Newfolder8.7z
- SHA256 0e06e9585cc9db33ee999ca4de668ab64ef6e9fa928ae6541b2f1ec68ff09da8
Overview
overview
10Static
static
100297bbb0f0...ee.exe
windows7-x64
30297bbb0f0...ee.exe
windows10-2004-x64
315aeb8380c...71.exe
windows7-x64
1015aeb8380c...71.exe
windows10-2004-x64
101820a0542f...34.dll
windows7-x64
101820a0542f...34.dll
windows10-2004-x64
101df11bc19a...ad.exe
windows7-x64
51df11bc19a...ad.exe
windows10-2004-x64
522934e006b...e7.exe
windows7-x64
322934e006b...e7.exe
windows10-2004-x64
324989d884f...b7.exe
windows7-x64
1024989d884f...b7.exe
windows10-2004-x64
102828fabf39...65.dll
windows7-x64
12828fabf39...65.dll
windows10-2004-x64
132b0fbaf95...08.exe
windows7-x64
1032b0fbaf95...08.exe
windows10-2004-x64
104bf2dace8a...d7.exe
windows7-x64
104bf2dace8a...d7.exe
windows10-2004-x64
1055d03f9954...44.dll
windows7-x64
1055d03f9954...44.dll
windows10-2004-x64
105e58e3818a...cb.exe
windows7-x64
105e58e3818a...cb.exe
windows10-2004-x64
10611cf2be67...47.exe
windows7-x64
10611cf2be67...47.exe
windows10-2004-x64
10654e574fb4...01.exe
windows7-x64
3654e574fb4...01.exe
windows10-2004-x64
36f4ac0da34...a5.exe
windows7-x64
96f4ac0da34...a5.exe
windows10-2004-x64
9$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral16
Sample
32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral17
Sample
4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral18
Sample
4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral19
Sample
55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral22
Sample
5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral23
Sample
611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe
Resource
win7-20240708-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral24
Sample
611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral25
Sample
654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe
Resource
win7-20240729-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral28
Sample
6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Newfolder8.7z
- Size 17.6MB
- Sample240927-2axjcssfmj
- SHA256 0e06e9585cc9db33ee999ca4de668ab64ef6e9fa928ae6541b2f1ec68ff09da8
- MD5 be23bf21f50efe03646c00428769da08
- SHA1 588f68a1f66ee0c689104d9096415b9070838827
- SHA512 b3850d8b79c88e5a1ac7d2855f5b03b08c3392629f041474a997f4c9d71e321c24b9a2c5dad79e8fa6a1bb94648a30808dfa37dbb61e1348fd221594beeda8aa
- SSDEEP 393216:gTZqJOaXIZoQGPISZpx/0iw+lT+6uxC2JxpG25Bbm:gsJd7ISLW+t+6mCOTdm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
icedid
Botnet
-
2683308570
C2
-
funnymemos.shop
-
trythisshop.club
-
shopoholics.best
-
buytheone.best
Attributes
-
auth_var
1
-
url_path
/audio/
Extracted
Family
-
wellmess
C2
-
http://178.211.39.6:80
-
https://141.98.212.55:121
rsa_privkey.plain
rsa_pubkey.plain
rsa_pubkey.plain
rsa_pubkey.plain
Signatures
- IcedID Second Stage Loader 1 IoCs
resource yara_rule static1/unpack001/654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe IcedidSecondLoader - Icedid family
- StormKitty payload 2 IoCs
resource yara_rule static1/unpack001/611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe family_stormkitty static1/unpack001/91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8.exe family_stormkitty - Stormkitty family
- Wellmess family
-
resource yara_rule static1/unpack003/orihonvp.exe themida static1/unpack001/91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8.exe themida - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496.exe autoit_exe -
resource yara_rule static1/unpack001/1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe upx - Unsigned PE 32 IoCs
Checks for missing Authenticode signature.
resource unpack001/0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe unpack001/15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe unpack001/1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.exe unpack001/1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe unpack002/out.upx unpack001/22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe unpack001/24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe unpack001/2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.exe unpack001/32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe unpack001/4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe unpack001/55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.exe unpack001/5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe unpack001/611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe unpack001/654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe unpack001/6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe unpack003/$PLUGINSDIR/System.dll unpack003/$PLUGINSDIR/UAC.dll unpack003/$PLUGINSDIR/UserInfo.dll unpack003/$PLUGINSDIR/nsDialogs.dll unpack003/$PROGRAMFILES/foler/olader/acledit.dll unpack003/$PROGRAMFILES/foler/olader/acppage.dll unpack003/$PROGRAMFILES/foler/olader/adprovider.dll unpack003/orihonvp.exe unpack001/7109e67cf655b41ff88903bf1e70cc4efa3e537a38df7df90d8a3ff95c4cab58.exe unpack001/79fb1d00ef9d85e958a17fd331b23dec507e4f2e2c150fd580d0668b84d29d00.exe unpack001/7ef9667e73b84b6a031e28b6279e04cd8abe82d69cd836043a7cfe0978cb8a98.exe unpack001/8264e723a411381a9d837458ec39cbb36c8d582bcba14f7ed7fc45f8154c479d.exe unpack001/8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496.exe unpack001/863c612734f5ff0ff0ea3fed7fd790dfb43c47eecdc1417bcd82c0ad866419af.exe unpack001/942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe unpack001/95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc.exe unpack001/99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe
File Explorer
-
Newfolder8.7z.7z 17.6MB
-
0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe.exe 2KB
-
15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe.exe 150KB
-
1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.exe.dll 38KB
-
1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe.exe 1.3MB
-
out.upx.exe 3.9MB
-
22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe.exe 2KB
-
24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe.exe 1.2MB
-
2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.exe.dll 179KB
-
32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe.exe 844KB
-
4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe.exe 787KB
-
55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.exe.dll 231KB
-
5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe.exe 865KB
-
611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe.exe 280KB
-
654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe.exe 8KB
-
6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe.exe 3.0MB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/UAC.dll.dll 14KB
-
$PLUGINSDIR/UserInfo.dll.dll 4KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PROGRAMFILES/foler/olader/acledit.dll.dll 8KB
-
$PROGRAMFILES/foler/olader/acppage.dll.dll 45KB
-
$PROGRAMFILES/foler/olader/adprovider.dll.dll 48KB
-
nasial.exe.exe 2.8MB
-
orihonvp.exe.exe 2.5MB
-
7109e67cf655b41ff88903bf1e70cc4efa3e537a38df7df90d8a3ff95c4cab58.exe.exe 708KB
-
71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.exe.dll 402KB
-
79fb1d00ef9d85e958a17fd331b23dec507e4f2e2c150fd580d0668b84d29d00.exe.exe 5.9MB
-
7ef9667e73b84b6a031e28b6279e04cd8abe82d69cd836043a7cfe0978cb8a98.exe.exe 2.3MB
-
8264e723a411381a9d837458ec39cbb36c8d582bcba14f7ed7fc45f8154c479d.exe.exe 2KB
-
8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496.exe.exe 856KB
-
863c612734f5ff0ff0ea3fed7fd790dfb43c47eecdc1417bcd82c0ad866419af.exe.exe 3KB
-
91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8.exe.exe 3.6MB
-
942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe.exe 732KB
-
95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc.exe.exe 6.5MB
-
99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe.exe 1.1MB
0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe
- IMPHASH d0e384aa95abd36d281a3e456d0e4dbe
- SHA256 0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee
- MD5 4a6ac8d48c9793c0c852a6ac93ba2002
- SHA1 cdc7a9cf8ee36099c823779ac2dd8ffe3a84d723
- SHA512 3aacced9817519ae31ed2bc4cf4063b2eb0a1c9e9addbcb9e08b3431f519ca0a8a6a8962e1039835a48e50cb52cd08d21cad642a66822c288d2b0a88541c361e
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WinExec
GetCommandLineA
GetCommandLineW
GetBinaryTypeA
ExitProcess
user32
BeginPaint
AnyPopup
AppendMenuA
Name
.text
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe
- IMPHASH 6e9e93f43de3e58e0f5a1cb9388f645c
- SHA256 15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71
- MD5 022f5345cfab4ef75476ffc7f708fcfe
- SHA1 81802b0a5f738b7333a60eece96441c1bca19792
- SHA512 6595ef6e3e0b65afd0a4f7d5bd5650466a4299df8284180b48ff0e30a537a42616a98c530fa4d39fdbe30eb1cc6c72fd749a98551890a0b488f04fd164b49f53
- SSDEEP 1536:YyuipsAiJm4cJI7CweL+eX9kEnOCGzJoQL2VwEeYIsUE4KvVf+boJPtgm4qeYwqN:FlpYU6vqXRPE2VyYIsf4K9ffFSqe72
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11560
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\ninuw_tadomuyamen100\bohowexehukaci4 bogex73 tevumecus.pdb
kernel32
HeapCompact
LoadResource
GlobalAddAtomA
GetEnvironmentStringsW
SetHandleInformation
WaitForSingleObject
GetConsoleAliasesLengthA
GetSystemTimeAsFileTime
GlobalAlloc
GetLocaleInfoW
DeleteVolumeMountPointW
GetFileAttributesA
GetFileAttributesW
GetDevicePowerState
GetConsoleAliasesW
GetLastError
GetThreadLocale
GetProcAddress
VirtualAlloc
GetFirmwareEnvironmentVariableW
LoadLibraryA
IsWow64Process
CreateHardLinkW
WaitForMultipleObjects
EnumResourceTypesW
EnumDateFormatsA
SetConsoleCursorInfo
FindNextFileW
GetConsoleTitleW
FillConsoleOutputAttribute
CheckRemoteDebuggerPresent
EnumCalendarInfoExA
LocalFree
WriteConsoleW
HeapReAlloc
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetModuleHandleW
ExitProcess
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapAlloc
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
CloseHandle
LoadLibraryW
WriteFile
GetModuleFileNameW
FreeEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ReadFile
Sleep
SetStdHandle
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
RaiseException
LCMapStringW
MultiByteToWideChar
GetStringTypeW
CreateFileW
user32
SetCaretPos
ole32
CoGetMalloc
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.exe
- IMPHASH 3d51d3fa0835c459058650f717b0a385
- SHA256 1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34
- MD5 a4017c06209e16b8f47fcf6e5845aba9
- SHA1 66d99a1cc92ed316e0d7a2ab6df466c289154ec3
- SHA512 52e4df915b3cb6eb60a3f37874b0d8a14646ffadb9aa621cf8ea3fb04b5cbb4250fb9cec3a2ed8722a7eae4b600836b5b7bf72e53e297e464fb844096a9b2f5e
- SSDEEP 768:tojIJWP0znqX60+KU6nCVUO2gTjZSXulSJ474fLv/zkSf2Vz:NnqXn+YoQ+lu474zo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
34616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
shlwapi
StrStrA
ord15
kernel32
GetModuleFileNameW
GetProcAddress
LoadLibraryA
GetCurrentThreadId
GetCurrentProcessId
CreateFileW
DeleteFileA
user32
MessageBoxA
GetWindowDC
KillTimer
GetClassNameW
GetMessageW
DispatchMessageW
GetForegroundWindow
SystemParametersInfoW
SetTimer
SendMessageA
gdi32
GetBkColor
?ab2sfgW@@YAHXZ
?noaseew@@YAHXZ
?sqxctrW@@YAHXZ
DllRegisterServer
DllUnregisterServer
PluginInit
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
424B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=25930,
count=9, id=257, version=25203,
count=20, id=1, productName=Unmarked objects,
count=4, productName=Unmarked objects (old),
count=1, id=256, productName=VS2017 v15.6.0 build 26128, version=26128,
count=1, id=258, productName=VS2017 v15.6.0 build 26128, version=26128,
1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe
- SHA256 1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad
- MD5 9344afc63753cd5e2ee0ff9aed43dc56
- SHA1 ee1fa399ace734c33b77c62b6fb010219580448f
- SHA512 6434c212a85180c1af00f5c5fa081a6a6ab66f5633edb74e130a7b9d754a6a65dc973f5e820f6f57a43956c276dbf3721021d1e9bb53fa79ac51ed8cb23f4090
- SSDEEP 24576:/U1v3pE+zO9mBt2bdm3EHVXkNA80Jl5IzCxWWDrSBkian7X5:/Qv74bdm3EHEA8UIzm8aj5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
4566784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
117KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 66054c753d386b84257061e6cfb01c532215dd61304467ae8eae3ea53ab43721
- MD5 a53fb76f7423078bcc1f85fdce151f7e
- SHA1 143fb0c11841580f9a38e8f63073f4dc0c1fbb4a
- SHA512 a5a4524cbfc1b80511a36373caa36407df4357d00804042fdcf9c1f4ecc5ed2166d2bd5c5bce229c177fa53d33797dc3c6e0410c2c836e9168f2751a8f2b1cf5
- SSDEEP 49152:xA4Lugqnlrb/TUvO90dL3BmAFd4A64nsfJTNrmorhOY2XRnd5j3bFD1LIdPPo6gw:x9onGhnvZeuY7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
_cgo_dummy_export
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
128KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
376KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
116KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe
- IMPHASH dfe29094a0a8bf3a447ff0dd263ec010
- SHA256 22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7
- MD5 af8ae6c1f2859cc139cd176a6656a855
- SHA1 161e2d577b418eaa94bf1959a634956b75d7922b
- SHA512 a80672ea1f49ebaeaf5b850377ee346e7953bf6379a79db91b826ba2249a66424b0f1be189351dc86088ff9efd72142a46f6d4bff2c5dc7271a4db22c10bcd1e
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WinExec
CloseHandle
FindFirstFileA
CreateFileW
FindFirstFileExA
ExitProcess
user32
AlignRects
Name
.text
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe
- IMPHASH ad35223e42e488e819f8bab49b2709bc
- SHA256 24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7
- MD5 39ae3110dc8ee4239811f2a1083e675e
- SHA1 f235ea35b4a408a052ec5bc93310adb77b52ecbc
- SHA512 cee1b9804a3a3d4f033d8076f66ffd6021a0b017a7588b96749d319d382056847d26aedc2f1fa5b7140c01697407da3c2873d59c78044376b083bc8f0c8494ee
- SSDEEP 24576:aG4NAckBXt2Uj3WTNWIcXuDTPyYaOnuhZiOASiN0A:O0shOeDjzagumObiN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8612
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\yuyulaj\ruvox28\judihu_20_pife-gibove.pdb
kernel32
FillConsoleOutputCharacterA
SetProcessAffinityMask
GetConsoleAliasesLengthW
GetDefaultCommConfigW
ReadConsoleA
QueryPerformanceCounter
GetEnvironmentStringsW
BackupSeek
GetTickCount
GlobalAlloc
GetFirmwareEnvironmentVariableA
LoadLibraryW
SizeofResource
GetSystemWindowsDirectoryA
HeapValidate
SetConsoleCursorPosition
GetAtomNameW
LCMapStringA
GetLastError
GetProcAddress
VirtualAlloc
SetStdHandle
LoadLibraryA
WriteConsoleA
BeginUpdateResourceA
SetSystemTime
GetModuleFileNameA
SetConsoleCursorInfo
UpdateResourceW
GetProcessAffinityMask
AddConsoleAliasA
SetFileValidData
FindNextVolumeA
lstrcpyW
CreateFileW
WriteConsoleW
HeapAlloc
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
HeapFree
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetHandleCount
GetFileType
DeleteCriticalSection
SetFilePointer
CloseHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
FreeEnvironmentStringsW
WideCharToMultiByte
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
CreateFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
RaiseException
HeapReAlloc
SetEndOfFile
GetProcessHeap
MultiByteToWideChar
ReadFile
LCMapStringW
GetStringTypeW
user32
SetCursorPos
Name
.text
Size
1007KB
Virtual Size
1007KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
152KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.exe
- IMPHASH 818152acf9b9745a10910998c6f4cf34
- SHA256 2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65
- MD5 69828a3d5c60eb466c3a62f3389f6f87
- SHA1 7b9526f82448d0a1fb59a8125d1de55e3a166d72
- SHA512 ce8818f78b62453fb56fcaf98efa7bc52068f7ddf915e1df6841f33a39aff6bd7c60692af16ea361cdf15b3cc79787e4a39bb6648faffc3eaac10ce886b45d5f
