Dimethylcadmium.exe-main.zip
- SHA256 83239ee058d2a5bf120848dd900654a94c770cce8c4cbe2a971b861795316a98
Overview
overview
7Static
static
3Dimethylca...in.zip
windows7-x64
7Dimethylca...in.zip
windows10-2004-x64
1Dimethylca...de.zip
windows7-x64
1Dimethylca...de.zip
windows10-2004-x64
1Dimethylcadmium.dev
windows7-x64
3Dimethylcadmium.dev
windows10-2004-x64
3Dimethylcadmium.exe
windows7-x64
6Dimethylcadmium.exe
windows10-2004-x64
6Dimethylcadmium.ico
windows7-x64
3Dimethylcadmium.ico
windows10-2004-x64
3Dimethylca...layout
windows7-x64
3Dimethylca...layout
windows10-2004-x64
3Dimethylca...vate.h
windows7-x64
3Dimethylca...vate.h
windows10-2004-x64
3Dimethylca...ate.rc
windows7-x64
3Dimethylca...ate.rc
windows10-2004-x64
3Dimethylca...te.res
windows7-x64
3Dimethylca...te.res
windows10-2004-x64
3Makefile.win
windows7-x64
3Makefile.win
windows10-2004-x64
3PayloadMBR/Create.bat
windows7-x64
1PayloadMBR/Create.bat
windows10-2004-x64
1PayloadMBR...ss.asm
windows7-x64
3PayloadMBR...ss.asm
windows10-2004-x64
3PayloadMBR...el.asm
windows7-x64
3PayloadMBR...el.asm
windows10-2004-x64
3PayloadMBR...om.bin
windows7-x64
3PayloadMBR...om.bin
windows10-2004-x64
3PayloadMBR...om.png
windows7-x64
3PayloadMBR...om.png
windows10-2004-x64
3PayloadMBR...DL.dll
windows7-x64
3PayloadMBR...DL.dll
windows10-2004-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dimethylcadmium.exe-main.zip
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dimethylcadmium.exe-main.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Dimethylcadmium.exe-main/Dimethylcadmium source code.zip
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Dimethylcadmium.exe-main/Dimethylcadmium source code.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Dimethylcadmium.dev
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
Dimethylcadmium.dev
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Dimethylcadmium.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
Dimethylcadmium.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
Dimethylcadmium.ico
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
Dimethylcadmium.ico
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Dimethylcadmium.layout
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
Dimethylcadmium.layout
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
Dimethylcadmium_private.h
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
Dimethylcadmium_private.h
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Dimethylcadmium_private.rc
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
Dimethylcadmium_private.rc
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
Dimethylcadmium_private.res
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
Dimethylcadmium_private.res
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
Makefile.win
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral20
Sample
Makefile.win
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
PayloadMBR/Create.bat
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
PayloadMBR/Create.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
PayloadMBR/Data/decompress.asm
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
PayloadMBR/Data/decompress.asm
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
PayloadMBR/Data/kernel.asm
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
PayloadMBR/Data/kernel.asm
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
PayloadMBR/Image/Custom.bin
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral28
Sample
PayloadMBR/Image/Custom.bin
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
PayloadMBR/Image/Custom.png
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
PayloadMBR/Image/Custom.png
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
PayloadMBR/Programs/QEMU/SDL.dll
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
PayloadMBR/Programs/QEMU/SDL.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Dimethylcadmium.exe-main.zip
- Size 10.2MB
- Sample241107-byx7pasgnm
- SHA256 83239ee058d2a5bf120848dd900654a94c770cce8c4cbe2a971b861795316a98
- MD5 4fbed3a4ec1f70d0e89019b3569748a3
