4fe0fb4e3c634a4933c0f5aa37862ca9_JaffaCakes118
- SHA256 3d58752d9201e3bc58d32c2ab930287f6776e70ff316e59edea4ce2179a0cc0e
Overview
overview
7Static
static
7LPv.dll
windows7-x64
7LPv.dll
windows10-2004-x64
7MSCOMCTL.dll
windows7-x64
3MSCOMCTL.dll
windows10-2004-x64
3MSINET.dll
windows7-x64
3MSINET.dll
windows10-2004-x64
3MSWINSCK.dll
windows7-x64
3MSWINSCK.dll
windows10-2004-x64
3MonsterBattle.dll
windows7-x64
7MonsterBattle.dll
windows10-2004-x64
7NPSCAN.dll
windows7-x64
3NPSCAN.dll
windows10-2004-x64
3monsterpk.dll
windows7-x64
3monsterpk.dll
windows10-2004-x64
3npgmup.dll
windows7-x64
3npgmup.dll
windows10-2004-x64
3npkcrypt.dll
windows7-x64
3npkcrypt.dll
windows10-2004-x64
3npkcrypt.sys
windows7-x64
1npkcrypt.sys
windows10-2004-x64
1npkcusb.sys
windows7-x64
1npkcusb.sys
windows10-2004-x64
1npkpdb.dll
windows7-x64
3npkpdb.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
LPv.dll
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
LPv.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
MSCOMCTL.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
MSCOMCTL.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
MSINET.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
MSINET.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
MSWINSCK.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
MSWINSCK.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
MonsterBattle.dll
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
MonsterBattle.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
NPSCAN.dll
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
NPSCAN.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
monsterpk.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
monsterpk.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
npgmup.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
npgmup.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
npkcrypt.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
npkcrypt.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
npkcrypt.sys
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
npkcrypt.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
npkcusb.sys
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
npkcusb.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
npkpdb.dll
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
npkpdb.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 4fe0fb4e3c634a4933c0f5aa37862ca9_JaffaCakes118
- Size 3.6MB
- Sample241017-avafsasbkf
- SHA256 3d58752d9201e3bc58d32c2ab930287f6776e70ff316e59edea4ce2179a0cc0e
- MD5 4fe0fb4e3c634a4933c0f5aa37862ca9
- SHA1 251f0b3447b22bcb3838c351ac36d023493bfd7d
- SHA512 61c41343bf14c7b4e58b3203ac890c68c8bd22411741217d9efe834dc072de342a367a132472bdadf1fd2179184404748e6f62ac7a0ac8d04ebb34c955254c13
- SSDEEP 98304:Gs6PG+xOYTmsN6ia9ZujWr4A4cA6gM5x6r:oM8RML99oM36r
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/npgmup.dll acprotect -
resource yara_rule static1/unpack001/monsterpk.dll aspack_v212_v242 -
resource yara_rule static1/unpack001/MonsterBattle.dll themida - Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/LPv.dll unpack001/MonsterBattle.dll unpack001/NPSCAN.DLL unpack001/monsterpk.dll unpack001/npgmup.dll unpack001/npkcrypt.dll unpack001/npkcrypt.sys unpack001/npkcusb.sys unpack001/npkpdb.dll
File Explorer
-
4fe0fb4e3c634a4933c0f5aa37862ca9_JaffaCakes118.rar 3.6MB
-
LPv.dll.dll 1.0MB
-
MSCOMCTL.OCX.dll 1.0MB
-
MSINET.OCX.dll 129KB
-
MSWINSCK.OCX.dll 105KB
-
MonsterBattle.dll.dll 831KB
-
NPSCAN.DLL.dll 261KB
-
PristonTale.ini380B
-
PristonTaleEng.ini385B
-
PristonTaleTest.ini419B
-
monsterpk.dll.dll 251KB
-
npgmup.dll.dll 63KB
-
npkcrypt.dll.dll 236KB
-
npkcrypt.sys.sys 24KB
-
npkcrypt.vxd18KB
-
npkcusb.sys.sys 36KB
-
npkpdb.dll.dll 52KB
LPv.dll
- IMPHASH baa93d47220682c04d92f7797d9224ce
- SHA256 a90ad1ae1e25bbca8115d07dace09ff66cec4e3779b300f7c453b38b519080e8
- MD5 82f4f15b5f2710f0ae0308180ecc42c7
- SHA1 420e14c7868dc79d01ce795d8414f0109c31be86
- SHA512 c98ab45f7eb70dd077d8f6049079cfb15c786a70765ffd27b9dada75260e9066068143e4980bbecc4598892ccb94538dfa826428daeee71b7b01ed869c2e2407
- SSDEEP 24576:JMumJWvkxJNvyIni+5rbcg+NJ9ZVL5KQd:JTavy4JrbcnbVL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2301952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
lstrcpy
comctl32
InitCommonControls