- SSDEEP 3072:uq3W3hXSPA5aodE8pn6kTDnlBtx6Qg9+Fh3SslsR/dLcEZD6zs:uIuXSPA5aWpn6kTDnjzjFm/1Z+4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
73020
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
Sleep
ExitProcess
HeapFree
lstrcmpiA
lstrcpyA
HeapAlloc
HeapCreate
LocalFree
LocalAlloc
GetModuleHandleA
GetWindowsDirectoryA
DeviceIoControl
GetLastError
CloseHandle
CreateThread
CreateFileA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
WriteFile
GetConsoleCP
GetConsoleMode
DeleteFileW
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
FlushFileBuffers
CreateFileW
SetFilePointerEx
WriteConsoleW
HeapSize
HeapReAlloc
SetEndOfFile
ReadFile
ReadConsoleW
advapi32
CheckTokenMembership
AllocateAndInitializeSid
StartServiceA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
FreeSid
shell32
ord680
Control
FreeBuffer
Release
Start
Name
.text
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=241, version=40116,
count=130, id=243, version=40116,
count=13, id=242, version=40116,
count=8, id=259, version=24123,
count=29, id=261, version=24123,
count=17, id=260, version=24123,
count=7, id=203, version=65501,
count=114, id=1, productName=Unmarked objects,
count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe
- IMPHASH 804961db55ba5c190e654e6d23768444
- SHA256 32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08
- MD5 a6f049a056e37a65280ddfe17f689b50
- SHA1 479e08954d4d58b643ada84da280bd01c71e779a
- SHA512 f7effb9a12c0723ed336117e3399940d4fe9e3682eec18cdf19cf074dab27d2ce8b1c14d30f1e3e26b5883732f8b970477a32ca4c12fe36a8fa3bc452586511b
- SSDEEP 24576:40bAk9PkFMVNgsbj6d2dXrpcpZBWGyDs1lwBUeF:PEGNgsnHDIZB/yDseB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5264
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\xuxiy\tuzuc16\punaha\s.pdb
kernel32
FillConsoleOutputCharacterA
GetPrivateProfileSectionNamesW
EnumResourceNamesW
SetVolumeLabelA
GetFileSize
lstrlenA
TlsGetValue
CommConfigDialogA
SetEndOfFile
FindResourceExW
FreeLibrary
LoadResource
ScrollConsoleScreenBufferW
GlobalSize
GetProfileStringW
WaitForSingleObject
WriteConsoleInputA
SignalObjectAndWait
SetVolumeMountPointW
OpenSemaphoreA
CallNamedPipeW
GetTickCount
GetCurrentThread
GetConsoleAliasesLengthA
GetPrivateProfileStringW
EnumTimeFormatsA
GetUserDefaultLangID
SetProcessPriorityBoost
GetDriveTypeA
GetVolumeInformationA
LoadLibraryW
GetConsoleMode
SetVolumeMountPointA
GetVersionExW
SetConsoleCursorPosition
GetFileAttributesW
SetTimeZoneInformation
VerifyVersionInfoA
SetSystemPowerState
WritePrivateProfileSectionW
TerminateProcess
IsDBCSLeadByte
ReadFile
CompareStringW
SetThreadPriority
DeactivateActCtx
CreateJobObjectA
ReleaseActCtx
OpenMutexW
FindFirstFileExA
GetLastError
SetLastError
GetProcAddress
VirtualAlloc
SetStdHandle
SetComputerNameA
WriteConsoleA
OpenWaitableTimerW
LocalAlloc
DeleteTimerQueue
MoveFileA
WriteProfileSectionW
AddAtomA
FindAtomA
GetPrivateProfileStructA
WaitForMultipleObjects
WTSGetActiveConsoleSessionId
GetThreadPriority
DebugSetProcessKillOnExit
GetModuleHandleA
RequestWakeupLatency
WaitForDebugEvent
DuplicateHandle
SetProcessShutdownParameters
ReleaseMutex
AddConsoleAliasA
DebugBreak
FindActCtxSectionStringW
ReadConsoleOutputCharacterW
GetProfileSectionW
CloseHandle
CreateFileW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
IsProcessorFeaturePresent
HeapValidate
IsBadReadPtr
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
HeapCreate
GetModuleFileNameW
WriteFile
RaiseException
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
RtlUnwind
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer
GetConsoleCP
FlushFileBuffers
user32
GetMessageTime
GetCursorInfo
_CallPattern@8
_go@4
_hiduk@8
Name
.text
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
601KB
Virtual Size
620KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fifafi
Size
1024B
Virtual Size
741B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=46, id=171, productName=VS2010 build 30319, version=30319,
count=31, id=158, productName=VS2010 build 30319, version=30319,
count=124, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=150, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe
- IMPHASH ce9705bb401fc9d98960cc1eae900199
- SHA256 4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7
- MD5 0b862b9c889d4bdc6f0bac7d702d8753
- SHA1 fdc030df123e6e6a712cbc960a2e7c63266bf040
- SHA512 4f7284a625b4909f9a0d80023c1dbfe3ed2de8a14fdf9a5bd3687d7e2fb21e265ee6cca613e4e6c8cab35f806501b155e6ed70a11530eb1cc78dbc38b22d3e8b
- SSDEEP 24576:reKt4RjnJ+wWEr55fRue+cfxiskJM0BPA:rORdGA55fkcJinM0BI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
619815
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\donato\losabexeka\wulug-kaxen.pdb
kernel32
InterlockedPopEntrySList
GetConsoleDisplayMode
CreateConsoleScreenBuffer
GetConsoleCP
VerifyVersionInfoA
WaitNamedPipeW
CreateMutexA
WriteConsoleA
SetLastError
CreateFileW
WritePrivateProfileSectionA
GetPrivateProfileSectionW
EnumDateFormatsExA
GetCurrentProcessId
LoadLibraryA
IsDebuggerPresent
SetConsoleCP
FindFirstVolumeW
WriteFile
BuildCommDCBA
VerLanguageNameA
AreFileApisANSI
WriteProcessMemory
SetEvent
GetExitCodeThread
EndUpdateResourceA
GetCPInfo
GetLastError
UpdateResourceA
SetConsoleTitleW
SetFilePointer
LoadLibraryExA
CopyFileW
ReadConsoleA
ActivateActCtx
AddRefActCtx
GetConsoleAliasW
DnsHostnameToComputerNameA
ReadConsoleOutputW
GetProcessHeaps
GetSystemWindowsDirectoryW
GetUserDefaultLCID
BuildCommDCBAndTimeoutsA
HeapAlloc
GetAtomNameA
GlobalSize
HeapSize
GetGeoInfoA
GetCurrentProcess
VirtualProtect
GetProcAddress
GetModuleHandleA
CreateThread
GetVersionExA
SetProcessAffinityMask
WaitForSingleObject
SetSystemPowerState
VerifyVersionInfoW
WriteConsoleOutputCharacterW
SetTimeZoneInformation
GetMailslotInfo
GetCPInfoExA
SetEnvironmentVariableA
GetFileAttributesExA
GetComputerNameW
CommConfigDialogW
GetConsoleAliasA
GetConsoleWindow
GetSystemTimeAsFileTime
GetDiskFreeSpaceA
CreateFileA
CreateActCtxW
HeapLock
GetConsoleAliasesLengthA
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
GetStartupInfoA
HeapFree
TerminateProcess
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
ExitProcess
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetStdHandle
LCMapStringA
LCMapStringW
GetConsoleMode
FlushFileBuffers
CloseHandle
GetConsoleOutputCP
WriteConsoleW
user32
RealChildWindowFromPoint
GetAltTabInfoW
advapi32
AdjustTokenGroups
BackupEventLogA
Name
.text
Size
639KB
Virtual Size
639KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
127KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.exe
- SHA256 55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344
- MD5 ee28a178e3aacfa1398ca74a9bc1822e
- SHA1 193bc249bac79c0a195e736c62de5ec16e5ef38d
- SHA512 3f0dbbbda0cba4a32fe49fd7941d3fa640a8b7aeec56a3f584d519593de68e4acf8036c651cd469e386a32c5465521035dccebb6f3732f7893be552803d48353
- SSDEEP 3072:ktkuGh43+xNkZ4I0+NFS1I74Y61cyJDz/+6BjbkJuWg349uoZaOG/mf3vfUgrfQj:FMZ4P+NEc4zYgV9QFhP0grf0dd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
DllGetClassObject
DllRegisterServer
EbxyskabfbgdEtzjfnaqjt
OjpojdphbheycQxlwjttmtbmur
PluginInit
QoxbghnQludTyxkiaa
ZnadyajccmsazwsCkxavgvhvsrir
Name
.text
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
577B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tdata
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=261, version=25930,
count=1, id=259, version=25930,
count=4, productName=Unmarked objects (old),
count=1, id=256, version=27045,
count=1, id=258, version=27045,
5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb
- MD5 aeccd0447a233ab8f7de5d7df28e9331
- SHA1 c9dbaac42e30413f8cdb6ef09cf90ca75d0137a7
- SHA512 44bcb72760eacb7c69b30b2835043f11fa47e3c950afc795286317645d92925cc1c7884bd611b4f0df2b74750949401e377c6d4fe5741926a0f720ddf99ca40e
- SSDEEP 24576:EejP2Qq5NJf5osyeT2DiqkRD73mOcohh:/jYNp5PTZqkRn3mz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
717026
