6ce1075c1eca41e5a2c2a86ef580496414f423529d6db4d4a4b25ecff9f767d1
- SHA256 6ce1075c1eca41e5a2c2a86ef580496414f423529d6db4d4a4b25ecff9f767d1
Overview
overview
10Static
static
7FEhkB_OsaH...PE.exe
windows7-x64
3FEhkB_OsaH...PE.exe
windows10-2004-x64
7FQ5NRIxS9E...ni.exe
windows7-x64
7FQ5NRIxS9E...ni.exe
windows10-2004-x64
7GEWsqYhryx..._Z.exe
windows7-x64
10GEWsqYhryx..._Z.exe
windows10-2004-x64
10GcNRfPQrt7...0i.exe
windows7-x64
10GcNRfPQrt7...0i.exe
windows10-2004-x64
10HKPHM9s7J_...V8.exe
windows7-x64
1HKPHM9s7J_...V8.exe
windows10-2004-x64
1HyHVsV9i0L...Hy.exe
windows7-x64
10HyHVsV9i0L...Hy.exe
windows10-2004-x64
10JC2pSzOI0Y...qp.exe
windows7-x64
9JC2pSzOI0Y...qp.exe
windows10-2004-x64
9JntlxTU2VS...XP.exe
windows7-x64
10JntlxTU2VS...XP.exe
windows10-2004-x64
10LIAbdwyShK...Gp.exe
windows7-x64
3LIAbdwyShK...Gp.exe
windows10-2004-x64
3Ls1JHbNzSC...JE.exe
windows7-x64
10Ls1JHbNzSC...JE.exe
windows10-2004-x64
10Mr4X5srRQR...AN.exe
windows7-x64
10Mr4X5srRQR...AN.exe
windows10-2004-x64
10OEmxRS9Uai...jI.exe
windows7-x64
10OEmxRS9Uai...jI.exe
windows10-2004-x64
10OvVYhhgvd6...oB.exe
windows7-x64
9OvVYhhgvd6...oB.exe
windows10-2004-x64
9QKvpJeDIaP...YY.exe
windows7-x64
9QKvpJeDIaP...YY.exe
windows10-2004-x64
9fCe2q13vzD...Di.exe
windows7-x64
10fCe2q13vzD...Di.exe
windows10-2004-x64
10fyiHA5hP7V...Ui.exe
windows7-x64
10fyiHA5hP7V...Ui.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
FEhkB_OsaHE2y08GZpzK8pPE.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
FEhkB_OsaHE2y08GZpzK8pPE.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
FQ5NRIxS9E6fSVzjWc_kvJni.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
FQ5NRIxS9E6fSVzjWc_kvJni.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
GEWsqYhryxfuQuVPf7TWao_Z.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
GEWsqYhryxfuQuVPf7TWao_Z.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
GcNRfPQrt7430052z4jWGX0i.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
GcNRfPQrt7430052z4jWGX0i.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
HKPHM9s7J_npOwbKmifWThV8.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
HKPHM9s7J_npOwbKmifWThV8.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
HyHVsV9i0LBAcDVqJzUYu3Hy.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral12
Sample
HyHVsV9i0LBAcDVqJzUYu3Hy.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral13
Sample
JC2pSzOI0YLF3KGWlIzGFqqp.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
JC2pSzOI0YLF3KGWlIzGFqqp.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
JntlxTU2VSh_6o3pBeenGZXP.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral16
Sample
JntlxTU2VSh_6o3pBeenGZXP.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral17
Sample
LIAbdwyShKY89Z9xSWSzZEGp.exe
Resource
win7-20241023-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
LIAbdwyShKY89Z9xSWSzZEGp.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
Ls1JHbNzSCujAe0rcXjY2nJE.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
Ls1JHbNzSCujAe0rcXjY2nJE.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
Mr4X5srRQR20TfuVZShfsrAN.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral22
Sample
Mr4X5srRQR20TfuVZShfsrAN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral23
Sample
OEmxRS9UaiMPqIKXPz6Ef8jI.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral24
Sample
OEmxRS9UaiMPqIKXPz6Ef8jI.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral25
Sample
OvVYhhgvd6ZhUony5cRMqVoB.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
OvVYhhgvd6ZhUony5cRMqVoB.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
QKvpJeDIaPtXDcwKwH_WmAYY.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral28
Sample
QKvpJeDIaPtXDcwKwH_WmAYY.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral29
Sample
fCe2q13vzDk3gxn554bfaSDi.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral30
Sample
fCe2q13vzDk3gxn554bfaSDi.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral31
Sample
fyiHA5hP7V19p7libPJSzjUi.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral32
Sample
fyiHA5hP7V19p7libPJSzjUi.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 6ce1075c1eca41e5a2c2a86ef580496414f423529d6db4d4a4b25ecff9f767d1
- Size 24.8MB
- Sample241107-mvp8fs1bph
- SHA256 6ce1075c1eca41e5a2c2a86ef580496414f423529d6db4d4a4b25ecff9f767d1
- MD5 222664da85e63f004da7e6fc51fbfbc2
- SHA1 b2ee76debadac44993e2db0986131ad80426b5ad
- SHA512 319b53e46ed904e09b60a3d48fbcf6230c2cc9afce39762370eb4a9e0ae6bedb73496173f5ef242a9bbd8c92ce2c16da4f8d35f25e34ed6d3c618e44095f326c
- SSDEEP 786432:yUnRIOjsR0PW/+5Ou0PW/+5OgoOicR2OjsC0K4hXdp6oOiK:L3sFnOnru1sC0K4NVk
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/JC2pSzOI0YLF3KGWlIzGFqqp.exe themida static1/unpack001/JntlxTU2VSh_6o3pBeenGZXP.exe themida static1/unpack001/OvVYhhgvd6ZhUony5cRMqVoB.exe themida static1/unpack001/QKvpJeDIaPtXDcwKwH_WmAYY.exe themida static1/unpack001/kKePDdd93KLKBNdrEa1mO5PU.exe themida static1/unpack001/kqJBUpX_tSxtbgjxLMOmMWxd.exe themida static1/unpack001/q_TzaanAkp60Doa2Vt025l91.exe themida - Unsigned PE 17 IoCs
Checks for missing Authenticode signature.