DllMain
Name
Size
171KB
Virtual Size
352KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
1016KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
wfmeeizo
Size
810KB
Virtual Size
812KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
mbpphsgm
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
MSCOMCTL.OCX
- IMPHASH ce21923007044b1701a0b2dc4ac9396b
- SHA256 bc58d624ceea02ab086f1cce809c992bf5a7105e88931853317a2f5aa5afd6e4
- MD5 ecc7d7f0d3446de36045d1d9e964fafe
- SHA1 da6b0ec081d628c33b150327f3bd16d3b7fa4729
- SHA512 443de697be9886cd97235e6468f3a7f6bf11612711e54dba31431b0d9418672e1434e839ed50cacf28107f692f0c9d9d2f57d90e3a843d81015d459c180db632
- SSDEEP 24576:s0LiK1d6dxOehwsj5dC33M/jYVRDSfaF0gg1CVGO7oVtNKG:n6dAehwaY19G1u7+Ln
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c7:c4:89:65:e3:9c:c5:cd:87:45:a0:f0:e3:45:44:66:2e:8c:1e:27
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 14, 2024
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US
Serial Number
0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2008
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 10, 2000 - Nov 12, 2005
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:7d:a7:00:00:00:00:00:48
Issuer
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 25, 2003 - Jan 25, 2005
Minor OS version
0
Major OS version
4
Entry point
27064
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CreateThread
LocalReAlloc
GetProfileIntA
RtlMoveMemory
LocalSize
FreeResource
GetCurrentProcessId
MulDiv
GetTickCount
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GlobalReAlloc
IsBadReadPtr
Sleep
WaitForSingleObject
GlobalHandle
GetThreadLocale
LocalFree
LocalAlloc
GlobalAddAtomA
SetFilePointer
SetStdHandle
FlushFileBuffers
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentProcess
TerminateProcess
ExitProcess
RtlUnwind
GetCommandLineA
CompareStringW
GlobalSize
CreateFileA
GetFileSize
GlobalUnlock
GlobalLock
ReadFile
CloseHandle
IsDBCSLeadByte
GetModuleHandleA
FindResourceA
LoadResource
LockResource
GetLastError
GetFileAttributesA
GetVersion
DisableThreadLibraryCalls
GetProcAddress
GetLocaleInfoA
LoadLibraryA
GetWindowsDirectoryA
lstrcatA
GetModuleFileNameA
IsBadWritePtr
lstrcmpiA
GetLocalTime
GetTimeFormatA
GetDateFormatA
lstrcmpA
GlobalAlloc
GlobalFree
GetVersionExA
GetCurrentThreadId
MultiByteToWideChar
CompareStringA
lstrcpyA
InterlockedExchange
lstrlenA
GetSystemDefaultLCID
lstrcpynA
HeapAlloc
DeleteCriticalSection
FreeLibrary
HeapFree
WideCharToMultiByte
lstrlenW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
InterlockedIncrement
InterlockedDecrement
HeapReAlloc
user32
DrawFocusRect
AdjustWindowRect
DrawFrameControl
TrackPopupMenu
GetMessageA
AdjustWindowRectEx
CopyRect
GetKeyNameTextA
ShowCaret
SetCaretPos
GrayStringA
HideCaret
DestroyCaret
CreateCaret
SetWindowTextA
SetScrollInfo
DrawTextExA
InvertRect
SetRectEmpty
GetShellWindow
SetKeyboardState
GetKeyboardState
GetScrollInfo
GetKeyboardLayout
DestroyCursor
GetUpdateRgn
GetUpdateRect
GetWindowRgn
ValidateRect
CallMsgFilterA
LockWindowUpdate
IsZoomed
GetDesktopWindow
GetIconInfo
GetCursor
GetForegroundWindow
InvalidateRgn
EndDeferWindowPos
EnumChildWindows
GetDoubleClickTime
FindWindowA
GetMessageTime
GetWindowThreadProcessId
RemovePropA
SendNotifyMessageA
SetScrollPos
SetScrollRange
GetWindowTextLengthA
EnableScrollBar
ChildWindowFromPoint
EndDialog
GetWindow
GetPropA
GetCursorPos
WindowFromPoint
GetClassNameA
GetDlgCtrlID
IsWindow
SetPropA
SetTimer
KillTimer
SendDlgItemMessageA
IsWindowVisible
UnregisterClassA
CharNextA
SetActiveWindow
CheckRadioButton
SetFocus
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
CheckDlgButton
GetDlgItem
IsWindowEnabled
GetDCEx
DrawIconEx
CreateIconIndirect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetClipboardFormatNameA
SetCursorPos
RegisterClipboardFormatA
MessageBeep
RegisterWindowMessageA
PeekMessageA
PostMessageW
PeekMessageW
VkKeyScanA
SetParent
CharUpperA
GetDlgItemInt
SetCursor
CreateDialogIndirectParamA
GetNextDlgTabItem
IsDialogMessageA
ScrollWindowEx
GetDlgItemTextA
SetWindowRgn
IntersectRect
EqualRect
MoveWindow
BeginPaint
EndPaint
DeferWindowPos
BeginDeferWindowPos
CharNextExA
DrawIcon
DestroyIcon
MapWindowPoints
CreatePopupMenu
AppendMenuA
TrackPopupMenuEx
DestroyMenu
GetActiveWindow
MessageBoxA
WinHelpA
PtInRect
DefWindowProcA
