c459a2c1c5630b36403ce0506a029fa5_JaffaCakes118
- SHA256 13d145b208632cea1403101859df2ef53a276a740b8efa11e04fefaf1a14027b
Overview
overview
10Static
static
3INQUIRY 20...20.exe
windows7-x64
10INQUIRY 20...20.exe
windows10-2004-x64
7$APPDATA/s...DH.dll
windows7-x64
1$APPDATA/s...DH.dll
windows10-2004-x64
1$APPDATA/s...ui.dll
windows7-x64
1$APPDATA/s...ui.dll
windows10-2004-x64
1$APPDATA/s...sX.exe
windows7-x64
1$APPDATA/s...sX.exe
windows10-2004-x64
1$APPDATA/s...60.dll
windows7-x64
1$APPDATA/s...60.dll
windows10-2004-x64
1$APPDATA/s...cl.dll
windows7-x64
3$APPDATA/s...cl.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$TEMP/Barracoon.dll
windows7-x64
3$TEMP/Barracoon.dll
windows10-2004-x64
3$TEMP/alum...60.dll
windows7-x64
1$TEMP/alum...60.dll
windows10-2004-x64
1$TEMP/alum...xy.exe
windows7-x64
3$TEMP/alum...xy.exe
windows10-2004-x64
3$TEMP/alum...gP.dll
windows7-x64
3$TEMP/alum...gP.dll
windows10-2004-x64
3$TEMP/alum...ap.dll
windows7-x64
1$TEMP/alum...ap.dll
windows10-2004-x64
1$TEMP/map/...60.dll
windows7-x64
1$TEMP/map/...60.dll
windows10-2004-x64
1$TEMP/map/...ip.dll
windows7-x64
8$TEMP/map/...ip.dll
windows10-2004-x64
8$TEMP/refe...80.dll
windows7-x64
1$TEMP/refe...80.dll
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
INQUIRY 200609-07_06_2020.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
INQUIRY 200609-07_06_2020.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
$APPDATA/simpleLogin/ear/AvVsPkDH.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
$APPDATA/simpleLogin/ear/AvVsPkDH.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
$APPDATA/simpleLogin/ear/jbimpui.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
$APPDATA/simpleLogin/ear/jbimpui.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
$APPDATA/simpleLogin/ear/resToResX.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$APPDATA/simpleLogin/ear/resToResX.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$APPDATA/speakers/manifest/74.opends60.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
$APPDATA/speakers/manifest/74.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
$APPDATA/speakers/manifest/edbgcl.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$APPDATA/speakers/manifest/edbgcl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/advsplash.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/advsplash.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$TEMP/Barracoon.dll
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
$TEMP/Barracoon.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
$TEMP/alumni_reunions/calendars/retail/52.opends60.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
$TEMP/alumni_reunions/calendars/retail/52.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
$TEMP/alumni_reunions/calendars/retail/VsLogP.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
$TEMP/alumni_reunions/calendars/retail/VsLogP.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
$TEMP/alumni_reunions/calendars/retail/almap.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