- SHA1 f5acdf821a2387c7c31f1cfe0a89af565271507d
- SHA512 2ad8e34114d5e1e0736be97d736e5f4bb84fc3ef896d9d6f5addb09358563f4b92c8254ed4c258746ce06d599ad9e9d2abc1c1421dbcd0b6a7dd06f7e1abb188
- SSDEEP 196608:rY7z7QWr7+US5gpmjnY2SL0pE3lQU8PARo94wd/yVuL6im99oEfRxYQ1/i0dk8Fu:rY7z71m1uL0kuUy9d/yVuIYOaAxm
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack002/Dimethylcadmium.exe unpack002/PayloadMBR/Programs/QEMU/SDL.dll unpack002/PayloadMBR/Programs/QEMU/libcurl-4.dll unpack002/PayloadMBR/Programs/QEMU/qemu.exe unpack002/PayloadMBR/Programs/compress.exe unpack002/PayloadMBR/Programs/nasm.exe unpack002/PayloadMBR/Programs/png2bin.exe unpack004/Dimethylcadmium.exe
File Explorer
-
Dimethylcadmium.exe-main.zip.zip 10.2MB
-
Dimethylcadmium.exe-main/Dimethylcadmium source code.zip.zip 10.2MB
-
Dimethylcadmium.dev1KB
-
Dimethylcadmium.exe.exe 59KB
-
Dimethylcadmium.ico4KB
-
Dimethylcadmium.layout99B
-
Dimethylcadmium_private.h590B
-
Dimethylcadmium_private.rc779B
-
Dimethylcadmium_private.res5KB
-
Makefile.win1KB
-
PayloadMBR/Create.bat397B
-
PayloadMBR/Data/decompress.asm1018B
-
PayloadMBR/Data/kernel.asm5KB
-
PayloadMBR/Image/Custom.bin10KB
-
PayloadMBR/Image/Custom.png.png 13KB
-
PayloadMBR/Programs/QEMU/SDL.dll.dll 1.0MB
-
PayloadMBR/Programs/QEMU/bios.bin128KB
-
PayloadMBR/Programs/QEMU/libcurl-4.dll.dll 295KB
-
PayloadMBR/Programs/QEMU/pxe-e1000.bin70KB
-
PayloadMBR/Programs/QEMU/qemu.exe.exe 2.5MB
-
PayloadMBR/Programs/QEMU/vgabios-cirrus.bin35KB
-
PayloadMBR/Programs/compress.cpp2KB
-
PayloadMBR/Programs/compress.exe.exe 50KB
-
PayloadMBR/Programs/nasm.exe.exe 1.2MB
-
PayloadMBR/Programs/png2bin.exe.exe 8.5MB
-
PayloadMBR/Programs/png2bin.py1KB
-
PayloadMBR/Programs/png2bin.spec416B
-
PayloadMBR/disk.img32KB
-
main.cpp209KB
-
main.o46KB
-
Dimethylcadmium.exe-main/Dimethylcadmium.zip.zip 18KB
-
Dimethylcadmium.exe.exe 59KB
-
Dimethylcadmium.exe-main/README.md106B
Dimethylcadmium.exe-main/Dimethylcadmium source code.zip
- SHA256 b1be40c9c9dff3b86c02080601559eaf152250918a6478725fdfeb896dcb5474
- MD5 5ddbdc18d0204869644922cf89ee2486
- SHA1 ba00ca53d6f20946db99bab914e98a96a0d7fbab
- SHA512 30f2dbf00e8da5eac3a315521d65906ebdeaadbc92a3fa16f41455df9e693c8f012b32b8965366bae18c20cedbc7c1e1fc928534c7889ffaa3618fd45d1a9d94
- SSDEEP 196608:2k9XnGC99OO2DCvqZh2KgHwLGjbk+EA3GzSSLFSVkhI+QdJ6EnxBkgYTV2mc8pEF:2k9Xn9WrSH8mbknZLFSVkECGsYanov
- MD5 SHA1 SHA512 SSDEEP
Dimethylcadmium.dev
- SHA256 dde8b44520eaa6b46d81c8513a948f51e0e5d794c06212bbe7deacec090126d3
- MD5 03878ee4da917f9c7e1d4333b5787776
- SHA1 900ab8ade0a6991322998f5f9988c5cf713f3b3e
- SHA512 e7567422e517c52d203f2d2727f383f68d0f029c5b530f610bca4bd9a7cfb2817dd8a10f376834e8b445ddc0bce65575123df4fa303bd1873907c0e22d4b939e
- MD5 SHA1 SHA512
Dimethylcadmium.exe
- IMPHASH 71d84bb660b2838ee9e244b824b9be12
- SHA256 36504aead5b06ea8d0dfc3d01c7a38063f1895e8c146756d44b6792210c8f072
- MD5 88447f4d05e7d9cb19c11333c1bfa788
- SHA1 1059cc274a2de48f50629cd924aec5bfc307b817
- SHA512 64b7584612e6a71c84a1decd954cb3b2698801193a6fee8492325d59032ecba596d3c3c5b5ae4796224c000bfbd08921eb3ed760146f0d9c141a54790fdb0a2e
- SSDEEP 768:C414KuzvDEqWF3lI5oiVVG+A1yAR2PmD48:ziqjoG+Gxh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
gdi32
BitBlt
CreateBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetBitmapBits
SelectObject
SetBitmapBits
kernel32
CloseHandle
CreateFileW
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
ntdll
NtRaiseHardError
RtlAdjustPrivilege
memcpy
memset
sin
strlen
winmm
waveOutClose
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_iob
_lock
_onexit
_unlock
abort
calloc
exit
fprintf
free
fwrite
malloc
signal
strncmp
vfprintf
user32
GetDC
GetDesktopWindow
GetSystemMetrics
InvalidateRect
MessageBoxW
ReleaseDC
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Dimethylcadmium.ico
- SHA256 14f9b97d1ed24286400851c4edb0a9e687e43662284ac040ec65ce17b2385717
- MD5 0b1137c0a08dbc5565a9cc9474f7013f
- SHA1 b6424220cfe5c98d10d122c8aa27fed2e0e95fe2
- SHA512 6f67a896c7ce5d43d010f189fd0b0b66a7256a97156a490a3b49902711d0d0fce2a3c39b83de2460c0488076b4d7c9d5b94feffc556321bd79f58f35296d0cdd