GetWindowDC
SetRect
LoadCursorA
IsRectEmpty
ClientToScreen
GetWindowRect
MapVirtualKeyA
DestroyWindow
CreateWindowExA
GetSysColorBrush
GetAsyncKeyState
EnableWindow
PostMessageA
TranslateMessage
DispatchMessageA
wsprintfA
DialogBoxParamA
UpdateWindow
GetWindowLongA
SetWindowLongA
GetDC
ReleaseDC
GetParent
OffsetRect
UnionRect
GetFocus
IsChild
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetMessagePos
ScreenToClient
SetWindowPos
SetCapture
GetWindowTextA
WindowFromDC
GetClientRect
CallWindowProcA
DrawEdge
GetSysColor
FrameRect
InflateRect
FillRect
DrawTextA
GetKeyState
GetCapture
ReleaseCapture
GetClassInfoA
RegisterClassA
InvalidateRect
LoadIconA
GetSystemMetrics
CopyImage
SendMessageA
LoadStringA
RedrawWindow
ShowWindow
CreateAcceleratorTableA
ole32
ReleaseStgMedium
DoDragDrop
RegisterDragDrop
RevokeDragDrop
CreateStreamOnHGlobal
OleLoadFromStream
OleSaveToStream
CreateOleAdviseHolder
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
advapi32
RegDeleteKeyA
RegOpenKeyA
RegQueryValueA
RegQueryValueExA
RegEnumKeyExA
RegCreateKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
oleaut32
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
GetErrorInfo
OleCreateFontIndirect
OleCreatePropertyFrame
LoadTypeLibEx
UnRegisterTypeLi
RegisterTypeLi
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
LoadTypeLi
VariantChangeTypeEx
SysStringByteLen
SysAllocStringByteLen
OleLoadPicture
SysAllocStringLen
VariantCopy
OleTranslateColor
VariantChangeType
OleCreatePictureIndirect
VariantCopyInd
SysStringLen
SysFreeString
VariantInit
VariantClear
SysAllocString
SafeArrayCopy
comdlg32
GetOpenFileNameA
gdi32
Arc
GetTextExtentPointA
GetCharWidthA
OffsetWindowOrgEx
ExtTextOutW
GetTextExtentPointW
Polyline
GetTextAlign
SetTextAlign
OffsetRgn
GetTextColor
CombineRgn
GetTextMetricsA
MoveToEx
LineTo
Ellipse
DeleteObject
SelectObject
CreateSolidBrush
SetViewportOrgEx
SetWindowOrgEx
SetViewportExtEx
SetWindowExtEx
SetMapMode
GetDeviceCaps
CreateFontIndirectA
GetObjectA
SelectClipRgn
ExcludeClipRect
RectVisible
GetClipBox
IntersectClipRect
GetClipRgn
CreateRectRgnIndirect
RealizePalette
SelectPalette
PatBlt
CreateCompatibleBitmap
CreateBitmap
CreateCompatibleDC
GetTextExtentPoint32A
TextOutA
SetBkColor
SetTextColor
SetBkMode
Rectangle
CreatePen
GetStockObject
GetViewportExtEx
GetWindowExtEx
LPtoDP
DeleteDC
CreateDCA
CreateRectRgn
StretchBlt
CreateICA
CopyMetaFileA
CopyEnhMetaFileA
GetPaletteEntries
GetDIBits
CreateDIBitmap
GetBitmapBits
CreatePalette
GetNearestColor
CreatePatternBrush
CreateDIBSection
CreateHalftonePalette
BitBlt
SetDIBColorTable
GetDIBColorTable
GetPixel
StretchDIBits
SetBrushOrgEx
GetBkColor
ExtTextOutA
RestoreDC
SaveDC
CreateFontA
DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
692KB
Virtual Size
690KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
40KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
MSINET.OCX
- IMPHASH d940cf5b3d0dfb340396c0608ef1a0c5
- SHA256 e55627932120be87c7950383a75a5712b0ff2c00b8d18169195ad35bc2502fc2
- MD5 90a39346e9b67f132ef133725c487ff6
- SHA1 9cd22933f628465c863bed7895d99395acaa5d2a
- SHA512 0337817b9194a10b946d7381a84a2aeefd21445986afef1b9ae5a52921e598cdb0d1a576bdf8391f1ebf8be74950883a6f50ad1f61ff08678782c6b05a18adbf
- SSDEEP 3072:R5JTZQu4epojdkYv55RCezn/T81B+ySRdL:RLTbP85RCezbwm
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
8a:cb:1c:af:c1:a1:9a:a8:ba:91:ac:e1:6b:ab:e7:b6:18:25:e9:91
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 14, 2024
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US
Serial Number
0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2008
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 10, 2000 - Nov 12, 2005
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:7d:a7:00:00:00:00:00:48
Issuer
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 25, 2003 - Jan 25, 2005
Minor OS version
0
Major OS version
4
Entry point
4860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
wininet
FtpSetCurrentDirectoryA
FtpCreateDirectoryA
InternetCrackUrlA
InternetSetOptionA
InternetCreateUrlA
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetFindNextFileA
FtpDeleteFileA
FtpGetFileA
FtpPutFileA
FtpRenameFileA
InternetReadFile
InternetConnectA
FtpGetCurrentDirectoryA
FtpRemoveDirectoryA
FtpFindFirstFileA
HttpQueryInfoA
HttpOpenRequestA
HttpSendRequestA