$TEMP/alumni_reunions/calendars/retail/almap.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
$TEMP/map/clickheat/documents/74.opends60.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
$TEMP/map/clickheat/documents/74.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
$TEMP/map/clickheat/documents/msisip.dll
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
$TEMP/map/clickheat/documents/msisip.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
$TEMP/referral/msvcrt80.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
$TEMP/referral/msvcrt80.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target c459a2c1c5630b36403ce0506a029fa5_JaffaCakes118
- Size 273KB
- Sample240827-e4bsesvcpn
- SHA256 13d145b208632cea1403101859df2ef53a276a740b8efa11e04fefaf1a14027b
- MD5 c459a2c1c5630b36403ce0506a029fa5
- SHA1 c2a85db65a7607c05808b144f401d7e8cf214508
- SHA512 a968d04a1f7a66e49628407e7e0df3016ad168c888b7e55900a2533feadbd1f9d152a36ec2719dd6d7184ddb552c4ab56980b4c8d89ffc2d2f845ab3a1c0233b
- SSDEEP 6144:Y4vvDyT0oKoX6UFk4XRUAYF5giA0d+XFiuvcXc/ComCUCzC0zF:voKK9Fk4BUAyg10dE0c/CosCzC0p
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/INQUIRY 200609-07_06_2020.exe unpack002/$APPDATA/simpleLogin/ear/AvVsPkDH.dll unpack002/$APPDATA/simpleLogin/ear/jbimpui.dll unpack002/$APPDATA/speakers/manifest/edbgcl.dll unpack002/$PLUGINSDIR/advsplash.dll unpack002/$TEMP/Barracoon.dll unpack002/$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe unpack002/$TEMP/alumni_reunions/calendars/retail/VsLogP.dll unpack002/$TEMP/map/clickheat/documents/msisip.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/INQUIRY 200609-07_06_2020.exe nsis_installer_1 static1/unpack001/INQUIRY 200609-07_06_2020.exe nsis_installer_2
File Explorer
-
c459a2c1c5630b36403ce0506a029fa5_JaffaCakes118.rar 273KB
-
INQUIRY 200609-07_06_2020.exe.exe 293KB
-
$APPDATA/simpleLogin/ear/AvVsPkDH.dll.dll 26KB
-
$APPDATA/simpleLogin/ear/jbimpui.dll.dll 12KB
-
$APPDATA/simpleLogin/ear/model6.xml.xml 7KB
-
$APPDATA/simpleLogin/ear/resToResX.exe.exe 38KB
-
$APPDATA/speakers/manifest/74.opends60.dll47B
-
$APPDATA/speakers/manifest/edbgcl.dll.dll 28KB
-
$APPDATA/speakers/manifest/ruby.xml.xml 4KB
-
$PLUGINSDIR/advsplash.dll.dll 5KB
-
$TEMP/Barracoon.dll.dll 16KB
-
$TEMP/Bustee147KB
-
$TEMP/alumni_reunions/calendars/retail/52.opends60.dll48B
-
$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe.exe 36KB
-
$TEMP/alumni_reunions/calendars/retail/VsLogP.dll.dll 6KB
-
$TEMP/alumni_reunions/calendars/retail/almap.dll16KB
-
$TEMP/alumni_reunions/calendars/retail/gml+xml.xml.xml 2KB
-
$TEMP/alumni_reunions/calendars/retail/streetsandalleys.xml.xml 1KB
-
$TEMP/alumni_reunions/calendars/retail/x-vorbis+ogg.xml.xml 3KB
-
$TEMP/map/clickheat/documents/74.opends60.dll47B
-
$TEMP/map/clickheat/documents/msisip.dll.dll 15KB
-
$TEMP/map/clickheat/documents/rdf+xml.xml.xml 2KB
-
$TEMP/map/clickheat/documents/x-go.xml.xml 2KB
-
$TEMP/referral/com.ubuntu.sound.gschema.xml.xml 367B
-
$TEMP/referral/msvcrt80.dll38KB
-
$TEMP/referral/x-systemd-unit.xml.xml 2KB
INQUIRY 200609-07_06_2020.exe
- IMPHASH 7c2c71dfce9a27650634dc8b1ca03bf0