resource unpack001/FEhkB_OsaHE2y08GZpzK8pPE.exe unpack001/FQ5NRIxS9E6fSVzjWc_kvJni.exe unpack001/GEWsqYhryxfuQuVPf7TWao_Z.exe unpack001/HKPHM9s7J_npOwbKmifWThV8.exe unpack001/HyHVsV9i0LBAcDVqJzUYu3Hy.exe unpack001/LIAbdwyShKY89Z9xSWSzZEGp.exe unpack001/Ls1JHbNzSCujAe0rcXjY2nJE.exe unpack001/Mr4X5srRQR20TfuVZShfsrAN.exe unpack001/OEmxRS9UaiMPqIKXPz6Ef8jI.exe unpack001/fCe2q13vzDk3gxn554bfaSDi.exe unpack001/fyiHA5hP7V19p7libPJSzjUi.exe unpack001/g7l9WKrAOrjeKD80YHStHQec.exe unpack001/gDFl9ioE4T5EqggsHpQDkpD0.exe unpack001/i2fKeVg8_CAPGRNvdEpuWHxY.exe unpack001/i_rtEkRUwNuf7SQBBBv9YzhJ.exe unpack001/ma_5nZD3yos0uV8jzHnJSVxT.exe unpack001/pnDF_dk604_fxVsUaLPL1Vfi.exe
File Explorer
-
6ce1075c1eca41e5a2c2a86ef580496414f423529d6db4d4a4b25ecff9f767d1.rar 24.8MB
-
FEhkB_OsaHE2y08GZpzK8pPE.exe.exe 90KB
-
FQ5NRIxS9E6fSVzjWc_kvJni.exe.exe 381KB
-
GEWsqYhryxfuQuVPf7TWao_Z.exe.exe 610KB
-
GcNRfPQrt7430052z4jWGX0i.exe.exe 927KB
-
HKPHM9s7J_npOwbKmifWThV8.exe.exe 163KB
-
HyHVsV9i0LBAcDVqJzUYu3Hy.exe.exe 321KB
-
IOU1HlTQeQfXti5Qaue4N5t9.exe.xml 223B
-
JC2pSzOI0YLF3KGWlIzGFqqp.exe.exe 2.4MB
-
JntlxTU2VSh_6o3pBeenGZXP.exe.exe 4.6MB
-
LIAbdwyShKY89Z9xSWSzZEGp.exe.exe 11KB
-
Ls1JHbNzSCujAe0rcXjY2nJE.exe.exe 273KB
-
Mr4X5srRQR20TfuVZShfsrAN.exe.exe 321KB
-
OEmxRS9UaiMPqIKXPz6Ef8jI.exe.exe 589KB
-
OvVYhhgvd6ZhUony5cRMqVoB.exe.exe 2.4MB
-
QKvpJeDIaPtXDcwKwH_WmAYY.exe.exe 2.4MB
-
QwnNK2SHckcc_GsoTwi8hDi5.exe.xml 223B
-
fCe2q13vzDk3gxn554bfaSDi.exe.exe 1.0MB
-
fyiHA5hP7V19p7libPJSzjUi.exe.exe 317KB
-
g7l9WKrAOrjeKD80YHStHQec.exe.exe 610KB
-
gDFl9ioE4T5EqggsHpQDkpD0.exe.exe 586KB
-
i2fKeVg8_CAPGRNvdEpuWHxY.exe.exe 11KB
-
i_rtEkRUwNuf7SQBBBv9YzhJ.exe.exe 589KB
-
iv1ZBvsZiT5PvxpOdFrdn024.exe.xml 223B
-
jFnkmB7oBiIVUoCTSJTevBck.exe.xml 223B
-
kKePDdd93KLKBNdrEa1mO5PU.exe.exe 4.6MB
-
kmgrjiOzeHTUfeCfQZLTyC5N.exe.exe 359KB
-
kmjYXGku7HcbPExGV5LKn8eF.exe.xml 223B
-
kqJBUpX_tSxtbgjxLMOmMWxd.exe.exe 2.4MB
-
ma_5nZD3yos0uV8jzHnJSVxT.exe.exe 163KB
-
pnDF_dk604_fxVsUaLPL1Vfi.exe.exe 599KB
-
q_TzaanAkp60Doa2Vt025l91.exe.exe 2.5MB
FEhkB_OsaHE2y08GZpzK8pPE.exe
- IMPHASH c7d3661f79d58d30854a3af50a6f4c2f
- SHA256 ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96
- MD5 ff2d2b1250ae2706f6550893e12a25f8
- SHA1 5819d925377d38d921f6952add575a6ca19f213b
- SHA512 c66544678f3dd49aa1a23cd459a556d923ba44c5d88334a165ea7bd16e4561955536546627b7e83bf1e759428c04b6312e08fdc8c2f6fab69cd29f3b62ce3d23
- SSDEEP 1536:lWvNrof2xIZ2ToPCt6VkPRYLUbrjhd3d7t20WYwuIJLO+s8jcdd1vzGHY:lWufhgTeCt0uREWrdhdY0W5uIVO77vKH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11579
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WriteFile
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
CreateFileW
GetLastError
LoadLibraryA
lstrcatW
CloseHandle
RaiseException
DecodePointer
GetProcAddress
DeleteCriticalSection
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetStringTypeW
SetStdHandle
GetFileType
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
LocalFree
EncodePointer
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
user32
wsprintfW
ole32
CoUninitialize
CoInitialize
oleaut32
SafeArrayGetDim
VariantInit
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysStringLen
SafeArrayUnaccessData
SysAllocStringLen
SafeArrayAccessData
VariantClear
GetErrorInfo
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=120, id=243, version=40116,
count=24, id=242, version=40116,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=259, version=24237,
count=45, id=261, version=24237,
count=19, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=110, id=1, productName=Unmarked objects,
count=2, id=264, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
FQ5NRIxS9E6fSVzjWc_kvJni.exe
- SHA256 857dd46102aea53f0cb7934b96410ebbc3e7988d38dcafdc8c0988f436533b98
- MD5 58f5dca577a49a38ea439b3dc7b5f8d6
- SHA1 175dc7a597935b1afeb8705bd3d7a556649b06cf
- SHA512 3c75c0cbbbc14bd25b4feb141fd1595ce02469da50432fb48400eb089d6150fe87831ccc775d921eeec697af7aad33a35fadcfd2ec775aeee1ce34355af7338a
- SSDEEP 6144:x/QiQXCfoL8+Ee0CYDTAsdRa1OGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7f:pQi3foL8+iDNdRa1lL//plmW9bTXeVh8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
42488
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
GEWsqYhryxfuQuVPf7TWao_Z.exe
- IMPHASH 5c06a288f07d43206aca52d5d94444b2
- SHA256 3593247c384586966e5a0e28eb4c4174b31e93c78c7a9e8fef96ec42a152e509
- MD5 592404767648b0afc3cab6fade2fb7d2
- SHA1 bab615526528b498a09d76decbf86691807e7822
- SHA512 83819e4956ac6da21c4927fa6edee2b178bc89bcda8fb5f4d0767d0d8310393f50f0f7e76e1a963002626a8176abfa8d864c9229a41e5b61e1a24a32d379dda9
- SSDEEP 12288:axGt1KIgj5TJuWaRGu7a81KE64i5uY4Cgbo73O1kV1nO1GVS9Td01LqB:tKIgKRGuO8gTGYwoS1kVg9q9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\hudozik\kahe 48-vayoyu\zumi\63-kohoyidovebeme49\yepafor.pdb
kernel32
SetThreadContext
SetFilePointer
lstrlenA
CopyFileExW
TlsGetValue
SetLocalTime
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
CompareFileTime
GlobalLock
WaitForSingleObject
SetEvent
OpenSemaphoreA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetCommandLineA
GetDriveTypeA
GetPriorityClass
GetConsoleMode
TerminateThread