InternetOpenUrlA
kernel32
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
HeapFree
WideCharToMultiByte
lstrlenW
HeapAlloc
InitializeCriticalSection
EnterCriticalSection
GetProcessHeap
CloseHandle
LocalFree
FormatMessageA
SetEvent
CreateEventA
GetLastError
MultiByteToWideChar
lstrcatA
lstrcpyA
lstrlenA
ResetEvent
SetLastError
lstrcpynA
WaitForSingleObject
WaitForMultipleObjects
GetTickCount
IsBadWritePtr
DisableThreadLibraryCalls
GetVersion
GetProcAddress
GetFileAttributesA
GetModuleFileNameA
GetWindowsDirectoryA
LoadLibraryA
GetLocaleInfoA
InterlockedIncrement
InterlockedDecrement
HeapReAlloc
lstrcmpiA
LockResource
LoadResource
FindResourceA
lstrcmpA
user32
SetDlgItemInt
SendDlgItemMessageA
GetMessageA
PostQuitMessage
GetDlgItemInt
GetDlgItemTextA
SendMessageA
ReleaseDC
GetDC
CharNextA
SetDlgItemTextA
SetWindowPos
SetWindowLongA
SetParent
EndPaint
GetClientRect
BeginPaint
GetWindowLongA
SetFocus
GetDlgItem
MoveWindow
GetWindow
GetActiveWindow
IsWindowVisible
TranslateMessage
GetParent
OffsetRect
EqualRect
DispatchMessageA
GetWindowThreadProcessId
ShowWindow
PtInRect
WinHelpA
IsDialogMessageA
GetNextDlgTabItem
IsWindowEnabled
IsChild
GetKeyState
CreateDialogIndirectParamA
MessageBoxA
MessageBeep
SetTimer
PeekMessageA
MsgWaitForMultipleObjects
PostMessageA
ClientToScreen
GetWindowRect
CreateWindowExA
EndDialog
LoadIconA
DrawEdge
DrawIcon
LoadCursorA
RegisterClassA
DestroyIcon
KillTimer
DestroyWindow
GetSystemMetrics
LoadStringA
wsprintfA
DialogBoxParamA
IntersectRect
SetWindowRgn
DefWindowProcA
PostThreadMessageA
UnregisterClassA
ole32
CoUninitialize
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CoCreateInstance
CreateOleAdviseHolder
advapi32
RegEnumKeyExA
RegQueryValueExA
RegQueryValueA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
oleaut32
OleCreatePropertyFrame
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
LoadTypeLibEx
SafeArrayCreate
SetErrorInfo
CreateErrorInfo
GetErrorInfo
LoadRegTypeLi
SysStringLen
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
VariantChangeTypeEx
SysAllocString
gdi32
GetWindowExtEx
SetViewportOrgEx
LPtoDP
DeleteDC
SetWindowExtEx
SetMapMode
SetViewportExtEx
GetViewportExtEx
SetWindowOrgEx
CreateDCA
GetDeviceCaps
CreateRectRgnIndirect
DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
68KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
MSWINSCK.OCX
- IMPHASH cb0275eec9ac31b6d4d44320e576fadb
- SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
- MD5 9484c04258830aa3c2f2a70eb041414c
- SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
- SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
- SSDEEP 3072:R7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrb:RNkVsuaRaU6mHGb
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Minor OS version
0
Major OS version
4
Entry point
4932
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
wsock32
accept
listen
inet_ntoa
recv
WSAGetLastError
WSASetLastError
select
__WSAFDIsSet
shutdown
ntohs
sendto
recvfrom
connect
getsockopt
setsockopt
getsockname
getpeername
closesocket
WSACancelAsyncRequest
gethostbyaddr
bind
WSAAsyncSelect
socket
WSAStartup
WSACleanup
inet_addr
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
gethostbyname
htons
gethostname
ioctlsocket
send
kernel32
lstrlenW
GetFileAttributesA
GetModuleFileNameA
InitializeCriticalSection
HeapFree
HeapAlloc
GetProcessHeap
lstrcpynA
lstrcpyA
lstrlenA
lstrcatA
IsBadWritePtr
WideCharToMultiByte
GetVersion
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
LocalFree
FormatMessageA
GetTickCount
MultiByteToWideChar
SetLastError
GetProcAddress
GetLocaleInfoA
DeleteCriticalSection
FreeLibrary
DisableThreadLibraryCalls
lstrcmpA
InterlockedDecrement
GetWindowsDirectoryA
LoadLibraryA
HeapReAlloc
InterlockedIncrement
lstrcmpiA
GetLastError
LockResource
LoadResource
FindResourceA
user32
EndDialog
DialogBoxParamA
GetActiveWindow
MessageBoxA
DrawEdge
GetDC
CharNextA
LoadCursorA
wsprintfA
GetWindowRect
SetWindowPos
ShowWindow
IsDialogMessageA
GetWindow
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
IsChild
GetKeyState
SetParent
WinHelpA
IsWindowVisible
EndPaint
GetClientRect
BeginPaint
SendDlgItemMessageA
LoadStringA
ClientToScreen
OffsetRect
EqualRect
IntersectRect
SetWindowRgn
PtInRect
MessageBeep
LoadBitmapA
GetSystemMetrics
GetParent
CreateDialogIndirectParamA