- SHA256 c9365a9c17d0b389e953ec604f7a12efb4555f35fe74d8ff99d181e252894a63
- MD5 1ed0376892edb0aca1e2b1c07ebb7830
- SHA1 79c5bea6346caafff580f21e0db8d14e288a4fc2
- SHA512 390cdc119fc0d58448a4a4e78f29cc13c35b772a0e0b72b67d62e9f6ede627f3aa2c6919c19f53da4834e2c2c3876a2b97f026536f9d668168a58f7cd4722852
- SSDEEP 6144:HPCganNbIJ9Zw715R0W25/WQsF+CnfZMhLu8lF90AaamNAsu70unL9XTbnyokkuV:dan52YrR0W21Wd+CfeMAnwNkXnyoNuum
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
13225
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
Sleep
GetTickCount
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
SetFileAttributesA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileTime
GetFileAttributesA
SetCurrentDirectoryA
MoveFileA
GetFullPathNameA
GetShortPathNameA
SearchPathA
CloseHandle
lstrcmpiA
GlobalUnlock
GetDiskFreeSpaceA
lstrcmpA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
GetPrivateProfileStringA
WritePrivateProfileStringA
MulDiv
MultiByteToWideChar
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
user32
GetSystemMenu
SetClassLongA
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
LoadImageA
CreateDialogParamA
SetTimer
SetWindowTextA
SetForegroundWindow
ShowWindow
SetWindowLongA
SendMessageTimeoutA
FindWindowExA
IsWindow
AppendMenuA
TrackPopupMenu
CreatePopupMenu
DrawTextA
EndPaint
DestroyWindow
wsprintfA
PostQuitMessage
gdi32
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ord17
ImageList_Destroy
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$APPDATA/simpleLogin/ear/AvVsPkDH.dll
- IMPHASH a22d4654114f2b83a1b8667cfbbd534c
- SHA256 28b451525a9122e07d3925643c432fb5b6625919d2ce172a65f79eae64c3aa9f
- MD5 dcb503b44bfe005df85e08a645e7c1e3
- SHA1 30e1cf630147d901c792049b1902885b4ffe0af8
- SHA512 9bba86c81d55e6bf200a73c1233d806b57f6049aa30d17d5ad0cf6ce32a6e28581148b61c6f6f88c212346fa2d6cbcacabfd88e724ff6ceb40637f719f2e6c5e
- SSDEEP 384:UCjkl0Ke5XN3XEUwBxGTKyP5IULV7pTuWECTE9W8S9UkOWKrhmdTXcpddWBK2yW4:UCjGe5dE2KkrxVTPTeFS9UkOWqmdTp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
14928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
AvVsPkDH.pdb
msvcr80
?terminate@@YAXXZ
__crt_debugger_hook
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
__C_specific_handler
_amsg_exit
??3@YAXPEAX@Z
_decode_pointer
_encoded_null
_initterm_e
_initterm
_malloc_crt
_encode_pointer
??2@YAPEAX_K@Z
??_V@YAXPEAX@Z
wcsrchr
free
__CxxFrameHandler3
memcpy
??_U@YAPEAX_K@Z
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
memcmp
atl80
ord23
ord61
ord64
kernel32
GetThreadLocale
GetLocaleInfoA
GetACP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetVersionExA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
Sleep
CloseHandle
GetProcAddress
SetUnhandledExceptionFilter
GetEnvironmentVariableW
InitializeCriticalSection
GetSystemDirectoryW
GetVersionExW
GetModuleFileNameW
RaiseException
GetLastError
DisableThreadLibraryCalls
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
OpenProcess
ReadProcessMemory
IsDebuggerPresent
rpcrt4
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
NdrOleAllocate
CStdStubBuffer_CountRefs
