Clumsy0.zip
- SHA256 5170cf7842d1beea31099a684797bc0ee656e2e0d700b840ac6349d15d15b90d
Overview
overview
8Static
static
3Clumsy0.4v...v3.exe
windows7-x64
7Clumsy0.4v...v3.exe
windows10-2004-x64
8܅�� zF.pyc
windows7-x64
܅�� zF.pyc
windows10-2004-x64
Clumsy0.4v....4.txt
windows7-x64
1Clumsy0.4v....4.txt
windows10-2004-x64
1Clumsy0.4v...rt.dll
windows7-x64
1Clumsy0.4v...rt.dll
windows10-2004-x64
1Clumsy0.4v...64.sys
windows7-x64
1Clumsy0.4v...64.sys
windows10-2004-x64
1Clumsy0.4v...ig.txt
windows7-x64
1Clumsy0.4v...ig.txt
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Clumsy0.4v3/Clumsy0.4v3.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Clumsy0.4v3/Clumsy0.4v3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
23 signatures
1800 seconds
Behavioral task
behavioral3
Sample
܅�� zF.pyc
Resource
win7-20240708-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral4
Sample
܅�� zF.pyc
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral5
Sample
Clumsy0.4v3/READ ABOUT UPGRADES FOR 0.4.txt
Resource
win7-20240903-en
windows7-x64
1 signatures
1800 seconds
Behavioral task
behavioral6
Sample
Clumsy0.4v3/READ ABOUT UPGRADES FOR 0.4.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
1800 seconds
Behavioral task
behavioral7
Sample
Clumsy0.4v3/WinDivert.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral8
Sample
Clumsy0.4v3/WinDivert.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral9
Sample
Clumsy0.4v3/WinDivert64.sys
Resource
win7-20240903-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral10
Sample
Clumsy0.4v3/WinDivert64.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral11
Sample
Clumsy0.4v3/config.txt
Resource
win7-20241010-en
windows7-x64
1 signatures
1800 seconds
Behavioral task
behavioral12
Sample
Clumsy0.4v3/config.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
1800 seconds
General
- Target Clumsy0.zip
- Size 6.9MB
- Sample241015-1185eazcla
- SHA256 5170cf7842d1beea31099a684797bc0ee656e2e0d700b840ac6349d15d15b90d
- MD5 7aec3f27d7ec6172ed8ddd5e16b402a9
- SHA1 6d3f60f6353a25e033a3d83ec4a2701b556f369e
- SHA512 1d2b9ea38c71960653da599b5fc0cecd585f1e4fd08bca855c68a41ec0a598dae52d257646e54ef9479a6efc3b37d44bc18b15c7407c7b0d5a1439305f27efed
- SSDEEP 196608:tqFhHeN/FJMIDJf89gsAGK5SEQReuAKe3bUF:gU/Fqyf89gsfNZAKh
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Clumsy0.4v3/WinDivert.dll
File Explorer
-
Clumsy0.zip.zip 6.9MB
-
Clumsy0.4v3/Clumsy0.4v3.exe.exe 6.8MB
-
܅�� zF.pyc857B
-
Clumsy0.4v3/READ ABOUT UPGRADES FOR 0.4.txt6KB
-
Clumsy0.4v3/WinDivert.dll.dll 15KB
-
Clumsy0.4v3/WinDivert64.sys.sys 37KB
-
Clumsy0.4v3/config.txt494B
Clumsy0.4v3/Clumsy0.4v3.exe
- IMPHASH 72c4e339b7af8ab1ed2eb3821c98713a
- SHA256 b3f7f7969e0785bbcd065f3ae393813b3a8b29a4a1f7a16e0c62f9d9d4746d6f
- MD5 9fd3c49b9da98a810d4f0b392f0ab0d9
- SHA1 98a44a3fba9cc28e49dfb9f632bbdc7b28f56a14
- SHA512 2129b5fb23a984eb9a81001c1fc928d893c4c13605f10c156b00101891451f7a4b9f899728412ea9f859ae887701ba7ae8c4979b235c747c2c3e6eb23af1eacd
- SSDEEP 196608:pqFhHeN/FJMIDJf89gsAGK5SEQReuAKe3bUb:cU/Fqyf89gsfNZAKP
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
38:e3:b7:8d:b7:5e:06:81:40:3f:e6:11:2e:7e:d9:7d:93:3a:bc:0e:82:ad:8b:8b:9b:de:41:89:1b:e9:0b:a4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Chains
Apr 25, 2023
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Serial Number
bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 29, 2021 - Sep 28, 2024
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
6
Entry point
52656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
LCMapStringW
CompareStringW
FlsFree
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsSetValue
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=180, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=33731,
count=9, id=259, version=33731,
count=17, id=260, version=33731,
count=40, id=261, version=33731,
count=11, id=257, version=30795,
count=155, id=1, productName=Unmarked objects,
count=25, id=260, version=33813,
count=1, id=258, version=33813,
܅�� zF.pyc
- SHA256 fe6b9210dc1963a8229c2f83b6b4a8612576c95544b6a3325559b2c25db2daea
- MD5 eecc1fcd96fd2815b7757ec6702096dc
- SHA1 cb017ac39a77fb37302d968c5fbc5dd13c57e3b6
- SHA512 3621e4777b0bda2d1c6ff7c072c7c8c2264635fccfe09274b5cfb4af72e5f17e2e611848c1b14307e782151b221498b0f1aeeb3de09556bbd63964415fb60797