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
692KB
Virtual Size
692KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
172KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47
- MD5 284b061036a1e367e41c00235d1b5e6f
- SHA1 f6277c4d7a39427e7c86a3f9040729d6b17aff65
- SHA512 21733f5d5953a07021536928842bce4be637235b7c1578fa0096c53a546614ecbc172f0e500fddf2611acd2dba94b13152fb1eff75efb0666342183c0f6627c6
- SSDEEP 6144:x6DKNllJ4Uc/gqXKq8+RigIWU+Ydm0UAtXbe9bu:sDKNlAUcBaq8+RnWm0UA9b
- MD5 SHA1 SHA512 SSDEEP
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
293342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
278KB
Virtual Size
278KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe
- IMPHASH a188f9ca081f5d553d295623012bedb0
- SHA256 654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801
- MD5 096a19cd1460c87f343444a4740327c2
- SHA1 0f55409dbc70927548c2d351185408f7615ee47c
- SHA512 259552c2bd72062aa531ea9dac59b6411b64d735c01197dbf0e2943cc8a9ddc37eb1e0be9f22118a48bead99f57a237f9bb986f8ceafc67ed463f9c00a6587bf
- SSDEEP 192:/G6OThBwj6k8TqLUh5wCb3py+g2O9Cung9C:/G9hNxh5Zp1i9Cun
- MD5 SHA1 SHA512 SSDEEP
-
IcedID Second Stage Loader
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
6812
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shell32
SHGetFolderPathA
advapi32
GetUserNameA
winhttp
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetOption
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpSetStatusCallback
kernel32
WriteFile
CreateFileA
HeapReAlloc
MultiByteToWideChar
ExitProcess
lstrcpyA
Sleep
VirtualAlloc
VirtualProtect
GetModuleFileNameA
CreateDirectoryA
lstrcatA
lstrlenA
GetFileSize
HeapAlloc
HeapFree
GetProcessHeap
ReadFile
CloseHandle
user32
wsprintfA
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
bss
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=257, version=25203,
count=37, id=1, productName=Unmarked objects,
count=7, id=264, version=25830,
count=1, id=258, version=25830,
6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe
- IMPHASH be41bf7b8cc010b614bd36bbca606973
- SHA256 6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5
- MD5 07ab47ba492cb4ce3b9255ecbfb543f7
- SHA1 b86f8aeddddd245f0198ad92ff6cee605cbe1d4e
- SHA512 0f161c751011070eca63baf0d544e35adfb7ae23c7bef6ef21684d93ee81d88fa0a83f5f1cc7be10e5a31c2012711298e599e4264d13f6607c9ce7abc8c5ad3a
- SSDEEP 49152:fb1ZTEb66GZQJAaYqh3owdV+xYtb/Khu0Ar51hRzEHgR8wfXhxld4sl9O3/TvHv0:5ZQ+6uQhYEom+mtkQ1hRwH2X9i/vFO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
14511
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW
user32
GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation
advapi32
RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
900KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=172, id=1, productName=Unmarked objects,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/System.dll
- IMPHASH 039bcbc605477e8e87ec550c2e60e748
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
10024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary
user32
wsprintfW
ole32
CLSIDFromString
StringFromGUID2
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
963B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=1, productName=Unmarked objects,
count=6, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/UAC.dll
- IMPHASH 0ef725341a4aecf8398c0e2132f38049
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10632
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetLastError
GetCurrentProcessId
GetCommandLineW
GetProcAddress
CreateThread
GlobalFree
LoadLibraryA
OpenProcess
GlobalAlloc
CreateFileMappingW
Sleep
MapViewOfFile
GetModuleHandleW
UnmapViewOfFile
CreateEventW
SetCurrentDirectoryW
GetVersionExW
GetExitCodeProcess
lstrcatW
LocalFree
GetPrivateProfileStringW
FormatMessageW
GetPrivateProfileIntW
CreateProcessW
CloseHandle
GetLastError
DuplicateHandle
GetCurrentThreadId
lstrlenW
SetEvent
WaitForSingleObject
lstrcmpiW
GetExitCodeThread
GetModuleFileNameW
user32
SetWindowPos
GetClientRect
GetWindowThreadProcessId
SetWindowLongW
DefWindowProcW
GetDlgItem
CallWindowProcW
CallNextHookEx
GetClassNameW
PeekMessageW
DestroyWindow
SendMessageW
SetForegroundWindow
IsWindowVisible
MsgWaitForMultipleObjects
LoadStringW
EndDialog
EnableWindow
DialogBoxParamW
LoadImageW
MessageBoxW
GetWindowLongW
DispatchMessageW
ShowWindow
wsprintfW
CreateDialogParamW
GetWindowRect
IsDialogMessageW
FindWindowExW
CharNextW
CreateWindowExW
LoadIconW
PostMessageW
SetWindowsHookExW
UnhookWindowsHookEx
TranslateMessage
shell32
ShellExecuteExW
advapi32
OpenServiceW
QueryServiceStatus
CloseServiceHandle
OpenProcessToken
OpenSCManagerW
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
EqualSid
ole32
CoInitialize
_
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=83, id=1, productName=Unmarked objects,
count=3, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$PLUGINSDIR/UserInfo.dll
- IMPHASH 45d25ca52c312b2254c60dbcb30342d1
- SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
- MD5 c7ce0e47c83525983fd2c4c9566b4aad
- SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
- SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4706
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW
GlobalAlloc
advapi32
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
OpenThreadToken
GetAccountType
GetName
GetOriginalAccountType
Name
.text
Size
1024B
Virtual Size
686B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
753B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=1, productName=Unmarked objects,
count=3, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
- SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
- MD5 4ccc4a742d4423f2f0ed744fd9c81f63
- SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
- SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
- SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
7445
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree
user32
LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW
gdi32
SetTextColor
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
comdlg32
GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
590B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=55, id=1, productName=Unmarked objects,
count=6, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PROGRAMFILES/foler/olader/acledit.dll
- IMPHASH 4841609d5e7c77c336247e7bb3fc4cef
- SHA256 727b96dca0363f7cd5767f94bf72e0655ef1d00f44b27d496deb733eb32be12b
- MD5 8d96cb171b4138f43a754317be9e982c
- SHA1 3c2975e7904486f39be0455a63afaa063064a93e
- SHA512 ab58bd28169042d9502f64410e78aa41d219753d998ad5309699c57b50ce343b50aeb42dda8ef6a52f8057dcd1bc2b4b6e0de52819285dd3517ba3fa032e6ee3
- SSDEEP 192:peH8gcV+GQqYTBBBAkvyMQ0F3OWYTWPGP:YH8gcV+GQqyAMD0WYTWPq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
5440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
acledit.pdb
msvcrt
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset
user32
LoadStringW
MessageBoxW
kernel32
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
DllMain
EditAuditInfo
EditOwnerInfo
EditPermissionInfo
FMExtensionProcW
SedDiscretionaryAclEditor
SedSystemAclEditor
SedTakeOwnership
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
674B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=205, version=65501,
count=12, id=206, version=65501,
count=24, id=1, productName=Unmarked objects,
count=7, id=203, version=65501,
count=1, id=202, version=65501,
count=1, id=211, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
$PROGRAMFILES/foler/olader/acppage.dll
- IMPHASH 28cc1fb51b5dca83c86f1fa8d16863a4
- SHA256 949fd56c5a63d3f1c20769bc2285ac5517c4ca84250c807f18247a2d93efc1a4
- MD5 290075961dd4856211078377d14942c8
- SHA1 ad7f6dfd89a253daa70d5bbb46e819dae7eb3f61
- SHA512 b431198324315e172fafb062fce93c5d5b18e691150e5e26dec30f150622c38ce4342b9e9f5d4d847860a55e7fb75411bb8765a0f0ae87c99e0dc30f1bc42854