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
user32
UnregisterClassA
oleaut32
SysFreeString
SysAllocString
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
ole32
CoCreateInstance
StringFromGUID2
advapi32
RegDeleteValueW
RegFlushKey
RegCloseKey
RegSetValueExW
RegCreateKeyExW
ntdll
memset
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
142B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
314B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=14, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=105, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50327,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=7, id=110, productName=VS2005 build 50727, version=50727,
count=10, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=5, id=113, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$APPDATA/simpleLogin/ear/jbimpui.dll
- SHA256 a8a39f536e1322929195fa6fd8f6f3fa1225898cb11165479acaeae4349ada62
- MD5 e3506368b06754e2cc27e29a1f2d3f8c
- SHA1 207d3945c93b499e7e5c28d406a9aa5465880da4
- SHA512 8c437e63b81826e673e30f44f0b23f6fa79b5dd1622dbc08d134c472fe821eecc07a48f1e944cd8f8b18cd2135e7379b9c1962d853b2374c4f77dadaf017a829
- SSDEEP 96:1REWQ8NNbW/AGcydg0IDg6beRJhexnDDQJ00B84iJT7JbzBkAIeVAWDBfkKhY76q:wWbNNbW/KlIlUkZ6wIUW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, productName=Unmarked objects (old),
count=1, id=120, productName=VS2005 build 50727, version=50727,
$APPDATA/simpleLogin/ear/model6.xml
- SHA256 8b2e59b29a937b71e46b8d1dc2e93119747f5108e435db609e3bc9f36a79751a
- MD5 d89aa38ab9a2075037fdda243ed8720c
- SHA1 c6f191976c357fd27f83bd498b8cad7f6a0d5b06
- SHA512 9dd95e2c0b43794cb937c4079d7024f6953cab74ad50f3ef6917dcc82c352649d01c2a613b4cfbe6486a4e01898bf94f85aa598a016ef0bdbde4071e2a847740
- SSDEEP 96:9CCDl7hk3hSjUJzA4KEqkCBCT5B5/5BM5aT53JWhCO2pj6O2Bl:BleY4KEqk3VV5ghC9pj69Bl
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/simpleLogin/ear/resToResX.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3a530aacf477d005147c3b3a782b96a7c9a8a17a0a3e163be255ca8a133ea430
- MD5 8952521941dbe005a4ac2fe8a88aba2c
- SHA1 b5114de8c2e78d72ec8ddb6ab7bcb02b1bb5291f
- SHA512 a79f7bd27370578be53e1ff46dbe52fc95c153c7213ad9ca5d2206c3d6e8ad315bb98058ad8d806aa33affc1c22c9784ba73b2e7da20b36dd77421f85a90d0ba
- SSDEEP 384:J1rc09Z2gN3uUXCKDWK93bZ3Jd0Oi9jqUOJesaxdu/+lW8wWhLCcMe/oTC4:H12jUXCH4rSqFCbU+17L3d/o+4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
29:c3:02:e3:fb:75:45:00:51:5b:8c:a4:15:ca:4e:23:0f:91:16:77
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US
Serial Number
0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2008
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 23, 2002 - Sep 25, 2011
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:87:58:00:03:00:00:00:5a
Issuer
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 5, 2005 - Apr 5, 2006
Minor OS version
0
Major OS version
4
Entry point
28478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries.x86ret\bin\i386\ResToResX.pdb
mscoree
_CorExeMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
$APPDATA/speakers/manifest/74.opends60.dll