GetDlgItemTextA
SetDlgItemInt
SendMessageA
DefWindowProcA
GetWindowLongA
DestroyWindow
KillTimer
SetTimer
UnregisterClassA
RegisterClassA
PeekMessageA
PostMessageA
SetDlgItemTextA
SetFocus
GetDlgItemInt
MoveWindow
SetWindowLongA
CreateWindowExA
ReleaseDC
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CreateOleAdviseHolder
advapi32
RegDeleteValueA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
oleaut32
SysAllocString
VariantChangeType
SysAllocStringLen
SysStringLen
SafeArrayRedim
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
LoadTypeLibEx
OleCreatePropertyFrame
LoadRegTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SetErrorInfo
CreateErrorInfo
GetErrorInfo
SysFreeString
SysAllocStringByteLen
SafeArrayCreate
VariantClear
SafeArrayGetUBound
SafeArrayGetLBound
SysStringByteLen
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayGetDim
VariantInit
gdi32
GetDeviceCaps
CreateCompatibleDC
CreateRectRgnIndirect
GetWindowExtEx
GetViewportExtEx
DeleteDC
DeleteObject
GetObjectA
LPtoDP
SetMapMode
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetWindowOrgEx
CreateDCA
BitBlt
SelectObject
DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
MonsterBattle.dll
- SHA256 8905e18d5ceb13bef8972660a360431e5dc424961377e7cff14dbf80af386853
- MD5 5133d98fe9b7bccedce99a8bbe8cfed8
- SHA1 ad7e8efe4b22f5b833269e35be846bf1a2c30917
- SHA512 289f6f49ebc674fbde08a21d444d28a36de1105600629f344457c67767784fa9c397978e349ff95ca0298406afb5821a4e8fcd771ed784e4ac579b18becc2295
- SSDEEP 24576:8sRrjrNEZJn26sL6UAiTwbxtfnjTWtjjrATdH/KjmWtFecL9h:8K9EPnqLNFTwTbTW+dfsmmFzLz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
393236
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
deats
gravar1
gravar2
sac
sac1
ver1
Name
Size
157KB
Virtual Size
324KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Themida
Size
648KB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
NPSCAN.DLL
- IMPHASH 6746f7f0de67e370d1eedd8451c53e6c
- SHA256 4bd79bbfea7c4b97ca4fceac814fe39003d22ed6a2bacf81f72a1107ae79cdc8
- MD5 ac1d82ada728a79886b5b5ad5122554f
- SHA1 2fedc1e798ef18daad3f472617c8200434680c73
- SHA512 0912f97ce7042c848719b74bd1db9c38c29a8f0bb6cb3dc88fce02d11fceab6b0fb88e98e7341717e2d5fff1fab1ef90b5d9e9aaacf7b0f21b796de157808ac6
- SSDEEP 6144:IHXRRnrSFwWRvHYYh1suFLO/+exURTNVQIENySVHR/Yn3F:IHXRRneFnpHJ17BWyVQgSVHR/Y3F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
737280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA
user32
wsprintfA
advapi32
RegDeleteValueA
dlCloseProbe
dlGetFileFormat
dlGetViRobotVersion
dlGetVirusName
dlGetVirusReport
dlProbeInto
dlRecoverFile
dlTurnOffViRobot
dlTurnOnViRobot
dlVRCloseEngine
dlVROpenEngine
Name
pec1
Size
251KB
Virtual Size
684KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
pec2
Size
5KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pec
Size
1KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=21, id=14, version=7299,
count=7, id=19, version=8034,
count=111, id=1, productName=Unmarked objects,
count=77, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=11, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
PristonTale.ini
- SHA256 459d6d8124e1009c78f8e3b0debb2e545d47fd7476bd94da8c606c6e278fd6a7
- MD5 62fd36b727cbe81945a0a985ea3849f7
- SHA1 218ffbbe7c6991cb9e08b30cc8e9f3b289bfc392
- SHA512 d99c506a48d256178d3adfc38db7b23a1494737958661732413cafe2e67234e9f9681c5119979b019de6826a38069cca86106c5febf9d94a7a850f000b2040ba
- MD5 SHA1 SHA512
PristonTaleEng.ini
- SHA256 fb52196aad6105801cd729c9e6e813945e55c6638c3276b7d2bf1db051c0379b
- MD5 bc2150906bf2c51c23068c490b50e3a2
- SHA1 fcce35829e1e880962a1b0bc882a1a7fd015189f
- SHA512 4b794be9554d184f621126f47903676cae4b1f068b8d42f97323071a89e38b098b3bf62bc9fb812e9a85fba489e6128f3eb3c54b9429f84332666de5b014d540
- MD5 SHA1 SHA512
PristonTaleTest.ini
- SHA256 9ad81853b38eec776a36256693136047dfe676e25ddba283a768f37d615517fe
- MD5 f17236cb90172870a53ffa13e83a36ba
- SHA1 3947b4a631148d8ba428e405ec3a4eb4167ffd6e
- SHA512 35d7b69d9ce5c46eb1e45b47187326be234618239c7a4904bf803e9783c6059f4de13d7153a0477f30920cf020b23d72913e5b0c53a7d5a3337b1bb7ec385a7d
- MD5 SHA1 SHA512
monsterpk.dll
- SHA256 6ffdab7f2d49d1e24e7f3b12c82869c8ec17ba412bf94534029ea0adc0c9cf16
- MD5 59206d3baf1d2bd175867f7bbf47fea7
- SHA1 e823064b0586e44f550e066926e19a20c69b388a
