99a8c21a529981ee
- MD5 3c92791a6d8724956716a515e9b301f5
- SHA1 2218cbb76b3089e4a8cfcde9ce629d5fe9cd912b
- SHA512 62c25674d4ac3539f7c4b34ec570b7427ff3ef016ee1646d995aa1f9e00f5a2ecf5fa943ea06b14340e2a6ad6d452c0aad1a9bbe36651189cbaf1df231068ee4
- SSDEEP 24576:9UWjEmPLnItMu6avxUjbTCKje2NHNUX0uvXjacuNWlt04hNF3:9mmPLnICubxUjfCKje2CX7vXjzuNW/Dp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1777200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=542, id=1, productName=Unmarked objects,
count=78, id=234, version=30501,
count=1, id=223, productName=VS2013 UPD2 build 30501, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,
out.upx
- SHA256 90527d257f605f93e6873a0f32df9d3c61427cb01b85eb298daf32746dacc4f4
- MD5 0b21a5b567b840a7ae929931a678e44e
- SHA1 b1a1e1d5b76a508ed336c9d5c7ed11e43e344af0
- SHA512 a27a9701e3533a08f4a156112f7a6ac3aad3c15ff5f68cb1569aac24c89af477689cb5f9df9938d571a2a6f50eff1be54b1a3090d8d80954eaabf0105fd90e12
- SSDEEP 49152:XpJ22R1rcUWPsPFVKKzISx/P7eBN6Gp/:X3M+tVKKzIqDsN7p/
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
159037
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
563KB
Virtual Size
562KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
839KB
Virtual Size
838KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=542, id=1, productName=Unmarked objects,
count=78, id=234, version=30501,
count=1, id=223, productName=VS2013 UPD2 build 30501, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,
saved from malware/Files/Downty.exe
- SHA256 7204bd33b6bffbc41937868a317984aad58935005297d542026de125542adbda
- MD5 1e2979dd1d6791f148e306d1f3c06b9f
- SHA1 4436fc85d2d999254db74816fc5cdf9f65c2dfef
- SHA512 40d71d93cf323f695e67ef804ddc566e4cebd4a39352b09e1bcc8a7cdcf690b872681691f6fe8f7b17c1cb7555cc586f892ad33439ff2416ce3ca41f6e688b79
- SSDEEP 24576:3UWjEmPLnItWoa3yGaJxh0I/oXfhv+aeMQGl86GD+gP/jgKtMt:3mmPLnIsn5aLiI/oXd+NU86GD+g3EKtM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1780176
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=542, id=1, productName=Unmarked objects,
count=78, id=234, version=30501,
count=1, id=223, productName=VS2013 UPD2 build 30501, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,
out.upx
- SHA256 ccc2ec8af362bfa4ec4373f3a483796a2b499c9ae72854a4cb2afedfee050e52
- MD5 7fe493a0980327ebbfe724bf5fb557db
- SHA1 eb4ced225fc0a2881b90c6562687f56839d57ee8
- SHA512 e066dd7504d142738aea2a214f5a051e467cf725acaf74bd904f9a54bb31bce04e16bc2d5a37f34a02746a0ae623931d17d4cad3e68fdeb9f3f716da4f069e38
- SSDEEP 49152:2pJ22R1rcUWPsPFVKpzTSx/P7eBN6Gp/:23M+tVKpzTqDsN7p/
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
159037
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
563KB
Virtual Size
562KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
841KB
Virtual Size
841KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=542, id=1, productName=Unmarked objects,
count=78, id=234, version=30501,
count=1, id=223, productName=VS2013 UPD2 build 30501, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,
saved from malware/Files/JQMain.exe
- IMPHASH 052a42c495a0aeaeca141d0e9c942b5e
- SHA256 cc1f767e45d13d086f52ef8cbfec8c480106b990b61f09b611ca2e001f76a0f3
- MD5 1ac3f40e91b18450cdc718d12047b424
- SHA1 51979360e518239a9d8de1b7224c76f11752ed19
- SHA512 8992ccc674bcf147deb2d4a81a741f3556678bba9ce553ed2d6335e16035c68021fd9154ef750d299557429f119e123e02983065f49146a3bbc0148358e27c2b
- SSDEEP 49152:H8CXJDV9bPb5XpmQ38Ebek9rET/MzAvEQWlLYzjoYTrseKTKJ:XJDV9bD55mTEbek9rEdMQWlLYzjoYTo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
72795
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
F:\VCtest\Projects\NEWGZXTEST\GZX\Release\JQMain.pdb
mfc140u
ord14590
ord3055
ord4494
ord9693
ord4502
ord4988
ord4927
ord4912
ord4974
ord5019
ord4942
ord4997
ord5013
ord4954
ord4960
ord4966
ord4948
ord5003
ord4936
ord1777
ord1756
ord1770
ord1744
ord1722
ord12258
ord12262
ord13878
ord3266
ord9256
ord11002
ord6978
ord12220
ord8965
ord14588
ord11936
ord3838
ord12089
ord9132
ord11726
ord11725
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord2761
ord8210
ord3302
ord3305
ord13756
ord6220
ord4225
ord8464
ord4323
ord1526
ord7495
ord462
ord8470
ord8386
ord12865
ord8324
ord5357
ord2486
ord12541
ord7923
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord2034
ord11982
ord3941
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord3852
ord5918
ord12239
ord12247
ord4589
ord8217
ord10433
ord12251
ord12219
ord12928
ord5249
ord5549
ord5760
ord6877
ord5525
ord5763
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10250
ord9209
ord6860
ord1113
ord6489
ord1111
ord1070
ord1447
ord6559
ord6566
ord3882
ord2304
ord1133
ord1066
ord1180
ord4092
ord13911
ord7313
ord13442
ord952
ord2205
ord7997
ord1472
ord995
ord7653
ord12542
ord14596
ord10379
ord280
ord5110
ord2477
ord3372
ord3371
ord3265
ord12168
ord5790
ord5984
ord10255
ord6589
ord4219
ord3145
ord9126
ord6129
ord6490
ord9139
ord6549
ord968
ord3872
ord2993
ord8744
ord4222
ord3147
ord1511
ord2409
ord8360
ord12921
ord14405
ord11717
ord5718
ord5289
ord12131
ord9040
ord11015
ord11396
ord3296
ord4886
ord1002
ord4815
ord290
ord2996
ord286
ord1045
ord296
ord265
ord266
ord3404
ord3403
ord3164
ord2682
ord6218
ord13752
ord2760
ord12173
ord9235
ord9210
ord6533
ord5935
ord13703
ord2990
ord5882
ord9350
ord13646
ord2458
ord2457
ord13656
ord8067
ord14364
ord8062
ord3605
ord11038
ord1391
ord890
ord3833
ord14234
ord12793
ord5419
ord13800
ord13628
ord8817
ord14137
ord10472
ord13806
ord1523
ord5813
ord5850
ord7820
ord14377
ord4885
ord2526
ord3932
ord6607
ord4227
ord8746
ord7447
ord7481
ord3697
ord2246
ord2215
ord4360
ord12124
ord6497
ord11983
ord9128
ord1513
kernel32
SetWaitableTimer
WideCharToMultiByte
SetEvent
CreateToolhelp32Snapshot
CreateProcessA
LockResource
GetTickCount
CreateWaitableTimerA
CloseHandle
LoadResource
FindResourceW
Process32FirstW
OpenFileMappingW
UnmapViewOfFile
Process32NextW
OpenProcess
MapViewOfFile
CreateFileMappingA
CreateEventA
CreateDirectoryA
WritePrivateProfileStringW
CreateDirectoryW
GetFileAttributesW
VirtualProtect
GetCurrentProcessId
GetModuleHandleW
GetProcAddress
SetCurrentDirectoryW
GetCurrentDirectoryW
SizeofResource
CancelWaitableTimer
GetProcessTimes
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
VirtualQuery
GetLastError
GetTempPathA
CreateFileW
DeviceIoControl
Sleep
CreateFileA
GetVolumeInformationA
OutputDebugStringW
CreateMutexW
GetFileAttributesA
GetPrivateProfileStringW
GetPrivateProfileIntA
GetPrivateProfileIntW
TerminateThread
WritePrivateProfileStringA
CreateThread
GetPrivateProfileStringA
GlobalSize
GlobalLock
GlobalUnlock
GetFileSize
ReadFile
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
CreateEventW
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemInfo
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
DeleteCriticalSection
LoadLibraryW
user32
GetClientRect
IsIconic
GetSystemMetrics
DrawIcon
GetWindowRect
GetParent
MoveWindow
UpdateWindow
GetWindow
GetDesktopWindow
AppendMenuW
IsWindowVisible
GetWindowTextA
SendMessageA
GetWindowTextW
OpenClipboard
GetClipboardData
CloseClipboard
GetSystemMenu
PostMessageA
GetCursorPos
GetSubMenu
LoadMenuW
MessageBoxW
LoadIconW
MessageBoxA
EnableWindow
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
SetWindowLongA
CallWindowProcW
GetWindowThreadProcessId
SendMessageW
advapi32
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenSCManagerA
OpenServiceA
DeleteService
CreateServiceA
StartServiceA
ControlService
shell32
ShellExecuteW
SHFileOperationW
DragQueryFileA
SHGetSpecialFolderPathA
SHGetFolderPathA
SHGetSpecialFolderPathW
comctl32
InitCommonControlsEx
shlwapi
StrCmpW
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
ws2_32
shutdown
WSAStartup
WSASocketW
select
WSAGetLastError
closesocket
inet_ntoa
ioctlsocket
gethostbyname
inet_addr
WSASend
WSARecv
WSAIoctl
setsockopt
connect
bind
htons
plfl32
P_UserReg
P_GetDataValue
P_GetLoginValue
P_UserLogin
P_LoadSystem
P_CardReCharge
psapi
GetProcessImageFileNameA
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenW
InternetCloseHandle
iphlpapi
GetAdaptersInfo
vcruntime140
__std_terminate
memmove
memchr
strstr
memset
__CxxFrameHandler3
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
_CxxThrowException
memcpy
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
fopen
fwrite
fclose
__stdio_common_vsprintf_s
feof
fgets
_set_fmode
__p__commode
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
remove
_access
api-ms-win-crt-string-l1-1-0
strtok
toupper
api-ms-win-crt-runtime-l1-1-0
_configure_wide_argv
_initterm
_initterm_e
_exit
_beginthreadex
_get_wide_winmain_command_line
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_set_app_type
_initialize_onexit_table
system
_c_exit
_initialize_wide_environment
_register_onexit_function
_crt_atexit
terminate
_controlfp_s
_cexit
_seh_filter_exe
exit
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
api-ms-win-crt-convert-l1-1-0
_wtol
atoll
_wtoll
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=23013,
count=14, id=260, version=23013,
count=28, id=261, version=23013,
count=526, id=1, productName=Unmarked objects,
count=7, id=257, version=23013,
count=8, id=265, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=151,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
saved from malware/Files/L.exe
- IMPHASH 08b1b12afb6e1cdcf5adc795ee884ca6
- SHA256 15d3d582663fbb799856dc06236466facd16ec76e788643fe750c2d2ccfddfc5
- MD5 6bca173cac4f84582eee2506ba82c1b6
- SHA1 009f014cf6201826d41b036d63fc55b289eeef82
- SHA512 f2905a940c3bce8603b28bfa1d2a2bc851d65fd4f920d173bf791f557c392929185a33656d6d462960a56f997534e340910320b934e978166948882a5bd4fd4d
- SSDEEP 6144:5cV90MuHQGFdBQ9u5VscmmKGfIWu4FmHZmpaJXnI:aV3uHQGFv7v/1/1mHYkJXn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
368640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CloseHandle
CreateMutexW
ExitProcess
GetCurrentProcessId
GetCurrentThreadId
GetLogicalDrives
GetProcessVersion
GetSystemDirectoryW
GlobalLock
GlobalUnlock
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
oleaut32
SysAllocString
SysFreeString
SysStringLen
VariantClear
VariantInit
user32
CloseClipboard
GetClipboardData
GetDC
GetSystemMetrics
GetWindowLongW
OpenClipboard
ReleaseDC
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetCurrentObject
GetDIBits
GetObjectW
SelectObject
Name
.text
Size
257KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
saved from malware/Files/M5traider.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2bcdb7a75707f841615be19f4bbcb95fc6b16ce19fb7ea782c5ff43ea1be024d
- MD5 1713300ba962c869477e37e4b31e40af
- SHA1 d5c4835bc910acccd28dbed0c451043ea8de95ef
- SHA512 70b2a2b17c6b3a0a295baf536451ef38c6e9e292a3c967a9fc950a6de321bbac0dc45e942ef151ba81b717f8ede3166388e68ce75f2afff0ec16aea98ea742e1
- SSDEEP 49152:H3rPT2lx2/lJe0f3+EGqX9QB+Vhc5fLBwR/WaMiukso0vOAtPeEvpDKYSEsVhbSm:H/jDem3Lc5FTVkso0vOclpeYSHhIs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4737054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mentorship_and_software_support.pdb
mscoree
_CorExeMain
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/Files/Meredrop.exe
- SHA256 a29d02251f54567edb1d32f7c17ce4c04d5c54e317eb3b2bea2a068da728e59a
- MD5 7867de13bf22a7f3e3559044053e33e7
- SHA1 42e56d72982ac04edba2ce7fb9f4e5048766aa94
- SHA512 f2b15fc7a6a255aeb1f66a66069482a0a882a43e00d4dcbeb41544ecd86089cd5bf614a8d9949792b6eff8248e9f213a2ebb4ca16597bc5b9b85dcf7be342ae8
- SSDEEP 768:WOjL5WyEf531YmKtiZSI1ZOt13hHJ6kekGyQSmOY:WOjsyEfIm0i3ZOt1RWkGyFW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
0
Entry point
%!f(<nil>)
Magic Number
Subsystem
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
LoadLi
Size
4KB
Virtual Size
1830.1MB
Characteristics
Name
Size
140KB
Virtual Size
4B
Characteristics
Name
����
Size
Virtual Size
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
generic
saved from malware/Files/PXHMAIN.exe
- IMPHASH af336d68081186dd2f182d0abf3f6e86
- SHA256 211b33f267b61f49ecade7a8e4d154d984499d3dd2c8f0b7e31c5a461684e8bf
- MD5 1badf69d9dabc9dd9725250c8c5564aa
- SHA1 eaa4e720a78cec1de8da45c37d7502cd256d0445
- SHA512 99f82d0fc7de25ba0f2bc0a18bb69590bd6162b2f9ba55d7a71c7fb8e9672630750d69020c0b91365d2b5e524aaee5bd61ce8231decf234baf4aea0f1b4df95c
- SSDEEP 98304:oJDV9bD55mTEbek9rEdMQWlLYzjog8g0dWmG2e32MLiU1RKyMUgzR50CDmt:C1BQyjYzjo+TFjdY50CDm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
59611
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
F:\VCtest\Projects\SpeedNEWdrPXH\Release\PXHMAIN.pdb
mfc140u
ord4936
ord1777
ord1756
ord1770
ord1744
ord1722
ord12258
ord12262
ord13878
ord3266
ord9256
ord11002
ord6978
ord12220
ord8965
ord14588
ord11936
ord3838
ord12089
ord9132
ord11726
ord11725
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord2761
ord8210
ord3302
ord3305
ord13756
ord6220
ord4225
ord540
ord8464
ord1526
ord290
ord7495
ord462
ord8470
ord8386
ord12865
ord8324
ord5357
ord2486
ord12541
ord12542
ord14589
ord5003
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord2034
ord11982
ord11983
ord5013
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord3852
ord5918
ord12239
ord12247
ord4589
ord8217
ord10433
ord12251
ord12219
ord12928
ord5249
ord4966
ord5760
ord9350
ord5525
ord5763
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10250
ord9209
ord6860
ord1113
ord6489
ord6566
ord3882
ord296
ord4815
ord2304
ord1111
ord1133
ord7922
ord4948
ord1066
ord1180
ord1171
ord4092
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord11717
ord13703
ord5935
ord2682
ord12124
ord3941
ord3372
ord3371
ord3265
ord12168
ord5790
ord5984
ord10255
ord6589
ord1511
ord2409
ord1002
ord4219
ord3145
ord9126
ord6129
ord6490
ord9139
ord6549
ord4360
ord13911
ord7313
ord13442
ord952
ord2205
ord7997
ord1472
ord995
ord7653
ord10379
ord280
ord1045
ord286
ord265
ord266
ord4960
ord5549
ord2215
ord2246
ord3697
ord3816
ord7481
ord7447
ord7820
ord5850
ord8757
ord2477
ord1523
ord10472
ord12921
ord12884
ord4663
ord5110
ord12131
ord9040
ord11015
ord11396
ord3404
ord3403
ord3164
ord6218
ord13752
ord2760
ord12173
ord9235
ord9210
ord6533
ord14377
ord2526
ord3932
ord6607
ord4227
ord8746
ord4886
ord8067
ord13646
ord5813
ord13656
ord8062
ord4884
ord3182
ord14137
ord11038
ord1391
ord4954
ord890
ord3833
ord14466
ord4885
ord1513
kernel32
GetLastError
GetTempPathA
CreateThread
Process32NextW
TerminateProcess
CloseHandle
Sleep
TerminateThread
SetSystemTime
OutputDebugStringW
CreateFileA
UnmapViewOfFile
SystemTimeToTzSpecificLocalTime
VirtualQuery
FileTimeToSystemTime
GetProcessTimes
OpenProcess
MapViewOfFile
OpenFileMappingW
Process32FirstW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateToolhelp32Snapshot
WideCharToMultiByte
CreateMutexW
DeviceIoControl
GetVolumeInformationA
VirtualProtect
GetPrivateProfileIntA
LoadLibraryA
GetProcAddress
GetFileAttributesA
CreateDirectoryA
GetPrivateProfileStringW
WritePrivateProfileStringA
WritePrivateProfileStringW
GetCurrentProcess
GetPrivateProfileIntW
GetLocalTime
GetPrivateProfileStringA
CreateProcessA
GetFileSize
ReadFile
GetFileAttributesW
GetModuleHandleW
GetCurrentProcessId
CreateEventA
CreateFileMappingA
SetEvent
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
CreateEventW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemInfo
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
DeleteCriticalSection
LeaveCriticalSection
GetTickCount
user32
GetWindowThreadProcessId
IsWindowVisible
GetWindowTextA
SendMessageA
GetWindowTextW
LoadMenuW
GetSubMenu
GetCursorPos
GetDesktopWindow
PeekMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
EnableWindow
GetWindow
UpdateWindow
MoveWindow
GetParent
GetWindowRect
DrawIcon
GetClientRect
IsIconic
GetSystemMetrics
AppendMenuW
GetSystemMenu
SetDlgItemTextW
PostMessageA
SendMessageW
LoadIconW
advapi32
RegQueryValueExA
OpenSCManagerA
OpenServiceA
CreateServiceA
StartServiceA
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey
RegSetValueExW
RegCreateKeyExW
shell32
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW
DragQueryFileA
SHGetFolderPathA
SHGetSpecialFolderPathA
comctl32
InitCommonControlsEx
ImageList_ReplaceIcon
shlwapi
StrCmpW
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
ws2_32
ntohl
closesocket
gethostbyname
inet_ntoa
htonl
WSASocketW
bind
WSAIoctl
setsockopt
WSASend
ioctlsocket
connect
select
shutdown
WSAStartup
WSAGetLastError
htons
WSARecv
inet_addr
plfl32
P_UserReg
P_GetLoginValue
P_UserLogin
P_LoadSystem
P_CardReCharge
wininet
InternetReadFile
InternetOpenW
InternetCloseHandle
InternetOpenUrlA
psapi
GetProcessImageFileNameA
iphlpapi
GetAdaptersInfo
vcruntime140
__std_terminate
memmove
strstr
memset
__CxxFrameHandler3
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
_CxxThrowException
memcpy
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_onexit_function
_invalid_parameter_noinfo_noreturn
terminate
system
_initialize_onexit_table
_seh_filter_exe
_set_app_type
_controlfp_s
exit
_beginthreadex
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
api-ms-win-crt-string-l1-1-0
strtok
toupper
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
_mktime64
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vsprintf_s
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf
fopen
fwrite
fclose
api-ms-win-crt-filesystem-l1-1-0
remove
_access
api-ms-win-crt-convert-l1-1-0
atoll
_wtol
_wtoi
_wtoll
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=23013,
count=14, id=260, version=23013,
count=28, id=261, version=23013,
count=509, id=1, productName=Unmarked objects,
count=7, id=257, version=23013,
count=8, id=265, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=151,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
saved from malware/Files/Project_8.exe
- IMPHASH 1a5e4ddad4ba385b765de613acbb20f9
- SHA256 8f5d2c5facf4702e4a6338b5224d9526d4761535901acf27f43992024340ccb0
- MD5 ed7cf64192cd90aac14b69cdd202f30d
- SHA1 eb1e1a8d336631f7be51e4189bcf251ee71bf60a
- SHA512 8d320b1f8bc051537f9e63cad2b3af5111f7d30b24cd38633b2a2ea84f81cd7c70fd85074222f61ffd4a1f02509df9428ee805534e175f581291f12a0275612c
- SSDEEP 6144:vS5n9peabtzHGx9LkLpSywZ3dMTHaXusO6EXxPapUTOVP66O1/hNiyXnxrSYJ:vsnHeaK9LaT+/+hFqZZIJESUY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
lstrlenA
GetModuleHandleExW
ExitProcess
Sleep
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
VirtualQuery
GetLastError
GetModuleHandleW
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
MultiByteToWideChar
RaiseException
IsDebuggerPresent
msvcrt
_msize
?terminate@@YAXXZ
realloc
_errno
_wcmdln
__wgetmainargs
__set_app_type
_XcptFilter
free
_controlfp_s
strcat_s
strcpy_s
__p__commode
_set_fmode
_initterm_e
_initterm
_except_handler4_common
memset
?_set_new_mode@@YAHH@Z
__CxxFrameHandler3
_amsg_exit
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gehcont
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
lSeoPnV
Size
273KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=260, version=27412,
count=3, id=261, version=27412,
count=7, id=199, version=41118,
count=2, id=257, version=32535,
count=25, id=261, version=32535,
count=1, id=260, version=32535,
count=26, id=261, version=26706,
count=11, id=260, version=26706,
count=12, id=259, version=26706,
count=3, id=257, version=26715,
count=93, id=1, productName=Unmarked objects,
count=1, id=261, version=27050,
count=1, id=255, version=27050,
count=1, id=151,
count=1, id=258, version=27050,
saved from malware/Files/SvCpJuhbT.exe
- IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
- SHA256 9eb758edc7a192e4a4fcfe1eac1799c1e64408cc57809628f2ae8c2114ff8eb6
- MD5 c726a4eba148b17c9ccf3692fbc90701
- SHA1 52d203ff30f7a23fdc4cb45caa2efa40324a43d9
- SHA512 8499f446c1a7ae0f52f75e61073c916e2531f09b4cf7fc133c63b874d3c42a5cddc280f8b9b9d1be038c6bb789e763213c8d0a1e27add3796cb3a46523ea707e
- SSDEEP 49152:rbwfYXOdg8BnGyKkv6dfaAHYgDJY2Zuqz1:rs7sf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
397856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
732KB
Virtual Size
731KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
894KB
Virtual Size
893KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
104KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/Files/a.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 d396ea92369d44d5f4363af459db49181441bf3fac84b682f3463fc1cfef8fd9
- MD5 7f363ccda3acbf2b4d43728005557390
- SHA1 c684ffb03b62f3fe63f0f02bce97cc97032abe80