- SHA256 d2b3069fb7c0fdfae1f1ac228c38be695f6b3155d00ae20c30acdddc39c31ace
- MD5 4984eb04c8300f18b3cc077c0b589c9c
- SHA1 b23c5002ea5d690740f3bd6df8a799dca6a2ca1f
- SHA512 400c423f22a378589f4cc227a030626f408ad24d40ae524eaf3bb4119a427ce968f112100e6c1d7b807f1ac7db67fb6a1325d899c75889b2b80f7073da999324
- MD5 SHA1 SHA512
$APPDATA/speakers/manifest/edbgcl.dll
- IMPHASH 45e4416f39b80457758c2793dc85eec1
- SHA256 a071c2d03d3f9fc282c49e98758e012b9f8c0675b00b7d3589e4f20a98e2a950
- MD5 82645c2a2cb19c465c1d57e561d022b8
- SHA1 ce21a234c6821b0aea12cf3b5cb1b3fcdc5b8ec7
- SHA512 204f7c543eb2b8b6a983d39a07722f4fbbc7f60af082ce0c6a90f31c44b920115b1534bcdf3b14e3216af0894ec4ad974f24874a1f28716a98b0443064fa4d1a
- SSDEEP 768:otC6PwhUl8ADS6lTCo1kjWUnFXz8h1rV:otCOXl8Ihu8kjW6K1rV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
23597
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
edbgcl.pdb
kernel32
DisableThreadLibraryCalls
DeleteCriticalSection
FreeLibrary
SetEvent
GetLastError
WaitForSingleObject
ResumeThread
CreateThread
CreateEventW
CloseHandle
IsDebuggerPresent
InitializeCriticalSection
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameW
LeaveCriticalSection
lstrlenW
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
lstrcmpW
SetUnhandledExceptionFilter
msvcr80
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
_onexit
_lock
??3@YAXPAX@Z
??_U@YAPAXI@Z
wcscpy_s
wcsncpy_s
??2@YAPAXI@Z
??_V@YAXPAX@Z
_purecall
wcscat_s
_encode_pointer
_malloc_crt
_encoded_null
free
_decode_pointer
_initterm
_initterm_e
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
memcpy
advapi32
RegDeleteKeyW
RegOpenKeyW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegEnumKeyW
RegCreateKeyW
ole32
StringFromGUID2
CoLockObjectExternal
CoTaskMemAlloc
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoCreateGuid
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoUninitialize
oleaut32
SysFreeString
VariantChangeType
SysStringLen
VariantClear
VariantInit
SysAllocString
wsock32
ntohl
htonl
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=2, id=110, productName=VS2005 build 50727, version=50727,
count=12, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=81, id=1, productName=Unmarked objects,
count=24, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$APPDATA/speakers/manifest/ruby.xml
- SHA256 0efafee0389ec306a7f17ea1563b379331de80b65ff09c170ca81c54332d7b58
- MD5 49e35aa46940919b3d8dd1b9aff051eb
- SHA1 ad1e8507b91410b2e74d611dea7d534b13862649
- SHA512 95f676a1c41b9674ad96baf8634f8f35b5c532b8904025297c263254e195e58e61adbbb84696f4a51e16545700d580e0d990428ab4eedb7be8c458995d5636fe
- SSDEEP 48:cCAbn296DEfB/Qv5pGQ+p6UzU+KTQUZQhY:1+2kcKPX1
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/advsplash.dll
- IMPHASH c0d4e5fadc92d88e6603d2d1c1d8421c
- SHA256 b1ef42f722254532953051d08e6763fd1d9087441b2c58c268ffc71a37bbfcdd
- MD5 3536302baf9f0a47cd5f9c0a5caf5bdd
- SHA1 d6f2a6267724a122a10fc41c12cef2f69a3c1987
- SHA512 8d5ce29225ced31c7352f280ca7667703ce3337ba10a73a8fe398bcd43ab742fbd78123a5665babddb2a43cc564262c9e64de8c86cd46900e6c7bc9194f68ef0