GetSystemWindowsDirectoryA
GetVersionExW
SetConsoleMode
IsProcessorFeaturePresent
SetConsoleCursorPosition
ReadFile
GetOverlappedResult
CompareStringW
GetStartupInfoW
GetNamedPipeHandleStateW
GetPrivateProfileIntW
CreateDirectoryA
GetFileSizeEx
SetCurrentDirectoryA
SetThreadLocale
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
CopyFileA
GetPrivateProfileStringA
LoadLibraryA
OpenMutexA
LocalAlloc
IsSystemResumeAutomatic
WriteProfileSectionW
HeapWalk
SetNamedPipeHandleState
SetConsoleTitleW
FindFirstChangeNotificationA
FreeEnvironmentStringsW
EnumResourceNamesA
WriteProfileStringW
FatalAppExitA
GetCurrentThreadId
GetCPInfoExA
FindAtomW
LCMapStringW
DeleteFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
GetModuleHandleA
user32
GetTitleBarInfo
winhttp
WinHttpCloseHandle
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
405KB
Virtual Size
31.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=130, id=131, productName=VS2008 build 21022, version=21022,
count=56, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=143, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
GcNRfPQrt7430052z4jWGX0i.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3da0e424a6f1268f5682d59be1f83572479c28ca1fb7dab48d0b53220acef66e
- MD5 0e86a231689637b656a0764f2017d22f
- SHA1 70954ef5b83a7b0cd9dca4542d63bf3a7dc7ac97
- SHA512 21a3195665975ba3ec7b042a19b9ce39b5311e7c96070e7a968e7a1f39514a0df3569e39b313529dbb6b948195cd294077fd5b4e8a81e08a38b4ba2d8f6f6f32
- SSDEEP 12288:bsp0kUKA1PfP5k9FLRqYjtatql9MiwlDwhl6s5Ep7XzNwzVzTEVGp7K1k:bspuHaFLsqkqyEl68E5azVzwVBk
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
00:50:57:fe:10:85:97:70:19:ef:ce:dc:c7:8b:7d:7d:b5:25:85:e1
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
736158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
711KB
Virtual Size
710KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
HKPHM9s7J_npOwbKmifWThV8.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b8f88d0b48fbf8c1eac3d72272ddc48c723cbf8ba0527fdf42ad20cc5724ab9f
- MD5 ec3921304077e2ac56d2f5060adab3d5
- SHA1 923cf378ec34c6d660f88c7916c083bedb9378aa
- SHA512 3796aab3dd9822ba41b57ef009166e4f99adab87cf279f9d86d4d7f227128da8faf2da7290e84ebffc11f1e8d17dfd0d8db9c2691e7fc08a93a02f748e293d28
- SSDEEP 3072:T17+hYe5fY7GFGRGkhRFLRYXGd171jpxszmiGAGRC2:J7ii7R9FgGNHszmiGxRC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
104846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
HyHVsV9i0LBAcDVqJzUYu3Hy.exe
- IMPHASH ad1c5bf15a899fcfef408e3485448e67
- SHA256 6aef62b3b8890bc22dd99f9b0d48247ae52c69e7ad9e384332658e73c725e40e
- MD5 94c78c311f499024a9f97cfdbb073623
- SHA1 50e91d3eaa06d2183bf8c6c411947304421c5626
- SHA512 29b61f1924f19d073460332950c2316acf769aa40ad7f62a41941160cd8a8da5958e8f96183e0e498afe8558fc3efb3a23f66c7519c142c780c91279ddecb545
- SSDEEP 6144:DQbZ65iKd8Ro5c7bW+7kUyptNv+6FsVAIXRwGA69PZ+9ElvczV:6Z65im8Rb7D7kUyP5cVAIhwGA69B+9uY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
7280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\siwuzux-deliwacecojig18\pihukirazab_yudavatu\vutumewu.pdb
kernel32
SetFilePointer
lstrlenA
GetDriveTypeW
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
CompareFileTime
GetSystemWindowsDirectoryW
GetNamedPipeHandleStateA
WaitForSingleObject
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
VirtualFree
GetConsoleAliasesLengthA
GetPrivateProfileStringW
WaitNamedPipeW
WriteFile
SetCommState
GetCommandLineA
TlsSetValue
GetPriorityClass
GlobalAlloc
GetConsoleMode
TerminateThread
CopyFileW
GetVersionExW
SetConsoleMode
IsProcessorFeaturePresent
GetBinaryTypeA
GetOverlappedResult
CompareStringW
SetThreadContext
GlobalUnlock
VerifyVersionInfoW
CreateDirectoryA
ReleaseActCtx
GetFileSizeEx
SetCurrentDirectoryA
GetCPInfoExW
OpenMutexW
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
WriteProfileSectionA
ResetEvent
OpenWaitableTimerA
LoadLibraryA
CreateSemaphoreW
WriteProfileSectionW
HeapWalk
FindAtomA
Process32NextW
WriteProfileStringA
GetModuleHandleA
FindFirstChangeNotificationA
EnumResourceNamesA
GetConsoleCursorInfo
FatalAppExitA
GetCurrentThreadId
GetSystemTime
LCMapStringW
CopyFileExA
DeleteFileA
GetStartupInfoW
UnregisterWait
GetStartupInfoA
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
TlsGetValue
TlsAlloc
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
FlushFileBuffers
gdi32
GetCharWidthW
Name
.text
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
113KB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
193B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=107, id=131, productName=VS2008 build 21022, version=21022,
count=55, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=144, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
IOU1HlTQeQfXti5Qaue4N5t9.exe
- SHA256 98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343
- MD5 a6a676051f857d516f6c4bec595a7cfb
- SHA1 10e7c48a109ffbe60fa7ab3585c4bd711942cbd2
- SHA512 df302b28e5897bac668ad1ae2b32d2424af7c8cdf4527ac54ea268e6e9fbf41efe28b236af25ceacb5e5acd95b6c99b8cf95fa735687358a265bd59e2b127ba6
- MD5 SHA1 SHA512
JC2pSzOI0YLF3KGWlIzGFqqp.exe
- SHA256 dab2a18df66f2e74d0831a8b118de6b9df2642ac939cbad0552e30696d644193