- SHA512 8ae8668d58dfd5bfb241e0f553b34ef08a9299da9d9ada264d7a46a49eae7bee4da85a6b764de6c34f37cd5a310fcee90290076cb2af8bc0f5bcabb7b4962bbb
- SSDEEP 1536:OL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHKh:60poOfP6+JuEjaaKHKh
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
102400
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/aaa.exe
- IMPHASH d4aa9ed1c24f35a9649cb4146576e0ec
- SHA256 d9af2a315ef22be9fe6c8aa43a2fd2e44d40adcbd353757a80345aca7762b933
- MD5 f4dc0c8021b2523195dc372184f2c162
- SHA1 5e7498fe4e76b20cc98eb6c75bb1168bd376fd39
- SHA512 bd656c209989f3009bb5d343792c57e16a0500f587ade62fe711cb03bd5786defd9f703c0f02017bb33e8f4daa7fa7de6ae551010580cb223c695aa6aba724ca
- SSDEEP 384:C+yL2/xK5X2+Y/yBMynuqVIdf1tiXpZP:C18+/YqBNnBa1i3P
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
36864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcr90
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
memset
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
srand
rand
mbstowcs
mpr
WNetAddConnection2W
WNetCancelConnectionW
ws2_32
WSAStartup
inet_addr
ioctlsocket
select
htons
socket
closesocket
gethostbyname
connect
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
shlwapi
PathFindFileNameW
urlmon
URLDownloadToFileW
kernel32
GetModuleFileNameW
CopyFileW
Sleep
WriteFile
GetTickCount
CreateProcessW
ExitProcess
DeleteFileW
CreateThread
ExpandEnvironmentStringsW
InterlockedExchange
CreateFileW
GetStartupInfoA
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetLastError
CreateMutexA
InterlockedCompareExchange
CloseHandle
user32
wsprintfA
wsprintfW
advapi32
OpenSCManagerW
CloseServiceHandle
CreateServiceW
StartServiceA
shell32
ShellExecuteW
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=18, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=88, id=1, productName=Unmarked objects,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/abc.exe
- IMPHASH 481f47bbb2c9c21e108d65f52b04c448
- SHA256 4d2eaca742a1d43705097414144921ae269413efa6a2d978e0dbf8a626da919c
- MD5 37fa8c1482b10ddd35ecf5ebe8cb570e
- SHA1 7d1d9a99ecc4e834249f2b0774f1a96605b01e50
- SHA512 a7b7341c4a6c332aef1ffb59d9b6c5e56ec7d6c1cb0eff106c8e03896de3b3729c724a6c64b5bf85af8272bd6cf20d000b7a5433a2871403dd95cca5d96ebd36
- SSDEEP 1536:IVbwdLjSUfCOjavEG0t6Se4juSbSDwgPCIMb+KR0Nc8QsJq39:okaO8T0t6SesS3PCIe0Nc8QsC9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38490
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
_iob
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
strrchr
wcsncmp
_close
wcslen
wcscpy
strerror
modf
strspn
realloc
__p__environ
__p__wenviron
_errno
free
strncmp
strstr
strncpy
_ftol
qsort
fopen
perror
fclose
fflush
calloc
malloc
signal
printf
_isctype
atoi
exit
__mb_cur_max
_pctype
strchr
fprintf
_controlfp
_strdup
_strnicmp
kernel32
PeekNamedPipe
ReadFile
WriteFile
LoadLibraryA
GetProcAddress
GetVersionExA
GetExitCodeProcess
TerminateProcess
LeaveCriticalSection
SetEvent
ReleaseMutex
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMutexA
GetFileType
SetLastError
FreeEnvironmentStringsW
GetEnvironmentStringsW
GlobalFree
GetCommandLineW
TlsAlloc
TlsFree
DuplicateHandle
GetCurrentProcess
SetHandleInformation
CloseHandle
GetSystemTimeAsFileTime
FileTimeToSystemTime
GetTimeZoneInformation
FileTimeToLocalFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
Sleep
FormatMessageA
GetLastError
WaitForSingleObject
CreateEventA
SetStdHandle
SetFilePointer
CreateFileA
CreateFileW
GetOverlappedResult
DeviceIoControl
GetFileInformationByHandle
LocalFree
advapi32
FreeSid
AllocateAndInitializeSid
wsock32
getsockopt
connect
htons
gethostbyname
ntohl
inet_ntoa
setsockopt
socket
closesocket
select
ioctlsocket
__WSAFDIsSet
WSAStartup
WSACleanup
WSAGetLastError
ws2_32
WSARecv
WSASend
Name
.text
Size
44KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=9, id=14, version=7299,
count=11, id=10, version=8047,
count=3, id=4, version=8047,
count=201, id=1, productName=Unmarked objects,
count=8, id=93, version=2179,
count=40, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
saved from malware/Files/amadey.exe
- IMPHASH dc5e346c01606ee3d3aee4549b4acd39
- SHA256 6338b823d5172f0321814534c1d7aff08a60132c62de48c2752c2c7dfc191228
- MD5 107c3b33e05d1d569cccc2052e56055e
- SHA1 e843ffcb2d67ec5778a66abce8ee3d162831dd90
- SHA512 86955fa11b16ffe0063fff9a57cca4c1afa8823fc6c78eaa1f23ba75182652ef55523160356017dabb61d570882f302e23f9dc8b288740588572d00666159f81
- SSDEEP 6144:og7RU92ushCQjrnlNTnbWRp1MHuqbMlAOxyYizl7:mTshCQjrnlluMHuqberyT7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
90701
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Mktmp\Amadey\Release\Amadey.pdb
kernel32
Sleep
GetTempPathA
GetLastError
GetFileAttributesA
CreateFileA
CloseHandle
GetSystemInfo
CreateThread
GetThreadContext
SetCurrentDirectoryA
VirtualAllocEx
RemoveDirectoryA
ReadProcessMemory
CreateProcessA
CreateDirectoryA
SetThreadContext
ReadConsoleW
SetEndOfFile
HeapSize
SetFilePointerEx
GetModuleHandleA
ResumeThread
GetComputerNameExW
GetVersionExW
CreateMutexA
PeekNamedPipe
VirtualAlloc
WriteFile
VirtualFree
WriteProcessMemory
GetModuleFileNameA
GetProcAddress
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
DeleteFileW
HeapAlloc
HeapFree
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
WriteConsoleW
user32
GetSystemMetrics
ReleaseDC
GetDC
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteObject
BitBlt
advapi32
RegCloseKey
RegGetValueA
RegQueryValueExA
GetSidSubAuthorityCount
GetSidSubAuthority
GetUserNameA
LookupAccountNameA
RegSetValueExA
RegOpenKeyExA
GetSidIdentifierAuthority
shell32
SHGetFolderPathA
ShellExecuteA
ord680
SHFileOperationA
wininet
HttpOpenRequestA
InternetReadFile
InternetConnectA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
HttpSendRequestExA
HttpAddRequestHeadersA
HttpEndRequestA
InternetOpenW
InternetOpenUrlA
InternetWriteFile
gdiplus
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
Name
.text
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=26715,
count=167, id=261, version=26715,
count=22, id=260, version=26715,
count=18, id=260, version=28117,
count=20, id=259, version=28117,
count=78, id=261, version=28117,
count=15, id=257, version=26715,
count=171, id=1, productName=Unmarked objects,
count=1, id=265, version=28315,
count=1, id=255, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=258, productName=VS2019 v16.4.3 build 28315, version=28315,
saved from malware/Files/build_2024-07-27_00-41.exe
- IMPHASH 227c2d4ce0274b95ccaadb855c19748d
- SHA256 217900ee9e96bcb152005818da2e5382cac579ab6edd540d05f2cdb8c8f4ce8b
- MD5 112da2a1307ac2d4bd4f3bdb2b3a8401
- SHA1 694bf7f0ea0ecfc172d9eb46f24bc2309bf47f4f
- SHA512 8455c8fb3f72eba5b3bf64452fb0f09c5fdc228cb121ca485a13daff9c8edef58ced1e23f986a3318d64c583b33a5e2c1b92220e10109812e35578968ed3b7a7
- SSDEEP 3072:loCOUY/xBy22gA9IwLB9LP+VxroVjWYQWs31TEOUHkMSpdI1F7PoCSLEDVOU:lDpY/Ly2+IwFA/oVjcWs31TzhFOFbfJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8425
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LocalCompact
EnumCalendarInfoW
SetEnvironmentVariableW
GetTickCount
CreateNamedPipeW
GetConsoleAliasesA
EnumResourceTypesA
GetConsoleCP
GlobalAlloc
SetFileShortNameW
LoadLibraryW
IsProcessInJob
FatalAppExitW
AssignProcessToJobObject
IsBadCodePtr
ReplaceFileW
GetModuleFileNameW
GetSystemDirectoryA
CreateFileW
GlobalUnlock
CreateJobObjectA
GetLastError
SetEndOfFile
VerLanguageNameW
LoadLibraryA
SetConsoleCtrlHandler
AddAtomW
HeapWalk
GetOEMCP
EnumDateFormatsA
GetModuleHandleA
GetProcessShutdownParameters
EnumResourceNamesA
GetFileTime
PeekConsoleInputA
GetDiskFreeSpaceExA
LCMapStringW
HeapSize
FlushFileBuffers
GetStringTypeW
WriteConsoleInputW
FindVolumeClose
GetProcAddress
HeapCompact
WriteConsoleW
HeapReAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
MultiByteToWideChar
ReadFile
GetModuleHandleW
ExitProcess
SetFilePointer
HeapCreate
WriteFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
GetConsoleMode
GetCPInfo
GetACP
IsValidCodePage
Sleep
RtlUnwind
SetStdHandle
IsProcessorFeaturePresent
CloseHandle
user32
GetMenu
CharUpperBuffW
SetCaretPos
GetMessageExtraInfo
DrawStateW
GetSysColorBrush
gdi32
GetCharWidthI
CreateDCA
GetCharABCWidthsI
winhttp
WinHttpOpen
msimg32
AlphaBlend
Name
.text
Size
138KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
55KB
Virtual Size
32.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sarivi
Size
1024B
Virtual Size
723B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.sivopod
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=27, id=171, productName=VS2010 build 30319, version=30319,
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=100, id=170, productName=VS2010 build 30319, version=30319,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=116, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
saved from malware/Files/clear.exe
- SHA256 18e4f9c4ecffb41dfb252e574ed2d55e0d58f25e94f2bd1c6cd06b9ffe0208cb
- MD5 954e4290b830ec048c7b700dfedd4df0
- SHA1 0311dbf6a2e9fb514e1003c0139e8f37f03929c5
- SHA512 4a7220eba30a8208ee5390f33ccb18b3606b3b078d5983ed3e2ef6d7cbb34d38b3dfda7ff41f167cdd06656b95fa47e4281ff81208195132e53f34a54d1dc993
- SSDEEP 6144:J68oipnnK9jqXEX52Ums+Tbxzbx9SmIqQyPodMUf8Dkzel6R8zHe1IQo:ffnnK9zABs+TbFx9SXOPCf8DkqAR8zHF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
816960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
298KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=183, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=73, id=180, version=40219,
count=55, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
saved from malware/Files/cmd/pocketrar.chm
- SHA256 88cb92994a76c000c184d2ef792252c5ce6f4e3b44246f49d03e73d131a6bf6d
- MD5 fb924432beef158f34a924cf2898e4e0
- SHA1 ab86562e0b1f27df3b2b834679fe0b2d7c29790e
- SHA512 f70cd420698547a861bae583ca48d36f4fb457b34ad5314938e3a417f953257402e0b4d77b5c39a66f5266e83b4357191b48165faf3d5193a4922cfbfd04e073
- SSDEEP 384:L6vAiCEunq2lJe/CQpJH2DBMGmTBWtplamRwI5l:L6l5u7yCQ/HOMDBwRl
- MD5 SHA1 SHA512 SSDEEP
saved from malware/Files/cmd/rar.ini
- SHA256 98d6f03871e74faabf044335dc49f99180fefe612bb382953818022a61833f5e
- MD5 94c57758ac71d3a5788bcb8d1a32b798
- SHA1 4af2aa49e7d82454402b152508ad35b8ecf79aca
- SHA512 4b2f4005fc42bb6b3d19d3d0d30150242f9d7206571b22d7bc9c04b25062f6ab1bae4e692ca8ffd4bd2368a290ffabf0bb9c1eba33247d521d62570d39f75c3c
- MD5 SHA1 SHA512
saved from malware/Files/cmd/rar.ppc_arm.cab
- SHA256 e16c46842d0b748ba306c3d6f80cfa8a54a8eaf089b9eed5a54741f001729f3b
- MD5 014eda1f05f8017b969cdd16b7dcfff0
- SHA1 e39b57a42977556ab732bd10ec719e2bf62e09d9
- SHA512 932863f337b03d543052efc0cf5b0c24b963b6f3c41ec8726b976270edeb8bad51fa5340914761e655efc9cc82f59e240223d066c4bda14aaa912e442b14711c
- SSDEEP 6144:vDEIkoRAu+0+hJHjt4kRuQq3RIMNkiKLlVKjqcwykRnL4z+:L7Jf+qNkiKLiXW
- MD5 SHA1 SHA512 SSDEEP
saved from malware/Files/cmd/uninstall.exe
- IMPHASH e5d29e6665d4ae72a2942abbe17a361c
- SHA256 36d218bf1b9394e255c706a845ed36e016f5bf87a9fce2ea586333a2bc2a605b
- MD5 3111d90b7d68530c8658821756b1e2be
- SHA1 ae74a7bbc5899b58aae698840d600ce3126a8735
- SHA512 43526d562ec35941fc46fb43b3c8b58229871bdf4f3729de294c44f9cd0612033433ab3c21295e69a61c6a14ca4904ecbbefe46a93f8ae4aacdf356984f41e3c
- SSDEEP 96:0PsGcSCvXiYOLug/EIdW4Lga/m/ds4IZtrXMOtaHhwacwmGvuxav:07BmiYOCg/EQW4saO/JIYHHhwacwmhcv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
CloseHandle
CompareStringA
CreateDirectoryA
CreateFileA
CreateProcessA
DeleteFileA
ExitProcess
FormatMessageA
GetCommandLineA
GetEnvironmentVariableA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVersionExA
LocalFree
MultiByteToWideChar
RemoveDirectoryA
SetCurrentDirectoryA
Sleep
WriteFile
lstrcatA
lstrcpyA
lstrlenA
shell32
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListA
user32
LoadStringA
MessageBoxA
wsprintfA
ole32
CoCreateInstance
OleInitialize
OleUninitialize
Name
.text
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
saved from malware/Files/cmd/whatsnew.htm
- SHA256 8cb95a1e121302ea1fda8fffda52088ff7398d86611178b2284d467ec09d3952
- MD5 dcb0a43f213f10549a8c3488f689a47c
- SHA1 6bb9db948ffadf37847a924afed535b602cdc129
- SHA512 c91ec10049b3a05478cbef4e64aec96b718bff62f15cfd63977898d580c1b2e1ecb8d5969f503cd2bd40ba19e5eb49262c56aec92b1f80c8ecf9ea840806d18f
- MD5 SHA1 SHA512
saved from malware/Files/ds.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 60dd002cc2b269d41f167af937005bbf5f447df3997b4ecdf2397b9877d652ea
- MD5 3b6b710da92a115329d00c5e55ad7671
- SHA1 489b2c96417490fd15419c93b953334f93581d28
- SHA512 6626804cacf522a9b33205a5ace276fc4de61f03a983ef5d35c8b0522b774ad48d0d58e431a07ca6089715482307b3974c5c87d65ff4ad3dd0a0008809e9578a
- SSDEEP 49152:sjoECAmAMfR1XZjGQnKBGcjr5bREh7mZGNEA:sjoEHm1XZjy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3310670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/Files/firefox.exe
- SHA256 14df6f7f496e3fe239da89795f410819377ac7b9b0710fa5b112e51cb664f220
- MD5 1ff615affe4dedbfdb5555d09194ba14
- SHA1 c3141b77fe51f299378e875a99c2c873da09c6a0
- SHA512 7ebcf92c794ecb4c4554e55f47b9929c4f12ad6c5250a2907ab962c3326770b8fd11168535844ac5935c8d0b350d32888e15fd9950c366930495877a2a08480b
- SSDEEP 12288:gvHOmh9159ZWAnMmc6JYFcTcXAZXWXR54p:UZ15FnvciY+FdWX
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
31:4a:e2:c1:8c:6c:80:e5:cd:b9:5a:c2:3e:3c:fe:42:f3:c4:de:af:25:a6:33:af:5c:c6:82:12:35:5e:ff:9d
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Chains
Jul 10, 2023
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Serial Number
0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 9, 2021 - Jun 19, 2024
Subject
CN=Dummy
Serial Number
7e:89:b9:df:00:6b:d1:aa:4c:48:d8:65:03:96:34:ca
Issuer
CN=Dummy
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 1, 2013 - Jan 2, 2013
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
6
Entry point
397312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=30795,
count=146, id=261, version=30795,
count=18, id=260, version=31935,
count=21, id=259, version=31935,
count=21, id=260, version=30795,
count=3, id=257, version=30795,
count=166, id=1, productName=Unmarked objects,
count=48, id=261, version=31935,
count=82, id=264, version=32215,
count=1, id=255, version=32215,
count=1, id=258, version=32215,
saved from malware/Files/guardservice.exe
- IMPHASH 7c0a45853a19590104720910cc56837f
- SHA256 c85c5409b8bd924f259868fc62982678bea105c723b70a5b7f24754ea9878b9a
- MD5 97282dff814d59949e713df30c1591bf
- SHA1 4feb6091de90a5b73ffac837974eb8f88f60b926
- SHA512 08991f04ee0f034dc0e57b33d4b5cade4625c403fffa1cffaf9ba724ddef7b369314feb5766cfb3058152c5fe71e0a9048cda8986e7befe7da32566e844d38e7
- SSDEEP 6144:oNAUAhuQ/F+H0iJWrRju5Vn7Ioppea+GGwZ+RzeRCPGMer5:oNAeQ/FSTE/oXBRV5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
372736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcess
GetCurrentDirectoryW
OpenProcess
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
LocalFree
TerminateProcess
GlobalAlloc
GetTickCount
GetProcessHeap
HeapAlloc
RtlMoveMemory
HeapFree
WaitForSingleObject
lstrcpyn
Process32Next
lstrcatA
CloseHandle
Process32First
LocalAlloc
CreateToolhelp32Snapshot
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
RtlUnwind
ExitProcess
GetCommandLineA
GetStartupInfoA
CloseHandle
GlobalFree
GlobalUnlock
GlobalLock
DeleteFileA
FindClose
FindNextFileA
FindFirstFileA
WriteFile
SetFilePointer
HeapFree
HeapAlloc
GetLastError
GetCurrentProcess
GetVersionExA
GetDriveTypeA
TerminateProcess
GetProcAddress
GetModuleHandleA
Sleep
FreeLibrary
lstrcpyA
LoadLibraryA
lstrlenA
MultiByteToWideChar
GlobalAlloc
SetLastError
lstrcatA
HeapReAlloc
GetTimeZoneInformation
GetVersion
GetCurrentThreadId
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
LocalFree
FlushFileBuffers
lstrcpynA
GetFullPathNameA
LocalAlloc
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalHandle
LeaveCriticalSection
GlobalReAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
GetCurrentDirectoryA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
user32
GetWindowThreadProcessId
GetClassNameA
GetWindowTextLengthW
GetWindowTextW
CallWindowProcA
IsWindowVisible
GetParent
GetInputState
FindWindowExA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
GetSysColor
AdjustWindowRectEx
GetClientRect
CopyRect
DestroyMenu
GetSystemMetrics
GetWindowRect
SendMessageA
GetClassNameA
wsprintfA
ReleaseDC
GetDC
SystemParametersInfoA
GetDlgItem
SetWindowLongA
GetWindowTextA
GetWindowLongA
PtInRect
GetWindow
GetParent
PostQuitMessage
PostMessageA
EnableWindow
MessageBoxA
IsWindowEnabled
GetLastActivePopup
SetWindowsHookExA
PeekMessageA
CallNextHookEx
GetKeyState
DispatchMessageA
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
DestroyWindow
GetDlgCtrlID
SetWindowTextA
GetMenuItemCount
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
msvcrt
strlen
shell32
ShellExecuteExW
SHChangeNotify
SHGetSpecialFolderPathA
ole32
CoUninitialize
CoCreateInstance
CoInitialize
odbc32
SQLDisconnect
SQLDriverConnect
SQLSetStmtAttr
SQLFetchScroll
SQLGetData
SQLDescribeCol
SQLFreeHandle
SQLPrepare
SQLEndTran
SQLGetConnectAttr
SQLGetDiagRec
SQLBrowseConnect
SQLExecDirect
SQLBindParameter
SQLNumResultCols
SQLRowCount
SQLSetEnvAttr
SQLAllocHandle
SQLSetConnectAttr
SQLExecute
ntdll
NtQueryInformationProcess
sprintf
advapi32
DeleteService
EnumDependentServicesA
StartServiceA
EnumServicesStatusA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
QueryServiceConfigA
CreateServiceA
GetServiceKeyNameA
QueryServiceConfig2A
ControlService
EnumServicesStatusExA
ChangeServiceConfigA
GetServiceDisplayNameA
ChangeServiceConfig2A
RegOpenKeyA
RegCloseKey
RegSetValueExA
RegDeleteValueA
wininet
HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetGetConnectedState
InternetCloseHandle
InternetConnectA
FtpFindFirstFileA
FtpOpenFileA
InternetSetFilePointer
InternetOpenUrlA
wmvert
wm_WriteFile
wm_StrComp
wm_InStr
wm_DoEvents
wm_Space
wm_SpaceBin
wm_GetBinData
wm_ReadFile
wm_BinLen
wm_BOr
wm_CnvToBin
wm_MkDir
wm_ObjClear
wm_ObjCreateObject
wm_ObjCopy
wm_TimePart
wm_ObjRunMethod
wm_ObjSetProperty
wm_Len
wm_RpSubText
wm_Now
wm_Sleep
wm_Split
wm_VariantSet
wm_ObjGetProperty
wm_IsFileExist
wm_Str
wm_SaveRegItem
wm_IsRegItemExist
wm_GetRunPath
wm_GetRunFileName
wm_pbin
wm_VariantGetBin
wm_VariantClear
wm_ObjGetTextProperty
wm_ObjGetNumProperty
wm_Trim
wm_Right
wm_Left
wm_Mid
wm_Asc
wm_UCase
wm_Mod
wm_SHR
wm_BAnd
wm_SHL
wm_ToByte
wm_InStrRev
wm_Chr
wm_BinMid
wm_SetVariantType
wm_VariantCreateArray
wm_ObjRunTextMethod
wm_RunVariantMethod
wm_pstr
wm_ZeroAry
wm_GetTickCount
wm_BinLeft
wm_Open
wm_SeekToEnd
wm_Close
wm_WriteBin
wm_ToInt
wm_NotifySys
wm_CreateWindowFromTemplate
gdi32
GetStockObject
GetDeviceCaps
SelectObject
DeleteDC
GetObjectA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
comctl32
ord17
Name
.text
Size
164KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
92KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=2, id=93, version=2179,
count=22, id=19, version=8034,
count=31, id=14, version=7299,
count=128, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=59, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=12, version=7291,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=632, id=1, productName=Unmarked objects,
count=19, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=24, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=18, id=11, productName=VS98 (6.0) build 8168, version=8168,
saved from malware/Files/m.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 d396ea92369d44d5f4363af459db49181441bf3fac84b682f3463fc1cfef8fd9
- MD5 7f363ccda3acbf2b4d43728005557390
- SHA1 c684ffb03b62f3fe63f0f02bce97cc97032abe80
- SHA512 8ae8668d58dfd5bfb241e0f553b34ef08a9299da9d9ada264d7a46a49eae7bee4da85a6b764de6c34f37cd5a310fcee90290076cb2af8bc0f5bcabb7b4962bbb
- SSDEEP 1536:OL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHKh:60poOfP6+JuEjaaKHKh
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
102400
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/mimikatz.exe
- IMPHASH ff6abb25b3369620afef1dacd4a21f4c
- SHA256 7d9d0ab00a01faf0390483bce5dfabfab3938cfc3dc752c26461fb8525a3a2d5
- MD5 b18861f89da21e28f14b2c60aa6b941a
- SHA1 2b2a5570e141d1842856a0c610e4280daeda031d
- SHA512 010782a0119f7d0eab9eef51301be8198c96152eb1b16affa8accaf07dc4ea1ca967338f39c644a21c66049275f9a9e894ea7ec094d80db8625c6f918223d760