- SSDEEP 768:ppb1tuabwj1WVIlaFKuIJJPclXkxAc5J9UaXotuM5Uqw2mom:Uj1WelaFczPclwYtuM6qw2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
35552
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
acppage.pdb
msvcrt
_lock
_unlock
sscanf_s
_onexit
_except_handler4_common
??3@YAXPAX@Z
_initterm
_amsg_exit
_XcptFilter
malloc
free
memset
wcscat_s
_wcsupr
_vsnwprintf
wcsstr
_wcsnicmp
_wcsicmp
??2@YAPAXI@Z
_purecall
__dllonexit
memcmp
ntdll
RtlImageRvaToVa
NtCreateSection
RtlNtStatusToDosError
NtQuerySection
RtlAllocateHeap
RtlFreeHeap
NtQueryInformationToken
NtOpenProcessToken
NtClose
NtOpenThreadToken
RtlInitUnicodeString
RtlImageDirectoryEntryToData
kernel32
GetModuleFileNameW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
MapViewOfFile
LoadLibraryExW
GetLocalTime
CreateFileMappingW
SystemTimeToFileTime
GetFileTime
FileTimeToSystemTime
QueryActCtxW
GetVersionExW
UnmapViewOfFile
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
RaiseException
EnterCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
GetLastError
lstrcmpiA
EncodePointer
CreateProcessW
HeapAlloc
HeapFree
GetModuleHandleW
GetProcessHeap
GetSystemDirectoryW
RegQueryValueExW
LoadLibraryW
CheckElevationEnabled
FormatMessageW
CreateFileW
GetProcAddress
DecodePointer
RegOpenKeyExW
BasepGetExeArchType
CloseHandle
RegCloseKey
LocalFree
ExpandEnvironmentStringsW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
user32
GetParent
IsWindowEnabled
GetWindowLongW
SetWindowLongW
SendDlgItemMessageW
ShowWindow
GetSystemMetrics
SetDlgItemTextW
SendMessageW
EnableWindow
LoadStringA
LoadStringW
InsertMenuW
GetDlgItem
shlwapi
ord487
PathFindFileNameW
PathFindExtensionW
ord176
StrCmpIW
shell32
SHParseDisplayName
ord155
SHGetPathFromIDListW
SHGetNameFromIDList
SHChangeNotify
SHGetItemFromDataObject
ole32
CoInitializeEx
CoTaskMemAlloc
CoGetObject
StringFromGUID2
CoGetMalloc
CoTaskMemFree
CoCreateInstance
HWND_UserSize
HWND_UserFree
ObjectStublessClient3
HWND_UserMarshal
HWND_UserUnmarshal
CoUninitialize
rpcrt4
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
NdrDllCanUnloadNow
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer_Release
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrDllGetClassObject
sfc
SfcIsFileProtected
msi
ord173
ord201
apphelp
SdbReleaseDatabase
SdbInitDatabase
ApphelpDebugPrintf
SdbGetMatchingExe
SdbQueryFlagMask
SdbGetAppPatchDir
DllCanUnloadNow
DllGetClassObject
GetExeFromLnk
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
174B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=205, version=65501,
count=15, id=206, version=65501,
count=218, id=1, productName=Unmarked objects,
count=31, id=203, version=65501,
count=3, id=207, version=65501,
count=1, id=202, version=65501,
count=20, id=210, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
$PROGRAMFILES/foler/olader/adprovider.dll
- IMPHASH 33aa7b92a68c0c85a98b0049813f29de
- SHA256 338287ddb5fdbf0f7540dac8ae8a3f02643f7b45f3b401a9dfa6447e39043049
- MD5 f981199c82a40cf638d313c4498ecab9
- SHA1 9f2ba1092a90b048aaf51304d139018e13144f3b
- SHA512 09b33588e58c50036614e0fa26ccd8d94ae810f63d95c8464ae74cb9169f4ddcbcd8c019d656cd313ed65f8bb92b9782cf319866ce2a9ba1c003bd62a1bed171
- SSDEEP 768:Amge8Q4UsMhIrA1pifdlIGHmizKO6EjjKRyGlqesRtgjEDy:AG548IrA1pifdRHmizKiWRPlqPjy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
31280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
adprovider.pdb
msvcrt
??3@YAXPAX@Z
_except_handler4_common
realloc
_vsnwprintf
_errno
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memset
wcschr
_purecall
??2@YAPAXI@Z
_atoi64
_wcsicmp
_wcsnicmp
wcstoul
_ultow
??_U@YAPAXI@Z
memcpy_s
malloc
wcscat_s
free
wcscpy_s
wcsncpy_s
??_V@YAXPAX@Z
memcmp
memcpy
kernel32
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetLastError
GetModuleFileNameW
LocalAlloc
LoadLibraryExW
GetModuleHandleW
FreeLibrary
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetSystemTimeAsFileTime
CompareFileTime
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
OutputDebugStringA
SystemTimeToFileTime
LocalFree
GetProcAddress
GetCurrentThreadId
advapi32
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
CryptReleaseContext
CryptDestroyKey
CryptGetUserKey
CryptAcquireContextW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegOpenCurrentUser
TraceMessage
wldap32
ord10
ord40
ord190
ord13
ord18
ord118
ord12
ord73
ord88
ord14
ord152
ord145
ord79
ord142
ord41
ord301
ord167
ord147
ord224
ord140
ord127
ord16
ord26
ord208
ord97
ntdsapi
DsReplicaGetInfo2W
DsReplicaFreeInfo
DsUnBindW
DsBindW
netapi32
NetApiBufferFree
DsGetDcNameW
crypt32
CertAddSerializedElementToStore
CertGetCertificateContextProperty
CryptHashCertificate
CertFreeCertificateContext
oleaut32
RegisterTypeLi
SysFreeString
VarUI4FromStr
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
ole32
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
user32
CharNextW
UnregisterClassA
secur32
GetUserNameExW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=205, version=65501,
count=14, id=206, version=65501,
count=184, id=1, productName=Unmarked objects,
count=27, id=203, version=65501,
count=4, id=207, version=65501,
count=1, id=202, version=65501,
count=6, id=211, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
nasial.exe
- SHA256 1aa7778da7aa6b68f649b53c8346a853f598f4c1681cd978bec1cf75ce4accae
- MD5 7cbae878c5e7f1ef96d351489e10d756
- SHA1 c6117aaa6084399d37f06ab454b7f53470d88b1e
- SHA512 133bda116b1488878911090e5708370a7c79296711cc6886dfe249b565682038d57663b6ee513e9171d0ec47379d973c498e149a7b47f0f2c2c659b4e8221b89
- SSDEEP 49152:q1Ox2H5JQKV4th1F3151kjli7/Ofyig7pglKIv8Pb438KIoQGUdfB9fGQJGj4NWj:q1Ox2H5JQKV4th1F3151kjli7/Ofyigq
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
4c:2d:23:27:ee:94:10:ce:f3:48:65:f6:2a:89:82:c8:bc:d6:e8:1d:4e:41:f1:2d:b4:80:c2:a2:8f:9b:9c:d9
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,STREET=Business Central Towers\, Tower A\, Office 2301 2303,L=Dubai,ST=Dubai,C=AE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024145
Chains
Oct 8, 2021
SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,STREET=Business Central Towers\, Tower A\, Office 2301 2303,L=Dubai,ST=Dubai,C=AE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024145
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,STREET=Business Central Towers\, Tower A\, Office 2301 2303,L=Dubai,ST=Dubai,C=AE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024145
Serial Number
1f:32:16:f4:28:f8:50:be:2c:66:ca:a0:56:f6:d8:21
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 7, 2019 - Oct 6, 2022
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
167521
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.interst
Size
512B
Virtual Size
381B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.porti
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.geysera
Size
1024B
Virtual Size
621B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.worrit
Size
1024B
Virtual Size
618B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ravelpr
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.armhoop
Size
512B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.possess
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.misappl
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.risque
Size
1024B
Virtual Size
676B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.toolles
Size
1024B
Virtual Size
585B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.uncompa
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.amicici
Size
512B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.logomac
Size
512B
Virtual Size
499B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bani
Size
512B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.calc
Size
1024B
Virtual Size
690B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.subles
Size