- MD5 b15db436045c3f484296acc6cff34a86
- SHA1 346ae322b55e14611f10a64f336aaa9ff6fed68c
- SHA512 804bee37e0a6247ef2edb5dba8d4b6820ff10b0a4cb76e4c039a7242285836ed5255a1f297f8ba96168d9295558844a9fd7ec3a977207f339296a001543c1fd9
- SSDEEP 49152:/JhGe/xVHII4W2qFRCsh7BQ0vLYtA2uORNJet/ylyPj792:/Jcevr2mLS0cT/Mj792
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
06:ca:86:8f:22:c6:23:95:ce:03:17:eb:7b:ae:12:c0:60:6c:a3:42
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
4463288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
96KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
35KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
| ⚛️
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
JntlxTU2VSh_6o3pBeenGZXP.exe
- SHA256 2b3c1a836d3218ccea9f8b01bb6be6949507298f2da9625f8315aefe89bed30b
- MD5 a20f5887bc06dda3e4c4d59d9b00f3ee
- SHA1 837d2cfdb935c67f5c018bcc15e2ac4ee8c741a9
- SHA512 1bf18d9ecd3ef84ae2219752e2b8364313c0fb2f18cacd1608bac7e4c00039a8d8d380f535b0f08f8818d61dcc235519deef63d475e51307278b678ca90cad6d
- SSDEEP 98304:vAQTMV6gJfxdnDTfwPyI6FuWlz0O+SBlnMgxNIopqBwwpU6k:vAPVlfvnDkGFuWImnPxhgrpUf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
21:58:a3:50:44:c0:58:07:95:bf:39:51:77:33:d1:50:6f:a2:4e:93:52:77:1a:91:0f:36:80:f5:d8:9d:52:c4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Akeo Consulting,O=Akeo Consulting,POSTALCODE=F92 D667,STREET=24 Grey Rock,L=Milford,ST=Co. Donegal,C=IE
Chains
Apr 30, 2021
CN=Akeo Consulting,O=Akeo Consulting,POSTALCODE=F92 D667,STREET=24 Grey Rock,L=Milford,ST=Co. Donegal,C=IE
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Akeo Consulting,O=Akeo Consulting,POSTALCODE=F92 D667,STREET=24 Grey Rock,L=Milford,ST=Co. Donegal,C=IE
Serial Number
24:69:26:63:ef:6c:0c:0a:3b:23:cf:a3:10:c3:64:9b
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2018 - Mar 16, 2022
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
6717528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
45KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.vm_sec
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
6.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
LIAbdwyShKY89Z9xSWSzZEGp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9bc6d20da16865822eb0510b8e4d26a36af0b1f7568a214b374c5c0c61d220b5
- MD5 e36bb066704e69c1cd7451a6c3b088a4
- SHA1 9deffcf1e30b044ed118f666b2e96cf50bf2e736
- SHA512 4feff2dc8a3ee793b35d77dbcffe583dc00c905ccb76d2d88c1fc290a2d77ff49d1e59d996be37662d222dd612ad79484be9ef864a6a5cbab9c7fae1218cdd41
- SSDEEP 192:1rHXcaPGRnTCwIprgLmQLdYNHKdIP+V5mbRyfLV7mBp:17XcaPGRnTsgLXLKNHKdIP4IgfLV7mB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Administrator\AppData\Roaming\Vision\obj\Debug\WindowsFormsApplication1.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ls1JHbNzSCujAe0rcXjY2nJE.exe
- IMPHASH 4dcb3c3a3fe5e134dd41266130cc79d2
- SHA256 46d153d7d517ea834af83364c01388f5c4af458c359625244aa7bac158e8bff2
- MD5 ac7f28f999ef6657abc24673642b518a
- SHA1 37c701301ba28e8329f7c990a790320d021331a0
- SHA512 d45fe4a99c81d2221ebb4b537a23ac2a64e05defb8c789eb8a716af30685d2ca5963e8caeadcaec74e5ea588311ea59509077f14870193408114b261e7b97370
- SSDEEP 6144:38Gjn4iGmFj3lToLMjHxWs0YMaGahpgxSDj4SmsLdnAJ:jnfGmRVTL74mpgSDkudnA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\wifidazelocini\zupet8.pdb
kernel32
GetCommandLineW
FileTimeToDosDateTime
SetThreadContext
GetNativeSystemInfo
SetFilePointer
lstrlenA
CopyFileExW
TlsGetValue
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
GetSystemWindowsDirectoryW
GlobalLock
WaitForSingleObject
SetEvent
FreeEnvironmentStringsA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetSystemTimeAsFileTime
QueryActCtxW
GetDriveTypeA
GetPriorityClass
LoadLibraryW
GetConsoleMode
GetVersionExW
SetConsoleMode
SetConsoleCursorPosition
GetOverlappedResult
CompareStringW
GetStartupInfoW
GetNamedPipeHandleStateW
LCMapStringA
GetPrivateProfileIntW
CreateDirectoryA
GetFileSizeEx
GetCPInfoExW
GetLastError
IsDBCSLeadByteEx
GetProcAddress
CopyFileA
GetPrivateProfileStringA
LoadLibraryA
OpenMutexA
LocalAlloc
IsSystemResumeAutomatic
SetCurrentDirectoryW
WriteProfileSectionW
HeapWalk
SetNamedPipeHandleState
Process32NextW
SetConsoleTitleW
FindFirstChangeNotificationA
FreeEnvironmentStringsW
EnumResourceNamesA
FatalAppExitA
GetCurrentThreadId
OpenSemaphoreW
FindAtomW
ReadConsoleOutputCharacterW
GetSystemTime
DeleteFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
GetModuleHandleA
user32
GetTitleBarInfo
winhttp
WinHttpReadData
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
69KB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=130, id=131, productName=VS2008 build 21022, version=21022,
count=56, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=141, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Mr4X5srRQR20TfuVZShfsrAN.exe
- IMPHASH ad1c5bf15a899fcfef408e3485448e67
- SHA256 6aef62b3b8890bc22dd99f9b0d48247ae52c69e7ad9e384332658e73c725e40e
- MD5 94c78c311f499024a9f97cfdbb073623
- SHA1 50e91d3eaa06d2183bf8c6c411947304421c5626
- SHA512 29b61f1924f19d073460332950c2316acf769aa40ad7f62a41941160cd8a8da5958e8f96183e0e498afe8558fc3efb3a23f66c7519c142c780c91279ddecb545