- SSDEEP 24576:tiDjF7X3YoGq4tC1YJk+3nWBkDeq26iLutKcEY4:t05YjqakE3Aq2vu7E
- MD5 SHA1 SHA512 SSDEEP
-
mimikatz is an open source tool to dump credentials on Windows
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1097728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
CryptSetHashParam
CryptGetHashParam
CryptExportKey
CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptDuplicateKey
CryptAcquireContextA
CryptGetProvParam
CryptImportKey
SystemFunction007
CryptEncrypt
CryptCreateHash
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
CopySid
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
SystemFunction033
SystemFunction032
ConvertSidToStringSidW
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
SetServiceObjectSecurity
OpenServiceW
BuildSecurityDescriptorW
QueryServiceObjectSecurity
StartServiceW
AllocateAndInitializeSid
QueryServiceStatusEx
FreeSid
ControlService
IsTextUnicode
OpenProcessToken
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
CryptSetProvParam
CryptEnumProvidersW
ConvertStringSidToSidW
LsaFreeMemory
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
SetThreadToken
CryptEnumProviderTypesW
SystemFunction006
CryptGetUserKey
OpenEventLogW
GetNumberOfEventLogRecords
ClearEventLogW
SystemFunction001
CryptDeriveKey
SystemFunction005
LsaQueryTrustedDomainInfoByName
CryptSignHashW
LsaSetSecret
SystemFunction023
LsaOpenSecret
LsaQuerySecret
LsaRetrievePrivateData
LsaEnumerateTrustedDomainsEx
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
LookupPrivilegeNameW
OpenThreadToken
EqualSid
CredFree
CredEnumerateW
SystemFunction026
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction027
SystemFunction041
CredIsMarshaledCredentialW
CredUnmarshalCredentialW
A_SHAFinal
A_SHAInit
A_SHAUpdate
cabinet
ord11
ord14
ord10
ord13
crypt32
CryptSignAndEncodeCertificate
CertEnumSystemStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryA
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CryptStringToBinaryW
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptUnprotectData
CryptBinaryToStringW
CryptBinaryToStringA
CryptExportPublicKeyInfo
CryptFindOIDInfo
CryptAcquireCertificatePrivateKey
CertNameToStrW
CertFindCertificateInStore
CertGetCertificateContextProperty
CertGetNameStringW
CryptEncodeObject
CryptProtectData
CryptQueryObject
cryptdll
MD5Update
MD5Final
CDLocateCSystem
MD5Init
CDLocateCheckSum
CDGenerateRandomBits
dnsapi
DnsFree
DnsQuery_A
fltlib
FilterFindFirst
FilterFindNext
mpr
WNetCancelConnection2W
WNetAddConnection2W
netapi32
NetStatisticsGet
DsGetDcNameW
NetApiBufferFree
NetRemoteTOD
NetSessionEnum
NetServerGetInfo
DsEnumerateDomainTrustsW
NetShareEnum
NetWkstaUserEnum
I_NetServerAuthenticate2
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge
odbc32
ord75
ord9
ord43
ord24
ord31
ord111
ord141
ord13
ole32
CoTaskMemFree
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
SysAllocString
VariantInit
SysFreeString
VariantClear
rpcrt4
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
MesEncodeIncrementalHandleCreate
RpcBindingSetAuthInfoExW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcImpersonateClient
RpcStringFreeW
RpcRevertToSelf
MesDecodeIncrementalHandleCreate
MesHandleFree
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeFree2
NdrMesTypeEncode2
RpcServerUnregisterIfEx
I_RpcBindingInqSecurityContext
RpcServerInqBindings
RpcServerListen
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcMgmtStopServerListening
RpcBindingToStringBindingW
RpcServerRegisterIf2
RpcServerRegisterAuthInfoW
RpcBindingVectorFree
UuidToStringW
RpcServerUseProtseqEpW
RpcEpUnregister
NdrServerCall2
NdrClientCall2
UuidCreate
RpcEpResolveBinding
RpcBindingSetObject
RpcBindingSetAuthInfoW
RpcMgmtEpEltInqDone
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
I_RpcGetCurrentCallHandle
shlwapi
UrlUnescapeW
PathIsDirectoryW
PathFindFileNameW
PathIsRelativeW
PathCombineW
PathCanonicalizeW
samlib
SamEnumerateAliasesInDomain
SamQueryInformationUser
SamCloseHandle
SamEnumerateDomainsInSamServer
SamFreeMemory
SamEnumerateUsersInDomain
SamOpenUser
SamLookupDomainInSamServer
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain
SamConnect
SamSetInformationUser
SamiChangePasswordUser
SamEnumerateGroupsInDomain
SamGetGroupsForUser
SamGetMembersInGroup
SamGetMembersInAlias
SamRidToSid
SamGetAliasMembership
SamOpenGroup
SamOpenAlias
secur32
FreeContextBuffer
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
LsaDeregisterLogonProcess
QueryContextAttributesW
InitializeSecurityContextW
AcquireCredentialsHandleW
EnumerateSecurityPackagesW
FreeCredentialsHandle
DeleteSecurityContext
LsaCallAuthenticationPackage
LsaConnectUntrusted
shell32
CommandLineToArgvW
user32
SetClipboardViewer
DefWindowProcW
GetClipboardSequenceNumber
OpenClipboard
CreateWindowExW
ChangeClipboardChain
RegisterClassExW
TranslateMessage
EnumClipboardFormats
PostMessageW
DispatchMessageW
GetKeyboardLayout
IsCharAlphaNumericW
SendMessageW
UnregisterClassW
GetMessageW
DestroyWindow
CloseClipboard
GetClipboardData
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
hid
HidD_GetFeature
HidD_GetPreparsedData
HidD_GetHidGuid
HidP_GetCaps
HidD_SetFeature
HidD_FreePreparsedData
HidD_GetAttributes
setupapi
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
winscard
SCardControl
SCardTransmit
SCardDisconnect
SCardGetAttrib
SCardEstablishContext
SCardFreeMemory
SCardListReadersW
SCardReleaseContext
SCardGetCardTypeProviderNameW
SCardListCardsW
SCardConnectW
winsta
WinStationCloseServer
WinStationOpenServerW
WinStationFreeMemory
WinStationConnectW
WinStationQueryInformationW
WinStationEnumerateW
wldap32
ord145
ord36
ord208
ord41
ord73
ord310
ord13
ord77
ord142
ord54
ord309
ord79
ord304
ord301
ord127
ord26
ord167
ord147
ord27
ord88
ord157
ord14
ord122
ord140
ord203
ord69
ord139
ord97
ord223
ord12
ord113
ord224
ord96
ord133
msasn1
ASN1_CreateEncoder
ASN1BERDotVal2Eoid
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1_FreeEncoded
ASN1_CloseModule
ASN1_CloseDecoder
ASN1_CreateModule
ntdll
RtlIpv6AddressToStringW
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlEqualUnicodeString
NtQueryObject
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlCreateUserThread
RtlGUIDFromString
RtlStringFromGUID
NtCompareTokens
RtlGetNtVersionNumbers
RtlEqualString
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
NtQueryDirectoryObject
NtResumeProcess
NtOpenDirectoryObject
RtlAdjustPrivilege
NtSuspendProcess
NtTerminateProcess
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW
kernel32
SystemTimeToFileTime
lstrlenA
GetDateFormatW
GetSystemTimeAsFileTime
ClearCommError
CreateRemoteThread
WaitForSingleObject
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteProcessMemory
VirtualProtect
InterlockedExchange
SetFilePointerEx
GetProcessId
GetComputerNameW
ProcessIdToSessionId
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
SetLastError
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
VirtualFree
VirtualQuery
GetComputerNameExW
DeviceIoControl
DuplicateHandle
OpenProcess
GetCurrentProcess
ExpandEnvironmentStringsW
FindNextFileW
FindClose
GetCurrentDirectoryW
GetFileSizeEx
FlushFileBuffers
GetFileAttributesW
FindFirstFileW
lstrlenW
GetProcAddress
LoadLibraryW
GetModuleHandleW
FreeLibrary
DeleteFileA
GetTempPathA
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCurrentDirectoryA
GetTempFileNameA
SetFilePointer
CreateFileA
FileTimeToDosDateTime
CreateThread
LocalFree
CloseHandle
LocalAlloc
GetLastError
CreateFileW
ReadFile
Sleep
TerminateThread
WriteFile
FileTimeToSystemTime
GetTimeFormatW
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
GetFileSize
CreateMutexW
HeapCompact
SetEndOfFile
HeapAlloc
QueryPerformanceCounter
HeapFree
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
FormatMessageA
FormatMessageW
GetVersionExW
WideCharToMultiByte
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
MultiByteToWideChar
GetTempPathW
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetSystemTime
AreFileApisANSI
ExitProcess
ExitThread
RaiseException
SetConsoleCtrlHandler
SetConsoleTitleW
SetFileAttributesW
GlobalSize
SetHandleInformation
CreatePipe
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEvent
CreateEventW
GetSystemDirectoryW
SetConsoleCursorPosition
GetTimeZoneInformation
GetStdHandle
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
IsWow64Process
SetCurrentDirectoryW
GetCurrentThread
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersion
GetModuleHandleA
GetCurrentThreadId
PurgeComm
msvcrt
calloc
__set_app_type
_lseeki64
wctomb
__setusermatherr
isspace
mbtowc
__mb_cur_max
_itoa
isleadbyte
isxdigit
localeconv
_snprintf
__p__fmode
ferror
iswctype
wcstombs
?terminate@@YAXXZ
_write
_isatty
ungetc
_controlfp
__badioinfo
__pioinfo
__p__commode
_read
isdigit
strrchr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
_errno
free
_wcsdup
_vsnprintf
_except_handler3
_wcsicmp
vfwprintf
_vscwprintf
fflush
_wfopen
wprintf
_fileno
_iob
vwprintf
_setmode
fclose
_stricmp
wcsrchr
wcschr
wcsstr
strtoul
_wcsnicmp
_vscprintf
memmove
strncmp
malloc
_msize
strcspn
realloc
fgetws
wcstoul
strchr
wcstol
wcsncmp
_wcstoui64
towupper
_wpgmptr
strstr
_strcmpi
strtol
getchar
memset
memcpy
__wgetmainargs
Name
.text
Size
628KB
Virtual Size
627KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
366KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,
count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=51, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=659, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=114, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/nc.exe
- IMPHASH 09d0478591d4f788cb3e5ea416c25237
- SHA256 3563add573f0ccd8fed5837e38eb6e889a99d2acf9a1eb0a9747ca46d2f5b6fa
- MD5 04915e73e6b6d161b573c86b8c3c030d
- SHA1 92162d9b2c051c4d345b42178e444b6c3f64998c
- SHA512 f89b6f4bacd08884bc50ebf8f7763c7e051661bb82d3345d78f8f969afbadb6ff7bb33041c5d662e13843d26372d9ea28b46f286aebec980c87e69498d26c248
- SSDEEP 768:mMBOqWS5cvgHEda3LqFwQjaWzCX4wHQWvOLTsLuOVojlR:xwSegHfLqWQBzi3HGdwa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19456
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Name
.text
Size
27KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
saved from malware/Files/newtpp.exe
- IMPHASH e3b708193fe03ba1bfd096b4ae42f3b9
- SHA256 1e325c270c7d49c8808946b6464b758aee715e2db83687db5e68069c8bb35adc
- MD5 95ab6987c6d2f2b5d40d62f2ec96821f
- SHA1 1cca932d995ea1ea1e94c34342413fd99ddaae16
- SHA512 e76e56a48d686e759eea887e25fbc100fd08f99a139fb04482488a942157aecad09989bf5f23defe25ae3569766fb9f937dac1da85c987d366f776aa278a49c1
- SSDEEP 1536:g9Ww4/inFmav82M1KeKKHqW4KYFqkKUSne1wjAUG94wU3KW:gWwohOT44KktKGa87U3KW
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
106496
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
_vscprintf
srand
rand
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/npp.exe
- IMPHASH 7fda7734b056db13fe95f35927509e47
- SHA256 6a12f718f1864bdfd93122393517aefa718d09bb2d00bd3df6a419028d665352
- MD5 4161ae471d08e9865d12931b4f7e8de0
- SHA1 a93d697391d8ccf6e404f239e4e23955aee0596a
- SHA512 5474a144ceef1209a38ef01efb64f1c3e9b77fff55f4c8d0e898177870b8f0d29920a990b579f96da69e50af9f6aebd14cf24774d45967e5953394111502efa5
- SSDEEP 192:A/wVNUYhUYPtp+OFMJxTmUBzthckCZwSSz9XXaKu:qwVNNUeoIMaUBzjCspaP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
24576
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathFileExistsW
msvcr90
__set_app_type
?terminate@@YAXXZ
_unlock
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
srand
rand
memset
__dllonexit
_crt_debugger_hook
wininet
InternetOpenA
InternetOpenUrlA
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileW
kernel32
SetUnhandledExceptionFilter
GetStartupInfoA
GetTickCount
ExpandEnvironmentStringsW
CreateFileW
WriteFile
CloseHandle
DeleteFileW
CreateProcessW
Sleep
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
InterlockedCompareExchange
InterlockedExchange
user32
wsprintfW
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
510B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.zero
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=59, id=1, productName=Unmarked objects,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/nxmr.exe
- IMPHASH f7505c167603909b7180406402fef19e
- SHA256 ce37ef26d31f745f9001be57c8205b8ae1279396a2ce2b8e7740907e08434475
- MD5 3832f7272df8a0189e7be2ea59572666
- SHA1 5e7931fd3161b663c02673ff5e144cb903cde718
- SHA512 b875a1ec0c3ec80a7cdd25d142edb8e3327e2e4720f2ed8cea6defd6c2b34dbca4a48951e6cfbcd26a2478f06517b4fce09e91a64ea251f1f199bf60dd9d5e35
- SSDEEP 98304:QavlQIN33nVKboT7MAwtCUxDwoQtKjnX6Og6X2XcNlfYWzdgIT3v:QIlQIN33nVKboT7MAwtCYzQQjn46yQlj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateSemaphoreW
DeleteCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetLastError
GetStartupInfoA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
RaiseException
ReleaseSemaphore
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_onexit
_wcsicmp
_wcsnicmp
abort
calloc
exit
fprintf
fputc
fputs
fputwc
free
fwprintf
fwrite
localeconv
malloc
memcpy
memset
realloc
signal
strcmp
strerror
strlen
strncmp
vfprintf
wcscat
wcscpy
wcslen
wcsncmp
wcsstr
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.zero
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
saved from malware/Files/o.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
- MD5 ababca6d12d96e8dd2f1d7114b406fae
- SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
- SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
- SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/pei.exe
- IMPHASH 7fda7734b056db13fe95f35927509e47
- SHA256 feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
- MD5 8d8e6c7952a9dc7c0c73911c4dbc5518
- SHA1 9098da03b33b2c822065b49d5220359c275d5e94
- SHA512 91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645
- SSDEEP 96:zMn7AN23D0TXraYgnY1dTNDiIp+BYA8vrcVO15uJxGE9YUBz2qh3C7tCEkC:A7ANUYhUYPtp+OFMJxTmUBzthckC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
5913
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathFileExistsW
msvcr90
__set_app_type
?terminate@@YAXXZ
_unlock
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
srand
rand
memset
__dllonexit
_crt_debugger_hook
wininet
InternetOpenA
InternetOpenUrlA
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileW
kernel32
SetUnhandledExceptionFilter
GetStartupInfoA
GetTickCount
ExpandEnvironmentStringsW
CreateFileW
WriteFile
CloseHandle
DeleteFileW
CreateProcessW
Sleep
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
InterlockedCompareExchange
InterlockedExchange
user32
wsprintfW
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
510B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=59, id=1, productName=Unmarked objects,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/peinf.exe
- IMPHASH fb0ee5bafbb99ce467989526f0be15c6
- SHA256 4cb590dfafb7653379326e840d9b904a3cf05451999c4f9eb66c6e7116b68875
- MD5 1382c0a4a9e0a9a2c942458652a4a0e4
- SHA1 55ed8ebd6281c280c3e77763773d789a6057e743
- SHA512 cc1ba7e779536b57409c974f16b0d8706fdf8749fb9eca36716d4e84d4f420a650b6476ac08570e684ad1e492da3bbacc15a4e5be4b94a1b708909d683da0b7e
- SSDEEP 384:B/piPNDeVU9iCUAdAAtlYxJ4JVB00FXMSKR:CPNaVUhU+LYOvFX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
12075
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathCombineW
StrCmpNW
msvcr90
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
wcsstr
memcpy
memset
kernel32
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
ExitThread
FindFirstFileW
lstrcmpW
FindNextFileW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
GetFileSize
CreateFileMappingA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
CreateFileW
CloseHandle
CreateThread
ExitProcess
GetLastError
CreateMutexA
Sleep
user32
CharLowerW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ole32
CoInitializeEx
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
650B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=75, id=1, productName=Unmarked objects,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/pered.exe
- IMPHASH a6cec5b1a631d592d80900ab7e1de8df
- SHA256 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840
- MD5 faf1270013c6935ae2edaf8e2c2b2c08
- SHA1 d9a44759cd449608589b8f127619d422ccb40afa
- SHA512 4a9ca18f796d4876effc5692cfeb7ce6d1cffdd2541b68753f416d2b0a7eff87588bc05793145a2882fc62a48512a862fa42826761022fed1696c20864c89098
- SSDEEP 196608:I3pwZJjbyU3b01Kpn3V+uq+VvpqL2Vmd6+Dfc/f/+SveM0EVRuvEKn:uSZL01+l+uq+VvIL2Vmd6mfc/e03RMZ
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
44976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetCPInfo
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=191, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=31328,
count=40, id=261, version=31328,
count=17, id=260, version=31328,
count=9, id=259, version=31328,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=20, id=260, version=31332,
count=1, id=258, version=31332,
saved from malware/Files/pi.exe
- IMPHASH 2ffdf0a1519d1adada787fd4df5a5fec
- SHA256 3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879
- MD5 1e8a2ed2e3f35620fb6b8c2a782a57f3
- SHA1 e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a
- SHA512 ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade
- SSDEEP 1536:y3Mz8f2Z9F1nc2ZWEa5pFeStStfFPeeeeeeeeWeeeee:ZwfYFRVZWz3XtStfF
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
24112
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
recvfrom
setsockopt
sendto
send
recv
WSAStartup
ioctlsocket
bind
WSACloseEvent
WSARecv
WSASend
WSAGetLastError
WSAEnumNetworkEvents
gethostname
connect
inet_ntoa
inet_addr
htons
getsockname
shutdown
socket
closesocket
gethostbyname
WSAEventSelect
WSAGetOverlappedResult
WSAWaitForMultipleEvents
getpeername
accept
WSACreateEvent
WSASocketA
listen
shlwapi
PathFileExistsW
StrCmpNW
PathMatchSpecW
PathFindFileNameW
StrChrA
StrStrIA
StrCmpNIA
StrStrW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
InternetOpenUrlW
InternetOpenUrlA
HttpQueryInfoA
InternetOpenW
InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetConnectA
InternetCrackUrlA
InternetReadFile
HttpAddRequestHeadersA
ntdll
memcpy
_chkstk
_aulldiv
RtlUnwind
memmove
mbstowcs
RtlTimeToSecondsSince1980
NtQuerySystemTime
NtQueryVirtualMemory
strstr
isdigit
isalpha
_allshl
_aullshr
memset
msvcrt
rand
srand
_vscprintf
kernel32
GetLastError
CreateProcessW
GetLocaleInfoA
DuplicateHandle
DeleteCriticalSection
GetThreadPriority
SetThreadPriority
GetCurrentThread
GetCurrentProcess
InterlockedExchangeAdd
InterlockedIncrement
InterlockedExchange
WaitForSingleObject
InterlockedDecrement
GetCurrentProcessId
HeapSetInformation
GetSystemInfo
PostQueuedCompletionStatus
GetProcessHeaps
HeapValidate
HeapCreate
HeapFree
HeapAlloc
HeapReAlloc
ExpandEnvironmentStringsW
CreateThread
CreateMutexA
MoveFileA
MoveFileW
CreateEventA
ExitProcess
GetQueuedCompletionStatus
CreateIoCompletionPort
SetEvent
GetVolumeInformationW
SetFileAttributesW
lstrcpyW
DeleteFileW
GetDiskFreeSpaceExW
FindNextFileW
lstrcmpiW
QueryDosDeviceW
RemoveDirectoryW
FindClose
lstrlenA
GlobalLock
GetModuleHandleW
GetTickCount
GlobalAlloc
Sleep
lstrcpynW
ExitThread
MultiByteToWideChar
lstrlenW
GlobalUnlock
GetFileSize
MapViewOfFile
UnmapViewOfFile
WriteFile
InitializeCriticalSection
LeaveCriticalSection
CreateFileW
FlushFileBuffers
EnterCriticalSection
CreateFileMappingW
CloseHandle
FindFirstFileW
GetDriveTypeW
MoveFileExW
CreateDirectoryW
GetLogicalDrives
CopyFileW
GetModuleFileNameW
lstrcmpW
user32
TranslateMessage
RegisterClassExW
wsprintfW
GetClipboardData
EmptyClipboard
ChangeClipboardChain
SetWindowLongW
DefWindowProcA
RegisterRawInputDevices
CreateWindowExW
SendMessageA
IsClipboardFormatAvailable
CloseClipboard
GetMessageA
wsprintfA
wvsprintfA
GetWindowLongW
DispatchMessageA
OpenClipboard
SetClipboardData
SetClipboardViewer
advapi32
RegSetValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegQueryValueExW
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExW
shell32
ShellExecuteW
ole32
CoInitializeEx
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=184, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=39, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/pimer_bbbcontents7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f7bbd59299cad16b2cb4916738ad1475f61e129763cae617f1f9184f20db1d99