512B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.overfai
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.prakrit
Size
512B
Virtual Size
475B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aphaere
Size
512B
Virtual Size
398B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.scutchi
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.yo
Size
512B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.omniana
Size
1024B
Virtual Size
646B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cardiaz
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.banc
Size
512B
Virtual Size
377B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.better
Size
1024B
Virtual Size
659B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.medicab
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.acinaci
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gran
Size
512B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.frigidn
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.perispl
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.dittand
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.workmas
Size
1024B
Virtual Size
611B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wis
Size
1024B
Virtual Size
531B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.anemono
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.triplic
Size
512B
Virtual Size
417B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.autist
Size
1024B
Virtual Size
607B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.thioant
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tribrom
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.viscome
Size
1024B
Virtual Size
561B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cholorr
Size
1024B
Virtual Size
638B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.peshkar
Size
512B
Virtual Size
425B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pochay
Size
512B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.satisfa
Size
1024B
Virtual Size
639B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.unreare
Size
512B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.spagyri
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.liberal
Size
1024B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.logwood
Size
512B
Virtual Size
351B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.hellebo
Size
512B
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.relaxat
Size
326KB
Virtual Size
349KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.chrysob
Size
512B
Virtual Size
140B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.souple
Size
512B
Virtual Size
102B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.dubious
Size
512B
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
146KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
orihonvp.exe
- SHA256 cfb90bf559d9835c25f8d65f3bc06aeeb7eaf0ff7abf55963622285eb715bd84
- MD5 f68d6d9422b5ae428c794f1da144525b
- SHA1 2451acebb1cccc35518351b2437b098682fc0143
- SHA512 46972a258fadf5fe3c98c9cf45f3149db4e8bf06b883988cab9992cee0303994e1fd6ef14d9aa82b2c057a5cc300a0508736482ef9776f804a4242054f0c454d
- SSDEEP 49152:Towd3wUG+5ioe4kFzkmYafm3lCezDip2nOBl2DsZy8evQijSfvzew:TovUmrFzkmMvidBlM2MlDw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4264112
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
55KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
13KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26715,
count=158, id=261, version=26715,
count=18, id=260, version=26715,
count=17, id=260, productName=VS2019 v16.2.3 build 27905, version=27905,
count=21, id=259, productName=VS2019 v16.2.3 build 27905, version=27905,
count=40, id=261, productName=VS2019 v16.2.3 build 27905, version=27905,
count=11, id=257, version=26715,
count=97, id=1, productName=Unmarked objects,
count=5, id=265, version=28106,
count=1, id=255, version=28106,
count=1, id=258, version=28106,
7109e67cf655b41ff88903bf1e70cc4efa3e537a38df7df90d8a3ff95c4cab58.exe
- IMPHASH b1583b0de68b5707a7d41293f45591df
- SHA256 7109e67cf655b41ff88903bf1e70cc4efa3e537a38df7df90d8a3ff95c4cab58
- MD5 6e9fa4e2f22ce3d1a0484820964ca208
- SHA1 6c5434cd4cc9305cdba85999f57df405d5a1dfa1
- SHA512 5d0516f13c317290e94065da227a8fe93ddb79b7eb89a10e1515259dd48dc8736333ffc93fd458dfd96ef29ddf41a81dd1b135bdd313a41da3d43504b9b0c000
- SSDEEP 12288:VE3SNI+zn1K4hsDMsaoUqZQdfcYKKhTXYcGK:NNI+g4ZPWQCxKhTIC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23957
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentDirectoryA
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlUnwind
CreateThread
ExitThread
HeapAlloc
GetStartupInfoA
GetCommandLineA
RaiseException
HeapFree
TerminateProcess
HeapSize
HeapReAlloc
GetACP
GetTimeZoneInformation
GetSystemTime
GetLocalTime
UnhandledExceptionFilter
FatalAppExitA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetPrivateProfileIntA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sleep
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
SetConsoleCtrlHandler
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
SetErrorMode
SetFileAttributesA
GetProfileStringA
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileTime
GetFileSize
GetFileAttributesA
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
WideCharToMultiByte
InterlockedIncrement
SuspendThread
SetThreadPriority
lstrcmpA
GetCurrentThread
InterlockedDecrement
GetModuleFileNameA
GetShortPathNameA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
lstrlenA
MultiByteToWideChar
DeleteFileA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
lstrcpynA
GetLastError
SetLastError
FreeLibrary
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
CreateEventA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpyA
GetModuleHandleA
GetProcAddress
LoadLibraryA
ExitProcess
SetEvent
ResetEvent
WaitForSingleObject
FindResourceA
LoadResource
SizeofResource
LockResource
GlobalAlloc
ResumeThread
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
CloseHandle
FreeEnvironmentStringsA
user32
SetDlgItemTextA
IsDlgButtonChecked
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
IsWindowEnabled
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
CharUpperA
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
PostQuitMessage
ShowOwnedPopups
ValidateRect
GetActiveWindow
TranslateMessage
GetMessageA
CreateDialogIndirectParamA
EndDialog
wvsprintfA
CharToOemA
OemToCharA
LoadStringA
DestroyMenu
GetClassNameA
GetDesktopWindow
GetSysColorBrush
SetCapture
ReleaseCapture
WaitMessage
GetWindowThreadProcessId
WindowFromPoint
InsertMenuA
DeleteMenu
GetMenuStringA
GetDialogBaseUnits
SetRectEmpty
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
SetMenu
ReuseDDElParam
UnpackDDElParam
BringWindowToTop
MapWindowPoints
PeekMessageA
DispatchMessageA
GetFocus
SetActiveWindow
IsWindow
SetFocus
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
IsWindowVisible
ScrollWindow
SetDlgItemInt
SetScrollInfo
UpdateWindow
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
MessageBoxA
IsChild
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
TrackPopupMenu
SetWindowPlacement
GetDlgItem
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
DefWindowProcA
DestroyWindow
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetCursorPos
ScreenToClient
PtInRect
SetCursor
IsIconic
GetSystemMetrics
GetClientRect
SetRect
EnableWindow
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DrawIcon
GetSystemMenu
AppendMenuA
SendMessageA
LoadIconA
LoadCursorA
CopyRect
GetSysColor
FillRect
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
GetScrollInfo
PostMessageA
InvalidateRect
GetDC
DrawFocusRect
DefDlgProcA
ShowScrollBar
SendDlgItemMessageA
ReleaseDC
IsWindowUnicode
CharNextA
InflateRect
GetParent
gdi32
SetBkColor
GetObjectA
CreateBitmap
StartDocA
SaveDC