- SSDEEP 6144:DQbZ65iKd8Ro5c7bW+7kUyptNv+6FsVAIXRwGA69PZ+9ElvczV:6Z65im8Rb7D7kUyP5cVAIhwGA69B+9uY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
7280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\siwuzux-deliwacecojig18\pihukirazab_yudavatu\vutumewu.pdb
kernel32
SetFilePointer
lstrlenA
GetDriveTypeW
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
CompareFileTime
GetSystemWindowsDirectoryW
GetNamedPipeHandleStateA
WaitForSingleObject
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
VirtualFree
GetConsoleAliasesLengthA
GetPrivateProfileStringW
WaitNamedPipeW
WriteFile
SetCommState
GetCommandLineA
TlsSetValue
GetPriorityClass
GlobalAlloc
GetConsoleMode
TerminateThread
CopyFileW
GetVersionExW
SetConsoleMode
IsProcessorFeaturePresent
GetBinaryTypeA
GetOverlappedResult
CompareStringW
SetThreadContext
GlobalUnlock
VerifyVersionInfoW
CreateDirectoryA
ReleaseActCtx
GetFileSizeEx
SetCurrentDirectoryA
GetCPInfoExW
OpenMutexW
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
WriteProfileSectionA
ResetEvent
OpenWaitableTimerA
LoadLibraryA
CreateSemaphoreW
WriteProfileSectionW
HeapWalk
FindAtomA
Process32NextW
WriteProfileStringA
GetModuleHandleA
FindFirstChangeNotificationA
EnumResourceNamesA
GetConsoleCursorInfo
FatalAppExitA
GetCurrentThreadId
GetSystemTime
LCMapStringW
CopyFileExA
DeleteFileA
GetStartupInfoW
UnregisterWait
GetStartupInfoA
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
TlsGetValue
TlsAlloc
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
FlushFileBuffers
gdi32
GetCharWidthW
Name
.text
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
113KB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
193B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=107, id=131, productName=VS2008 build 21022, version=21022,
count=55, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=144, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
OEmxRS9UaiMPqIKXPz6Ef8jI.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d
- MD5 34c76bcc1506b513c7a1ac605c045c4e
- SHA1 271c6b3853e33e039242da7cf8f4465c48e90d2e
- SHA512 cb2170b5fa492dcb7df54cfd7f4ad94214de98face0f1710cbad749c79bf322ea1106ace723520486bdeabdf0aa2eefbf70dcc060d61fcda1124298225c36865
- SSDEEP 12288:fhdKHkwkYGXXRJRC7ijHRAWteLwnHdYnXQ6mr4ZFrUD:fzKYQv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
607394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
586KB
Virtual Size
585KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
OvVYhhgvd6ZhUony5cRMqVoB.exe
- SHA256 dab2a18df66f2e74d0831a8b118de6b9df2642ac939cbad0552e30696d644193
- MD5 b15db436045c3f484296acc6cff34a86
- SHA1 346ae322b55e14611f10a64f336aaa9ff6fed68c
- SHA512 804bee37e0a6247ef2edb5dba8d4b6820ff10b0a4cb76e4c039a7242285836ed5255a1f297f8ba96168d9295558844a9fd7ec3a977207f339296a001543c1fd9
- SSDEEP 49152:/JhGe/xVHII4W2qFRCsh7BQ0vLYtA2uORNJet/ylyPj792:/Jcevr2mLS0cT/Mj792
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
06:ca:86:8f:22:c6:23:95:ce:03:17:eb:7b:ae:12:c0:60:6c:a3:42
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
4463288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
96KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
35KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
| ⚛️
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
QKvpJeDIaPtXDcwKwH_WmAYY.exe
- SHA256 844c20ca22a32cb2b23ff601dd070dfc800240bbcb2cbd825f3d3b325ad18a5f
- MD5 a7feb91676ca65d3da71c8ff8798e2ec
- SHA1 96b60cacea9e992ae9eef8e159d51e50bb0c7a79
- SHA512 d029d1e3746ae2c0dbf3351efbd744bdfef15fa9462de1cd35a4c5624d60365e5432e8ce7c49953b01df67f82525f35b79da371affc047e859ee61f60dbf9d75
- SSDEEP 49152:yzaIawrFIsU6+anPakV7/HFangWtl4UjhlXAl6RUbbzRMWv5pKJa2Xkut:yzzaOBU6++PrV7/lDmhxAl6UbbzRMWba
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f4:4a:15:b6:c0:fa:b9:f1:27:50:24:12:fe:ac:42:8a:11:23:e5:3e
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
4460120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
189KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
27KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
| ⚛️
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
QwnNK2SHckcc_GsoTwi8hDi5.exe
- SHA256 98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343
- MD5 a6a676051f857d516f6c4bec595a7cfb
- SHA1 10e7c48a109ffbe60fa7ab3585c4bd711942cbd2
- SHA512 df302b28e5897bac668ad1ae2b32d2424af7c8cdf4527ac54ea268e6e9fbf41efe28b236af25ceacb5e5acd95b6c99b8cf95fa735687358a265bd59e2b127ba6
- MD5 SHA1 SHA512
fCe2q13vzDk3gxn554bfaSDi.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 318ca6786488302f65aa4989d7be9b8ae25225ceef57894ef47e485153742170
- MD5 956c60ba7d7d44f04b4d9ae2db9f723e
- SHA1 5b254193558cd413b015cd7efe7633e8712ffcb5
- SHA512 e5b10f641a8544f873ae23c37e0a7d850a0e59b012f0bf01d0a75382e3728436ff2c0077b8a61c71008ec44739fadedc5bdd1f33d052acf589dd944918fa1945
- SSDEEP 12288:/kX6fGXRvt07nyHJXqiVZ1bhBeGkdq2MF5Jc2mh8IWvcdxCwEGP5WnDbt+MsD1:cqmJX/Pdjehdvgc38IWkiwJInD9s1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
976190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
945KB
Virtual Size
945KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
fyiHA5hP7V19p7libPJSzjUi.exe
- IMPHASH ab6a8b01372d51e7fed6c22dcfc42852