- MD5 abb5797dd47bf453358359acf2453551
- SHA1 cbce075e182eb636b6935296d80fb185a48a07a3
- SHA512 a6885bd39a574c75587476328968d0fb1206ada1b33f575551433b70341d259a3db3fc7b19ef0d6e30c4411c38073e09aa0ad92ebeb1fca9889f37f734d3f9ba
- SSDEEP 98304:NBnTaRw5XvCTQsvyuC7qlML4ZRediPxWaNdW/FaJh:NBTaRbTBvyHqlML4adWh2/FU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3830350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
pimer.bbbcontents7.pdb
mscoree
_CorExeMain
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
506B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/Files/pocketrar350sc.exe
- SHA256 38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3
- MD5 a6a4daa74d974f2d92b35392207070ce
- SHA1 6ece78cd87fe221ec4113cad8d41bef2475408ea
- SHA512 7a1cc21ec30728aadc04146b3a4acaf1b46359d49058a2143e08aa9f999360e92e80f968d0ca820d32959b08028aa3639796564b24c7474bc6a8f38aade19a91
- SSDEEP 6144:WVYmoP2D+6u6e1t0pjWcLCWhc6bTQUzjyvmELZ/lsyw03SxOqtLOoaMVVKlFUB7G:m2Pn6uN/0BjCacrEjyvRtTGrtLLqle9G
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
143360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
43KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.lif
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
saved from malware/Files/pp.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
- MD5 ababca6d12d96e8dd2f1d7114b406fae
- SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
- SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
- SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/ps.exe
- IMPHASH c8bf48e03c8c37268b47f1d2591aa6fd
- SHA256 d76ce4776f4bffcf3b9d84cc7ed0afca5157257a459fed6ca21d68c986e2d63d
- MD5 b26b57b28e61f9320cc42d97428f3806
- SHA1 6d494ca04455b3fd4265bafbdac782bcaafed538
- SHA512 84ddf715637c0da1ab988e3b6b19da05d38c3f5707e3cea4549de70517c173d2ae3c3dcbd6e6e2de7c604d1335e0c270af6364a9f4df04f7a937c3b73ca53031
- SSDEEP 384:prwpQx/8pqH67ujksnWOFqgWJ+SSloQzC:prT/8gH65gWVnkC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8375
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ConnectNamedPipe
GetComputerNameW
CreateThread
CloseHandle
GetCurrentThread
GetLastError
CreateEventW
GetSystemDirectoryW
WaitForSingleObject
CreateNamedPipeW
GetCurrentProcess
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
advapi32
OpenThreadToken
AdjustTokenPrivileges
RevertToSelf
SetTokenInformation
LookupPrivilegeNameW
CreateProcessWithTokenW
OpenProcessToken
ImpersonateNamedPipeClient
InitializeSecurityDescriptor
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DuplicateTokenEx
GetTokenInformation
rpcrt4
UuidCreate
RpcBindingFree
RpcStringFreeW
RpcStringBindingComposeW
UuidToStringW
RpcBindingFromStringBindingW
NdrClientCall2
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
vcruntime140
memset
__current_exception_context
__current_exception
_except_handler4_common
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
_set_fmode
__acrt_iob_func
__stdio_common_vswprintf
fflush
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-convert-l1-1-0
wcstoul
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_initterm_e
_set_app_type
_cexit
_seh_filter_exe
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_configure_wide_argv
_initterm
_exit
_initialize_wide_environment
__p___wargv
_initialize_onexit_table
_get_initial_wide_environment
exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=19, id=261, version=30034,
count=12, id=260, version=30034,
count=1, id=259, version=30034,
count=9, id=257, version=27412,
count=87, id=1, productName=Unmarked objects,
count=2, id=264, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
saved from malware/Files/r.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
- MD5 ababca6d12d96e8dd2f1d7114b406fae
- SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
- SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
- SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/random.exe
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 d2f54fd3046001066f90ed1ec1a08663dddb9bd5b51a9fa08113761da4492143
- MD5 5a9a6f0a1431eaaf52b95fae72c49020
- SHA1 d758fefc4253462ca9c62c5227f8baa12ac95368
- SHA512 4b5e2620d194ce0b711bdcafa9f5009178cbcd795886c8aa1dead893a209f8eea63f9e7519e0c43eee78af4658b938fc2fb230b3d26a38c2fd029bf71d59840d
- SSDEEP 49152:l9RAiPbQBV6ihtRdw6heHTStkT++crpgMi4xTorO2Z:l7AiPbQmihtndEHs+c9g34xMrOG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5009408
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
Name
Size
183KB
Virtual Size
416KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
avopxyzm
Size
1.6MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
rvrtgwyg
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.taggant
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=14, id=259, version=26715,
count=160, id=261, version=26715,
count=18, id=260, version=28117,
count=22, id=259, version=28117,
count=117, id=261, version=28117,
count=20, id=260, version=26715,
count=19, id=257, version=26715,
count=214, id=1, productName=Unmarked objects,
count=1, id=265, version=28315,
count=1, id=255, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=258, productName=VS2019 v16.4.3 build 28315, version=28315,
saved from malware/Files/request.exe
- IMPHASH 015966a997659caed7ef58f6ab2e8bde
- SHA256 8e2fa428fa5e7092d117dadf10529a35f415a0b8fa27cd17607e23dd913ffcdc
- MD5 ef8320eace6f753231666c61104bdd49
- SHA1 0166aceb79a7d6b4a041fd7595fc1d75404a4419
- SHA512 354676c97fe1666920a75fdbffecfd0ac802613572b9e7d0dbc9a1ac24b3c771ca8fa3c1f3375f0a1c90364a07fa22469d2e7eb822196c0a2a1893931b62efe9
- SSDEEP 6144:hh9fH2l34HigA2/BDBaBL7cpnBZVCBQrfYQSlyItcJ2+QmmaeIBqk3biuFo480AL:s9jtaeIBqmu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
117082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleA
Sleep
CopyFileA
GetLastError
CloseHandle
VirtualProtectEx
ResumeThread
GetProcAddress
VirtualAllocEx
ReadProcessMemory
CreateProcessA
SetThreadContext
GetComputerNameA
WriteConsoleW
WaitForSingleObject
CreateMutexA
VirtualAlloc
WriteProcessMemory
GetThreadContext
GetModuleFileNameA
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapAlloc
HeapFree
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetEndOfFile
advapi32
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
GetUserNameA
RegCloseKey
shell32
ShellExecuteA
ole32
CoUninitialize
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
oleaut32
VariantInit
SysFreeString
VariantClear
SysAllocString
wininet
InternetOpenUrlA
InternetOpenW
InternetCloseHandle
InternetReadFile
ws2_32
sendto
htons
recv
connect
socket
send
inet_addr
WSACleanup
closesocket
WSAStartup
Name
.text
Size
229KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=29395,
count=174, id=261, version=29395,
count=23, id=260, version=29395,
count=17, id=260, version=30034,
count=21, id=259, version=30034,
count=77, id=261, version=30034,
count=15, id=257, version=29395,
count=133, id=1, productName=Unmarked objects,
count=5, id=265, version=30152,
count=1, id=258, version=30152,
saved from malware/Files/s.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
- MD5 ababca6d12d96e8dd2f1d7114b406fae
- SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
- SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
- SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/sthealthclient.exe
- IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
- SHA256 81908eb006898c4993eb332ebade732da005f427cf66ce0e87673038657f35c6
- MD5 1907d926371267d57e8a7d36f22048a3
- SHA1 7dd06f3da64b888b2738a87cbc8c648905a1683f
- SHA512 194397c19d0809e86e68a8dcfcc8bb5c8545d8c8a58c6edc391a472f54d437fb4bf0256dafbae9764850b2e991db2cc544e8321ae12eba06291df33126d4f57e
- SSDEEP 49152:okQTAoymLMg1EPdD2tedvDWdGdOwvV/uELXaGJiLagMiecdWUaGnEqDBIMXT2F7I:oaoywEZ0eTkwxXa2irMi8RiEq3TYL9nk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
52527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
ole32
OleInitialize
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
saved from malware/Files/t.exe
- IMPHASH e3b708193fe03ba1bfd096b4ae42f3b9
- SHA256 d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3
- MD5 e2e3268f813a0c5128ff8347cbaa58c8
- SHA1 4952cbfbdec300c048808d79ee431972b8a7ba84
- SHA512 cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc
- SSDEEP 1536:W9mw4/inFmav82TmKtj+5qUPsY3BCHYJhcWPA4G9kj3K1:CmwohOBiPsWMH4ogj3K
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29968
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
_vscprintf
srand
rand
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/t1.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
- MD5 ababca6d12d96e8dd2f1d7114b406fae
- SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
- SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
- SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/t2.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
- MD5 ababca6d12d96e8dd2f1d7114b406fae
- SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
- SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
- SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/tdrpload.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
- MD5 ababca6d12d96e8dd2f1d7114b406fae
- SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
- SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
- SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/tools.exe
- IMPHASH f6243a15fa8eee8ee96b5e1144d461f6
- SHA256 fd1b4e248d92c3aa8f5d6e76a7a8b8b5c04ca3e208a39d3effcc7901f5d03e7f
- MD5 f2bb9263e5a42975fcaab9b11293d7b2
- SHA1 d83def6dc0be54002c7db35d146e5a05af7cdbc1
- SHA512 89815f52eed08753a9037677d98071909f7fd81bf62f43a7b731a7564f9653c83ce9c57a5b8a132b4a632f7eb7fe2a1da21e1ef8336416a90a356748afeac2da
- SSDEEP 6144:YNbsm37slE8J0vpdNawM8H3cG76A2qMsQYxKlwDba:YbL2JJ00wzHMGMqtQYxxba
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
ConnectNamedPipe
CreateFileA
CreateNamedPipeA
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
ReadFile
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
msvcrt
__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_iob
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
sprintf
strlen
strncmp
vfprintf
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
303KB
Virtual Size
303KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
saved from malware/Files/tpeinf.exe
- IMPHASH 68ea642d9ea854cd557366cd6c8ee49a
- SHA256 d93add71a451ec7c04c99185ae669e59fb866eb38f463e9425044981ed1bcae0
- MD5 cfb7fbf1d4b077a0e74ed6e9aab650a8
- SHA1 a91cfbcc9e67e8f4891dde04e7d003fc63b7d977
- SHA512 b174d0fed1c605decc4e32079a76fbb324088b710ce1a3fe427a9a30c7bdcd6ac1ad223970cdc64061705f9a268afa96463ee73536b46991981d041517b77785
- SSDEEP 96:An2ZBONNkv90S32BOl7LN8cVHH/PtboynuYUBPCtL:An3NNazCE7dfP1oynfUBe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
5150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathFileExistsW
msvcrt
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_initterm
_except_handler3
_controlfp
__getmainargs
_acmdln
exit
_XcptFilter
_exit
srand
rand
memset
__set_app_type
wininet
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle
InternetOpenW
InternetOpenUrlW
urlmon
URLDownloadToFileW
kernel32
CloseHandle
DeleteFileW
CreateFileW
ExpandEnvironmentStringsW
GetTickCount
GetModuleHandleA
GetStartupInfoA
Sleep
CreateProcessW
WriteFile
user32
wsprintfW
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
60B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
246B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=37, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/tt.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
- MD5 ababca6d12d96e8dd2f1d7114b406fae
- SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
- SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
- SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/twztl.exe
- IMPHASH 2e23372b9869b74c90162a6fda4f170d
- SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
- MD5 ababca6d12d96e8dd2f1d7114b406fae
- SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
- SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
- SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
- MD5 SHA1 SHA512 SSDEEP
-
Phorphiex payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetCloseHandle
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
DeleteUrlCacheEntryW
InternetOpenUrlW
InternetOpenW
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
srand
rand
_vscprintf
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
lstrcmpW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
ExpandEnvironmentStringsW
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
DeleteFileW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/v.exe
- IMPHASH 38ca2cef077b08d131c2be3bfd70789c
- SHA256 3860e4bc7a35d52b4193b256bd76e62d98e9d05e504e4871a56585ea56295228
- MD5 5381689d4c9a0ce9d0f67dd8485188d2
- SHA1 28a5df66c1b6cc6b1181a3344edf7df0bb6fa246
- SHA512 3ca6be4c6c1fcc571325cbd5d24938a80a8d3b986419c43a3df34fdaaa7b6f94aafd118bc7dc4f6ec69343e88c70137e0ec07bd9d7b67789a2d55e6d1823e63b
- SSDEEP 192:3p94aeZmoVfBLMhegdZJJfxMLkWScZqYSi/HX:3p94iQYgOZTxMQWSc9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6923
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcr90
_invoke_watson
_except_handler4_common
memset
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
wcscmp
wcslen
srand
rand
_controlfp_s
urlmon
URLDownloadToFileW
wininet
InternetOpenUrlW
HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetOpenW
shlwapi
PathFindFileNameW
PathFileExistsW
kernel32
CreateMutexA
GetLastError
ExitProcess
GetModuleFileNameW
CopyFileW
SetFileAttributesW
GetTickCount
ExpandEnvironmentStringsW
CreateFileW
WriteFile
InterlockedExchange
DeleteFileW
CreateProcessW
Sleep
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetSystemTimeAsFileTime
InterlockedCompareExchange
GetStartupInfoA
CloseHandle
UnhandledExceptionFilter
TerminateProcess
user32
wsprintfW
advapi32
RegSetValueExW
RegCloseKey
RegOpenKeyExW
shell32
ShellExecuteW
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
644B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=73, id=1, productName=Unmarked objects,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/Files/xmrig.exe
- IMPHASH 16bb67d62ee484974f9392fc52c45722
- SHA256 9ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
- MD5 4813fa6d610e180b097eae0ce636d2aa
- SHA1 1e9cd17ea32af1337dd9a664431c809dd8a64d76
- SHA512 5463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa
- SSDEEP 98304:ZLsUYfB9pOp/BWLbrkShfa+XQD/YPLTDtU5SXXMQHJw7ZB87TtIeUK+MzfL7cybS:Kgp/NQ7rfWOlb1paSbkJFsxfKLNIS
- MD5 SHA1 SHA512 SSDEEP
-
XMRig Miner payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
CloseServiceHandle
ControlService
CreateServiceW
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEnumProvidersW
CryptExportKey
CryptGenRandom
CryptGetProvParam
CryptGetUserKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashW
DeleteService
DeregisterEventSource
FreeSid
GetSecurityInfo
GetTokenInformation
GetUserNameW
LookupPrivilegeValueW
LsaAddAccountRights
LsaClose
LsaOpenPolicy
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceConfigA
QueryServiceStatus
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegisterEventSourceW
ReportEventW
SetEntriesInAclA
SetSecurityInfo
StartServiceW
SystemFunction036
crypt32
CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
iphlpapi
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToNameW
GetAdaptersAddresses
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AssignProcessToJobObject
CancelIo
CancelIoEx
CancelSynchronousIo
CloseHandle
ConnectNamedPipe
ConvertFiberToThread
ConvertThreadToFiber
CopyFileW
CreateDirectoryW
CreateEventA
CreateFiber
CreateFileA
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectW
CreateNamedPipeA
CreateNamedPipeW
CreateProcessW
CreateSemaphoreA
CreateSymbolicLinkW
CreateToolhelp32Snapshot
DebugBreak
DeleteCriticalSection
DeleteFiber
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsA
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FlushFileBuffers
FlushInstructionCache
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
GetComputerNameA
GetConsoleCursorInfo
GetConsoleMode
GetConsoleScreenBufferInfo
GetConsoleTitleW
GetConsoleWindow
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetHandleInformation
GetLargePageMinimum
GetLastError
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNamedPipeHandleStateA
GetNativeSystemInfo
GetNumberOfConsoleInputEvents
GetPriorityClass
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessIoCounters
GetProcessTimes
GetQueuedCompletionStatus
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetSystemFirmwareTable
GetSystemInfo
GetSystemPowerStatus
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
GetTickCount64
GetVersion
GetVersionExA
GetVersionExW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
IsDBCSLeadByteEx
IsDebuggerPresent
K32GetProcessMemoryInfo
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PeekNamedPipe
PostQueuedCompletionStatus
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserWorkItem
RaiseException
ReOpenFile
ReadConsoleA
ReadConsoleInputW
ReadConsoleW
ReadDirectoryChangesW
ReadFile
RegisterWaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
SetConsoleTitleA
SetConsoleTitleW
SetCurrentDirectoryW
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFileCompletionNotificationModes
SetFilePointerEx
SetFileTime
SetHandleInformation
SetInformationJobObject
SetLastError
SetNamedPipeHandleState
SetPriorityClass
SetProcessAffinityMask
SetSystemTime
SetThreadAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepConditionVariableCS
SuspendThread
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
TryEnterCriticalSection
UnmapViewOfFile
UnregisterWait
UnregisterWaitEx
VerSetConditionMask
VerifyVersionInfoA
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleInputW
WriteConsoleW
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__argv
__doserrno
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_assert
_beginthreadex
_cexit
_close
_close
_commode
_endthreadex
_errno
_exit
_fdopen
_filelengthi64
_fileno
_findclose
_fileno
_findfirst64
_findnext64
_fmode
_fstat64
_fullpath
_get_osfhandle
_gmtime64
_initterm
_isatty
_localtime64
_lock
_lseeki64
_mkdir
_onexit
_open
_open_osfhandle
_read
_read
_setjmp
_setmode
_snwprintf
_stat64
_stricmp
_strdup
_strdup
_strnicmp
_time64
_ultoa
_unlock
_umask
_vscprintf
_vsnprintf
_vsnwprintf
_wchmod
_wcsdup
_wcsnicmp
_wcsrev
_wfopen
_wopen
_write
_wrmdir
abort
atof
atoi
calloc
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
isxdigit
_write
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
putc
putwc
qsort
raise
realloc
rand
setlocale
setvbuf
signal
sprintf
srand
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtol
strtoul
strxfrm
tolower
toupper
towlower
towupper
ungetc
vfprintf
ungetwc
wcschr
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsstr
wcstombs
wcsxfrm
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
shell32
SHGetSpecialFolderPathA
user32
DispatchMessageA
GetLastInputInfo
GetMessageA
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
MapVirtualKeyW
MessageBoxW
ShowWindow
TranslateMessage
userenv
GetUserProfileDirectoryW
ws2_32
FreeAddrInfoW
GetAddrInfoW
WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSAGetOverlappedResult
WSAIoctl
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSASetLastError
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
gethostname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
shutdown
socket
Name
.text
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
188KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
238KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/a/1111.exe
- IMPHASH 74aaf0b5a0230a863603c8c6bcd8756b
- SHA256 da96b85bb04c797fd30df884ec895f8a03c7dc98c9e188733a4ee1d8754fec70
- MD5 2055eb0fa5dfccef0c68146527b0c4f4
- SHA1 9a04941b835e1f13d96a3b4fcd137038689105a3
- SHA512 8aa28d3febc2c2aeeed19f75cb871ef5f5e5e105108b7f210c54dcf9c9aafb193a9287be99bacea3e713807a89fd9c8f637b45c849e2336e6397844187a643e4
- SSDEEP 49152:54sOIb6IN32aRdB3c9dhawmxMGkzLhwGiPYm4+Zniq:54dHINGaRdB3cThawmUr+8q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetTempPathA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrlenA
msvcrt
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_assert
_cexit
_errno
_chsize
_filelengthi64
_fileno
_initterm
_iob
_lock
_onexit
_unlock
abort
atoi
calloc
exit
fclose
fflush
fgetpos
fopen
fputc
fread
free
freopen
fsetpos
fwrite
getc
islower
isspace
isupper
isxdigit
localeconv
malloc
memcmp
memcpy
memmove
memset
mktime
localtime
difftime
_mkdir
perror
printf
realloc
remove
setlocale
signal
strchr
strcmp
strerror
strlen
strncmp
strncpy
strtol
strtoul
tolower
ungetc
vfprintf
time
wcslen
wcstombs
_stat
_utime
_fileno
_chmod
main
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
66B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/80
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/91
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/102
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/a/66ae96cb3d23b_crypted.exe
- IMPHASH ddd411113fce64ff664d110a3ad7d003
- SHA256 0e0c0490ffc84c7495c29f2cd0e302e982efc377764f22b57f0acbf637b93630
- MD5 4587aa68e93674b5d4e35fff967b72b0
- SHA1 30e7f586ce5cf8a53241e8270d8ee0cb314bc68a
- SHA512 72a2a8d96133b643c29ef068aadfb2d854c8ba7f01e2f722f0d9fcf133103de9708ab0ffcde89121b3e3189a95d4721f4ca93620efbbc0b81e9a068043fcf324
- SSDEEP 24576:F3dQC5oKB7j2xKR13XYpAaZq39jImMqKcXwm8j/jwt:FBoKB7j2xK1sZq3hImMqKI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
05:8f:79:c9:1e:77:06:ec:45:3e:8a:2a:4d:c5:23:3c:99:63:3c:cc:c5:f9:35:4f:9e:02:3f:a7:3d:e1:c7:e4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 2, 2023
CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 13, 2023 - Jan 16, 2026
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Minor OS version
0
Major OS version
6
Entry point
170623
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\ytjij8b4e5q\output.pdb
kernel32
WaitForSingleObject
CreateThread
GetProcAddress
VirtualAllocEx
GetModuleHandleW
MultiByteToWideChar
FormatMessageA
GetStringTypeW
WideCharToMultiByte
GetCurrentThreadId
CloseHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
GetLocaleInfoEx
LCMapStringEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
QueryPerformanceFrequency
SetFileInformationByHandle
GetTempPathW
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
CompareStringEx
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateFileW
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
GetTimeZoneInformation
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
HeapSize
WriteConsoleW
Name
.text
Size
522KB
Virtual Size
522KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
312KB
Virtual Size
318KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=29395,
count=173, id=261, version=29395,
count=21, id=260, version=29395,
count=3, id=257, version=29395,
count=123, id=1, productName=Unmarked objects,
count=18, id=260, version=33218,
count=21, id=259, version=33218,
count=85, id=261, version=33218,
count=1, id=265, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
saved from malware/a/66ae9b239854c_crypto.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 10f1ea0c6154e61af5be55c6e79de07ab3df91d10515004a8395b52e41417286
- MD5 d6ef7693d2c323305a62db85c85f42cd
- SHA1 0e80caa10a525ec9a9d08fa82b538d72ec117a41
- SHA512 20df1464361c6f3de4eb591bab2a14adc75cb333cd92bddbcbad0bbf9e948768a9082c5ec87b5c5fa1d21f2bddbeed73b2024a576ad75a52f5252badb36eb5cd
- SSDEEP 49152:Bhv5pWzxTTUL2XdAKdB96KcOpP0i1bloi+UGTf2kOKnr6byw6edJDn108F4aSyz3:BhvAfbp6qJjR+yz/YaNrobTVRxwU2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4636798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
fastconverter.pdb
mscoree
_CorExeMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66af4e35e761b_doz.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0843b763880a4e1b559d29140afff5cd867bcada20eda6db2524d4e5045af114
- MD5 c7904602501fb4a18a2ceb29d1c7748b
- SHA1 cf51727aab14549d8748ab60876b3915532b08be
- SHA512 70512f5498fb5f813bfcfb3383807f3beee8dfceb24156cfa9dab122baf2aa15681b0b9dbcd0e29537d07383656e08a6dd2d2b8328ec2c80488839ba66d08a13
- SSDEEP 49152:cr/3+oa7VxrIg3J5h0ib1kAVBe4kmF3k+fthNbLIGivvPucQqppfDNKHoAjc16Nv:cr/+oa7brb3dkMCFPJjDwI716X
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4652558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
tashkentsoft.pdb
mscoree
_CorExeMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66af531b832ee_main.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 521d404952876e51d0cf3a4d0d69e30566406a3a129343d5e53d5d7274f4d3dc
- MD5 46bb5bf831f8b516b87078f35286a4d6
- SHA1 4a6637b3ace0542d5629dfef7ad3b0b5e73e9c01
- SHA512 9b8abf0478563a402edff57282c1be0475742f403c07d9b99ca5ff36a5fb7831d2af76bbef046dc9b2b1b084ea287b20040610c44e0ccb7251b9d6e9fb2fda19
- SSDEEP 49152:h1B2HjcXLJbDjU+zI0EMnp6a8ZPoMhY+FbmJDXVBRSd2ANZtJjVQRQEdSeN5uzKV:h1B2HILF00fp6a8MmfB5EdS+u+I/Mp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4530590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
simplemusic.pdb
mscoree
_CorExeMain
Name
.text
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66af9bdbf0f60_Team.exe
- IMPHASH c346eaddb975f381aa1bae852c6a8010
- SHA256 1fc3e92f7f30f4f68861d3ceb8284853ae30c11cbd0ed3e46ea9eb698b3ec348
- MD5 2f208b17f8bda673f6b4f0dacf43d1bf
- SHA1 5131b890e8f91770039a889e72464b5ce411c412
- SHA512 2830984abc5476e23609c947304f1124fd33f38e654b98bccbcde44e7fbadb75584983243e83a006b69403ac3d42ab379e1665989bec368320efdd5e98ad62df
- SSDEEP 98304:IdEOTQvv8toqK+tO985QWRDXpFviNkYDdQI:GEOFtoqK+898jRDZ8kY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
10147968
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
user32
CharNextW
LoadStringW
WINNLSEnableIME
SetClassLongPtrW
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateLayeredWindow
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
TrackMouseEvent
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCaret
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetCapture
SetActiveWindow
SendMessageTimeoutW
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxIndirectW
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
InsertMenuItemW
InsertMenuW
HideCaret
GetWindowThreadProcessId
GetWindowTextLengthW
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowDC
GetUpdateRgn
GetUpdateRect
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetScrollBarInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgCtrlID
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameW
GetClassInfoExW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EndMenu
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
CreateAcceleratorTableW
CopyImage
CopyIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
AppendMenuW
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
kernel32
Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FindResourceW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
lstrlenW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
TryEnterCriticalSection
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryW
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
IsDebuggerPresent
OutputDebugStringW
MultiByteToWideChar
MulDiv
LockResource
LocalFree
LoadResource
LoadLibraryW
LeaveCriticalSection
LCMapStringW
IsValidLocale
InitializeCriticalSection
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GlobalUnlock
GlobalSize
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetUserDefaultLCID
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathW
GetSystemDirectoryW
GetStdHandle
GetLongPathNameW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfoExW
GetCPInfo
GetACP
FreeResource
FreeLibrary
FormatMessageW
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExpandEnvironmentStringsW
EnumSystemLocalesW
EnumResourceNamesW
EnumCalendarInfoW
EnterCriticalSection
DeleteFileW
DeleteCriticalSection
CreateThread
CreateFileW
CreateEventW
CompareStringA
CompareStringW
CloseHandle
Sleep
gdi32
UnrealizeObject
TextOutW
StretchDIBits
StretchBlt
StartPage
StartDocW
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetTextAlign
SetStretchBltMode
SetRectRgn
SetROP2
SetPixel
SetMapMode
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetRegionData
GetPixel
GetPaletteEntries
GetObjectA
GetObjectW
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetClipBox
GetCharABCWidthsFloatW
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
ExtTextOutW
ExtFloodFill
ExtCreateRegion
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExW
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateFontW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
CombineRgn
Chord
BitBlt
ArcTo
Arc
AngleArc
AbortDoc
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
ole32
CreateStreamOnHGlobal
ReleaseStgMedium
OleDraw
DoDragDrop
RevokeDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoGetClassObject
CoUninitialize
CoInitialize
IsEqualGUID
comctl32
InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
msvcrt
isxdigit
isupper
isspace
ispunct
isprint
islower
isgraph
isdigit
iscntrl
isalpha
isalnum
toupper
tolower
strchr
strncmp
memset
memcpy
memcmp
shell32
ShellExecuteW
Shell_NotifyIconW
DragQueryFileW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
comdlg32
PageSetupDlgW
PrintDlgW
GetSaveFileNameW
GetOpenFileNameW
winspool.drv
SetPrinterW
OpenPrinterW
GetPrinterW
GetDefaultPrinterW
EnumPrintersW
DocumentPropertiesW
DeviceCapabilitiesW
ClosePrinter
GetDefaultPrinterW
winmm
timeGetTime
d3d9
Direct3DCreate9
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
9.7MB
Virtual Size
9.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
841KB
Virtual Size
841KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
124KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
157B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
880B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
109B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
534KB
Virtual Size
533KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
513KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
saved from malware/a/66afa0d3934d8_ultfix.exe
- IMPHASH 5929190c8765f5bc37b052ab5c6c53e7
- SHA256 a0906077d04dbccf4fdcaa15f49f5d214bfdb2baf845126d44ff638f620681bf
- MD5 0da8d6933fc99a15fc4ed8b20145f7b5
- SHA1 915bf2ee3078ddc7b9a8785b3dc5efa80a11f537
- SHA512 ed247ff1b11bfd6601e690e5e9a4743988945f8c6f32b15c1a02d7ecfc9a16a123bd6fa4e3e891283b6ab9c641c4258a610dbefdfb26146f55d7354e66ac7199
- SSDEEP 98304:Hy3ex5+JHQDw3/2xXz5pDUcg+b+EmCu8scTiPc8HLaAK4i:aHLuxXz5eWb7mCl/TifKr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
5312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddAtomA
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateThread
CreateWaitableTimerExW
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
FormatMessageA
FreeEnvironmentStringsW
GetAtomNameA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetHandleInformation
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RaiseFailFastException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetLastError
SetProcessAffinityMask
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_lock
_memccpy
_onexit
_setjmp
_strdup
_ultoa
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
longjmp
malloc
memcpy
memmove
memset
printf
realloc
signal
strerror
strlen
strncmp
vfprintf
wcslen
_cgo_dummy_export
Name
.text
Size
5.8MB
Virtual Size
5.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
351KB
Virtual Size
350KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
9.7MB
Virtual Size
9.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
182KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
383KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/a/66b09f01e0030_dozkey.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fa565ec0da19b4c700bf3705101bd49c9c09aaf26691abb6fe1c3622926cc8d2
- MD5 e66c202fc9367708b37d5ed10975bfa8
- SHA1 090ce59f7507b732b36b74e14dbbbef662d2157a
- SHA512 91c0bace672cbabbf7b8dc7b5b50e996592f177b3fa03be6cc2f558bc1132377188b13e1aebc5930a294c950711de378ee23534175b84c09b5bad91b6ff3bb19
- SSDEEP 49152:OJeWnnSndfDmDeyev3jh2iB/rcipCNweSNP0r5hHqtCavMvBVRZsp1u68wA4:OJVnnSnVDmDey/0g/Kca0ZVQp4sA4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4069902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
marcetsoft.pdb
mscoree
_CorExeMain
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b0ba4420669_main.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 13368bfeba0fbf3160dbbb1155b1439b7fcdb0fb59baef1cc93207821e63465f
- MD5 fee265f64791e63acdcd3e04acdc93b9
- SHA1 ce95f3b23180323579c9b7cdcc50fc16fceabcdf
- SHA512 5873c1d1c1b7362a5ce24cad8acb882baf4c8431617944db70224e9f8a9e1ce09256c37e39f80d31c4ab50ea6a9bd22e60b08823c943f7e73dc3c21c3f82b9ba
- SSDEEP 49152:BkMVEqXfvoOqoYqUPVK3tkhoUIL02aQxoRTLbvZgkxnM9iTRyiqy4:BJ9fAOqrd2acopv/2iohy4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3953358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
burjhsoft.pdb
mscoree
_CorExeMain
Name
.text
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b0ee142cf8f_PhotosExifEditor.exe
- IMPHASH c595f1660e1a3c84f4d9b0761d23cd7a
- SHA256 8ef1d24500ab75ee2ebde59ea01df3a168b41d9d7e987ae843c1188ec7dac49f
- MD5 677ad736788d93b76ca77717706a8176
- SHA1 e5ceecfa05f98c11f58b8844cba4e52850e11009
- SHA512 df2b84b37380ef2776d5f4d5179006e5ef0f318928fd040bea7ba4a88808bdf62220cddc3ce7406f30aac1e7ea019d1a994eda2c7fd23038ca0748e078db6700
- SSDEEP 49152:Imo7Co7xWaVpuCaqn1FmIV6Oi+eVw3HaRAGx3ycrcj/ushk8JZSjkE5E64Lo8QXs:w/VhZ0CLwEmCPaDy3B51VX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
5312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddAtomA
AddVectoredContinueHandler
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateThread
CreateWaitableTimerExW
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
FormatMessageA
FreeEnvironmentStringsW
GetAtomNameA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetHandleInformation
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RaiseFailFastException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetLastError
SetProcessAffinityMask
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_lock
_memccpy
_onexit
_setjmp
_strdup
_ultoa
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
longjmp
malloc
memcpy
memmove
memset
printf
realloc
signal
strerror
strlen
strncmp
vfprintf
wcslen
_cgo_dummy_export
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
563KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
316KB
Virtual Size
315KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/a/66b1b02a20b5a_cry.exe
- SHA256 a840a9894c71901d75fc4e4b5ef40a061d00d58870c3dbae302aa485685ab7b5
- MD5 e663ec19352235b194c0ea3a558b44b3
- SHA1 f99e23ae78e5b401eae1d637b9da51b85b7dc5cd
- SHA512 8374838f538b15334403ed72a44ef927dfd76fca025c008aa12f21ca224582c929945acd7811e60a09992646176c443b1c5488f899c6b1485af731cf9f932aea
- SSDEEP 6144:u+8KW1TIUD71g29/pmW9txE9s1k9jWydiLs1YRfiKdeF:u+tWRxj9/pH9ti8LO2iK8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4238718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
4.0MB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
118KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
saved from malware/a/66b331646d2cd_123p.exe
- IMPHASH 3fac356340f08f787f93cbf317f090cd
- SHA256 bef765aff3d916d8be504b604c0dc37afe3fd76260fe158508b778b5e4b85ddf
- MD5 27b14ad026da76c1111174c6b4ba6aba
- SHA1 e55a0aa823a6c91ec602d4e6f283b23858965a08
- SHA512 a4f682d6e047c5e3bafc5431d6ddc2a3d6decf47c14ef14ae3a9581cf669db5314bb19b7f9437b9236a28338472e94407dad7745465afb691ffce3548503624f
- SSDEEP 196608:tSiB9/zPAW0ILyawlf9Ul33DqL4zDefJglqYnkFTdl434Mfr:tX97fB6iXvkFTf4zj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
18797972
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
__C_specific_handler
kernel32
DeleteCriticalSection
Name
.text
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
12.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text0
Size
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text1
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text2
Size
10.1MB
Virtual Size
10.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
193KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
saved from malware/a/66b331997e05e_main21.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 12df075fcaec366639ab37f203aa412540f351ee17e7f126a4a126e7a61c2a9b
- MD5 305d50d93ffc87e36a9d7d0914f8c4c5
- SHA1 54e1e8998810a96a038b5f0c7c8a4846335e778e
- SHA512 ffadb7e34cf8360b062e62e51862c22716f16a42024dcfbadbe5e1c907704e9994e394915d74b04fe5a471892f16c9c4f07bac4d707eb188e009960866e2ab4b
- SSDEEP 196608:Qhb0vhDix4Xgvoe4IdCCmbU0RWtPHYb/FCUUrbNQv4:U0JVXgvoerkU1p4btnYM4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8562062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
softconverter.pdb
mscoree
_CorExeMain
Name
.text
Size
8.2MB
Virtual Size
8.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b382f122c02_stk.exe
- IMPHASH add63f909d344437ae54d223c75de68e
- SHA256 be9862ad765af7e71a322549640747a6952c4e8bc18b6568c4781df33f0bbfd6
- MD5 f2908c73543719738bea99c02fdafe00
- SHA1 2fc8790129fa21cb76642cbd7ab04fc1783e911b
- SHA512 fa9d5987ef0f9f14d98d5070e09d980e944e4f06966b2601a3b01bfe95a0df239305bd4dad292a8808e6dee6e02d0d33079eda2ddb668ba31d2a9949173a2a31
- SSDEEP 196608:HSpxdHp8lQbLfamxV06mpg2fsT0A0F+kuwN9:4HamxVBmpdfsT0q4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20349249
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
advapi32
GetUserNameA
shell32
ShellExecuteA
ole32
CoCreateInstance
ws2_32
send
Name
.MPRESS1
Size
6.4MB
Virtual Size
19.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
139KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
saved from malware/a/66b38609432fa_sosusion.exe
- IMPHASH e902806dc6753d09a7c13ca6f68bc7e5
- SHA256 7518651b8d76be49723b20618d03479549e945c841435e49dae6fb9d0bba2ab3
- MD5 0031946b83cbec1b920f827478e68c17
- SHA1 3553f0e44e812a38798fea106b0b081827713d6d
- SHA512 401d70a7774cdde53d42abee593179e96eca83c4d5db0eeaf6d8491fb02018d6f7ce3c93ed00b32f36f47aa37e031c1f72445a3fe9eac186a81e175876ebca47
- SSDEEP 24576:iFDGU/pFtzpVR42sentv4BZaUfd9/JW6d:aDGirSR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
299404
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetTempPathW
FreeLibrary
GetProcAddress
LoadLibraryW
WideCharToMultiByte
WriteConsoleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapFree
CloseHandle
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
HeapReAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
CreateFileW
FlushFileBuffers
ReadFile
ReadConsoleW
HeapSize
SetEndOfFile
Name
.text
Size
401KB
Virtual Size
401KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
205KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.enigma1
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.enigma2
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp1
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp2
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.arch
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.srdata
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.xpdata
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.xtls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.dsstext
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=167, id=261, version=30795,
count=18, id=260, version=30795,
count=16, id=260, version=30034,
count=10, id=259, version=30034,
count=78, id=261, version=30034,
count=3, id=257, version=30795,
count=99, id=1, productName=Unmarked objects,
count=1, id=261, version=30154,
count=1, id=258, version=30154,
saved from malware/a/66b38b9ae0da3_palnet_new.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 11c350a41232b6adfe9634d8d9e2afacac1e5e06bd20ee1fbc480a3987b83ab0
- MD5 12d8e993204cd8a39b7b5938ea6369eb
- SHA1 2539692bca45fdda62876fa7cf5baa87ae2b28e5
- SHA512 62a282d86a9b537d213368e3f1998d372e55fcc08f5dd9726dc8b2369c5879d16fb369709884f77a41bf77d630b8c3f79d53db13fdf34d0109e3d7717ad5da19
- SSDEEP 49152:xwetL0lRvzzZamhKUFsDFf1v5gBIx1Di6nujpzbWdRb:xw0L4zzZamh7FsDFN5gKs6ujWRb
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
69:56:9b:68:fc:50:e2:a8:3b:9a:19:f8:44:c9:ea:d5:dd:a4:a1:a0:27:ac:1c:46:0a:e8:b4:40:6b:b3:56:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))
Chains
Aug 7, 2024