- SSDEEP 48:bVyhUu20zfZeu3zdyDpmbCLQspOna/QLJASzJBLVw+xL1KXLsPXkg7:MWYutC/wMOO
- MD5 SHA1 SHA512 SSDEEP
Dimethylcadmium.layout
- SHA256 b526bd09eb9d87769188807ee49daff75961098aa20f82b799b823f966f3fd91
- MD5 223273dde8fd7ab7a98d685a4e06df53
- SHA1 7b8fc4f6d3c901dc3f3023a9a085727cf8186dae
- SHA512 18b693e7e4ea38af10f95c050237e7e9e2a2552c556e12af8c1010fb7ee8f9bb090831c18e84a3ff19073544f329616165889692e3c6451a9d8a0b1493c9b35a
- MD5 SHA1 SHA512
Dimethylcadmium_private.h
- SHA256 7262c28785bd267364dee51f2f3ae936990768c46d9fb0a9755860cf908f36b4
- MD5 29d57c57fcfab080d8ec67ad6e3417c1
- SHA1 194c7502d04c7d8b25d30479786057cda7915069
- SHA512 925da22d7570a85b45d588eb6d3c28a9ecc04797f0ce9844981d179d15c2b8940af0f5aa00dfbf07b91f05c4bfd2e79f0b678668fa9a15ece467c612e53ec5c6
- MD5 SHA1 SHA512
Dimethylcadmium_private.rc
- SHA256 b6093f97d44328623cd6337c50fcb9df0f21cf83432d523a604a865bf72f3ede
- MD5 8a5217704f4f140bceba46ba79593c4e
- SHA1 82f35308f45ace369de206cc0b99e1bb5f6bdd05
- SHA512 110cace8ec983ffe3bf5fee6db55438d86cea2305ada99beb54faff7e96c733cf1b9537a62d212e2ef836a4bf7eb5a9802407f388a585489cf6116bc555a1da1
- MD5 SHA1 SHA512
Dimethylcadmium_private.res
- SHA256 cb586512784f1dd11f518f1ba9dd24be628f26fdbe62243d75f34e302e0abae8
- MD5 e3522987781fc70869dd04a4413df12b
- SHA1 ac4d91cd8d8832cd34cec155a4d323272f2e06b7
- SHA512 2e73c1079c2fd3c4af9a2f7e4629aaf51a7905ff083e551e9cbf514e90b3d33be9093120cba003b81c1cbbd44f32f3517f7d3bc53868c67b95840240133eb486
- SSDEEP 48:FSVyhUu20zfZeu3zdyDpmbCLQspOna/QLJASzJBLVw+xL1KXLsPXkg7pWXla0VRJ:xWYutC/wMO8uRhJ
- MD5 SHA1 SHA512 SSDEEP
Makefile.win
- SHA256 a6284ab963acc5c3b1706e09e7fad6e3b53685928422a439a09ce4b192b47c96
- MD5 42e632c27b48a12b53683e416373cc0e
- SHA1 cff1713fb44c49d14ae9668773429ab0fecbe8e9
- SHA512 3f3499ab31cb81c2230e464d18c6333cd31840a917805255207a27c5d2c20215d41e06ebfea96fa7f025237af61e673ae3c4870eca4a622341d39b26e7694e36
- MD5 SHA1 SHA512
PayloadMBR/Create.bat
- SHA256 05a3a4faa2422e5d923439f6bafb331e0c1a2a2a334f376bdda6a49feef90e09
- MD5 61e988b23f22b1c21626df02ca92b010
- SHA1 bd60038f968325dbe556f583d0ae7ea306c6d332
- SHA512 cbc564bd2af5b901cacb2114ab26a4dce12575a3e6a2fb20547adfef0605b2481020faa9837556fcec3fbecee146ce373905535f58c86a8f1d81e624574b2538
- MD5 SHA1 SHA512
PayloadMBR/Data/decompress.asm
- SHA256 3711c36eb6c4c93c88ee8fe31d2f32e4324b83a8336e7ca24e5adc3206dfa572
- MD5 92d328c40ad015ee16ca8e0a3024bddc
- SHA1 323f2cb3eb6f3315aab84dee013ace175c47d87f
- SHA512 f22b86fb492f07622a2fdfc4462e530f49bbc532cf0a2eddb4c17e7e91b55f8ca1a730cff49420bb8d84b248f54ad3987523a3fd4d404baaa4a5629a3558672e
- MD5 SHA1 SHA512
PayloadMBR/Data/kernel.asm
- SHA256 6eb08dcb31b524997c5c04101d75fc383c641e74f0e8e22f531ca0e32554d488
- MD5 cbbbdd6f0e7adf9e8a98744775875d42
- SHA1 185ed2eede1707d408a59b162ff0ec07c4405af8
- SHA512 59395fbf5008418064f68f37ff20fd84f3983af813763f174ad5f78ef9bde8c5a628920f476cf758b6101434015f4a81f6f3aa525969c46c72e0e19dc3dff928
- SSDEEP 96:C13zH/W+ie+3IXw+06pdF2flVihXhsUihMKlh8DdX9cous3:k/WLeMVGWdV4XaU4MKlaDlt3
- MD5 SHA1 SHA512 SSDEEP
PayloadMBR/Image/Custom.bin
- SHA256 3f7f14087ea72ff9bfde4c3b3265a672d34f829d1850d23d7a1e86ab9a1f9aa7
- MD5 0109d6add9c2e43b5b06506599795450
- SHA1 9550a84ca3e6b2b513d47d446a0b87fac5dc8367
- SHA512 e1211066f9e772cca6d03013397e7acf168c7210b2cb1c394fa6491d6b52ba2dd96c8e6f84bc97d54826bd9c4ba761617f94b07c0b7de7e2211be166cd6ab248
- SSDEEP 192:UlIy3oeAczv6/AAJAM0+ciVqDeWKOhLJE7ebNOtuyj/0kT55mj72OdUz7JHGp:UlVoXcqJJKiVjRG+AAoyT0h72VPJmp
- MD5 SHA1 SHA512 SSDEEP
PayloadMBR/Image/Custom.png
- SHA256 d11d15dc005bd759cb40fc5a6447517a56d9018166bbbc1e6ad6f20f82b8b6df
- MD5 bbc3e247db574aefd97c369b6290070f
- SHA1 559355da8b131fba6ce91613d6866c930e6bd8f0
- SHA512 2f78cd7a8bb1b226531c2cc0b13e5e2eef219c3867a0d035392ff6cf17572c1e0399c767c9791418b68ab2362465028eeb597633dbb694af3e9166126f74d987
- SSDEEP 384:PUUQQ/p3+yU7vgWy847zpj5k+9K0EJJkdffih/SAp:PnQK3+yd8uD/EJJkdHihjp
- MD5 SHA1 SHA512 SSDEEP
PayloadMBR/Programs/QEMU/SDL.dll
- IMPHASH 07715dfbd2fb762d2b3fd8ef4273adc9
- SHA256 0cce4795789a49c433d7f9d1ce7663f265f948f672ebde5fec41f2447fcd8741
- MD5 cea03998e710dc5bfc4954cde440333d
- SHA1 a6490955fa171fd85a6e64d06642e129493c7ba4