- SHA512 1ffc5f75df7b939ecbab489f7f252a955d753d8f7bec7096a8597a10f23e2eca0834ce6e45b33835ff858533b4dafe62b6396ecd502b11490237d4c287fc3d6a
- SSDEEP 6144:YHJIlEajXCYu83c8qLCVKJEv8xvJFF1Vp+0CBwc:milEav3czMFWp+04w
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
634881
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
o2
Name
CODE
Size
200KB
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
22KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
npgmup.dll
- SHA256 777312f8e78517693bbfd9915c1e787212dd2ccbfc0daf41f20015c89852fdea
- MD5 0e5ca0586b4798ac8e8a10b3f3f25569
- SHA1 110e120b403de69c8294d10e234de8786e3008f7
- SHA512 5ee56134616d16c0aeaa25dd94e7fdfed68b3b606f30f54693a26062f570aacdb35658c5846f952b0b4defe39a41eacd7b9019f818bde75b009a3b5c0d6b0293
- SSDEEP 1536:B7qgsrpT5F5gvOQ5HnAgeyFATpGMQL0lWaQ2hjBqk2PXNq:B7qgsJH+HAgeBcMQLZatjBqZ9q
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
153600
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
text
Size
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
rdata
Size
58KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=25, id=14, version=7299,
count=8, id=11, version=8047,
count=110, id=10, version=8047,
count=13, id=93, version=2179,
count=145, id=1, productName=Unmarked objects,
count=6, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
npkcrypt.dll
- IMPHASH e44ffd0e9c1c19ae13fdcb3a9f30fb6a
- SHA256 fd5a97ae28ee2f111551023a1dbbd6ed5824f4dec4faf531d47b756ea0e2e0d5
- MD5 e3fa2cd23814b44ea8f1aa76ba95b557
- SHA1 bff20ce7f972746fcf16c8f7d2a733eaf1e4da82
- SHA512 8aa66c6877c1d3413346ba07f0de83462d3a4a84829a4a38525c156e4a34c74978252ab4ce981f319df88c76ef8cf37be3e295cf01326f1e954e2f78c0cafe3c
- SSDEEP 3072:aXOrVEJFGWkUo5r2pryB0f3ejXwJPtte9iLmhj0wASFgn6bgLo2npUbWO9Elf:aerf0o52YBWeDwYkaAR6b0Ucf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
60436
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
RegOpenKeyExA
OpenSCManagerA
CloseServiceHandle
DeleteService
SetServiceObjectSecurity
SetEntriesInAclA
BuildExplicitAccessWithNameA
GetSecurityDescriptorDacl
QueryServiceObjectSecurity
OpenServiceA
RegQueryInfoKeyA
RegOpenKeyA
CreateServiceA
StartServiceA
ControlService
RegCreateKeyA
RegDeleteKeyA
RegCreateKeyExA
IsTextUnicode
GetUserNameA
kernel32
GlobalFlags
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentDirectoryA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
LockResource
LoadResource
FindResourceA
GetProcessVersion
DuplicateHandle
GetCurrentProcess
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
MoveFileA
DeleteFileA
GetVolumeInformationA
GetFullPathNameA
GetStringTypeExA
GetThreadLocale
GetCPInfo
TlsSetValue
GetFileAttributesA
GetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlUnwind
HeapReAlloc
CreateThread
ExitThread
GetTimeZoneInformation
MulDiv
GetLocalTime
GetCommandLineA
RaiseException
ExitProcess
TerminateProcess
HeapSize
GetACP
FatalAppExitA
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
IsBadReadPtr
IsBadCodePtr
SetConsoleCtrlHandler
SetStdHandle
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
ExpandEnvironmentStringsA
lstrcpynA
lstrcpyA
SetErrorMode
TlsGetValue
GetSystemTime
LocalReAlloc
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
SetThreadPriority
SetEvent
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpiA
GetCurrentThread
lstrcmpA
lstrlenA
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
OpenProcess
FreeLibrary
MultiByteToWideChar
lstrcatA
FindFirstFileA
FindClose
lstrlenW
WideCharToMultiByte
GetModuleFileNameA
GetVersionExA
CopyFileA
CreateEventA
GetOverlappedResult
SetLastError
QueueUserAPC
GetModuleHandleA
GetProcAddress
WaitForSingleObject
ResumeThread
SuspendThread
TerminateThread
DeviceIoControl
SleepEx
WaitForMultipleObjects
GetCurrentThreadId
InterlockedExchange
FormatMessageA
LocalLock
GetProcessHeap
HeapAlloc
LocalFree
HeapFree
Sleep
CreateFileA
GetFileSize
GetSystemDirectoryA
DisableThreadLibraryCalls
GetLastError
GetShortPathNameA
GetCurrentProcessId
UnmapViewOfFile
CloseHandle
GetVersion
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
GetOEMCP
user32
DrawTextA
GrayStringA
CheckDlgButton
CheckRadioButton
GetDlgItem
GetDlgItemInt
GetDlgItemTextA
SendDlgItemMessageA
SetDlgItemInt
SetDlgItemTextA
IsDlgButtonChecked
ScrollWindowEx
IsDialogMessageA
GetWindowTextLengthA
MoveWindow
SetWindowPos
ShowWindow
SetFocus
GetWindowPlacement