Subject
CN=^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))
Serial Number
52:47:96:ee:4a:18:0f:b8:4d:1e:a2:50:67:e9:ce:39
Issuer
CN=^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))^^^^^^^^^^^^^################(((((((((((())))))))))))))))))))))))))))
Timespan
Aug 6, 2024 - Aug 7, 2034
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
2714750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
palnet_to_creator.pdb
mscoree
_CorExeMain
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
121KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b4af430a0a1_files.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c4af46f2a357b68ce8e5830d9639e0c9212c61ae5d0fd1bb283812217a14ab72
- MD5 f3d8c82810e55bc012bdeb2557ff13b9
- SHA1 f899ab6b698678aedc8b24a6d7599114479216fe
- SHA512 3e93f06c4fcbe06a904144bb08ec876587b58626c80d9774c0282f67530d3cf0668a9da795899cdc618e6ace6e513b9cd82b7dafa4c09d4fdb0e9b2160dd4f7f
- SSDEEP 98304:O7Mc42rKqtx1rLs5Et54d5k0rCs0ZBLzj7xibnsoKbmLe:O7Mc42rKqVbt54dtus0Zhzj7gyb0e
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
bd:93:1f:c1:7b:64:b0:f4:73:ea:b6:82:af:f6:e5:6d:36:0b:a6:d1:5e:b5:99:73:81:cc:2e:85:9b:f2:7c:b0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}
Chains
Aug 8, 2024
Subject
CN={{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}
Serial Number
54:64:0d:9c:13:56:5f:96:4d:7b:75:47:73:45:61:97
Issuer
CN={{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}
Timespan
Aug 7, 2024 - Aug 8, 2034
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
4537950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
data763portfolio.pdb
mscoree
_CorExeMain
Name
.text
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b4b5e40dbf6_template832components.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2115d84882f5f20f2d06e3170cb17f75eb1ad0ae2106149683be0a560adbad20
- MD5 d46a50db86b3fd08fcfee930731d63ed
- SHA1 449662e06ac7f585b3562912f0c6f35227f6a974
- SHA512 9e70d594ff1605e8bce57040b84e975117f0e405596b639af2bd29b7b9b52f9140ad4164f1c688e8bc3eb807adbb6b2c4f65a5e50f7ada286b0bfc25a6bae4c3
- SSDEEP 98304:UyMJPJlnVdw3W+JrkbbDQ800Neue6nPL8:UyGDVq3DrCF00NrH8
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f5:22:d6:34:46:06:95:69:43:be:1e:cb:3d:6b:04:53:c5:f4:3f:51:eb:42:0c:9b:bc:cf:ef:80:13:4f:e0:eb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}
Chains
Aug 8, 2024
Subject
CN={{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}
Serial Number
54:64:0d:9c:13:56:5f:96:4d:7b:75:47:73:45:61:97
Issuer
CN={{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}{{{{{{_____%%%%%%%%%%%--------}}}}}}}}}}
Timespan
Aug 7, 2024 - Aug 8, 2034
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
4266238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
template832components.pdb
mscoree
_CorExeMain
Name
.text
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b4ed2ceb0d7_stealc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 70a55c52fb1ebaee4b64ce822e6f3ed8c4e103fa6fc835dbed25e74b46ac184b
- MD5 c0475f36aa20f3974528fdb57d62bfef
- SHA1 350e8a505c1d801afd2802654dc5ce9f625676fb
- SHA512 6f6e46e01e9bb5a786c001c8265576ea1a72a9b5d3ea54cd0dc8211303ac7cd1d7db1475d88dcc9e0bd72ae4bcf2f09ff902e03747529812acf7987f204f246b
- SSDEEP 98304:RG8Co1C3Bupi+qpt+BGTpCO+BpjR3sqz2hG6UqEbo:R5Co1C3BD+qpg4k3vj6qC0eb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6443854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
soundsoft.pdb
mscoree
_CorExeMain
Name
.text
Size
6.1MB
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b5ac1092454_otraba.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 022845dbd0b028f17d257923279a9adcde5c7e4024f219059e0682c3825b7eae
- MD5 f46974f39aebf4f4d039600f3881d6b6
- SHA1 0b39ed9e6f02bd36930da303933df76a48320701
- SHA512 01ca6f8b8df34ba18a83521276078286f09b237bd7821011486de4161fc1f036fff864d407ab1865353458bde334284f7d8fe9ddc81c57f03a7386e55347b796
- SSDEEP 98304:b4SlKWywcBysE28E894v+YgrgpwrOnlZ9FBUFw:bjlKW2oO+k+YjpsalZ9F6C
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6590382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
lisasoft.pdb
mscoree
_CorExeMain
Name
.text
Size
6.3MB
Virtual Size
6.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b5ac957cc65_crypta.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e6e621591cd287a1b4504c178c9ce8e53e8c7e8c299ffaf0add782e21c96b99b
- MD5 6faf304cc49ec71e06409e5965296025
- SHA1 42c36bc0741798185118879a55006a56008a9257
- SHA512 794423d0efaf2012f9eb93f91d02ce99ca473eab0e6a295b423541522bef3dcaad0ce235f0c73a7059a9de6e4bc1a1931b5e803c1ae1347afd62aa9de42452b8
- SSDEEP 98304:DFRyE8ADCR14arlckfj7QGdjKTy2lZ1Kcn9v1ZRHM+RU:O314arlckfjFdjKO2lp9v1ZRH5RU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6839198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
tomorrowsoft.pdb
mscoree
_CorExeMain
Name
.text
Size
6.5MB
Virtual Size
6.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b5ace3a06b0_dozkey.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6ae1ebeb88e73be3fd5141deb9e85ed84203af1ef50cea7f2efc6be74816e52e
- MD5 1971d66193a4acc5be2af2c1d34c2d4d
- SHA1 e33f7bfb8aa73f1674e141590bfb823d0545312f
- SHA512 5e1d5b88035b183ac51dba94861bd95fc593c879cd6c5156b0e9e61c7af80aea8549ab623fa54ea7c33a60ce4843f7c0dfe9f834da00c7c885ee1bb7996416ed
- SSDEEP 98304:R5jFPIOFO/utnLvigHc5wqBg+HVkgq2KJ6l91N56OLyl:R5jNfnjPgBTBKM56yyl
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ab:f3:2a:f8:88:99:8a:8e:b5:06:8b:45:75:14:8c:ee:c2:51:00:bd:16:81:49:22:26:c0:38:b6:a3:e4:d0:da
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
Chains
Sep 18, 2016
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
fd:d4:a2:c8:47:22:0d:dc:78:aa:23:1a:06:37:f7:9f:ea:06:3c:ad
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
Chains
Sep 18, 2016
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
Serial Number
26:18:1c:ed:f2:c1:13:e1:6a:c7:48:20:df:7a:38:a3
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 31, 2015 - Jan 27, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US
Serial Number
5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 11, 2015 - Dec 29, 2020
Subject
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Serial Number
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Timespan
Jan 1, 1997 - Dec 31, 2020
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR
Serial Number
26:18:1c:ed:f2:c1:13:e1:6a:c7:48:20:df:7a:38:a3
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 31, 2015 - Jan 27, 2017
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US
Serial Number
55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 11, 2015 - Dec 29, 2020
Subject
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Serial Number
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Timespan
Jan 1, 1997 - Dec 31, 2020
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Minor OS version
0
Major OS version
4
Entry point
6219054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
firetool.pdb
mscoree
_CorExeMain
Name
.text
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
126KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b5b75106ac6_stealc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e7ad5000fcab4b69737e7b206f7ea0fbeeb7f68443e983e924e2710b54c7e5d4
- MD5 67d39f0cbbab44b99fffaf3a408b2088
- SHA1 ab84d55834c956a7904db0061a9fe145a6e9c783
- SHA512 b5ef2c31e80527bf5715db45cb859d79b16ae4361657298173dd666290d14ce3f04e366ef203f00663964c815fa101ef4a42036669412c67ac4daa020f4faab4
- SSDEEP 98304:whGngB5QYShcGyafbzArMRYELUzbf9sdA:whGngBuiGZzAgR1L0bf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6216302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
waterchrom.pdb
mscoree
_CorExeMain
Name
.text
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
118KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b5d9d3adbaa_defaultr.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b8a5ef9ea9fa588907a197db55c743559460190aa58b227db10d6be75d8bfe39
- MD5 45c0d8bedd6bff145cbe1c3064f2cf56
- SHA1 5a68f160bde8531f0b38ed8f9c6b19b7e615a905
- SHA512 3963adecb4ee013b54c926328fe0d6576d291dcae0ead3f675c38ddb51b2747e0469179fa4903e3237fe2beea7079f67da377f3787b3bd4ddba8694102af0703
- SSDEEP 196608:uq5Uz55kDba3q4c1X2usHfdV5bvMzeO/FmwuAf0+OTZ5l3:ur55kPa3qEbHfdVRvI50wnVOj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11511502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
todaysoft.pdb
mscoree
_CorExeMain
Name
.text
Size
11.0MB
Virtual Size
11.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b74da9b163e_1234.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0b937b6b47796295a7ad405daee481beb8ac1268e5b2121996f1c514378968da
- MD5 3acb965ae22984ecfff23257cf1fb049
- SHA1 194d4c7a68bff966ce655b4e42ce74d388428438
- SHA512 9c87d73a84fd92daaf0ee3c0c8939569cafdd69eaaa110d1aff92b3a6f4bd8b8490a68bd147d9e3002e909921132c944250e51223a6a5c8ad55859a983220135
- SSDEEP 98304:vn9nm0nGVzfXr9c5ylnau1HG0UEY2a0YpvpiXZS7HtxyNnE:vn9m0nyb7YylnauhN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6053102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
BigWerks.DripUnique.pdb
mscoree
_CorExeMain
Name
.text
Size
5.8MB
Virtual Size
5.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
498B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b7a2aef1283_doz.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0f79d37dd89fe7f6dab0c5bb89ade5bcf8378cd30a960ffeeb27c08460c9bd03
- MD5 eb47857a107cd0ebf986c08be274bd2e
- SHA1 de67ffb3e0a281e74ebac9ed0cb9f14247d1f942
- SHA512 bcf0976cd33c696c4e88970ca1c5d168b08926935b72bcc1b7ce3e40d69e8e61b128886668a8ec3ff51f04497a449c9f1c822814c8651166732038d1314cf23a
- SSDEEP 98304:gbz071DT8eKHsJ5MZux2G/rKJnMLEsrlIevc:u071DeHo5SGeJMosxIyc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
b9:db:9a:64:11:93:c1:e0:fa:71:19:35:c3:7b:3b:05:a7:48:12:18:75:d9:70:b5:bd:b5:6e:a4:0d:6e:0b:17
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Florian Heidenreich,O=Florian Heidenreich,ST=Sachsen,C=DE
Chains
Aug 8, 2024
CN=Florian Heidenreich,O=Florian Heidenreich,ST=Sachsen,C=DE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Florian Heidenreich,O=Florian Heidenreich,ST=Sachsen,C=DE
Serial Number
ce:bb:f6:9f:06:30:55:e8:07:d5:17:9d:4a:44:66:c7
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 26, 2024 - Jun 26, 2027
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
4595646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
drowsoft.pdb
mscoree
_CorExeMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b7a4a075311_AsianAsp.exe
- IMPHASH be41bf7b8cc010b614bd36bbca606973
- SHA256 440a157bbd8c8332d4edc63e6dc1399777e73bfb7ef3c5a356ab98fa56d1feea
- MD5 4f92aec3cd981658d5311657bee27d9a
- SHA1 c62e80cd55367064a811ac028541f78f19446684
- SHA512 8d82934cc5fa9de5ad0a85f2b3e5acc5e50f50bb59976a02e8736cfa0a9180335dd01e6c81c6a48de0d9f667dc1da0a5ec06511eb486893c757355eb2cbfea59
- SSDEEP 24576:7nHXHXBT5R5/llzSX73B/EnNYJC9R81qi5eTLM/BysWAQAJAG:THXd5tlI73B/EnNJ9RjiGsSE9
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e9:32:4e:59:b8:55:aa:13:54:6f:74:9e:3e:a9:9f:a1:cc:f1:eb:11:b1:7e:7a:53:a1:5d:4c:d5:61:3a:f6:71
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Musecy SM Ltd.,O=Musecy SM Ltd.,ST=Lemesos,C=CY
Chains
Jul 19, 2024
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
4b:2c:3b:01:01:8b:ad:2a:bc:8c:7b:5b:3e:ed:90:57
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 22, 2021 - Mar 21, 2046
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Musecy SM Ltd.,O=Musecy SM Ltd.,ST=Lemesos,C=CY
Serial Number
c1:34:b2:a3:ae:7f:9b:d5:a2:60:dc:5f:cc:04:08:7c
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 21, 2022 - Apr 20, 2025
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
0
Major OS version
5
Entry point
14511
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW
user32
GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation
advapi32
RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
327KB
Virtual Size
327KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=172, id=1, productName=Unmarked objects,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
saved from malware/a/66b7d12b3a8ea_5k.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8e1628d8702e49c52d4fcb0df8f9872dc693c38e685243a0e0dd03594b899ea2
- MD5 4bead3a1a9683a320959d1f0704e5c62
- SHA1 938015c08e0862ce5380c2a5953e2b8700b636ae
- SHA512 035048d3df36b130c6497c342017714d2ace8d4cfc06adb5b511969f2373921f02294ed854edd64b1d54f82e138e6154220561aee3f2339a0be5c55fda597eed
- SSDEEP 12288:0UVPgerhCT+SnR/on1QVk110E+fpnpTB:0UVYer86SnlMQVk1Ofp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
426990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\wmaogm116irqog\obj\Release\MSG.pdb
mscoree
_CorExeMain
Name
.text
Size
409KB
Virtual Size
408KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b7d3a2e7a4d_deepweb.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 bcc2bf333f69425c0b61f8d48a3cd7c931deff82aa796229cf47764878dc4e3b
- MD5 4f1b08b2de97134ea899bede6f28098e
- SHA1 7707c795230a38e58bfa0073a12336a1a235f954
- SHA512 c9c4f02e43765d6a231eaef9d57723c2cfdb1e2cb16b8467c43b00916cd399e84f248979d263608078eced9d8985771f88cc3627558741ca6b8e57847abbe091
- SSDEEP 1536:623xlbDU8eA3SWfy+Yjc5JmNWsfYgkcr32gsS6JQyYmXmGsRYDewshHS4XBxw:623xlg8s5+YjuJmNWHjERNmW0DtoY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
112110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\uw22uphtu\obj\Release\MSG.pdb
mscoree
_CorExeMain
Name
.text
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b837290469c_vidar.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e603e36cae3f0fa9badbeaeff8fb0becb1ed444776892db76cd8d219e2ba92bd
- MD5 dd9a8bbd0b8038552cb57b07a56f0ae2
- SHA1 0f4a5f36b7f29f9012f73595594c564b574df9ee
- SHA512 1d215eae3e854b04e8fe4d2f3119c9308882f5c2f4125183ca21e034c7be6da0a6549aacb0880900e667cb2ee3b1a29aabef24a17bdec83e1a415038664b2b64
- SSDEEP 196608:Jpz9fBq0j8nLcDEWbmuSrparTKQiwiYAwE5H:fHctDHQziYU5H
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9b:e6:c5:0e:aa:9f:7b:c4:be:e0:76:e7:4c:1b:5d:88:3e:e0:b4:6b:78:33:52:ea:17:c2:44:41:e6:de:04:45
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Florian Heidenreich,O=Florian Heidenreich,ST=Sachsen,C=DE
Chains
Aug 8, 2024
CN=Florian Heidenreich,O=Florian Heidenreich,ST=Sachsen,C=DE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Florian Heidenreich,O=Florian Heidenreich,ST=Sachsen,C=DE
Serial Number
ce:bb:f6:9f:06:30:55:e8:07:d5:17:9d:4a:44:66:c7
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 26, 2024 - Jun 26, 2027
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
9685550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
videosoft.pdb
mscoree
_CorExeMain
Name
.text
Size
9.2MB
Virtual Size
9.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/66b85f47d1f63_stealc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4ff955e39fc6b4f0c0a715c3b87b95c47d61df9145e0071061a5070a5c87c855
- MD5 f90545447cc1a034b5808ed7fdf73091
- SHA1 9bb93d17ff2aa79cd39ba9307f2f2dc907f854f9
- SHA512 c3c8670afb7b4bb4b9a2e787577a9dc3bf8564d0795fdb978090ecc97ec00db633303773a1843dceb4cd89a281c96a39cb5a7c231d87382989dff07536a95807
- SSDEEP 98304:EOWppv2hgpNk4oGuiauETZj+Sn4vVri/GI:EOWppv2UkTbuE9j+S4Vi/GI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7261598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
converter_default.pdb
mscoree
_CorExeMain
Name
.text
Size
6.9MB
Virtual Size
6.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
708B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/ApertureLab.exe
- IMPHASH 986447145f752ee174944cbcb0f6260b
- SHA256 980fcb6365092cd752934417abb0f2a95bca452c58856240157107e70c1d754d
- MD5 77970896073bbafdc8c1811414c62536
- SHA1 c2d2fdbc9e80daa95e3046e2d3bd13e7ca312e18
- SHA512 5fc31572ad864ca15cd2eb7e8baadc62b72a72ad5d28da4ae04158f67b6cbfd1985983586fd6e51a4781bdffbdd557b30d44d38a3a37ae88cf785c834d739a30
- SSDEEP 49152:/Xe2JFJ0l5VO6T9xX2AdPj15GZ0yB/dqyvVamJW:/Xe2JFJ0liu3GAdPj15GZft6
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
4c:73:bc:b4:42:31:87:ba:26:3a:5a:86:20:d8:48:1a:86:ac:15:cd:4e:98:6a:2c:52:61:a3:0b:e3:70:e5:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=91430104MA4QAQW82U,CN=Changsha Ruike Hotel Management Co.\, Ltd.,O=Changsha Ruike Hotel Management Co.\, Ltd.,L=Changsha,ST=Hunan,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 1, 0001
Subject
SERIALNUMBER=91430104MA4QAQW82U,CN=Changsha Ruike Hotel Management Co.\, Ltd.,O=Changsha Ruike Hotel Management Co.\, Ltd.,L=Changsha,ST=Hunan,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
3a:0d:91:73:22:85:bf:24:fd:a0:56:4a:f5:a9:8e:71
Issuer
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 22, 2024 - Jan 21, 2025
Subject
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 26, 2019 - Mar 22, 2034
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
5
Entry point
120492
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
comctl32
InitCommonControlsEx
shlwapi
SHAutoComplete
kernel32
FindClose
FindNextFileW
FindFirstFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
GetModuleFileNameW
FindResourceW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetLocaleInfoW
GetNumberFormatW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
WaitForSingleObject
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
GetTempPathW
MoveFileExW
UnmapViewOfFile
Sleep
MapViewOfFile
GetCommandLineW
CreateFileMappingW
GetTickCount
OpenFileMappingW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateThread
GetProcessAffinityMask
CreateEventW
CreateSemaphoreW
ReleaseSemaphore
ResetEvent
SetEvent
SetThreadPriority
SystemTimeToFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
LocalFileTimeToFileTime
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
SetFileTime
SetFileAttributesW
GlobalAlloc
SetCurrentDirectoryW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
ExitProcess
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualAlloc
VirtualFree
HeapCreate
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileAttributesW
FlushFileBuffers
ReadFile
GetFileType
SetEndOfFile
SetFilePointer
WriteFile
GetStdHandle
GetLongPathNameW
GetShortPathNameW
GetCPInfo
MoveFileW
CreateFileW
CreateDirectoryW
DeviceIoControl
RemoveDirectoryW
DeleteFileW
CreateHardLinkW
GetCurrentProcess
CloseHandle
SetLastError
GetLastError
CreateFileA
IsDBCSLeadByte
GetCommandLineA
RaiseException
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
HeapFree
RtlUnwind
user32
EnableWindow
GetDlgItem
ShowWindow
SetWindowLongW
GetDC
ReleaseDC
FindWindowExW
GetParent
MapWindowPoints
CreateWindowExW
UpdateWindow
LoadCursorW
RegisterClassExW
DefWindowProcW
DestroyWindow
CopyRect
IsWindow
LoadIconW
LoadBitmapW
PostMessageW
GetSysColor
SetForegroundWindow
MessageBoxW
WaitForInputIdle
IsWindowVisible
DialogBoxParamW
DestroyIcon
SetFocus
GetClassNameW
SendDlgItemMessageW
EndDialog
GetDlgItemTextW
SetDlgItemTextW
wvsprintfW
SendMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW
GetWindowRect
GetClientRect
SetWindowPos
GetWindowTextW
SetWindowTextW
GetSystemMetrics
GetWindow
GetWindowLongW
OemToCharBuffA
gdi32
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
StretchBlt
DeleteDC
GetObjectW
DeleteObject
CreateDIBSection
comdlg32
GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
shell32
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFileInfoW
ShellExecuteExW
SHChangeNotify
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ole32
CLSIDFromString
CoCreateInstance
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
oleaut32
VariantInit
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
148KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=27, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=143, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=238, id=1, productName=Unmarked objects,
count=104, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
saved from malware/a/Extreme%20Injector%20v3.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
- MD5 ec801a7d4b72a288ec6c207bb9ff0131
- SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
- SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
- SSDEEP 49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9a:NNEVJyZlng4p2V
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1955422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/GGWS.exe
- IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
- SHA256 d9d996d7ff1501de587ba3bb7f15e9d3ea3f81b58a8a20348f1e229158c5b01e
- MD5 e2b0ca22d48c42d262cf6015565a106c
- SHA1 0000067ea3baaa9f1357b6d615f4019e2b8aacbe
- SHA512 d047d3e759ccff4181c479a63ab5e3bc7b4faf5e889b7ad37d157f319b4b0fe758d2ad2f7e8979345331d48bbfbe25475cce7b1ea36b9c4046274623d8d9675f
- SSDEEP 98304:SaMZXSmGU+Ex+69ryNwVDfwqWPSvMjBLjwoNcZUpxkTGDDRJf8QWU4MXOEWyY8MB:S/GVK+N8YqWPS3ZEWTGDD4qXZoZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
52527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
ole32
OleInitialize
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6.0MB
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
saved from malware/a/GGWSUpdate.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ec966333cd05aaa773d76001d184fe28c1fe7945ec942ec6912602b05b8df6ab
- MD5 2b1a769d68dd3486b48e3e5bd2296397
- SHA1 53a2ed0d0b38560461058c52aeef6bd1032f78e5
- SHA512 fb3a73833f93be2e579691f19aaa13b6b1ab2c4a0f532d5d60cb5b054cc5f38299d2843800dcc75a371719390fdf097247decaa50722976c9e8b9819e356da46
- SSDEEP 384:qXoT2zOz/5wOCLINqp2oSVfLzE7lDhpnod4BJ8q0ffmkvsOn3Wn5:qXoT2n0kOzE79rF0nmkS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\GGWS\GGWSUpdate\obj\Release\GGWSUpdate.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/Identifications.exe
- IMPHASH 93b0547f5090c9427cc4f187c26f3f73
- SHA256 41657910cd010c7e5ebbbfc11a2636fa1868a9bffe78d98b8faa7bd0e9c5c3b8
- MD5 5f283d0e9d35b9c56fb2b3514a5c4f86
- SHA1 5869ef600ba564ae7bc7db52b9c70375607d51aa
- SHA512 b5b78975c6328feb5e1986698174a85ddf722a639234eb6fe80cfccabaa7d0c09678c9465fd6a9586a0a412f2586d9e9d38eb5243626a2b44a8c8512322415b3
- SSDEEP 98304:PhkHWcnoeoJETpLcGQF3CRqQh+R3VH+TSBEcDqpK5:pYWQoeo8cGQ3wqQGleTSjq8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
5718016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayGetElemsize
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
user32
CharNextW
LoadStringW
SetClassLongPtrW
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCaret
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsDialogMessageW
IsClipboardFormatAvailable
IsChild
InvalidateRect
InsertMenuItemW
InsertMenuW
InflateRect
HideCaret
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetScrollBarInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgCtrlID
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameW
GetClassInfoExW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumClipboardFormats
EnumChildWindows
EndPaint
EndMenu
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
CreateAcceleratorTableW
CountClipboardFormats
CopyImage
CopyIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
kernel32
Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
WritePrivateProfileStringW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
UnmapViewOfFile
TryEnterCriticalSection
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryW
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
QueryDosDeviceW
IsDebuggerPresent
MulDiv
MapViewOfFile
LockResource
LocalFree
LoadResource
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GlobalUnlock
GlobalSize
GlobalHandle
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetVolumeInformationW
GetVersionExW
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathW
GetTempFileNameW
GetSystemDirectoryW
GetStdHandle
GetProcAddress
GetPrivateProfileStringW
GetModuleHandleW
GetModuleFileNameW
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetExitCodeThread
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameW
GetCPInfoExW
GetCPInfo
GetACP
FreeResource
FreeLibrary
FormatMessageW
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumSystemLocalesW
EnumResourceNamesW
EnumCalendarInfoW
EnterCriticalSection
DeleteFileW
DeleteCriticalSection
CreateThread
CreateFileMappingW
CreateFileW
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringA
CompareStringW
CloseHandle
Sleep
gdi32
UnrealizeObject
StretchDIBits
StretchBlt
StartPage
StartDocW
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetRectRgn
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
ResizePalette
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetNearestPaletteIndex
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExW
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
Chord
BitBlt
ArcTo
Arc
AngleArc
AbortDoc
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize
IsEqualGUID
comctl32
InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
msvcrt
memset
memcpy
shell32
Shell_NotifyIconW
SHGetSpecialFolderPathW
winspool.drv
OpenPrinterW
EnumPrintersW
DocumentPropertiesW
ClosePrinter
GetDefaultPrinterW
winmm
timeGetTime
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
5.4MB
Virtual Size
5.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
491KB
Virtual Size
491KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
46KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
484B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
109B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
279KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
308KB
Virtual Size
308KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
saved from malware/a/InstallerPack_20.1.23770_win64.exe
- IMPHASH 42d651751c1d75ed4fa8fe71751854ff
- SHA256 eda401786b61b9b555596c6f88f1ea858c8946491b6a37688d6c7c859cb3a04a
- MD5 d4e494aac738b34231cb341acb16b961
- SHA1 4cdaf5333250193c1e8939c807728a804e9dd4ad
- SHA512 b490cd7dd1e1861ab723856417a9c60fb379e5adc0acbe9aceffa0cd6f4cb79493522282a1e799071bd53372fc22cadfec1bacfcba0eeda6b8392177c3cd0f8e
- SSDEEP 98304:XT0oyl9J0T4FdTM4tSpnctPL+EyYLgTjzKlgknJ1g9+JXlxso:XTpg9J0S0nctaQAu9L7so
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
0a:f6:c2:cd:d6:0d:9e:7d:7a:e6:d7:4a:08:76:c0:87:1d:33:ef:ad
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Screaming Bee Inc,O=Screaming Bee Inc,L=Palm Coast,ST=Florida,C=US
Chains
Aug 14, 2024
Subject
CN=Screaming Bee Inc,O=Screaming Bee Inc,L=Palm Coast,ST=Florida,C=US
Serial Number
fc:48:49:3e:a5:af:0a:f3:ea:04:0f:de:b7:70:c6:15
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 7, 2021 - May 6, 2024
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Minor OS version
1
Major OS version
5
Entry point
188273
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\66\s\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
CloseEventLog
OpenEventLogW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DecryptFileW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
PeekMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
GetMessageW
TranslateMessage
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
gdi32
DeleteDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
CreateCompatibleDC
shell32
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CLSIDFromProgID
CoInitializeSecurity
kernel32
GetCPInfo
GetOEMCP
IsValidCodePage
CloseHandle
CreateFileW
GetProcAddress
LocalFree
HeapSetInformation
GetLastError
GetModuleHandleW
FormatMessageW
lstrlenA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
Sleep
GetLocalTime
GetModuleFileNameW
ExpandEnvironmentStringsW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
GetFullPathNameW
CompareStringW
GetCurrentProcessId
WriteFile
SetFilePointer
LoadLibraryW
GetSystemDirectoryW
CreateFileA
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FindClose
GetCommandLineA
GetCurrentDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
GetCurrentProcess
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetNativeSystemInfo
GetModuleHandleExW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetCommandLineW
VerifyVersionInfoW
GetVolumePathNameW
GetDateFormatW
GetUserDefaultUILanguage
GetSystemDefaultLangID
GetUserDefaultLangID
GetStringTypeW
ReadFile
SetFilePointerEx
DuplicateHandle
InterlockedExchange
InterlockedCompareExchange
LoadLibraryExW
CreateEventW
ProcessIdToSessionId
OpenProcess
GetProcessId
WaitForSingleObject
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
InterlockedIncrement
InterlockedDecrement
ResetEvent
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
MapViewOfFile
UnmapViewOfFile
CreateMutexW
CreateFileMappingW
GetThreadLocale
FindFirstFileExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DecodePointer
WriteConsoleW
GetModuleHandleA
GlobalAlloc
GlobalFree
GetFileSizeEx
CopyFileW
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SystemTimeToFileTime
GetSystemInfo
VirtualProtect
VirtualQuery
GetComputerNameW
SetCurrentDirectoryW
GetFileType
GetACP
ExitProcess
GetStdHandle
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
LoadLibraryExA
rpcrt4
UuidCreate
Name
.text
Size
292KB
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
126KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=125, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=260, version=26706,
count=20, id=259, version=26706,
count=43, id=261, version=26706,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=341, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=2, id=151,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
saved from malware/a/NJTCFVIV.exe
- IMPHASH b5a014d7eeb4c2042897567e1288a095
- SHA256 c8f53fd939b1b4140b33fe6cfb6128d0b7d7c788400b88dbbcf173d8f2c9f241
- MD5 c350fa7b1a8b9cbbab1ae59e00575209
- SHA1 8fe8eeec8c2ecd10ba3ed10e704f5cf5ce1a8048
- SHA512 a8af7117d985d78988dde4740a26e34ac6474f66a9de5f8273f77ede33004f1a9ce0b6c973565d7abddbf3180d50362b0b5bc85ac976c0e95dbf182eb75433cd
- SSDEEP 98304:+pwpuZMdDiBGmsn81Xckvi/b3JAfZvENiqS+oqN52ybAbqhrqOKja7FoyIV:+pwPdD4GlaA/TJAftDqS+oqLbVbKj6SV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
73199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
kernel32
GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetModuleHandleW
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceExA
MulDiv
GlobalFree
GlobalAlloc
lstrcmpiA
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MultiByteToWideChar
GetLocaleInfoW
lstrlenA
lstrcmpiW
GetEnvironmentVariableW
lstrcmpW
GlobalMemoryStatusEx
VirtualAlloc
WideCharToMultiByte
ExpandEnvironmentStringsW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetThreadLocale
GetLocalTime
GetSystemTimeAsFileTime
lstrlenW
GetTempPathW
SetEnvironmentVariableW
CloseHandle
CreateFileW
GetDriveTypeW
SetCurrentDirectoryW
GetModuleFileNameW
GetCommandLineW
GetVersionExW
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
TerminateThread
ResumeThread
SuspendThread
IsBadReadPtr
LocalFree
lstrcpyW
FormatMessageW
GetSystemDirectoryW
DeleteCriticalSection
GetFileSize
SetFilePointer
ReadFile
SetFileTime
SetEndOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetModuleHandleA
SystemTimeToFileTime
GetLastError
CreateThread
WaitForSingleObject
GetExitCodeThread
Sleep
SetLastError
SetFileAttributesW
GetDiskFreeSpaceExW
lstrcatW
ExitProcess
CompareFileTime
GetStartupInfoA
user32
CharUpperW
EndDialog
DestroyWindow
KillTimer
ReleaseDC
DispatchMessageW
GetMessageW
SetTimer
CreateWindowExW
ScreenToClient
GetWindowRect
wsprintfW
GetParent
GetSystemMenu
EnableMenuItem
EnableWindow
MessageBeep
LoadIconW
LoadImageW
wvsprintfW
IsWindow
DefWindowProcW
CallWindowProcW
DrawIconEx
DialogBoxIndirectParamW
GetWindow
ClientToScreen
GetDC
DrawTextW
ShowWindow
SystemParametersInfoW
SetFocus
SetWindowLongW
GetSystemMetrics
GetClientRect
GetDlgItem
GetKeyState
MessageBoxA
wsprintfA
SetWindowTextW
GetSysColor
GetWindowTextLengthW
GetWindowTextW
GetClassNameA
GetWindowLongW
GetMenu
SetWindowPos
CopyImage
SendMessageW
GetWindowDC
gdi32
GetCurrentObject
StretchBlt
SetStretchBltMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetObjectW
GetDeviceCaps
DeleteObject
CreateFontIndirectW
DeleteDC
shell32
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
ole32
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
oleaut32
VariantClear
OleLoadPicture
SysAllocString
msvcrt
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
memset
_wcsnicmp
strncmp
malloc
memmove
_wtol
memcpy
free
memcmp
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
_controlfp
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
saved from malware/a/OpenArk32.exe
- SHA256 fe7e31f267a642037e21e81ecb6b467528648714bf9362b58a8aef3184568787
- MD5 4fa51b18a50d2e0e409195d2b3b7bd0a
- SHA1 cb58803d2176cde73bac1a712ffd6d30d9bc6897
- SHA512 1b61c352e8ab33478d369dde35973c12c5d9e224630090ecaf0c3ca72a2bbfd331e1bdb054a0284eca10ca2ed35781837c3887902a8a6f4bfe70ca8a3afa4219
- SSDEEP 196608:glBr7ePWch1l6MmW+0XFabS4XpmI2SV8p7SGt9HQ0fdHvsUpyYz0oQGS0Cp:0BmP1h1uWjXFab35h2O8FSGXHQidvsU2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
30982080
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
19.7MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
9.8MB
Virtual Size
9.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
102KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=47, id=241, version=40116,
count=182, id=243, version=40116,
count=40, id=242, version=40116,
count=5, id=199, version=41118,
count=31, id=259, version=24237,
count=2, id=203, version=65501,
count=132, id=261, version=24237,
count=39, id=260, version=24237,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=672, id=1, productName=Unmarked objects,
count=116, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=787, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=10, id=260, version=24247,
count=210, id=261, version=24247,
count=1, id=255, version=24247,
count=1, id=151,
count=1, id=258, version=24247,
saved from malware/a/OpenArk64.exe
- SHA256 fb25fad8dc9dbcaa08be75e221bb9996db1ed367f6cb20b737aac1243d0a5cf3
- MD5 30d259a6145bb276aff6e3c9f62035bd
- SHA1 5792c6cf12efea816e0a47327ca8940f54603bd7
- SHA512 9175680687bb03901e3d6e484466a7b52b153fe691062a730b089a4f6e6072203ea1cbf5612e4be69056904a6b30dc23637649e84d0d790d226dc49f4bc8b40c
- SSDEEP 49152:SYsdeb0O4Nufn15iTs50AXbEDeVpP2zIuoOuL7GF0GjSyYMfa:5v48HC80mEDupO0BnGFLjnc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
25216224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
13.3MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
10.7MB
Virtual Size
10.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
102KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
saved from malware/a/STHealthUpdate.exe
- IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
- SHA256 229c201de7a746e65acb6552198aba51fa153619cb4f29de0af15cb3f2e1f7d0
- MD5 341a6645505c8eaf54ec83738067d0c8
- SHA1 ee06b6c55d3671090bcf1f5d711d3fa3aadc98cb
- SHA512 75748565211164f0681ef42c68b2ef1b0b1be27c39d084676ad9c8036ec8532919d318088fcedcf501308e807e874ac62593c654e44f5131af0892b368f6de43
- SSDEEP 6144:GDKW1Lgbdl0TBBvjc/n9dNAC6dM3KoUG808Z:gh1Lk70TnvjcTmC6sdR80K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
52527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
ole32
OleInitialize
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
saved from malware/a/T7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a288d0d898c7729037ab07a8ab05713862a3b74aba2c5fc55ec2cd590d547a7b
- MD5 106317cd019b63fde3dc44b2e365d0e6
- SHA1 cf8158e8e6433a5ddd81f68558632bbad3d33db6
- SHA512 b1eff4c179096157252ae383860862fc53394094d76459d18568b669290c150291f671f8d80f7e741c436466e66cb0db197f79d9a9a9282961b3baa101f9d5a6
- SSDEEP 192:blqqChM/KUTOQ4DT7hcGFJy/y/y/yuQ7HsIChl9ozK75MqfD+YCPAe:5qqChMSUr4vuG6uLChczK75MqfhP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\Desktop\RunPe-Link — копия\RunPE\obj\Release\RunPE.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/T9.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8b2951ff344d2fcaeb0045269c93e0ced5402ff53efe685cde78fba2293e6283
- MD5 762e2c938ec4a35e6b67fafb977fd05c
- SHA1 2082b2a1b33adcc4aae73cbc072eaac50f72ab7e
- SHA512 c688320e12ca1536217282a42c02dd4d19b97d2dc96ea206b1327866fd496f277c21426fe9cb3e894fdf3bd59d0da6f4ab787bfa4e53d010d038e1d3156f9dfc
- SSDEEP 192:nlqqChM/KUTOQgDT7hcGFJy/y/y/yuQ7HsIChl9ozK75Mq3DCGpYCMe:lqqChMSUrgvuG6uLChczK75Mq3eGOv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\Desktop\RunPe-Link — копия\RunPE\obj\Release\RunPE.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/TTF.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2d187bb4a0d2a51dbe68e4085815167c952803f310c323bfe6f39b2cfc9f6532
- MD5 b5fe23cf43111d7500a18d432d1a9307
- SHA1 e3b7dc412ce069a4262522b7c8e791278fc130dc
- SHA512 54ee18272c9d3e700452a69a7a0d56cd9ab32196878f059e3ab3fbce0558183c5fbc06eae7b7b0def3636ec6747867a138b1350cd8a9a2ec046e704453f4db26
- SSDEEP 192:ldZHTyWdt0hqi47BzrbqIwpnvnvONDTWoREN5Mqg/CNe:ZHOouh7y+rqREN5MqcA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\Desktop\RunPe-Link\RunPE\obj\Release\RunPE.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/U.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 05609085a166cd35855e70c9b9e89372f15e35a21dcf6e0da8a30648b4950f93
- MD5 50ab74c3916f51cd30d6d588211148a3
- SHA1 cca87dbd37fc9df0e007c3a98ac7d214eee703a7
- SHA512 094eb17919dfc550238fa202080136cb3d8298ee518618935c54ee4cab6b0c4e3bb863b9e53b1580d1bbe42b307dc72f0b6f4c47740bbf79de20ded3e4741320
- SSDEEP 192:11ZHTyWdt0hqic7BzrbqIwpnvnvONDTWoREN5MqT/CMe:RHOouh7G+rqREN5Mqrh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\Desktop\RunPe-Link\RunPE\obj\Release\RunPE.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/Update/server.txt
- SHA256 3c86be28b8a059d46690ea434e9517a9436c729540cf70c3d718619190481fc0
- MD5 8e21ad6c3782e8eadb9031fa66049bcd
- SHA1 45cec4a5f3c3f223e756b9b8bc32510e879b8f10
- SHA512 a64c1a7022b6e161b90e93ee8782c6c91f718ef56b4c28f9ef5d144e5f8fa8ce87f2d0c16d56c8bd08796431bebd223e7375a296e7c0cec261737e92be2e8126
- MD5 SHA1 SHA512
saved from malware/a/WE.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 afc9edae65579141465dd988495aa73366f942287ac85773f0c630b5bb3e2420
- MD5 c3810dc34fb0dd806c01d2a15617e343
- SHA1 7e7a1635fff8401c6342ad3c68472b6ef1ed1d1f
- SHA512 b8d1bf4fb186bd45faecdd11af29c2d30d97916d6d8ae94f55ca6f6d2d3dd771b6da09b3e56d0517da25232e8e3a72d1a3f4ef0b6dab7be48f020bf327e61893
- SSDEEP 192:56ZHTyWdt0hqiP7BzrbqIwpnvnvONDTWoREN5Mq2/CE7e:yHOouh71+rqREN5MqGX7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\Desktop\RunPe-Link\RunPE\obj\Release\RunPE.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/asusns.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e5797ef4bea22b1d24a9147c48726e9960ffa1b5866e04c11de117531483fe9d
- MD5 0e3ed8b5e5952cffc0e119b6082a6599
- SHA1 b8275da931abd327fb0ad3b102a5917aa950c636
- SHA512 15e06c4a477984dac67d7301d8019935af32e7a5fc47c6d69533f00e7aa3992cd8e496d02f05f9c2f4c43f3a928fe070276bdcb18f86bcab43faae3709522beb
- SSDEEP 12288:et42iNz42Cdcb1uW/ch7DrYVF4MAjDNSNfrxRX7ATFe6k:X1x4Xdcb8W/chEVOjhS5xee9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
655486
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oEDs.pdb
mscoree
_CorExeMain
Name
.text
Size
632KB
Virtual Size
632KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/authenticator.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0bb9e107a5f5f9ad838173ebf222107d37cc1f378fa10f46ad5b2914f19f8e72
- MD5 1560d6506f8e57432427df2bc4263f12
- SHA1 70f83580e72e75f4a1b215abf55d9e07beb683f0
- SHA512 e5b0eff2054b6b24efeb9f8df23cd22e307d5fac1669e86b798d8caee2e3c4ea3e4c6213abe868ba44b37b689e5b52d4d3a40fd0167a476c06bc32dded69a202
- SSDEEP 12288:rvsXZv8km0OHcbGbvzWHz0Hnquw3y+h0ssFWylkkoAbtEkOwfNqbYS2VbICKMIU6:UfPz0H0Lh0ssFlSjbmk
- MD5 SHA1 SHA512 SSDEEP
-
SectopRAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
792494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
766KB
Virtual Size
765KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/backdoor.exe
- IMPHASH 8e93afb33c433eede3fd358369a7f47e
- SHA256 9cc2e2d5feeb360b2ea9a650809468f08e13c0e997ebadf5baa69ae3c27a958e
- MD5 698f5896ec35c84909344dc08b7cae67
- SHA1 4c3eb447125f74f2eef63e14a5d97a823fa8d4e9
- SHA512 2230abef3f2ac7fff21f2af8a1df79a0ab3f7b1153ce696745ff5cef7f677bfe562dc820eb36be8e4819210ffa565d52e3b940f0cad5427d30a3aa05a4bcde2b
- SSDEEP 768:VprWOayEeJqYEs4fmZn5gzVwKXlhK2FkHPP3lLuzZPKqcPOI+HhM81+idVNH:Vk7fmDgZhHFkHPP3lLuBZc9AroidVNH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
AllocConsole
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
_chdir
_strdup
_stricoll
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_fpreset
_fullpath
_iob
_isctype
_onexit
_pclose
_pctype
_popen
_setmode
abort
atexit
calloc
exit