- SHA512 c2aa76413fa9526abad2a3a61f3d0595027df32bcb7e0005a654625a7c894f386563d277ccda89d6eb96fdb869d262252927cfdf764c26c2dfd5cc966d23cfa3
- SSDEEP 12288:lFqs6ZgPvI6bw3uJwV/MRb2F6t1YAG7S86OIYO8iJghIQoXk6MEgw4u8XcQexssC:lFqs6gvIgoYSF6vE7CwoQ6LwUGdL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
gdi32
BitBlt
ChoosePixelFormat
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreatePalette
DeleteDC
DeleteObject
DescribePixelFormat
GetDIBits
GetDeviceGammaRamp
GetSystemPaletteEntries
GetSystemPaletteUse
RealizePalette
SelectObject
SelectPalette
SetDIBColorTable
SetDeviceGammaRamp
SetPaletteEntries
SetPixelFormat
SetSystemPaletteUse
SwapBuffers
UnrealizeObject
kernel32
CloseHandle
CreateFileA
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetACP
GetCurrentThread
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentVariableA
GetLastError
GetLocaleInfoA
GetModuleHandleA
GetProcAddress
GetVersionExA
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
ReleaseMutex
ReleaseSemaphore
SetEnvironmentVariableA
SetErrorMode
SetFilePointer
SetThreadPriority
Sleep
TerminateThread
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
_strdup
__dllonexit
__lc_codepage
__mb_cur_max
_beginthreadex
_endthreadex
_errno
_iob
_isctype
_pctype
_stricmp
atof
atoi
fclose
fflush
fputc
fread
free
fseek
ftell
fwrite
getenv
localeconv
log
malloc
memcpy
memset
pow
qsort
raise
realloc
signal
sscanf
strchr
strlen
strstr
wcslen
user32
AdjustWindowRect
AdjustWindowRectEx
BeginPaint
CallWindowProcA
ChangeDisplaySettingsA
ClientToScreen
ClipCursor
CreateCursor
CreateIconFromResourceEx
CreateWindowExA
DefWindowProcA
DestroyCursor
DestroyIcon
DestroyWindow
DispatchMessageA
EndPaint
EnumDisplaySettingsA
GetClassInfoA
GetClientRect
GetCursor
GetCursorPos
GetDC
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutNameA
GetKeyboardState
GetMenu
GetMessageA
GetSystemMetrics
GetWindowLongA
GetWindowRect
InvalidateRect
IsZoomed
KillTimer
LoadImageA
LoadKeyboardLayoutA
MapVirtualKeyExA
MapWindowPoints
PeekMessageA
PostMessageA
PostQuitMessage
PtInRect
RegisterClassA
ReleaseCapture
ReleaseDC
SetCapture
SetClassLongA
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
ToAsciiEx
ToUnicode
TranslateMessage
UnregisterClassA
WindowFromPoint
winmm
joyGetDevCapsA
joyGetNumDevs
joyGetPosEx
mciGetErrorStringA
mciSendCommandA
timeBeginPeriod
timeEndPeriod
timeGetTime
timeKillEvent
timeSetEvent
waveOutClose
waveOutGetErrorTextA
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
SDL_AddTimer
SDL_AllocRW
SDL_AudioDriverName
SDL_AudioInit
SDL_AudioQuit
SDL_BuildAudioCVT
SDL_CDClose
SDL_CDEject
SDL_CDName
SDL_CDNumDrives
SDL_CDOpen
SDL_CDPause
SDL_CDPlay
SDL_CDPlayTracks
SDL_CDResume
SDL_CDStatus
SDL_CDStop
SDL_ClearError
SDL_CloseAudio
SDL_CondBroadcast
SDL_CondSignal
SDL_CondWait
SDL_CondWaitTimeout
SDL_ConvertAudio
SDL_ConvertSurface
SDL_CreateCond
SDL_CreateCursor
SDL_CreateMutex
SDL_CreateRGBSurface
SDL_CreateRGBSurfaceFrom
SDL_CreateSemaphore
SDL_CreateThread
SDL_CreateYUVOverlay
SDL_Delay
SDL_DestroyCond
SDL_DestroyMutex
SDL_DestroySemaphore
SDL_DisplayFormat
SDL_DisplayFormatAlpha
SDL_DisplayYUVOverlay
SDL_EnableKeyRepeat
SDL_EnableUNICODE
SDL_Error
SDL_EventState
SDL_FillRect
SDL_Flip
SDL_FreeCursor
SDL_FreeRW
SDL_FreeSurface
SDL_FreeWAV
SDL_FreeYUVOverlay
SDL_GL_GetAttribute
SDL_GL_GetProcAddress
SDL_GL_LoadLibrary
SDL_GL_Lock
SDL_GL_SetAttribute
SDL_GL_SwapBuffers
SDL_GL_Unlock
SDL_GL_UpdateRects
SDL_GetAppState
SDL_GetAudioStatus
SDL_GetClipRect
SDL_GetCursor
SDL_GetError
SDL_GetEventFilter
SDL_GetGammaRamp
SDL_GetKeyName
SDL_GetKeyRepeat
SDL_GetKeyState
SDL_GetModState
SDL_GetMouseState
SDL_GetRGB
SDL_GetRGBA
SDL_GetRelativeMouseState
SDL_GetThreadID
SDL_GetTicks
SDL_GetVideoInfo
SDL_GetVideoSurface
SDL_GetWMInfo
SDL_Has3DNow
SDL_Has3DNowExt
SDL_HasAltiVec
SDL_HasMMX
SDL_HasMMXExt
SDL_HasRDTSC
SDL_HasSSE
SDL_HasSSE2
SDL_Init
SDL_InitSubSystem
SDL_JoystickClose
SDL_JoystickEventState
SDL_JoystickGetAxis
SDL_JoystickGetBall
SDL_JoystickGetButton
SDL_JoystickGetHat
SDL_JoystickIndex
SDL_JoystickName
SDL_JoystickNumAxes
SDL_JoystickNumBalls
SDL_JoystickNumButtons
SDL_JoystickNumHats