RestoreDC
GetStockObject
SelectPalette
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetTextColor
GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
CreateRectRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetViewportExtEx
GetWindowExtEx
CreatePen
ExtCreatePen
CreateHatchBrush
CreatePatternBrush
CreateDIBPatternBrushPt
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextExtentPoint32A
GetTextMetricsA
CreateFontIndirectA
GetClipBox
GetDCOrgEx
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
SetMapperFlags
CreateDIBitmap
PatBlt
GetTextExtentPointA
GetDeviceCaps
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyA
RegCloseKey
shell32
DragFinish
SHGetFileInfoA
DragAcceptFiles
ShellExecuteA
DragQueryFileA
comctl32
ord17
ole32
CreateStreamOnHGlobal
olepro32
ord251
Name
.text
Size
228KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
300KB
Virtual Size
312KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, productName=Unmarked objects (old),
count=17, id=19, version=8034,
count=396, id=1, productName=Unmarked objects,
count=78, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=24, id=14, version=7299,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=63, id=11, productName=VS98 (6.0) build 8168, version=8168,
71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.exe
- SHA256 71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e
- MD5 74d8ec87fcc6d4fb65dea95cbf0b7ed0
- SHA1 0907206e93cbf8492e673c59855965bb6bd9d6aa
- SHA512 5fff54384cf81a4fb2b27b25bd574630b85dbf8d1b9a9f94188720e92ee3ba8e9ed0e921922e2bba29748a2d5892330faa3780595c6977ae645170e94fb5438b
- SSDEEP 6144:jI80K7rRaixyrkYTj4tO8eptRnyFWo2NZTLmdJdWqF83kdE0WPQ2:N0K7rRaUuTj/8eC6H8JZZdE3
- MD5 SHA1 SHA512 SSDEEP
Digest
96:43:25:ae:64:17:1b:80:2b:6f:22:e8:bf:76:dd:75:32:0a:e0:b2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OOO Artmarket,O=OOO Artmarket,STREET=d. 32 ofis 7\, ul. Gastello,L=Ekaterinburg,C=RU
Chains
Dec 10, 2020
CN=OOO Artmarket,O=OOO Artmarket,STREET=d. 32 ofis 7\, ul. Gastello,L=Ekaterinburg,C=RU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=OOO Artmarket,O=OOO Artmarket,STREET=d. 32 ofis 7\, ul. Gastello,L=Ekaterinburg,C=RU
Serial Number
2c:1e:e9:b5:83:31:0b:5e:34:a1:ee:69:45:a3:4b:26
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 10, 2020 - Dec 10, 2021
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 1, 2010 - Jan 18, 2038
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
43121
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Covotary
DllUnregisterServer
Plesiotype
Neogamous
DllGetClassObject
Confusedly
Croftland
Curvidentate
Saturniidae
Beadlike
Anthropophagic
Oneiromancy
Jolliness
DllCanUnloadNow
Pegman
Anthropoglot
DllRegisterServer
Saccharogalactorrhea
Name
��������
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sadisti
Size
130KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
213KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
79fb1d00ef9d85e958a17fd331b23dec507e4f2e2c150fd580d0668b84d29d00.exe
- IMPHASH f0070935b15a909b9dc00be7997e6112
- SHA256 79fb1d00ef9d85e958a17fd331b23dec507e4f2e2c150fd580d0668b84d29d00
- MD5 f97d9e4da358b905fb068bcc044573be
- SHA1 00905551c0db6102a02ae65c7e202b94e987cb86
- SHA512 4936ca488024d81f84192b8ab7bec4500eb4ef71d61d3e4862e8b140f9e887120c9d671882ed442cd1d7699fe4c1235ef90172c0d619be720ef24e842fa3cdc8
- SSDEEP 49152:7raLTtbKnm4Rqa1Dy1J9EJIaGNxRHxIZuDufzGo4Mrbf460DHVwggVJm4I6pMT63:Pal+FYa1KyJIaGNPRauDo5PA60tA6/i
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
374768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
LoadLibraryA
LoadLibraryW
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatus
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
255KB
Virtual Size
387KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
914B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
188KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
7ef9667e73b84b6a031e28b6279e04cd8abe82d69cd836043a7cfe0978cb8a98.exe
- IMPHASH 4035d2883e01d64f3e7a9dccb1d63af5
- SHA256 7ef9667e73b84b6a031e28b6279e04cd8abe82d69cd836043a7cfe0978cb8a98
- MD5 bd12b3601bd72416d9520e41963125ea
- SHA1 de0ce050117639effbce198f6e3d5f72c1978352
- SHA512 999dafe0d27d36ddb36591563769a6ae0f7c17c4f1bb25bbe448e6c675639ecd67a3822c206e121bd552a90342e5d2c694a1548e8da840a8f27052e347816336
- SSDEEP 49152:kfn0QZ9e7GSUYBGE1siw4y9fvBfQZTowhO+8L0N:uHe7GH54yQVowh8L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
424800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
Sleep
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
797KB
Virtual Size
797KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
780KB
Virtual Size
779KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
107KB
Virtual Size
399KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/4
Size
512B
Virtual Size
281B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
42B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
233KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/90
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
8264e723a411381a9d837458ec39cbb36c8d582bcba14f7ed7fc45f8154c479d.exe
- IMPHASH 8774ee7d6d9ba528612866f507132661
- SHA256 8264e723a411381a9d837458ec39cbb36c8d582bcba14f7ed7fc45f8154c479d
- MD5 6adff744d8522b6663dd71dcebc7f43e
- SHA1 8ebaedcd7e1b433bc1202ab6aafa5d1c9e7e492d
- SHA512 af43e11e159c0b34a61eed0f2b33c77974967a8c4237b935c19ea3b8286fdebfdf27f0b0f1ea1e64a835b753ed43e888b870c2f3c2352802486f7f4817f8f42c
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WinExec
GetFileSize
GetComputerNameA
GetCurrentDirectoryW
ExitProcess
user32
CascadeChildWindows
CascadeWindows
ChangeClipboardChain
CallNextHookEx
CallWindowProcA
CallWindowProcW
Name
.text
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496.exe
- IMPHASH eb97e4fc5518ac300a92a11673825e0b
- SHA256 8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496
- MD5 20bbb20ab9a373eb5134c977c7ffc05e
- SHA1 cff7c57d1eaf0730fd945501dd332dd8693605bb
- SHA512 fadd51df5524bc97e90e592107fa3a1d6f578e5534f9cf8b70b274651968525ee59b6ac647254c5123497fc889646ec5f228a49bd3e67fd73ecb4e68aabc38ae
- SSDEEP 24576:dAHnh+eWsN3skA4RV1Hom2KXMmHa8/bX5:8h+ZkldoPK8Ya81
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
163850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSACleanup
socket
inet_ntoa
setsockopt
ntohs
recvfrom
ioctlsocket
htons
WSAStartup
__WSAFDIsSet
select
accept
listen
bind
closesocket
WSAGetLastError
recv
sendto
send
inet_addr
gethostbyname
gethostname
connect
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetQueryDataAvailable
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetConnectW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
SetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
DeleteFileW
FindNextFileW
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
LoadLibraryW
VirtualAlloc
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentThread
CloseHandle
GetFullPathNameW
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
FindClose
SetEnvironmentVariableA
user32
AdjustWindowRectEx
CopyImage
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
SetRect
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
MonitorFromRect
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
PeekMessageW
UnregisterHotKey
CheckMenuRadioItem
CharLowerBuffW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
LoadImageW
GetClassNameW
gdi32
StrokePath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
GetDeviceCaps
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
DeleteDC
GetPixel
CreateDCW
GetStockObject
GetTextFaceW
CreateFontW
SetTextColor
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
StrokeAndFillPath
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
RegCreateKeyExW
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
AddAce
SetSecurityDescriptorDacl