- MD5 SHA1 SHA512
Clumsy0.4v3/READ ABOUT UPGRADES FOR 0.4.txt
- SHA256 6220d2d0fc51a57072cc3e4243fbcb0fc901fe0d1fb17ee31cec8fe564d49d55
- MD5 2cfa5b3d8ba0c0d8d4e7be670d8e3fa4
- SHA1 169656d2233c9ca02569e2a26a5051ac5df5740f
- SHA512 f51a2a32b0bfab28fbca0b17eb33ee57af95c90bbc45408297d3b16c78ded2a68b822239142f7b5e53a4555443635cf924d0cfa9008afc5a02983e9a06763e56
- SSDEEP 48:w/MMMMMMMMMMMMjMMMMjMMMMhMMMMjMMMMhMMMMjMMMMMMMMMMMMjMMMMMMhMMML:w3H/8
- MD5 SHA1 SHA512 SSDEEP
Clumsy0.4v3/WinDivert.dll
- IMPHASH 4b5b0fb09f29ed8e5306bbb27b5ae668
- SHA256 9444a6e6b66f13f666f9c60d1935824f61c7256e35a8cf0440e29baa7fbe42c7
- MD5 1b1284100327d972e017f565dbecf80e
- SHA1 5b4f0c122a80478973eb6f9cb3bbcaf186295aea
- SHA512 4ccb9e233a3573f6eded0efa8fa54ed929818394cdf2153623d902c749d37751da6f489354aa50968e53d42d5ce339f6368dedb7858a4ff43a1927b4338954a4
- SSDEEP 384:EHGiP0PYf9pHuGvATXlQRNq/EbUKxcneWuDlE:E9MQf90GvQXlQvAEcehD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW
kernel32
CloseHandle
CreateEventW
CreateFileW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
msvcrt
isalnum
isspace
isxdigit
strcmp
tolower
DivertClose
DivertGetParam
DivertHelperCalcChecksums
DivertHelperParseIPv4Address
DivertHelperParseIPv6Address
DivertHelperParsePacket
DivertOpen
DivertRecv
DivertSend
DivertSetParam
WinDivertClose
WinDivertDllEntry
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
730B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Clumsy0.4v3/WinDivert64.sys
- IMPHASH 5c9956100a10f17fd6cacca768f3c364
- SHA256 208c092fe77f161c5a313b916d73fa7f6d10dd289bab8bb5dfb3d59aacb27f25
- MD5 3bd5ac2e9d96e680f5dbdd183a58c47d
- SHA1 83b08cb5e61c7b37bd710ea01196a26fc8f38610
- SHA512 6cccd7971f423f72f5dbd01a83a2d27bb2bde63c4d1f5e127d77cfa0df85c289a2c3cd95c110ce38b58b9ea9a49aad18ae50f352ac6b21740d0294f771fbcb78
- SSDEEP 768:R5VorUqgJs3/KtdrbYiZdNSRUYjbMUYOUaCdHUZ9fdCrYc:vVorUn9cRUuILLd07fdCU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
97:da:76:ff:9a:56:81:d7:d7:9f:b8:81:15:69:91:15:f6:21:9c:00
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nemea Mjukvaruutveckling AB,O=Nemea Mjukvaruutveckling AB,L=Stockholm,ST=Vastra Gotaland,C=SE
Chains
Nov 20, 2014
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Nemea Mjukvaruutveckling AB,O=Nemea Mjukvaruutveckling AB,L=Stockholm,ST=Vastra Gotaland,C=SE
Serial Number
0a:42:f1:e3:68:68:b7:25:06:ea:50:77:bf:7b:bc:5b
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2014 - Sep 9, 2015
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Minor OS version
1
Major OS version
6
Entry point
20212
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\windivert\install\WDDK\amd64\WinDivert64.pdb
ntoskrnl.exe
RtlCopyUnicodeString
KeBugCheckEx
IoAllocateMdl
MmMapLockedPagesSpecifyCache
IoFreeMdl
MmBuildMdlForNonPagedPool
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExFreePoolWithTag
ExUuidCreate
ExAllocatePoolWithTag
ndis.sys
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisAllocateNetBufferListPool
NdisGetDataBuffer
NdisFreeNetBufferListPool
fwpkclnt.sys
FwpmCalloutDeleteByKey0
FwpsInjectNetworkReceiveAsync0
FwpmSubLayerAdd0
FwpsCalloutUnregisterByKey0
FwpsFreeCloneNetBufferList0
FwpsQueryPacketInjectionState0
FwpsFreeNetBufferList0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmFilterAdd0
FwpmEngineOpen0
FwpmTransactionAbort0
FwpsCalloutRegister0
FwpsInjectForwardAsync0
FwpmFilterDeleteByKey0
FwpmCalloutAdd0
FwpsInjectNetworkSendAsync0
FwpmTransactionCommit0
FwpsInjectionHandleCreate0
FwpsAllocateNetBufferAndNetBufferList0
FwpsInjectionHandleDestroy0
FwpmSubLayerDeleteByKey0
wdfldr.sys
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
540B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
246B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=136, version=30729,
count=42, id=1, productName=Unmarked objects,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Clumsy0.4v3/config.txt
- SHA256 68d9f0a48c33b279478c168578e1d5ff9ff5331be68d686a23c22f36de2a4463
- MD5 96e1f04ec8c447bc7fa7076556b816b6
- SHA1 56393dfb14a5bd5ecd33a1b8c7e5b150b068a7ff
- SHA512 12e26a747363cb636066ae3a8e391e7d22d2ae6d35064501bdeee01ae65b96d3cb6187578c6537fb4eef8e556524880a48b1556f73c8ff674e69ad33fe0ce5c5
- MD5 SHA1 SHA512