SDL_JoystickOpen
SDL_JoystickOpened
SDL_JoystickUpdate
SDL_KillThread
SDL_Linked_Version
SDL_ListModes
SDL_LoadBMP_RW
SDL_LoadFunction
SDL_LoadObject
SDL_LoadWAV_RW
SDL_LockAudio
SDL_LockSurface
SDL_LockYUVOverlay
SDL_LowerBlit
SDL_MapRGB
SDL_MapRGBA
SDL_MixAudio
SDL_NumJoysticks
SDL_OpenAudio
SDL_PauseAudio
SDL_PeepEvents
SDL_PollEvent
SDL_PumpEvents
SDL_PushEvent
SDL_Quit
SDL_QuitSubSystem
SDL_RWFromConstMem
SDL_RWFromFP
SDL_RWFromFile
SDL_RWFromMem
SDL_ReadBE16
SDL_ReadBE32
SDL_ReadBE64
SDL_ReadLE16
SDL_ReadLE32
SDL_ReadLE64
SDL_RegisterApp
SDL_RemoveTimer
SDL_SaveBMP_RW
SDL_SemPost
SDL_SemTryWait
SDL_SemValue
SDL_SemWait
SDL_SemWaitTimeout
SDL_SetAlpha
SDL_SetClipRect
SDL_SetColorKey
SDL_SetColors
SDL_SetCursor
SDL_SetError
SDL_SetEventFilter
SDL_SetGamma
SDL_SetGammaRamp
SDL_SetModState
SDL_SetModuleHandle
SDL_SetPalette
SDL_SetTimer
SDL_SetVideoMode
SDL_ShowCursor
SDL_SoftStretch
SDL_ThreadID
SDL_UnloadObject
SDL_UnlockAudio
SDL_UnlockSurface
SDL_UnlockYUVOverlay
SDL_UnregisterApp
SDL_UpdateRect
SDL_UpdateRects
SDL_UpperBlit
SDL_VideoDriverName
SDL_VideoInit
SDL_VideoModeOK
SDL_VideoQuit
SDL_WM_GetCaption
SDL_WM_GrabInput
SDL_WM_IconifyWindow
SDL_WM_SetCaption
SDL_WM_SetIcon
SDL_WM_ToggleFullScreen
SDL_WaitEvent
SDL_WaitThread
SDL_WarpMouse
SDL_WasInit
SDL_WriteBE16
SDL_WriteBE32
SDL_WriteBE64
SDL_WriteLE16
SDL_WriteLE32
SDL_WriteLE64
SDL_getenv
SDL_iconv
SDL_iconv_close
SDL_iconv_open
SDL_iconv_string
SDL_mutexP
SDL_mutexV
SDL_putenv
SDL_strlcat
SDL_strlcpy
Name
.text
Size
228KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
292B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/19
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/35
Size
370KB
Virtual Size
369KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/47
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/61
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/73
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/86
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/97
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/108
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
generic
PayloadMBR/Programs/QEMU/bios.bin
- SHA256 e8587df7c290525cf5fd6f5869fd00ca29a8635cd5096dfcf08e0be25f15318c
- MD5 1ef20d0614ffaf802f5b1fd408078241
- SHA1 e054fdd02f7ef664ea75aaafb551b7444b9c33c8
- SHA512 dbd53b5af960367502796d9a0b7935fc287a53e3a401cc3c311977efcd5dc960b653cb497e487cfb18de25a30722498f020062f52da40704d22dfaa72816a969
- SSDEEP 3072:leyfHyyKq+o2g6xFAyMxhJKPNJOh/eH6rrVY8Bzl1XOspA:lfxJuNJOteH6FY8Bzl1XA
- MD5 SHA1 SHA512 SSDEEP
PayloadMBR/Programs/QEMU/libcurl-4.dll
- IMPHASH 591bfb96218654ea9677f9b7123d0d31
- SHA256 cde6e2b58641afd108ae2606337a71775021127a6109d6d64eadb056ca4598b7
- MD5 baae54b1157b4c9587cceb4680b13da5
- SHA1 939642b482d3e7697cec88d11aebc07bb076c2d1
- SHA512 433f411f740bb2978a47776fa856874717531985ca3bfbf17cb2f6d1e106585132a7a90ef7b803a10f1293aaad63f2264ee8a8aea2806593d6944e189e0ff813
- SSDEEP 6144:wK0GMvBI/QtKUbp9pDKRCzKuGpHTBI9yAR17rRH:wKEvB7Ke9pDXgHTdm7dH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
AddAtomA
CloseHandle
CreateEventA
CreateMutexA
DuplicateHandle
ExpandEnvironmentStringsA
FindAtomA
FormatMessageA
FreeLibrary
GetAtomNameA
GetCurrentProcess
GetExitCodeThread
GetFileType
GetLastError
GetProcAddress
GetStdHandle
GetTickCount
LoadLibraryA
PeekNamedPipe
ReadFile
ReleaseMutex
SetEvent
SetLastError
Sleep
SleepEx
TerminateThread
WaitForMultipleObjects
WaitForSingleObject
msvcrt
_close
_open
_read
_strdup
_stricmp
__dllonexit
__mb_cur_max
_beginthreadex
_errno
_fstati64
_iob
_isctype
_lseeki64
_pctype
_stati64
_stricmp
_strnicmp
_sys_nerr
abort
atoi
calloc
fclose
fflush
fgets
fopen
fprintf
fputc
fread
free
fseek
fwrite
getenv
gmtime
malloc
mbstowcs
memchr
memcpy
memmove
memset
rand
realloc
setlocale
sprintf
srand
sscanf
strchr
strcpy
strerror
strlen
strncmp
strncpy
strrchr
strstr
strtol
strtoul
time
tolower
wcstombs
wldap32
ber_free
ldap_err2stringA
ldap_first_attributeA
ldap_first_entry
ldap_get_dnA
ldap_get_values_lenA
ldap_initA
ldap_memfreeA
ldap_msgfree
ldap_next_attributeA
ldap_next_entry
ldap_search_sA
ldap_set_optionA