IsIconic
SystemParametersInfoA
IntersectRect
OffsetRect
RegisterWindowMessageA
SetForegroundWindow
GetMessagePos
GetMessageTime
SetWindowPlacement
TrackPopupMenu
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
IsChild
GetTopWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetScrollInfo
GetScrollInfo
ScrollWindow
EndDeferWindowPos
CopyRect
BeginDeferWindowPos
GetClientRect
DeferWindowPos
EqualRect
AdjustWindowRectEx
SetActiveWindow
GetSysColor
MapWindowPoints
UpdateWindow
LoadIconA
LoadCursorA
GetSysColorBrush
CharUpperA
DestroyMenu
GetDesktopWindow
SetWindowTextA
ClientToScreen
GetWindowDC
TabbedTextOutA
GetWindowRect
PtInRect
LoadStringA
UnregisterClassA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
ShowOwnedPopups
PostQuitMessage
OemToCharA
CharToOemA
GetWindowInfo
GetKeyboardState
ToAscii
GetSystemMetrics
EnumChildWindows
CallWindowProcA
CallWindowProcW
MapVirtualKeyA
GetKeyboardLayout
GetKeyState
GetAsyncKeyState
DefWindowProcA
CreateWindowExA
SetWindowsHookExA
DestroyWindow
UnhookWindowsHookEx
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
GetFocus
SendMessageTimeoutA
keybd_event
PostMessageA
wsprintfA
MessageBoxA
GetPropA
IsWindow
SendMessageA
GetWindowTextA
RemovePropA
GetClassNameA
GetWindowLongA
IsWindowUnicode
GetParent
SetPropA
ReleaseDC
GetDC
ScreenToClient
GetMenuStringA
DeleteMenu
EndPaint
GetDlgCtrlID
BeginPaint
GetClassNameW
GetWindowLongW
InsertMenuA
GetWindow
GetMenuItemCount
SetWindowLongA
GetClassLongW
GetClassInfoExW
GetClassLongA
GetClassInfoExA
SetWindowLongW
CallNextHookEx
gdi32
StartDocA
SaveDC
RestoreDC
SelectObject
GetStockObject
SelectPalette
SetBkColor
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
DeleteDC
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
CreateRectRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreatePatternBrush
CreateDIBPatternBrushPt
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetDCOrgEx
GetObjectA
DeleteObject
SetWindowOrgEx
CreateBitmap
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
shell32
DragAcceptFiles
SHGetFileInfoA
comctl32
ord17
npkpdb
NPKPDBCreateExpPrgDb
NPKPDBIsExpProgram
NPKPDBCloseExpPrgDb
imm32
ImmReleaseContext
ImmGetConversionStatus
ImmGetContext
ImmNotifyIME
ImmGetOpenStatus
setupapi
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyA
SetupDiSetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiSetClassInstallParamsA
NPKCloseDriver
NPKEnumHookedProcess
NPKGetAppCompatFlag
NPKGetCryptKey
NPKGetEngineVersion
NPKGetHookPause
NPKGetLoadStartup
NPKGetSecOpt
NPKGetWindowEditText
NPKGetWindowText
NPKLoadAtStartup
NPKOpenDriver
NPKOpenDriverEx
NPKRegCryptFunc
NPKRegCryptMsg
NPKRegCryptWindowParent
NPKRegNotifyWindow
NPKRegisterCryptProgram
NPKRegisterCryptProgramEx
NPKRegisterCryptWindow
NPKRegisterCryptWindowFunc
NPKRegisterCryptWindowMsg
NPKRegisterNotifyWindow
NPKSetAppCompatFlag
NPKSetCryptProgramUseAlert
NPKSetDrvPath
NPKSetHook
NPKSetHookPause
NPKSetHookPlc
NPKSetInfoWindow
NPKSetKbdExtensionKeyLock
NPKSetKbdLock
NPKSetKeyMode
NPKSetSecOpt
NPKSetTargetWindow
NPKSetUseKeyMode
NPKSetUseMsgType
NPKUnregCrypt
NPKUnregisterCryptProgram
NPKUnregisterCryptProgramAll
NPKUnregisterCryptWindow
NPKUnregisterCryptWindowAll
Name
.text
Size
168KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=12, version=7291,
count=6, productName=Unmarked objects (old),
count=425, id=1, productName=Unmarked objects,
count=19, id=19, version=8034,
count=26, id=14, version=7299,
count=106, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=72, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
npkcrypt.sys
- IMPHASH 5a33af5f3ff68ac82c870885a2e6b6a8
- SHA256 0b93205a6dee189d9c38514bc48174a2682fe024805ea2cffa408bd1a55b17e8
- MD5 8bcb281a2540e7aff0cd00f9878fe21f
- SHA1 5b4b615221fbd6220700237c9fa4fe7a56482526
- SHA512 22b6c8bbaa2cae9fe9a6f4266001baeff1b2bfcc37f47332596f8687bbf27166cb26792df4166472c9d8b174c378dfef08c5d58891c56edcc86145bd6050e918
- SSDEEP 384:i4pU7EkGCl0MHalpAg4GlvpiK1K/d7ipAxBv98G9/iBmnZW39aM0PbaA96W61f2i:e7EkR0M6l2P1R9YAj96W66ffVK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ntoskrnl.exe
IofCallDriver
ExFreePool
MmMapLockedPages
MmMapLockedPagesSpecifyCache
IoCreateSymbolicLink
IoCreateDevice
ExAllocatePoolWithTag
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
MmUnmapLockedPages
ObReferenceObjectByHandle