- SSDEEP 96:HqNXqwK188CgAtXvZBkjDf0yf9ysrtWpThwol:HAqrg1XvZB6kYtWpt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpynA
LoadLibraryA
lstrcpyA
lstrcatA
GetProcAddress
GlobalAlloc
GlobalFree
user32
EnumDisplaySettingsA
LoadImageA
BeginPaint
SetWindowLongA
SystemParametersInfoA
EndPaint
GetClientRect
CreateWindowExA
DefWindowProcA
DestroyWindow
IsWindow
GetMessageA
DispatchMessageA
UnregisterClassA
wsprintfA
PostMessageA
SetWindowRgn
RegisterClassA
LoadCursorA
SetWindowPos
gdi32
BitBlt
DeleteDC
DeleteObject
CombineRgn
GetObjectA
GetDIBits
SelectObject
CreateCompatibleDC
CreateRectRgn
winmm
timeSetEvent
PlaySoundA
timeKillEvent
show
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
460B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=1, productName=Unmarked objects,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$TEMP/Barracoon.dll
- IMPHASH 81e430800d6403049e7cc6ed11502fcd
- SHA256 5a3c55f4e99aed79b58cfc985661f0d055b3ddb759c96757724407d7435278b4
- MD5 78b9abbf79ea11a22c73107e63924bf7
- SHA1 022e05bc47a33b20eeaf541d72b915187cc0702c
- SHA512 aec84bbb46e93d149e955a7753bd9b138f1aa93e347f04ef6ec7bb78b999446265ec20fe555b0d1d16c959551019eea7b69b6dc75c2060605115327210a6b879
- SSDEEP 192:WyqDoJe27ORNBXzXwTR1muELYWgHASgHASgHArHxvkZVk8e3zQeJuS2OkAda3nau:WvoJe2KRHXDgmueYUoorHxwVPeW6V+O
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
LogonUserW
CryptGetKeyParam
RegQueryValueW
RegEnumValueW
SetKernelObjectSecurity
gdi32
DrawEscape
ws2_32
gethostbyaddr
WSAUnhookBlockingHook
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetModuleHandleA
GetProcAddress
SetSystemTimeAdjustment
TlsGetValue
SetHandleCount
ReadFile
MoveFileW
VirtualUnlock
TerminateProcess
IsDebuggerPresent
Ambatch
Childe
Gingersnaps
Hemlock
Involute
Muss
Waterrates
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=1, productName=Unmarked objects,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$TEMP/Bustee
- SHA256 fe6817875714e58081a015b97ea4cdb1a1f8f05c779469ee6d9de2897b803b1b
- MD5 f64907d25a33dd8e4bd37715c3b95b42
- SHA1 1e1d9fd552a0ec2043239ddb332497031d583a25
- SHA512 47632178e7520d7cc9133dd4f9d4606403f20663ddc1809d79c37d518c9870928dbf0a8e9f35f0275e8c83e4cfe56ced2930ca5340f9df1414b86171d7ae7c35
- SSDEEP 3072:ZyHZAbsLCxS9XZtR9BgHJ1DSwbamNAsdgl0e7ni+9XTb/Q4l3RNyz2hoFk:ZyHpSSlF90CaamNAsul0unL9XTbT3byI
- MD5 SHA1 SHA512 SSDEEP
$TEMP/alumni_reunions/calendars/retail/52.opends60.dll
- SHA256 8935bcf2c389ffdfa7bd3eccc2af92dd8092f11f8845d95f16e61f7393edf86b
- MD5 2c113f0eada02c58621b12aa16cf85c9
- SHA1 a7a8b1b971c2765befdb16ee2b6043dd2dc155db
- SHA512 696b7699f1e57538549f9715be516ee101642c2d109d87cc0033f174c2151a1b4fafb00d881650f4e8947ce09565f6431092f67464812cbee43a18cf5a893285
- MD5 SHA1 SHA512
$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 46b1a81f5ebb43404ac7229d14593d5f47930c8fc3fb5279ac5402507f7ea7b3
- MD5 6ad1c32675ecd48f15535e4a0e474e28
- SHA1 2d9b200ea1d9fb6442f21bb5441072bd4b9d1968
- SHA512 8a425760aa2e7bbe286b2322d2413eaee42d7e386448050c46f61c461481407800ed2b5bd19beee77dd74fcb30e496d36c303d0845e1ee138babf6f483da1659