ldap_simple_bind_sA
ldap_unbind_s
ldap_value_free_len
ws2_32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
getsockname
getsockopt
htons
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info
Name
.text
Size
185KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
PayloadMBR/Programs/QEMU/pxe-e1000.bin
- SHA256 b15e5c6355795acb4dd0a93854f1b528775a1a13d8f08362d5fa18c80180093f
- MD5 8226b7e99dd7f341265b450299c72e73
- SHA1 31705a716e4842e9d8911f01287dc04b90438469
- SHA512 483fb62ef9b55d4700ed340a533d09dd8529f22112a2d06fbdc45b0459d6cd289146232f21630f7c9e9a2e5c6a5955abe742d9a9665a309444174eb03077d20f
- SSDEEP 1536:4T7vz7mAkLcHL6PUMRLHjQ+BOOqclD+Ax/TZq6+npAvqdO8PrwP:o7HmkHL633aOqk+sTZH+o38DwP
- MD5 SHA1 SHA512 SSDEEP
PayloadMBR/Programs/QEMU/qemu.exe
- IMPHASH 9334847cc8edb5e7f67fbdf914c4dd65
- SHA256 fa2255e47506aa291b59f003b298b98b4ab50b4138a0be87fcbdc5a90696b9bc
- MD5 98dfea60ecff618c2940823119a279b4
- SHA1 aab26cb098fdb76a4643044f494d9b09a7796038
- SHA512 306d9a66a0209d4c805fafbfbff88a9788574ab4999956fd03cda784a67b8dab2fb5d02ca0a7bdf269c7efc1e4564c0bd2f2e1c610ddf54b401c89e705d8613d
- SSDEEP 49152:mH1QTnKjzdXskm4AwiiBfFS28OSNI6EsGC+T:mSLKjRXskmPwLBfFGOSNhEsGC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
sdl
SDL_CloseAudio
SDL_CreateCursor
SDL_CreateMutex
SDL_CreateRGBSurfaceFrom
SDL_CreateSemaphore
SDL_DestroyMutex
SDL_DestroySemaphore
SDL_EnableKeyRepeat
SDL_EnableUNICODE
SDL_FillRect
SDL_FreeCursor
SDL_FreeSurface
SDL_GetAppState
SDL_GetCursor
SDL_GetError
SDL_GetModState
SDL_GetMouseState
SDL_GetVideoInfo
SDL_Init
SDL_InitSubSystem
SDL_LoadBMP_RW
SDL_MapRGB
SDL_OpenAudio
SDL_PauseAudio
SDL_PollEvent
SDL_Quit
SDL_QuitSubSystem
SDL_RWFromFile
SDL_SemPost
SDL_SemWait
SDL_SetColorKey
SDL_SetCursor
SDL_SetModuleHandle
SDL_SetVideoMode
SDL_ShowCursor
SDL_UpdateRect
SDL_UpperBlit
SDL_WM_GrabInput
SDL_WM_SetCaption
SDL_WM_SetIcon
SDL_WarpMouse
SDL_mutexP
SDL_mutexV
SDL_strlcpy
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
libcurl-4
curl_easy_cleanup
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_global_init
curl_multi_add_handle
curl_multi_cleanup
curl_multi_info_read
curl_multi_init
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket_all
iphlpapi
GetNetworkParams
kernel32
AddAtomA
ChangeTimerQueueTimer
ClearCommError
CloseHandle
CommConfigDialogA
ConnectNamedPipe
CreateEventA
CreateFileA
CreateNamedPipeA
CreateSemaphoreA
CreateThread
CreateTimerQueueTimer
DeleteCriticalSection
DeleteTimerQueueTimer
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
ExitThread
FindAtomA
FlushFileBuffers
FormatMessageA
FreeLibrary
GetAtomNameA
GetCommandLineA
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetDefaultCommConfigA
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileAttributesA
GetFileSize
GetLastError
GetLogicalDriveStringsA
GetModuleFileNameA
GetModuleHandleA
GetOverlappedResult
GetProcessAffinityMask
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetVersion
GlobalAlloc
GlobalFree
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseSemaphore
ResetEvent
SetCommMask
SetCommState
SetCommTimeouts
SetConsoleCtrlHandler
SetEndOfFile
SetEvent
SetFilePointer
SetProcessAffinityMask
SetUnhandledExceptionFilter
SetupComm
SignalObjectAndWait
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WriteFileEx
lstrlenA
msvcrt
_access
_close
_dup2
_fdopen
_fstat
_getpid
_mkdir
_open
_pclose
_popen
_putenv
_read
_rmdir
_stat
_strdup
_unlink
_write
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_beginthreadex
_cexit
_commit
_errno
_exit
_findclose
_findfirst
_findnext
_ftime
_fullpath
_get_osfhandle
_iob
_isctype
_lseeki64
_onexit
_pctype
_setjmp
_setmode
_stricmp
_strnicmp
abort
atan2
atexit
atoi
bsearch
calloc
ceil
clearerr
cos
exit
fclose
fflush
fgets
floor
fopen
fputc
fread
free
fseek
ftell
fwrite
getenv
gmtime
ldexp
localeconv
localtime
log
longjmp
malloc
memchr
memcpy
memmove
memset
mktime
modf
perror
pow
puts
qsort
rand
realloc
rename
setbuf
signal
sin
sqrt
srand
sscanf
strchr
strcmp
strcpy
strerror
strftime
strlen
strncmp
strncpy
strrchr
strstr
strtok
strtol
strtoul
tan
time
tolower
toupper
wcslen
winmm
waveInAddBuffer