- SHA256 bddcd5eba3036a21b11e6d6d3cbe84daf562db27814adf7e32b5cc103d3c25d3
- MD5 145bf5658332302310a7fe40ed77783d
- SHA1 5370ac46379b8db9d9fca84f21d411687109486f
- SHA512 d3d9a8231f256efee7ce7ba6841d78c598dc912e7e5d503a9a094e6303d0f9f165a60c5370f353076b1f592d7d9ee6765d0ba4863a1c4935bb47e2ffa4ffb776
- SSDEEP 6144:QIH2L4AqFKDXavv7HPdVVJ31H0WJhtJSOi4k/YjN6+7i3eWQj3KWS/jrAZcEujqY:WLKFKqvz3CehLSO+YjN43jRPoZNm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\yanoy_lakupozejo.pdb
kernel32
GetCommandLineW
FileTimeToDosDateTime
SetThreadContext
GetNativeSystemInfo
SetFilePointer
lstrlenA
CopyFileExW
TlsGetValue
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
GetSystemWindowsDirectoryW
GlobalLock
WaitForSingleObject
SetEvent
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetDriveTypeA
GetPriorityClass
LoadLibraryW
GetConsoleMode
TerminateThread
GetVersionExW
SetConsoleMode
SetConsoleCursorPosition
ReadFile
GetOverlappedResult
CompareStringW
GetStartupInfoW
GetNamedPipeHandleStateW
GetPrivateProfileIntW
CreateDirectoryA
GetFileSizeEx
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
CopyFileA
GetPrivateProfileStringA
LoadLibraryA
OpenMutexA
LocalAlloc
IsSystemResumeAutomatic
SetCurrentDirectoryW
WriteProfileSectionW
HeapWalk
SetNamedPipeHandleState
Process32NextW
SetConsoleTitleW
FindFirstChangeNotificationA
FreeEnvironmentStringsW
EnumResourceNamesA
FatalAppExitA
GetCurrentThreadId
GetCPInfoExA
FindAtomW
GetSystemTime
LCMapStringW
DeleteFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
GetModuleHandleA
user32
GetTitleBarInfo
winhttp
WinHttpReadData
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
113KB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
193B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=130, id=131, productName=VS2008 build 21022, version=21022,
count=56, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=142, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
g7l9WKrAOrjeKD80YHStHQec.exe
- IMPHASH 5c06a288f07d43206aca52d5d94444b2
- SHA256 3593247c384586966e5a0e28eb4c4174b31e93c78c7a9e8fef96ec42a152e509
- MD5 592404767648b0afc3cab6fade2fb7d2
- SHA1 bab615526528b498a09d76decbf86691807e7822
- SHA512 83819e4956ac6da21c4927fa6edee2b178bc89bcda8fb5f4d0767d0d8310393f50f0f7e76e1a963002626a8176abfa8d864c9229a41e5b61e1a24a32d379dda9
- SSDEEP 12288:axGt1KIgj5TJuWaRGu7a81KE64i5uY4Cgbo73O1kV1nO1GVS9Td01LqB:tKIgKRGuO8gTGYwoS1kVg9q9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\hudozik\kahe 48-vayoyu\zumi\63-kohoyidovebeme49\yepafor.pdb
kernel32
SetThreadContext
SetFilePointer
lstrlenA
CopyFileExW
TlsGetValue
SetLocalTime
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
CompareFileTime
GlobalLock
WaitForSingleObject
SetEvent
OpenSemaphoreA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetCommandLineA
GetDriveTypeA
GetPriorityClass
GetConsoleMode
TerminateThread
GetSystemWindowsDirectoryA
GetVersionExW
SetConsoleMode
IsProcessorFeaturePresent
SetConsoleCursorPosition
ReadFile
GetOverlappedResult
CompareStringW
GetStartupInfoW
GetNamedPipeHandleStateW
GetPrivateProfileIntW
CreateDirectoryA
GetFileSizeEx
SetCurrentDirectoryA
SetThreadLocale
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
CopyFileA
GetPrivateProfileStringA
LoadLibraryA
OpenMutexA
LocalAlloc
IsSystemResumeAutomatic
WriteProfileSectionW
HeapWalk
SetNamedPipeHandleState
SetConsoleTitleW
FindFirstChangeNotificationA
FreeEnvironmentStringsW
EnumResourceNamesA
WriteProfileStringW
FatalAppExitA
GetCurrentThreadId
GetCPInfoExA
FindAtomW
LCMapStringW
DeleteFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
GetModuleHandleA
user32
GetTitleBarInfo
winhttp
WinHttpCloseHandle
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
405KB
Virtual Size
31.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=130, id=131, productName=VS2008 build 21022, version=21022,
count=56, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=143, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
gDFl9ioE4T5EqggsHpQDkpD0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 eec05dc9ade2a7ee74ea5fb115bdd687b457d1f81841238a61e9775d6cc4bfa6
- MD5 29903569f45cc9979551427cc5d9fd99
- SHA1 0487682dd1300b26cea9275a405c8ad3383a1583
- SHA512 f8f29c163bfabc90ade4981523feb943656cc20a562e5b4f6f2c6788f781408aec39114a129e765332aa0022d154d4516e9cb56bc01762b114833fddb30d23fb
- SSDEEP 12288:+zoXpiQ70M3HvlvGWE/FckBRi+9wjQPf48a6EzMzPxiDOZ1z4/2fH:T2GlvGkC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
604762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
583KB
Virtual Size
582KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
672B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
i2fKeVg8_CAPGRNvdEpuWHxY.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9bc6d20da16865822eb0510b8e4d26a36af0b1f7568a214b374c5c0c61d220b5
- MD5 e36bb066704e69c1cd7451a6c3b088a4
- SHA1 9deffcf1e30b044ed118f666b2e96cf50bf2e736
- SHA512 4feff2dc8a3ee793b35d77dbcffe583dc00c905ccb76d2d88c1fc290a2d77ff49d1e59d996be37662d222dd612ad79484be9ef864a6a5cbab9c7fae1218cdd41