- SSDEEP 384:EW2BCQspyJi6d0XsNGIEP/06V78FIISqa4ld2Cxs+NHsRo8CWewMW:fBqJbS8N7IIlaAs+NHsKe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Microsoft.XslDebugProxy.pdb
mscoree
_CorExeMain
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
$TEMP/alumni_reunions/calendars/retail/VsLogP.dll
- IMPHASH 4465fb8f3efd6983454e98bbf576c7fe
- SHA256 0e269d428ecc49125bd2ff997a659c47d6b8124d38e1d9102d08e98f64055e85
- MD5 42741f3de52a793918627eacbf6a45ca
- SHA1 31310a08b370b8e56445791d93b6bf87464e808d
- SHA512 0143fab89d72cf3acea003ac418702dcc8ef3d9788396b7c6d797854904f21b1b024f5d9304346c9e8a1ae23fad25f69b3e01570984f50fdedc47967618c5c2a
- SSDEEP 96:UteThBZRibjkt3sb8z6AC+AqAEWrZAdxWPV0:UteTXZRjt3sQzBAq5Wr+dxWN0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
VsLogP.pdb
kernel32
DisableThreadLibraryCalls
rpcrt4
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_CountRefs
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllUnregisterProxy
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_IsIIDSupported
oleaut32
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=24, id=1, productName=Unmarked objects,
count=2, id=113, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$TEMP/alumni_reunions/calendars/retail/almap.dll
- SHA256 154c99a265cff2e12f151d77d561f5a80b11c8227dcfc61cad0fbf1fb66d35b5
- MD5 595f376cfd0583882f67f3bf16d88760
- SHA1 699784474329d2f548a869fdd6211ffc5b7316cc
- SHA512 fc0eaade59dbf155cb96a1750e849a78a2b59e74045ba729216835788f1de3b1690c467fe871fc5eda6ca59007dbec3ea43e8dd987786a4a355dd88a6aeb3ffb
- SSDEEP 384:8qUuKJpjw9YxO9FJUuDq9j8tCqYqOO//ur/J5J+Of4o3VghRGA:8qUuKJpjwWO9FJUuDqigqYqOO//ur/JU
- MD5 SHA1 SHA512 SSDEEP
$TEMP/alumni_reunions/calendars/retail/gml+xml.xml
- SHA256 ed30a51b24b97c2e5f7f6df147be36321cc9e3a128396efac5005ff88b1a0403
- MD5 7f9c607402985467fecd4c4e779601b0
- SHA1 b42cd0ff6eb3525d869a8be1e9ff62645b2150f2
- SHA512 0259d267dfe848884d305eb829469ba00104dd276309d0391698a99b9cd41a521f4bb588d34ff261fe9a4b2f17dacbcec3ed4527b86b385bd2724a4dcf1c3d9b
- MD5 SHA1 SHA512
$TEMP/alumni_reunions/calendars/retail/streetsandalleys.xml
- SHA256 2bf062dc360b1ccea41163a4da8d52e2763be71a642a387fe868ad8ed8fd2539
- MD5 918279f505875423e70777f7dd29d12d
- SHA1 86cca568e60e4ff865f23caae54a87d4860a9524
- SHA512 bc0ba111db06a6f4771c4a0a41ca0896ca5905fe991d03023da27fda042bade8c5bc006da412861d4f2eb8951b589988664ca88b57081f1d17919864624961e9
- MD5 SHA1 SHA512
$TEMP/alumni_reunions/calendars/retail/x-vorbis+ogg.xml
- SHA256 4c13e0c04bb6b7af076a5832ed4cafc168f245bd1e12d33ca2df21de6b0f42e4
- MD5 e58a29e78aaf08442516c340604499e1
- SHA1 aaef1b1a1f0e93e515ea313369fa89a20c0d7aa0
- SHA512 d012c6d0b53b674cb731efe014df6d0963a7a1d9b66aeb5c7c544a6c34d6b18877d02d1e8b433b6aef944fcb1063ebaa0900ed3ae5575daa5276c587a0931b3a
- MD5 SHA1 SHA512
$TEMP/map/clickheat/documents/74.opends60.dll
- SHA256 d2b3069fb7c0fdfae1f1ac228c38be695f6b3155d00ae20c30acdddc39c31ace
- MD5 4984eb04c8300f18b3cc077c0b589c9c
- SHA1 b23c5002ea5d690740f3bd6df8a799dca6a2ca1f
- SHA512 400c423f22a378589f4cc227a030626f408ad24d40ae524eaf3bb4119a427ce968f112100e6c1d7b807f1ac7db67fb6a1325d899c75889b2b80f7073da999324
- MD5 SHA1 SHA512
$TEMP/map/clickheat/documents/msisip.dll