waveInClose
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutClose
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutUnprepareHeader
waveOutWrite
ws2_32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
678KB
Virtual Size
677KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
PayloadMBR/Programs/QEMU/vgabios-cirrus.bin
- SHA256 de727fd5bbda54d2ab04116ec2bdb349e8a8f18e3d919900fbb5e943c57aa8db
- MD5 b2c0e52d8c74a30b5af63f44f49456fe
- SHA1 b9aa495d16ad3647c606d805877c277a6f31d78c
- SHA512 ef2062c6bc843524a9ae895a634574ad15605bbac6b9d6cf36429de4a6949551ba0f3d24c9bc67db692809059f2e283a233f1ed825e0c311c8cd40a915fdb4e6
- SSDEEP 384:1XjfaJHokcnmdPRfNQqAlKGkVPd0QqJDR39lfPAcW4AK/iXKJ2c:hjGHDx5GkVPd+JDR3TQWAFXw
- MD5 SHA1 SHA512 SSDEEP
PayloadMBR/Programs/compress.cpp
- SHA256 92fa743a1c1cd0eb4761b134aeaad712e7281210f8c565d291a5a00498cdac49
- MD5 180299633ade892cc8090493aa2d6684
- SHA1 b3ca088b863d213084a95da2b6be40d6613055a1
- SHA512 5d0210c24287867964cf1aaf9891e9867150dc4d5fa8dcb362bf2b7ecf4272f50d86e284c3f7248e62356749b83842d0330b5663aeb44215f9facd6753fdf936
- MD5 SHA1 SHA512
PayloadMBR/Programs/compress.exe
- IMPHASH 9468839a33cefa14b007ce8a0bd988e6
- SHA256 abccc981147d5f9b43463e0f9ec6b7f168b7444626048c6c6a1c4dd7f8137096
- MD5 884e43a197998dfeac6865c525321935
- SHA1 32c27b036332e795fbe1060bcb43fe84468e423b
- SHA512 558d587ec0d0f07555d13d9d3262dcfdd5c344d735a2b5220356554467f255c42345b2b2443ea373537a9c4098c66ad0368fb8b2c62dd1922308276df5a3775e
- SSDEEP 768:K4u2i8xCuM5AFEApuz7WHLeEA6vyFuu8A5U:ru0MApuereN6j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_iob
_lock
_onexit
_unlock
abort
calloc
exit
fclose
fopen
fprintf
fread
free
fwrite
malloc
memcpy
memset
printf
signal
strlen
strncmp
system
vfprintf
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/14
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
307B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
1024B
Virtual Size
553B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
PayloadMBR/Programs/nasm.exe
- IMPHASH 245fd5847db29ac01003e87f2fc0fe30
- SHA256 442f6f984804c2e08c151f5565c2fdddda3a899d8e380512f271a3edbbf34cb4
- MD5 288f2be6334f4ea09abf3209166f9ac1
- SHA1 c6c613aea50ee2f51518b2e5e0e1041ee101beb5
- SHA512 470ad18548d290bfbe4de768258ac6fc0863d28f4ad5bd8d169cff0d84f1326fb33351c5549c8f888258a7226ad8701ec2d913a8de300a96333403d60a510baa
- SSDEEP 12288:dzMVtmYR2GGsxc7rjzWzzEqGc3I/Iga5/:dQCYEGGsxcvjzWX5/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__C_specific_handler
__dllonexit
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_chsize
_errno
_filelengthi64
_fileno
_fmode
_fullpath
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_onexit
_stat64
_stricmp
_strnicmp
_time64
_unlock
_vsnprintf
_write
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getenv
isalnum
isalpha
isspace
isxdigit
malloc
memcmp
memcpy
memset
perror
printf
putc
puts
qsort
realloc
remove
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strtoul
tolower
toupper
ungetc
vfprintf
_fileno
_access
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
876KB
Virtual Size
875KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
PayloadMBR/Programs/png2bin.exe
- IMPHASH 91ae93ed3ff0d6f8a4f22d2edd30a58e
- SHA256 b6f3a0a6345932dca7df51b7cd7ec56d9c4fee9217772c4fd3efd8a37547a413
- MD5 c6f98ceec41c080120ebd6121fab72a1
- SHA1 d4e06fafc5807055acccad44bf31031f765868f7
- SHA512 06d8a957d3f69cb89e4172e11b0c3f6377dfacfd119d7da364781cff18edcfe04b2f5a6c8741088241fe3b9c2cd5c5b5c6112e0ff90e94e160a46caecea56f24
- SSDEEP 196608:rgF+h90+7s8H9EmtqZiIP/Kr1zBB0PTAjQDCwkWt5JvVlkzKssOZK:rgF+h9fBGvrY1lOXHkW3O2ss
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
31187
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxW
MessageBoxA
kernel32
SystemTimeToTzSpecificLocalTime
DecodePointer
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
GetShortPathNameW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
RaiseException
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
CreateDirectoryW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
ws2_32
ntohl
Name
.text