- SSDEEP 192:1rHXcaPGRnTCwIprgLmQLdYNHKdIP+V5mbRyfLV7mBp:17XcaPGRnTsgLXLKNHKdIP4IgfLV7mB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Administrator\AppData\Roaming\Vision\obj\Debug\WindowsFormsApplication1.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
i_rtEkRUwNuf7SQBBBv9YzhJ.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d
- MD5 34c76bcc1506b513c7a1ac605c045c4e
- SHA1 271c6b3853e33e039242da7cf8f4465c48e90d2e
- SHA512 cb2170b5fa492dcb7df54cfd7f4ad94214de98face0f1710cbad749c79bf322ea1106ace723520486bdeabdf0aa2eefbf70dcc060d61fcda1124298225c36865
- SSDEEP 12288:fhdKHkwkYGXXRJRC7ijHRAWteLwnHdYnXQ6mr4ZFrUD:fzKYQv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
607394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
586KB
Virtual Size
585KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
iv1ZBvsZiT5PvxpOdFrdn024.exe
- SHA256 98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343
- MD5 a6a676051f857d516f6c4bec595a7cfb
- SHA1 10e7c48a109ffbe60fa7ab3585c4bd711942cbd2
- SHA512 df302b28e5897bac668ad1ae2b32d2424af7c8cdf4527ac54ea268e6e9fbf41efe28b236af25ceacb5e5acd95b6c99b8cf95fa735687358a265bd59e2b127ba6
- MD5 SHA1 SHA512
jFnkmB7oBiIVUoCTSJTevBck.exe
- SHA256 98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343
- MD5 a6a676051f857d516f6c4bec595a7cfb
- SHA1 10e7c48a109ffbe60fa7ab3585c4bd711942cbd2
- SHA512 df302b28e5897bac668ad1ae2b32d2424af7c8cdf4527ac54ea268e6e9fbf41efe28b236af25ceacb5e5acd95b6c99b8cf95fa735687358a265bd59e2b127ba6
- MD5 SHA1 SHA512
kKePDdd93KLKBNdrEa1mO5PU.exe
- SHA256 2b3c1a836d3218ccea9f8b01bb6be6949507298f2da9625f8315aefe89bed30b
- MD5 a20f5887bc06dda3e4c4d59d9b00f3ee
- SHA1 837d2cfdb935c67f5c018bcc15e2ac4ee8c741a9
- SHA512 1bf18d9ecd3ef84ae2219752e2b8364313c0fb2f18cacd1608bac7e4c00039a8d8d380f535b0f08f8818d61dcc235519deef63d475e51307278b678ca90cad6d
- SSDEEP 98304:vAQTMV6gJfxdnDTfwPyI6FuWlz0O+SBlnMgxNIopqBwwpU6k:vAPVlfvnDkGFuWImnPxhgrpUf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
21:58:a3:50:44:c0:58:07:95:bf:39:51:77:33:d1:50:6f:a2:4e:93:52:77:1a:91:0f:36:80:f5:d8:9d:52:c4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Akeo Consulting,O=Akeo Consulting,POSTALCODE=F92 D667,STREET=24 Grey Rock,L=Milford,ST=Co. Donegal,C=IE
Chains
Apr 30, 2021
CN=Akeo Consulting,O=Akeo Consulting,POSTALCODE=F92 D667,STREET=24 Grey Rock,L=Milford,ST=Co. Donegal,C=IE
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Akeo Consulting,O=Akeo Consulting,POSTALCODE=F92 D667,STREET=24 Grey Rock,L=Milford,ST=Co. Donegal,C=IE
Serial Number
24:69:26:63:ef:6c:0c:0a:3b:23:cf:a3:10:c3:64:9b
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2018 - Mar 16, 2022
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
6717528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
45KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.vm_sec
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
6.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
kmgrjiOzeHTUfeCfQZLTyC5N.exe
- IMPHASH c3357f55d714ba99dcfee6966059bf12
- SHA256 d8f723849493f85b6bd44cf8b94261f30ff26fa3080d5e53b537a5eacfdd873d
- MD5 73ca4c10afa6a3f712facb40aa8254ae
- SHA1 ad824606d6c465a46296b736e8fa116bb67309a3
- SHA512 9c71e25022b678025a0465c8b5e92f99f2a957c4c3601b6e1617c48e19881e36da94c3ac87d6b05a6116088137be69fc67e61cbd8eac9dc8da26bbde571de907
- SSDEEP 6144:W5cg4yf/CHeM7JSjrkIKN3xyGUyOxDIjl+WMIzgjnHwpR3G8WhQg1CM1SzQf+:Tgffa+Mt1zhUBxDi4WQHxJQwZg/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
61:be:cd:28:5a:34:ab:88:7c:3e:6b:3a:86:f9:d8:f5:3e:4b:c4:05:cc:73:48:ac:c6:46:bf:67:83:d9:ff:1e
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,ST=Berlin,C=DE
Chains
Jun 21, 2021
CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,ST=Berlin,C=DE
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=MAGIX Software GmbH,O=MAGIX Software GmbH,L=Berlin,ST=Berlin,C=DE
Serial Number
57:1c:5f:05:7e:b9:03:c6:51:87:11:e1:56:c4:e7:5f
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 3, 2020 - May 3, 2023
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
5
Entry point
8160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\zav\nonukasag.pdb
kernel32
GetCommandLineW
FileTimeToDosDateTime
SetThreadContext
GetNativeSystemInfo
SetFilePointer
lstrlenA
CopyFileExW
TlsGetValue
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
GetSystemWindowsDirectoryW
GlobalLock
WaitForSingleObject
SetEvent
FreeEnvironmentStringsA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetDriveTypeA
GetPriorityClass
LoadLibraryW
GetConsoleMode
TerminateThread
GetVersionExW
SetConsoleMode
SetConsoleCursorPosition
ReadFile
GetOverlappedResult
CompareStringW
GetStartupInfoW
GetNamedPipeHandleStateW
LCMapStringA
GetPrivateProfileIntW
CreateDirectoryA
GetFileSizeEx
GetCPInfoExW
GetLastError
IsDBCSLeadByteEx
GetProcAddress
CopyFileA
GetPrivateProfileStringA
LoadLibraryA
OpenMutexA
LocalAlloc
IsSystemResumeAutomatic
SetCurrentDirectoryW
WriteProfileSectionW
HeapWalk
SetNamedPipeHandleState
Process32NextW
SetConsoleTitleW
FindFirstChangeNotificationA
FreeEnvironmentStringsW
EnumResourceNamesA
FatalAppExitA
GetCurrentThreadId
OpenSemaphoreW
FindAtomW
ReadConsoleOutputCharacterW
GetSystemTime
DeleteFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
GetModuleHandleA
user32
GetTitleBarInfo
winhttp
WinHttpReadData