fgets
free
fwrite
malloc
mbstowcs
memcmp
memcpy
memset
printf
puts
realloc
setlocale
signal
strcat
strcmp
strcoll
strcpy
strlen
strncmp
strncpy
strtok
tolower
vfprintf
wcstombs
user32
FindWindowA
ShowWindow
wsock32
WSACleanup
WSAStartup
closesocket
connect
htons
inet_addr
recv
send
socket
libgcc_s_dw2-1
_Unwind_Resume
__deregister_frame_info
__register_frame_info
__udivdi3
libstdc++-6
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4dataEv
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEPKcj
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4sizeEv
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv
_ZNSaIcEC1Ev
_ZNSaIcED1Ev
_ZNSolsEPFRSoS_E
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1ERKS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEaSEOS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEaSEPKc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEaSERKS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc
_ZNSt8ios_base4InitC1Ev
_ZNSt8ios_base4InitD1Ev
_ZSt4cerr
_ZSt4cout
_ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
__gxx_personality_v0
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/14
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
303B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/a/build2.exe
- IMPHASH 0275392671bba1542f88797f29212ff8
- SHA256 e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042
- MD5 f9a4f6684d1bf48406a42921aebc1596
- SHA1 c9186ff53de4724ede20c6485136b4b2072bb6a6
- SHA512 67294a47dfef6aba404939497c403f93318841e9c5ee28b706f7506b5dff2630381e28e86f6dcbfdff2427092a515db1dc0a04e334e7f8de8b0b682269ff88fd
- SSDEEP 12288:UHdftnB3Zp+52J9+62HHLhJ3er8XSwW0:UNz3ZwwJ9+7HFnXP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
19412
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
EnumResourceNamesW
HeapReAlloc
SetFilePointer
CommConfigDialogA
SetConsoleTextAttribute
OpenJobObjectA
GetConsoleAliasA
OpenSemaphoreA
LockFile
GetModuleHandleW
GetTickCount
CreateNamedPipeW
GetConsoleAliasesA
GetConsoleAliasesLengthA
GetNumberFormatA
EnumTimeFormatsA
GlobalAlloc
LoadLibraryW
FatalAppExitW
IsBadCodePtr
CreateEventA
SetVolumeMountPointA
SetConsoleCP
ReplaceFileW
CreateFileW
CreateActCtxA
CreateJobObjectA
GetLastError
GetCurrentDirectoryW
SetLastError
GetProcAddress
GlobalFree
LoadLibraryA
OpenThread
InterlockedExchangeAdd
CreateFileMappingW
AddAtomW
SetEnvironmentVariableA
GetOEMCP
SetLocaleInfoW
HeapSetInformation
EnumResourceNamesA
VirtualProtect
PeekConsoleInputA
SetProcessShutdownParameters
SetFileShortNameA
GetDiskFreeSpaceExW
GetCurrentProcessId
LCMapStringW
GetProcessHeap
SetEndOfFile
HeapSize
FlushFileBuffers
WriteConsoleW
SetStdHandle
RaiseException
CreateFileA
CloseHandle
HeapAlloc
MultiByteToWideChar
GetCommandLineW
GetStartupInfoW
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
WideCharToMultiByte
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WriteFile
GetModuleFileNameW
HeapCreate
RtlUnwind
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeW
Sleep
GetConsoleCP
GetConsoleMode
ReadFile
user32
CharUpperBuffA
DrawMenuBar
GetMenuBarInfo
ChangeMenuA
GetDC
DrawStateA
GetKeyboardLayout
shell32
FindExecutableA
ole32
StringFromIID
CoRegisterPSClsid
Name
.text
Size
315KB
Virtual Size
315KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
95KB
Virtual Size
36.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=28, id=171, productName=VS2010 build 30319, version=30319,
count=31, id=158, productName=VS2010 build 30319, version=30319,
count=127, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=124, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
saved from malware/a/c7.exe
- IMPHASH 08b1b12afb6e1cdcf5adc795ee884ca6
- SHA256 e00f4b1980537b569386c1e5d37410b11aa74a4f771311cec06d60130d7aa1c5
- MD5 819ea2d1b7f70aa3fab1a5eefd8928fd
- SHA1 c13b663ec677b95631a845d2627e12d71ca96fdd
- SHA512 3e8261f470ddc9a06077ad352fd5d34f3c999f168e7e53b9d5c8c2d4ab9691af89ab208c09767b27519bcf9cd6fdf4e4df949ec219bca4fda1165b178efad113
- SSDEEP 6144:q0Waah8pp1DQaymgZuGITFu1Vu3bM3ejGhYKZ9de90lL9ZD/FwOm0wu:qApH7gUGITFUyGh7Z9UGlfqk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
38624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CloseHandle
CreateMutexW
ExitProcess
GetCurrentProcessId
GetCurrentThreadId
GetLogicalDrives
GetProcessVersion
GetSystemDirectoryW
GlobalLock
GlobalUnlock
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
oleaut32
SysAllocString
SysFreeString
SysStringLen
VariantClear
VariantInit
user32
CloseClipboard
GetClipboardData
GetDC
GetSystemMetrics
GetWindowLongW
OpenClipboard
ReleaseDC
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetCurrentObject
GetDIBits
GetObjectW
SelectObject
Name
.text
Size
261KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/a/cookie250.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f7b57a665ac90377683c434a04b8b6894c369d34fdb03273778a8c9f8fdbb262
- MD5 1b099f749669dfe00b4177988018fc40
- SHA1 c007e18cbe95b286b146531a01dde05127ebd747
- SHA512 87dc26b28cb2c43c788d9ae9ef384b69be52b27500bc23cdc6acc8567e51705d99ef942cdc0b23fa6a7c84d4ddaaa8f05865a8e7bb4ad943ba5deabf7a4105fd
- SSDEEP 3072:Oq6EgY6iwrUjdy68KwPMCqJRn7cTAVtAaK0FcZqf7D341eqiOLibBOU:1qY6ihwPIzn7cTAbAqFcZqf7DIfL
- MD5 SHA1 SHA512 SSDEEP
-
RedLine payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
178598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/exec.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 69e4ee0c49e80e9aed263df6c7a62b6896a80972002b3e71b68d7623843c01d3
- MD5 7f437ba23ac06e9f17bf831fe4610b7c
- SHA1 0131f155fa2aee4a8d3c77cd795988f466eff6d3
- SHA512 802ed8bcc7bb2651794cbbd0a0391b931b6f776551457496d9f461f7dea5d9b189bcf388151544934f72164c75d3e91680a053313e0e2f293bef120b8ccb837c
- SSDEEP 3072:Eqq6EgY6iRrUjsgMmwPPQhy2qmTAPtkSiihcZqf7D34deqiOLibBO2:EpqY6igwPMXqmTAlkQhcZqf7DInL
- MD5 SHA1 SHA512 SSDEEP
-
RedLine payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
178602
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/keylogger.exe
- IMPHASH aabc7d829ec4bcf3eb634829eff84ef7
- SHA256 6054e52edc7112fcecaaf39f37c6bdaa35f98bfaff45d4e01802b9a8bedd2eef
- MD5 fbbc99e0b5c7a5f4b76886520f5a4f63
- SHA1 361b841c52643792c26868f90e0330ba2ab131ae
- SHA512 5de0b99a9d3f7cdee1d9ed8122c62f096b59cca93c9ad4c4eb15da6bb08d5ea07c09f2864e8a841dcc4095e890e47dd595f51c535ab37713f807a151de52cb11
- SSDEEP 768:7GXBPxEENGqtiAoga/G5PP3lLuzZPKqkQF/rxa0VeBFt:7GxHGqM5p/qPP3lLuBZkQFE0Vgt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
AllocConsole
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
_strdup
_stricoll
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_fpreset
_fullpath
_iob
_isctype
_onexit
_pctype
_setmode
abort
atexit
calloc
free
fwrite
malloc
mbstowcs
memcpy
realloc
setlocale
signal
strcoll
strlen
tolower
vfprintf
wcstombs
user32
FindWindowA
GetAsyncKeyState
GetKeyState
ShowWindow
libgcc_s_dw2-1
_Unwind_Resume
__deregister_frame_info
__register_frame_info
libstdc++-6
_ZNSt14basic_ofstreamIcSt11char_traitsIcEE5closeEv
_ZNSt14basic_ofstreamIcSt11char_traitsIcEE7is_openEv
_ZNSt14basic_ofstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode
_ZNSt14basic_ofstreamIcSt11char_traitsIcEED1Ev
_ZNSt8ios_base4InitC1Ev
_ZNSt8ios_base4InitD1Ev
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_c
__gxx_personality_v0
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/14
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
303B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
saved from malware/a/l2.exe
- IMPHASH 28410aacd961a705a3e199dc5b1733bd
- SHA256 f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599
- MD5 af6e384dfabdad52d43cf8429ad8779c
- SHA1 c78e8cd8c74ad9d598f591de5e49f73ce3373791
- SHA512 b55ba87b275a475e751e13ec9bac2e7f1a3484057844e210168e2256d73d9b6a7c7c7592845d4a3bf8163cf0d479315418a9f3cb8f2f4832af88a06867e3df93
- SSDEEP 98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e6:82:1f:21:ef:a3:17:90:ce:3e:c0:65:89:89:dd:08:70:18:4e:5d:49:18:07:1a:0f:71:fa:00:9b:6f:d4:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Karcher VC 4 Cordless myHome (1.198-620.0)
Chains
Jun 4, 2023
Subject
CN=Karcher VC 4 Cordless myHome (1.198-620.0)
Serial Number
37:57:1d:ed:6b:23:b4:82:4f:29:11:2f:37:2e:93:9c
Issuer
CN=Karcher VC 4 Cordless myHome (1.198-620.0)
Timespan
Jun 2, 2023 - Jun 3, 2033
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
7831752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
shell32
SHGetFolderPathW
Name
.MPRESS1
Size
4.0MB
Virtual Size
7.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
382KB
Virtual Size
381KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
saved from malware/a/msedge.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 97b1441bd0a459186311604d3cf3fc2b212dff334f4640d9171189080698c940
- MD5 c2ec3c7d003e11d0db8aab918df1e47a
- SHA1 9c1c3421a1d0207bec271b9cd38a48cb0a1fb285
- SHA512 bb43cf35712213ec0643a48451791da6cd8e9c4f1281980dd972e8483ddba7f56b55d23cd4fc9eca91b1ca4e1bc7370769b71cdc3e250c9f1941eb72ce278170
- SSDEEP 3072:H0ZLbt+Bq3ngeMJFNn7Zs+9snU64LXm7ved5W9dxOJdXRUGKXs+S++7KFSbxeY+g:Ic44V9EU6P7ved5AOJd2GqStKEbxI
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
153226
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/mservice64.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b0d8f20c0bb09ab90c44281d372e98520c94cecaba6a374be64dc4fdd45f1c89
- MD5 c1915f095d3e7b2ad07b5aadc21be2e3
- SHA1 9643864f45e15e14e95545cfae9462c977933ba4
- SHA512 e1dbd8501409dab0537b9afdb8961c3031280e0968f0dc0bc3339e14af3e1f009bdfa0c5425f62590f1db6c8c33fc65b95da65cacdc83338128a7887676bee13
- SSDEEP 6144:RQZ5k+iRrJ4Nt8sWrmWzSbz3V9boYOusHoAljVmA4eXq6X7Af8eeNMqQQRl37qco:6Z51wJ43JrDAJVBVXG1Qd2f
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
688526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
664KB
Virtual Size
664KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/nano.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4bfcba248d79dfd6c2cba52d7c9ee18842f007bfa0e3ba99ababacb4794e8c6e
- MD5 1873f27a43f63c02800d6c80014c0235
- SHA1 3441bba24453db09fb56e02a9d56cdf775886f07
- SHA512 9f2b663afc1cc3dbc8eba3278f61ffb41c19e42f94ee4c8a60eff83c8846b81d34e4ff869b643434a8ad5657c46bd06a712f0598062b62802ba6f0ee6f4fb8f2
- SSDEEP 12288:WLV6BtpmkzPLrQIh+ReoSwN+Jp9rQj3SHdEIzqLPxc3hHyOm:EApfzPfQ9RecEp9NzUi3JyL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
124818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
437KB
Virtual Size
437KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/networks_profile.exe
- IMPHASH 2cdcfb3a828433ba76b5b41f45519bd9
- SHA256 37c9a26faec0bb21171b3968d2e4254f6ae10ff7ae0d0b1493226685bc5d3b4b
- MD5 7306abcf62c8ee10a1692a6a85af9297
- SHA1 69900ccc2400e685b981b3654af57c062ffb44e2
- SHA512 cd00a60387e06fcc6f14242adb97a54575a49cf1e9b22c74aa5d8bb7617e571fc194049691e4ee0fcff8bdd659b04de62f46d07e2f3330c18ac7035134e183d1
- SSDEEP 196608:p+TPoCsXDjDyf6L2WliXYrHW1LIiruQC:2PoCEDVL2ciIrHWRIiS
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
40196
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
FreeLibrary
LoadLibraryExW
CloseHandle
GetCurrentProcess
LoadLibraryA
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
GetStartupInfoW
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RaiseException
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
GetFileAttributesExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=7, id=259, version=27412,
count=185, id=261, version=27412,
count=3, id=253, version=28518,
count=38, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=9, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=5, id=257, version=27412,
count=114, id=1, productName=Unmarked objects,
count=19, id=260, productName=VS2019 v16.9.4 build 29914, version=29914,
count=1, id=258, productName=VS2019 v16.9.4 build 29914, version=29914,
saved from malware/a/out_test_sig.exe
- SHA256 3d37b55464bded5c54903c5328e695d9b08b483e65cf6bdadd4ecf93954dfc9e
- MD5 47f2701f1d1f6645baccced737e8e20c
- SHA1 56e90cc7888e2cc74916ce10148a10c9261fdf2f
- SHA512 1b3f47fa75b041e8a2e144d3e98d103e90ed119b530ab7f7ac61ada3c4cad9abfac93a480b2236f1f6c9093f2ea9529acace77ac15f851450f5e16015735b045
- SSDEEP 98304:tPtk042OYyWXqqxx2pC6BGwwsNFkeP9ISfhg:tNy5qxpC6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1776040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
651KB
Virtual Size
651KB
Characteristics
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_MEM_READ
generic
saved from malware/a/pimer_bbbcontents7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f7bbd59299cad16b2cb4916738ad1475f61e129763cae617f1f9184f20db1d99
- MD5 abb5797dd47bf453358359acf2453551
- SHA1 cbce075e182eb636b6935296d80fb185a48a07a3
- SHA512 a6885bd39a574c75587476328968d0fb1206ada1b33f575551433b70341d259a3db3fc7b19ef0d6e30c4411c38073e09aa0ad92ebeb1fca9889f37f734d3f9ba
- SSDEEP 98304:NBnTaRw5XvCTQsvyuC7qlML4ZRediPxWaNdW/FaJh:NBTaRbTBvyHqlML4adWh2/FU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3830350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
pimer.bbbcontents7.pdb
mscoree
_CorExeMain
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
506B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/regasm.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5f569c72db9c31528daf2e907938b9bb711ea3a050efe5bf5d514dc962c5415c
- MD5 f74f2df998219d602185c46107329e82
- SHA1 a0f8eeb2e5c712e690923fdaf3b7cefc64f3d63e
- SHA512 b28e1eafefaf4f71666bf6c216c8672eb615a5e369bd913b85d99b2774df76ffaa489f145722a93f80f2afcb76eef40e62dcf246793bcf867d696487e9343a9f
- SSDEEP 12288:s2yqVxaEUU+U4J6eMt0LYrfZLpiBLpuexkO4G36F2nP:s2yqk++T6ewBrfl0Bsex36
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
544686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Eycb.pdb
mscoree
_CorExeMain
Name
.text
Size
524KB
Virtual Size
523KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/request.exe
- IMPHASH 015966a997659caed7ef58f6ab2e8bde
- SHA256 8e2fa428fa5e7092d117dadf10529a35f415a0b8fa27cd17607e23dd913ffcdc
- MD5 ef8320eace6f753231666c61104bdd49
- SHA1 0166aceb79a7d6b4a041fd7595fc1d75404a4419
- SHA512 354676c97fe1666920a75fdbffecfd0ac802613572b9e7d0dbc9a1ac24b3c771ca8fa3c1f3375f0a1c90364a07fa22469d2e7eb822196c0a2a1893931b62efe9
- SSDEEP 6144:hh9fH2l34HigA2/BDBaBL7cpnBZVCBQrfYQSlyItcJ2+QmmaeIBqk3biuFo480AL:s9jtaeIBqmu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
117082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleA
Sleep
CopyFileA
GetLastError
CloseHandle
VirtualProtectEx
ResumeThread
GetProcAddress
VirtualAllocEx
ReadProcessMemory
CreateProcessA
SetThreadContext
GetComputerNameA
WriteConsoleW
WaitForSingleObject
CreateMutexA
VirtualAlloc
WriteProcessMemory
GetThreadContext
GetModuleFileNameA
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapAlloc
HeapFree
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetEndOfFile
advapi32
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
GetUserNameA
RegCloseKey
shell32
ShellExecuteA
ole32
CoUninitialize
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
oleaut32
VariantInit
SysFreeString
VariantClear
SysAllocString
wininet
InternetOpenUrlA
InternetOpenW
InternetCloseHandle
InternetReadFile
ws2_32
sendto
htons
recv
connect
socket
send
inet_addr
WSACleanup
closesocket
WSAStartup
Name
.text
Size
229KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=29395,
count=174, id=261, version=29395,
count=23, id=260, version=29395,
count=17, id=260, version=30034,
count=21, id=259, version=30034,
count=77, id=261, version=30034,
count=15, id=257, version=29395,
count=133, id=1, productName=Unmarked objects,
count=5, id=265, version=30152,
count=1, id=258, version=30152,
saved from malware/a/robotic.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2999b0ecf157b9f37dcfa1cb4a0ffff73092c416499a356fdb1558d66985e9a3
- MD5 6b1bbe4e391cdfd775780d8502ccbc41
- SHA1 a910f7ac9ed8fd57f7455f04e99bcd732bc8241a
- SHA512 9ad2ca4cc8af0b6185be87d9026da5cdac2c52ff15b0fd2ba333ff3a25016e06a294d7cf5cf32b1869a1f5e3692f071f582ba2151ac16f9be738ea7862ab57d3
- SSDEEP 6144:sYqdc0NkzDVATfmTIlA41QBcN3p0NIb88WsNMPaKFP3b2V122J0sL:s9J82jXgcN3CNIb88WsNMP5F1k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
182990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
366KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/sahost.exe
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 8cf6a3d7e5694a0453d85e67a038bb5804b6eb8969287f1d021bdb7b95234e9d
- MD5 29e3de6b17d0fdfb360834f038b59a39
- SHA1 1e3fdca7e4dec1ebb618f69675928363657ba064
- SHA512 ebf889085bb105182739d7a748d8b12b26de3e47f11535260adac23beee3d5b43aa572b6043ace7ac068cee36529c3cf448986f3218aec742ab6fce4db47440a
- SSDEEP 6144:AYa6iWDISW500H8LI/xMccQ/4Fizd/zyH1sGzZYhP2C1PWPYmZBP7PRcJnPGiE+t:AYM0aHqJQwFizxzSiGu2suKPGWUUrTb
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
38:07:ff:d9:3c:fd:d1:3b:04:eb:03:fb:2b:1a:b2:a8:d4:e6:93:98:a5:1c:be:ad:e9:79:b0:ec:68:b7:1b:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Storbyens Forfjerdinger Kalibreringsmaalernes\ ,O=Indkomstopgrelsers,L=Firminy,ST=Auvergne-Rhône-Alpes,C=FR
Chains
Aug 14, 2024
PE Signature issue
Digest
f1:fc:87:ab:2e:99:84:9d:96:94:3a:95:fb:a0:6b:52:3d:8e:5d:1d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Storbyens Forfjerdinger Kalibreringsmaalernes\ ,O=Indkomstopgrelsers,L=Firminy,ST=Auvergne-Rhône-Alpes,C=FR
Chains
Aug 14, 2024
Subject
CN=Storbyens Forfjerdinger Kalibreringsmaalernes\ ,O=Indkomstopgrelsers,L=Firminy,ST=Auvergne-Rhône-Alpes,C=FR
Serial Number
59:bc:90:e9:59:74:50:6a:6e:e8:6b:bb:4a:61:ea:bc:34:4a:83:92
Issuer
CN=Storbyens Forfjerdinger Kalibreringsmaalernes\ ,O=Indkomstopgrelsers,L=Firminy,ST=Auvergne-Rhône-Alpes,C=FR
Timespan
Aug 2, 2024 - Aug 2, 2027
Subject
CN=Storbyens Forfjerdinger Kalibreringsmaalernes\ ,O=Indkomstopgrelsers,L=Firminy,ST=Auvergne-Rhône-Alpes,C=FR
Serial Number
59:bc:90:e9:59:74:50:6a:6e:e8:6b:bb:4a:61:ea:bc:34:4a:83:92
Issuer
CN=Storbyens Forfjerdinger Kalibreringsmaalernes\ ,O=Indkomstopgrelsers,L=Firminy,ST=Auvergne-Rhône-Alpes,C=FR
Timespan
Aug 2, 2024 - Aug 2, 2027
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
saved from malware/a/settings.xml
- SHA256 5ac943e8f98a91ac43e1f9804012f3fe49acc339e4845f12ad1218e77202d867
- MD5 6c1652e7c6fc54f042685e47a62f682d
- SHA1 49c72108f48b6df3c70c02c42bc483a0e97c38e2
- SHA512 288844f156a6c67491250576b47009bf6f0d979b8570fa8213b04409c8882bbc468c80ee4ba043c71b487d555272c7359840b5977d5dd4ab34afc6f2a3d6efbf
- MD5 SHA1 SHA512
saved from malware/a/sthealthclient.exe
- IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
- SHA256 61ea68229965be4facdaaacada953ad6139b6f4107a4e2d1631ca4cd9ece528a
- MD5 5a49dfb1f8484d86675a3811e95c5020
- SHA1 7e24c4df568f9c8768e99b2fa07cd17fcdc18c9c
- SHA512 eceb8e5072c47de3c07279b30393b041e183f1008689d196399fc21c00afeaa2a033bcead3321b0f85a3c3d7b676f5158b936783f7664243af60f4c958fe34d6
- SSDEEP 98304:oaoywEZ0eTkwxXa2irMi8RiEq3TYL9n3wOkeJsHk/Z:oPyNBxXa3rnEsS9AJHEZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
52527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
ole32
OleInitialize
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
saved from malware/a/stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 91fb355fdc173c40fa77f8a252031d6bc32fab91c5e5573da28044494691c820
- MD5 a7ed4ba445aa61c4632dd6579c212bf5
- SHA1 a81d766d12a6dd8c3cec537387a089650b34e103
- SHA512 2a0e0afdecf803657f2d67433399dc3119a3b4221334a9c8d7cb3e3e741457aaa26d2edd32377a102f1c539a4ef065cb5296d4cdfe7657993223e675e3fd4bae
- SSDEEP 768:2u62dT9slTJWUhDuzmo2qLGdFx4mMaYc13WOAo0E0brMIYLECgNREeo7Hkc1KXc9:2u62dT9We2ZamecoOA1brM6CgAHkSpdX
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
saved from malware/a/wahost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 850752cfce58c44ce5d48735f4d53ccc1f8d12b7e1ae00d367d9c42103d9ad99
- MD5 14b98daca4a9912ad416eb7c0231cc21
- SHA1 58328f022b71c8b3001449e87f91fbad4ac973ea
- SHA512 1169760e0245b4b1f2676271e0e56b62db0157a08ada4098d7dfacbf5c1e2d6cac29275c04a2d59471d7a9d9420425c07387c63fd3bc9bc4f91a9b3d5addcb0a
- SSDEEP 12288:8HRQpjndCNI+y0vplnoXMPr2oYFoDOuK4MMRqAEqHgKNLg470oKNcOWR5HYhFJba:8HSjdCNN/z2onDOuK4MqqARHlF73ccOS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
717966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
696KB
Virtual Size
693KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