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=172, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=259, version=24123,
count=29, id=261, version=24123,
count=18, id=260, version=24123,
count=7, id=203, version=65501,
count=115, id=1, productName=Unmarked objects,
count=17, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
PayloadMBR/Programs/png2bin.py
- SHA256 f12bf9386320e3bf1419cc0227430d86c280d40a855b35aff36939f0396b11c7
- MD5 32dfd28117b185e4870eaf506bb38af7
- SHA1 b3f3572f0f4403d90889ee5cae7f0774759a1328
- SHA512 247b2ab09495f1a596bfcd567df5a39742591164b1472fd5e6c13d02dbcef0906212a8c06ddfdc8233e11af01cbf8b32536fff1550d7dc7599153d55edcf974d
- MD5 SHA1 SHA512
PayloadMBR/Programs/png2bin.spec
- SHA256 9eef8dde3c8b19b41bf2e35105778aa2af734fae5266a7b21d55c2e91852cc72
- MD5 75b2b94d50349f896b07076bcfe2b6c9
- SHA1 fe8f88e1228b4ceeb51cac5cdd969998822746cb
- SHA512 c1a24099969ad4eb03a471a9184ad8ce7616e0f8cecf772c216b6ad4e8038d6c490a982076bd0ea8d03978f9a1c48219aac1c30a5a0fb47be9904a4979f8bdbd
- MD5 SHA1 SHA512
PayloadMBR/disk.img
- SHA256 e2dd8ba6c2bede5bb2713620beda5140f001ecc5415d6d99ab64320547e4fb55
- MD5 b32beb9b5ad4caae02b15cc383658eac
- SHA1 ad1ee7b9b8a238afa96ce8df6f0a963f684ced66
- SHA512 c5fab876644f7cffff98f2a026e12649101c3713e3c97ebc5f39699c5cd35e584f9d1ab67d36a7192278f85adb3d0f4f9caf37c2c9a0ab22c73967ccb0a63d4d
- SSDEEP 192:aHLlIy3oeAczv6/AAJAM0+ciVqDeWKOhLJE7ebNOtuyj/0kT55mj72OdUz7JHG:+lVoXcqJJKiVjRG+AAoyT0h72VPJm
- MD5 SHA1 SHA512 SSDEEP
main.cpp
- SHA256 fbeda0f48d2963739ab5b1a9c0b2f009c6f019141d13e84b9b111ba8b084e509
- MD5 a4082cd2f14013f17f7d251dfec7f4d0
- SHA1 4fabd475fafa1eee814c2b178a5dd7839e785fe4
- SHA512 9e3efb62e12e4125f51ee6c2eb048b09618b7d3177a38dd80fcd39830366d5a26458fbb6bb08b583bcd01c4f197948feeb301affa7f0cb8336c6b207f4973b55
- SSDEEP 768:fh0lUFnqrF2uF0hbUDtbVHoYn1cmR7bUgKJbXeIv4BBXBBBBByuF62XyjDoBowBW:JW4Lp6hIY1cmR3elSK2Gx
- MD5 SHA1 SHA512 SSDEEP
main.o
- SHA256 0a4ffc94676ad398fc5597de3cb6ce25a402ce1697456a23036bdbb667842336
- MD5 006c0efd903fd311d1af8ba147b2c189
- SHA1 ea45c5875b8905bbb6d2c1649d4bdd2d599f0cc6
- SHA512 ba551a90e51bd99ea11040a42e18c0a16132ce7d0c2b330bf403339f08acb32cd5dfd88608b25c013a0f4c42fc1774b804aa7c4169504f126887254e5677b824
- SSDEEP 768:7cTqu+G0lI5oiVVG+A1yAR2PmbEwhui6PU0k:5joG+Gx1Ln6PU0k
- MD5 SHA1 SHA512 SSDEEP
Dimethylcadmium.exe-main/Dimethylcadmium.zip
- SHA256 d88b1a73f5387ed23b78837dca47c60a5dd6cf0c7a183170a5e9e5ca9b9e8443
- MD5 e4ca8cacaa00c8538acae51d3b645b89
- SHA1 f5223a5f0070548bf8a0ae64c0bf029425346829
- SHA512 6b1deef888ec750c846280b69fe62230055d6519dfc172b743f99ad402a886778672f57f3859922e5be2100b96751a6bf3f0008bd093e3a355e77e53ca17113a
- SSDEEP 384:nhv01YkA8lJn731r1xWxQdqr8z/MGi4kE9p8o4:5gYp+n7HxNdmE/bv9So4
- MD5 SHA1 SHA512 SSDEEP
Dimethylcadmium.exe
- IMPHASH 71d84bb660b2838ee9e244b824b9be12
- SHA256 36504aead5b06ea8d0dfc3d01c7a38063f1895e8c146756d44b6792210c8f072
- MD5 88447f4d05e7d9cb19c11333c1bfa788
- SHA1 1059cc274a2de48f50629cd924aec5bfc307b817
- SHA512 64b7584612e6a71c84a1decd954cb3b2698801193a6fee8492325d59032ecba596d3c3c5b5ae4796224c000bfbd08921eb3ed760146f0d9c141a54790fdb0a2e
- SSDEEP 768:C414KuzvDEqWF3lI5oiVVG+A1yAR2PmD48:ziqjoG+Gxh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
gdi32
BitBlt
CreateBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetBitmapBits
SelectObject
SetBitmapBits
kernel32
CloseHandle
CreateFileW
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
ntdll
NtRaiseHardError
RtlAdjustPrivilege
memcpy
memset
sin
strlen
winmm
waveOutClose
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_iob
_lock
_onexit
_unlock
abort
calloc
exit
fprintf
free
fwrite
malloc
signal
strncmp
vfprintf
user32
GetDC
GetDesktopWindow
GetSystemMetrics
InvalidateRect
MessageBoxW
ReleaseDC
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Dimethylcadmium.exe-main/README.md
- SHA256 282b3579b4cd625d2979e1d61705be25614a6a0b42247af6816fd45bbca8db18
- MD5 759ccbc28bfa855c59d18019072382ba
- SHA1 49e215c8eb154d6633d61c11e045443efc00900a
- SHA512 7538cd81f68aa062a28a29b44fdd927ab26cd32db238580f7ae7f56c21fdd2e5f4d55670e5405e7bd5fa25fa8dc0b621ea702c9927e4e4e87abf2ceb3fc4576e
- MD5 SHA1 SHA512