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
141KB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=130, id=131, productName=VS2008 build 21022, version=21022,
count=56, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=142, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
kmjYXGku7HcbPExGV5LKn8eF.exe
- SHA256 98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343
- MD5 a6a676051f857d516f6c4bec595a7cfb
- SHA1 10e7c48a109ffbe60fa7ab3585c4bd711942cbd2
- SHA512 df302b28e5897bac668ad1ae2b32d2424af7c8cdf4527ac54ea268e6e9fbf41efe28b236af25ceacb5e5acd95b6c99b8cf95fa735687358a265bd59e2b127ba6
- MD5 SHA1 SHA512
kqJBUpX_tSxtbgjxLMOmMWxd.exe
- SHA256 844c20ca22a32cb2b23ff601dd070dfc800240bbcb2cbd825f3d3b325ad18a5f
- MD5 a7feb91676ca65d3da71c8ff8798e2ec
- SHA1 96b60cacea9e992ae9eef8e159d51e50bb0c7a79
- SHA512 d029d1e3746ae2c0dbf3351efbd744bdfef15fa9462de1cd35a4c5624d60365e5432e8ce7c49953b01df67f82525f35b79da371affc047e859ee61f60dbf9d75
- SSDEEP 49152:yzaIawrFIsU6+anPakV7/HFangWtl4UjhlXAl6RUbbzRMWv5pKJa2Xkut:yzzaOBU6++PrV7/lDmhxAl6UbbzRMWba
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f4:4a:15:b6:c0:fa:b9:f1:27:50:24:12:fe:ac:42:8a:11:23:e5:3e
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
4460120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
189KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
27KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
| ⚛️
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ma_5nZD3yos0uV8jzHnJSVxT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b8f88d0b48fbf8c1eac3d72272ddc48c723cbf8ba0527fdf42ad20cc5724ab9f
- MD5 ec3921304077e2ac56d2f5060adab3d5
- SHA1 923cf378ec34c6d660f88c7916c083bedb9378aa
- SHA512 3796aab3dd9822ba41b57ef009166e4f99adab87cf279f9d86d4d7f227128da8faf2da7290e84ebffc11f1e8d17dfd0d8db9c2691e7fc08a93a02f748e293d28
- SSDEEP 3072:T17+hYe5fY7GFGRGkhRFLRYXGd171jpxszmiGAGRC2:J7ii7R9FgGNHszmiGxRC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
104846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
pnDF_dk604_fxVsUaLPL1Vfi.exe
- IMPHASH 290057969690a7d76b2c7d89d0ec8c78
- SHA256 8acc169eac0f47377ad2a34a4fe277b73431f26cf3b262728bc1a8f17020c3e8
- MD5 85d019feb83854aa587fb13a34d1e2e7
- SHA1 5af4a2e70f32dc2705d3517260341456249b96b7
- SHA512 aa0baabd8d2533464b1ce752f14adbaf93da91abad85a10bdbef4463f4c260f224deb37ac332221b9e7eee053f58eaca96fe44f679d8d8cbcfb75a04ffaa953d
- SSDEEP 12288:uN1kItBnm0Z1/kjkTD59+rLiFn7s0ZEfCsWre/W:fItBnWjEDqrL87jZ34/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8944
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\jun.pdb
kernel32
SetFilePointer
lstrlenA
CopyFileExW
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
CompareFileTime
GetNamedPipeHandleStateA
GlobalLock
WaitForSingleObject
SetEvent
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetPrivateProfileStringW
GetCommandLineA
GetDriveTypeA
TlsSetValue
GetPriorityClass
GlobalAlloc
GetConsoleMode
TerminateThread
GetSystemWindowsDirectoryA
SetConsoleMode
IsProcessorFeaturePresent
ReadFile
GetBinaryTypeW
GetOverlappedResult
CompareStringW
SetThreadContext
GetPrivateProfileIntW
CreateDirectoryA
ReleaseActCtx
GetFileSizeEx
SetCurrentDirectoryA
OpenMutexW
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
CopyFileA
LoadLibraryA
CreateSemaphoreW
WriteProfileSectionW
HeapWalk
Process32NextW
SetConsoleTitleW
GetModuleHandleA
FindFirstChangeNotificationA
EnumResourceNamesA
WriteProfileStringW
GetConsoleCursorInfo
FatalAppExitA
GetCurrentThreadId
GetCPInfoExA
GetVersionExA
FindAtomW
FindActCtxSectionStringW
UnregisterWaitEx
GetSystemTime
LCMapStringW
DeleteFileA
GetStartupInfoW
UnregisterWait
WideCharToMultiByte
HeapValidate
IsBadReadPtr
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsFree
SetLastError
Sleep
ExitProcess
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
GetModuleFileNameA
WriteFile
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
RtlUnwind
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
gdi32
GetCharWidthW
winhttp
WinHttpCloseHandle
Name
.text
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
403KB
Virtual Size
31.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=109, id=131, productName=VS2008 build 21022, version=21022,
count=54, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=147, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
q_TzaanAkp60Doa2Vt025l91.exe
- SHA256 492f4d8cae0b2cd6105f089b368d322bf6e388a803890f5196d5ccc4ac85bb04
- MD5 f4f313d1f82fa87e710bd947a3667384
- SHA1 6ac08dd818b3dac502041508399f8c6392668521
- SHA512 97e4af0f46fa9e9b3d5a916af3a50bb6c9ba4df8fd5d63c63764f2a421f0eb04b4d48df2293152dcbe6184ffeb8adb9552d250aaab0e2f95ffdea443a853b59a
- SSDEEP 49152:zKQVnnBfPya5I4GMsUvwYcD9mKDGYNUe5hBlg1RIpxfFF:vtBXPTG74wYtiGY73xj
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5a:b6:dc:85:ab:29:8b:15:90:fa:52:4d:e6:ee:46:e0:00:5c:aa:6a
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
4459856
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
189KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
52KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
| ⚛️
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