- IMPHASH d954e4f364d84fae7605db94ece6a447
- SHA256 cacbc2940693d704d489f90015d24a01ec509b426bd96febc1852131a53977b8
- MD5 da23a12845607133acf1db3502d4e575
- SHA1 3808f3a44ffb3b2bdb7a5e57c650b0a96cd52b5f
- SHA512 8b0d6a3598d4bb6b4dd061d6ad1c56c1dc8fcad5047e5c484c9b85a9698e52029cd0d873dbe8c74bcb53e6d61750fbb616f1c9e6f8ecebb82367d9e73a14ba1b
- SSDEEP 192:tF8MmFDXLSPZdLzAfbkKIcY7HvqAdsiLuvRzJhaSjocS0xY0Yrk26Ab8WQn:tqvFDXmPZN+/IcY7HyniCRa4IIYvGWQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
13319
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msisip.pdb
msvcrt
malloc
_adjust_fdiv
_initterm
free
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
kernel32
lstrlenW
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
lstrlenA
FreeLibrary
GetProcAddress
LoadLibraryW
SetLastError
CloseHandle
GetLastError
lstrcmpW
DllRegisterServer
DllUnregisterServer
MsiSIPCreateIndirectData
MsiSIPGetSignedDataMsg
MsiSIPIsMyTypeOfFile
MsiSIPPutSignedDataMsg
MsiSIPRemoveSignedDataMsg
MsiSIPVerifyIndirectData
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=30, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=9, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=92, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
$TEMP/map/clickheat/documents/rdf+xml.xml
- SHA256 812b08a208abfeba9fea776fcb0376d41c6db3c793cee0a23d111d2df0db7408
- MD5 5712f331bad1c2c10c69fcef4c32ef78
- SHA1 6d6f5f069b1dbc45e7ed4225bc8978d2161651bb
- SHA512 7ed3f20c803af6fab8cf84797c97dbc86aff568c4624a13ce7c9d2b27cf1fe6090fd567c5c08fc2e8fabadb83f23e32a17d470c2e4c8d8623434e613f08d88b3
- MD5 SHA1 SHA512
$TEMP/map/clickheat/documents/x-go.xml
- SHA256 15a72181c1a36adc3b066223913120ae65535edef80b83d2e17b6c16004da562
- MD5 0c29e94cfe31d093f0538012c0c80c9f
- SHA1 7490771cfd73f8f62a0ebd3db42a6137555bea3f
- SHA512 c942a65ccd9f525bf185349973e245c13c31a54f659ab72172f0ea438d8f35d6ec3c20941aee90a442a488c125311b00260cded1027edf768aa1991cb3f12f8f
- MD5 SHA1 SHA512
$TEMP/referral/com.ubuntu.sound.gschema.xml
- SHA256 f943dab2fe2654f93b1de5622b58f93f78a044f834222748ef896848bf136237
- MD5 65afe6de2b6f2a167369fd118afd6190
- SHA1 9cd33f80ef65897c11e63ae7398abced81fc9c6f
- SHA512 93d127f5dc5100a00a516b566a1159de64fb3913675538b01b1e2721a92b8e96282e760d04461446ea044327cef0c7e8db305c1a8708797df0ff0a41967351c5
- MD5 SHA1 SHA512
$TEMP/referral/msvcrt80.dll
- SHA256 19f4c2ffc874646f4f290a4255cba805e597d4569684d0537591588fea2f1962
- MD5 cdce62bd68cfd6b3bee664e32453708a
- SHA1 0315c77484f4f28c8e17c05ee20695dcd6001ce2
- SHA512 0e7aaa37a89f6bbe857112e749860e604573ec6473ae4b6232781b7580659376b22c40395ff302049f4764f85ed2dfc88a5268b5896288da4f3e9b53a17a00dc
- SSDEEP 768:Jq8q7Y4Y4Y4d+pfeC5Z8U1l0TOu6OXQ+c+jiut+vSL3uBsP:Jq9dqfZ5Z8U10cA5QaGsP
- MD5 SHA1 SHA512 SSDEEP
$TEMP/referral/x-systemd-unit.xml
- SHA256 5a2d168f83be18844fe84cda3366bcd5964d7864b8a837e9cec8b8b9edb8e9b4
- MD5 1e6e54636dc98c3ec582d3680bbb963a
- SHA1 e4457807a08893b3df38789c7b318a345ffff80a
- SHA512 860b13922ba8d359d462dcb53119629047546f1ad16cedbbedebed72209ab158bf9cdf8a505f9a88b40e1853848e5c0c50fcacee8dcd5620c1a614adffe3456b
- MD5 SHA1 SHA512