PsGetCurrentProcessId
IoAttachDeviceToDeviceStack
swprintf
ObfDereferenceObject
IoDetachDevice
IofCompleteRequest
sprintf
KeInsertQueueDpc
PsGetVersion
IoGetCurrentProcess
strncmp
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
KeRemoveQueueDpc
KeNumberProcessors
KeGetCurrentThread
KeSetAffinityThread
IoRegisterShutdownNotification
KeInitializeSpinLock
KeSetEvent
KeInitializeDpc
hal
HalBeginSystemInterrupt
KfReleaseSpinLock
KfRaiseIrql
KfLowerIrql
HalGetInterruptVector
HalEndSystemInterrupt
KfAcquireSpinLock
ndis.sys
NdisSetTimer
NdisInitializeTimer
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
736B
Virtual Size
716B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
960B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=7, id=19, version=9049,
count=1, id=6, version=2134,
count=1, id=14, version=8204,
count=7, id=10, productName=VS98 (6.0) build 8168, version=8168,
npkcrypt.vxd
- SHA256 c10ca50db899cf40bc6d08a53c95fd2eada02dada3e1d212081d51799a536d7a
- MD5 24851991fcb1136415620e01533b9e3d
- SHA1 2a55fe08e0cdda06fd9ea8b221aeec34de0daeb5
- SHA512 c9a94d5c560347246a00ab6a11ea1c829fabba7651c949463744928d50f263130ad72e2286433f004460198db2e7862bfd0fc4825cc4d04dac2f976b0b7a2d26
- SSDEEP 192:+fPi3fZ2uwTkKF4dvZjz9YYaVUk8WCqt5XLJlNsMgjRzA25DrjrdrFp/PogMIU6+:+fa3fZDd99/Q7t5XLJlajT1Lp8
- MD5 SHA1 SHA512 SSDEEP
npkcusb.sys
- IMPHASH 35b74266ff944d379620f444e7ab8a1a
- SHA256 c6b176700ba6983286278bb9f30148dca97f053dedd00e6f16a1e0f9bf29c40f
- MD5 9d26933101f655f0d21118e561708239
- SHA1 b1aaa33b950fcb744bdba18a2a6048b3a1fd1b48
- SHA512 cb0e74db07765f6af13a066300623e0bd47ab76808c263611138bccaf052051ababbe2109b72743b65cbf2959ca6d5ffc4a19cab12d47fda23558e41e72c4c55
- SSDEEP 768:BFwUHvAHkIXjb+htU2584gxh8Auet1UXukbYBW+uYl:BlHvAHkIktU2589R6mBW+Rl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
28919
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ntoskrnl.exe
InterlockedIncrement
RtlCopyUnicodeString
ExAllocatePoolWithTag
IoIsWdmVersionAvailable
RtlFreeUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
ExFreePool
IoDetachDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
_except_handler3
InterlockedDecrement
MmMapLockedPages
PoCallDriver
PoStartNextPowerIrp
IofCallDriver
MmMapLockedPagesSpecifyCache
IoCreateSymbolicLink
KeInitializeSpinLock
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
MmUnmapLockedPages
ObReferenceObjectByHandle
IoGetCurrentProcess
KeSetEvent
KeInitializeEvent
IofCompleteRequest
DbgPrint
hal
KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
page
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
init
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
640B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
960B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
960B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=35, id=1, productName=Unmarked objects,
count=5, id=19, version=9049,
count=1, id=6, version=2134,
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
npkpdb.dll
- IMPHASH 19d4374f3e0c08ff9cdb4826b422ae5e
- SHA256 47744c95349d59f82ea6fbf2d90d352bd0bdc2fc5c83b00e45a08ae8862cf849
- MD5 1fc78ae657b3f3a5cee688071ac2878d
- SHA1 8756b1429e45095b8510b43f4a3644ce9d1092a1
- SHA512 b60f3bc9a461191303b98d4007364fa7364e0f147ae162b0076b9df3e8354fe56c23fb135c3207c915c4a057448657629d1bf3f0c9deb11fd2eb5570a87eee04
- SSDEEP 768:mXB5K8gIMTLh67Ki68wVLgtR6UZT6noj8z:mR5cVTLQO9O6ewojq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6772
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetHandleCount
LockResource
SizeofResource
LoadResource
FindResourceA
GetProcAddress
GetModuleHandleA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapAlloc
HeapFree
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
FreeResource
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
GetCPInfo
RtlUnwind
GetStringTypeA
GetStringTypeW
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
LoadLibraryA
NPKPDBCloseExpPrgDb
NPKPDBCreateExpPrgDb
NPKPDBIsExpProgram
Name
.text
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.NUMEGAB
Size
4KB
Virtual Size
914B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=20, id=14, version=7299,
count=56, id=10, version=8047,
count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=19, version=8034,
count=70, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,