GetUserNameW
InitiateSystemShutdownExW
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoSetProxyBlanket
CoCreateInstanceEx
CoInitializeSecurity
oleaut32
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
RegisterTypeLi
CreateStdDispatch
DispCallFunc
VariantChangeType
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
VariantCopy
VariantClear
OleLoadPicture
QueryPathOfRegTypeLi
RegisterTypeLibForUser
UnRegisterTypeLibForUser
UnRegisterTypeLi
CreateDispTypeInfo
SysAllocString
VariantInit
Name
.text
Size
568KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
863c612734f5ff0ff0ea3fed7fd790dfb43c47eecdc1417bcd82c0ad866419af.exe
- IMPHASH bacb1b451bd198b6224176f15e1822f4
- SHA256 863c612734f5ff0ff0ea3fed7fd790dfb43c47eecdc1417bcd82c0ad866419af
- MD5 463127c9a2b5eb1bca799aced10e4954
- SHA1 df78c1cca98d6f260f744a2b0639e1fff1c11a5e
- SHA512 86c01a90941ad53e7d5c77b64c249bb0b4a69d9cc0f3e3971813464312a80ef6b06caef24cec9e9e194a25f0e667eafb445acbe9ce220830e4681312b498d9a4
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WinExec
CloseHandle
FindFirstFileA
FindFirstFileW
FindFirstFileExA
ExitProcess
user32
AllowSetForegroundWindow
Name
.text
Size
1024B
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8.exe
- SHA256 91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8
- MD5 beef5daf51dadc2acdbccc37a73ccfec
- SHA1 1a49019a42f0a195828bf2a5e7b41013709cc8c9
- SHA512 f6021d968f28a2dbf25e58c0bd9b474662de542b9cdf9dc3454bc97ee30e23aa2bd754c455e6fc973f7cf4ead9ca5c9f186e0cb3f9f6dec1e2f9aa3b31f64580
- SSDEEP 98304:qbkDpLr5n9Ov7NCnsAAS7QG0owscxF7ZLN:q2pA7NksAASUqwsOLN
- MD5 SHA1 SHA512 SSDEEP
-
StormKitty payload
PE Signature issue
Digest
27:59:8e:54:40:b9:73:36:e9:d0:8c:77:02:88:f2:67:f1:4a:e0:86
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Sep 26, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
5834632
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
249KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
💳NVID
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
vmp0
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe
- IMPHASH b3536084cb50b2be3b69aa695eba88f0
- SHA256 942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38
- MD5 31b1fe0aacf5fcbced44e89252d1d4b8
- SHA1 3d56a02e23bbf2f6b3ac86db262391ccd2d06e5a
- SHA512 1b49741fab83d12bf0082c9ee070d999ab79860744322d755d7b5a53998ad6827d38306bb7d43763ae487ee64d451de5aec5aaab357422250174c4b8920add60
- SSDEEP 12288:UhR9WptAc/LnqJc0LYBlaql0OxymXkDptSwUlq1Y4I+hHfyc:u9gtAcWfLYbOcep+Uyc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
610919
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\simirezahubigo\bev lofakuzaxumu\mi.pdb
kernel32
InterlockedPopEntrySList
EnumDateFormatsW
GetConsoleAliasesLengthA
GetTapePosition
GetLongPathNameA
GetUserDefaultLangID
AddRefActCtx
GetCPInfoExA
WriteConsoleInputW
ReadConsoleInputW
GetTapeParameters
WaitCommEvent
GetNumaNodeProcessorMask
GetConsoleCP
VerifyVersionInfoA
WaitNamedPipeW
CreateMutexA
WriteConsoleW
GetLastError
CreateFileA
DeleteFileW
WritePrivateProfileSectionA
GetPrivateProfileSectionW
GetLongPathNameW
SetStdHandle
LoadLibraryW
IsDebuggerPresent
FindFirstVolumeW
WriteFile
BuildCommDCBW
FindActCtxSectionStringW
VerLanguageNameW
SetFileShortNameW
WriteProcessMemory
GetFileAttributesW
OpenEventA
SetEvent
IsBadReadPtr
Sleep
WaitForSingleObject
LoadResource
GetProfileIntA
FreeConsole
SetConsoleCtrlHandler
SetConsoleTitleW
GetCurrentConsoleFont
SetConsoleTextAttribute
AttachConsole
GetConsoleAliasesLengthW
ReadConsoleA
ReadConsoleOutputW
GetSystemWindowsDirectoryW
GetStringTypeW
BuildCommDCBAndTimeoutsA
HeapUnlock
HeapLock
GetAtomNameW
HeapReAlloc
HeapCompact
GetGeoInfoW
GetCurrentProcess
GetProcAddress
GetModuleHandleA
CreateThread
GetVersionExW
GetOEMCP
WaitForMultipleObjects
VerifyVersionInfoW
WriteConsoleOutputCharacterA
LocalAlloc
SetMailslotInfo
GetCPInfoExW
SetEnvironmentVariableW
SetCalendarInfoA
CommConfigDialogA
GetConsoleWindow
FindAtomW
SetFileApisToOEM
GetStringTypeA
HeapSize
GetDiskFreeSpaceA
GetModuleHandleW
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
GetStartupInfoA
HeapAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetHandleCount
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
GetCPInfo
GetACP
IsValidCodePage
RtlUnwind
GetLocaleInfoA
GetConsoleMode
FlushFileBuffers
MultiByteToWideChar
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
CloseHandle
@GetSecondVice@0
Name
.text
Size
625KB
Virtual Size
625KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc.exe
- SHA256 95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc
- MD5 d7817bc8fc539fba6388907223773546
- SHA1 505409528cec20ad4744513d83489b7025d23889
- SHA512 3f61fd9b1c534ad5a274d700e5ffcbd4901d1b449a49fb2f0c3b81aa0a997e9b6e2c77fa06470730bad3358f7be896a12dec5b6bab3b3a31e7a1d8907fb5e7eb
- SSDEEP 49152:D3/n2UcyKARqqRp+KrZs12ai17PgRNWPmfQpPmoFjPnMBFdk3Vk9WqWLNlBDszU:Lf2GTrRE4hPMopfMdk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
351072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
716KB
Virtual Size
857KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/4
Size
512B
Virtual Size
255B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/18
Size
238KB
Virtual Size
237KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/30
Size
220KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/43
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/59
Size
130KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/75
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/90
Size
970KB
Virtual Size
970KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.symtab
Size
346KB
Virtual Size
345KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe
- IMPHASH e13582e50ecb7af95558f57b919f6a34
- SHA256 99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e
- MD5 18e0d922bead757af754e54cc744eaa0
- SHA1 22a03fbc28e0dadf13e1ace67109b1dc3e91d0f5
- SHA512 3f9d6ef04fbd56b1b26169c04f754ddca50f802e2dfbaa4344a82f6b724673de36c5b645ce97241eed35d5557ddaf27e20a7c699dfe1f3540010fe207df00f4f
- SSDEEP 24576:gQ8nt67av7QEet8tYFKOYZDcdW1PIe+W15X1d:4nt6+vUEetcC7Y5cdW1PIe+GZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8653
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\nuximekiso\resakuyivebuk\dowuki8.pdb
kernel32
lstrlenA
EnumDateFormatsExW
WriteConsoleOutputW
InterlockedIncrement
GetConsoleAliasA
InterlockedDecrement
WritePrivateProfileSectionA
GetSystemWindowsDirectoryW
GetEnvironmentStringsW
GetUserDefaultLCID
GetComputerNameW
SetEvent
GetConsoleAliasesLengthA
GetConsoleTitleA
CreateActCtxW
InitializeCriticalSection
GetConsoleCP
GetVersionExW
DnsHostnameToComputerNameW
lstrcpynW
SetConsoleCursorPosition
GetFileAttributesW
VerifyVersionInfoA
HeapQueryInformation
IsBadWritePtr
GetCompressedFileSizeA
GetSystemDirectoryA
CreateFileW
GetACP
GetVolumePathNameA
FlushFileBuffers
InterlockedExchange
GetLastError
GetProcAddress
PeekConsoleInputW
CreateTimerQueueTimer
LocalLock
GetConsoleDisplayMode
EnterCriticalSection
SetTimerQueueTimer
GetLocalTime
WriteConsoleA
LocalAlloc
DeleteTimerQueue
CreateTapePartition
BeginUpdateResourceA
GlobalGetAtomNameW
WaitForMultipleObjects
SetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
WriteConsoleOutputAttribute
EndUpdateResourceA
ReadConsoleInputW
FindFirstVolumeW
GetCurrentProcessId
AreFileApisANSI
LCMapStringW
lstrcatA
GetSystemDefaultLangID
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
GetModuleHandleW
Sleep
ExitProcess
GetCommandLineA
GetStartupInfoA
WriteFile
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
GetCPInfo
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
user32
RealGetWindowClassA
advapi32
AdjustTokenGroups
@GetAnotherVice@12
@SetFirstEverVice@4
Name
.text
Size
980KB
Virtual Size
979KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
40.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