909aaea4a3072305c0bcaab9d7b9cab70990305541db276ab8d870e3fbc51a18
- SHA256 909aaea4a3072305c0bcaab9d7b9cab70990305541db276ab8d870e3fbc51a18
Overview
overview
10Static
static
7Mr4X5srRQR...AN.exe
windows7-x64
10Mr4X5srRQR...AN.exe
windows10-2004-x64
10OEmxRS9Uai...jI.exe
windows7-x64
10OEmxRS9Uai...jI.exe
windows10-2004-x64
10OvVYhhgvd6...oB.exe
windows7-x64
9OvVYhhgvd6...oB.exe
windows10-2004-x64
9QKvpJeDIaP...YY.exe
windows7-x64
9QKvpJeDIaP...YY.exe
windows10-2004-x64
9QxZsdXOO8X...jN.exe
windows7-x64
10QxZsdXOO8X...jN.exe
windows10-2004-x64
10QzUu4XgUxQ...C3.exe
windows7-x64
10QzUu4XgUxQ...C3.exe
windows10-2004-x64
10SHSPDO6BYD...j9.exe
windows7-x64
10SHSPDO6BYD...j9.exe
windows10-2004-x64
10SqCuVl85T1...Di.exe
windows7-x64
10SqCuVl85T1...Di.exe
windows10-2004-x64
10T8Ulrjj8F6..._x.exe
windows7-x64
10T8Ulrjj8F6..._x.exe
windows10-2004-x64
10Trj0QcTNVE...S9.exe
windows7-x64
10Trj0QcTNVE...S9.exe
windows10-2004-x64
10Uwc7l02Hzj...tU.exe
windows7-x64
Uwc7l02Hzj...tU.exe
windows10-2004-x64
1VoTrXaqIJ3...LW.exe
windows7-x64
10VoTrXaqIJ3...LW.exe
windows10-2004-x64
10Wp77te7Dqj...Hr.exe
windows7-x64
9Wp77te7Dqj...Hr.exe
windows10-2004-x64
9XOCYAkm_Nn...Q3.exe
windows7-x64
10XOCYAkm_Nn...Q3.exe
windows10-2004-x64
10Xd_XnNqsZT...Ai.exe
windows7-x64
10Xd_XnNqsZT...Ai.exe
windows10-2004-x64
10Xr9ca9oQNQ...Z9.exe
windows7-x64
9Xr9ca9oQNQ...Z9.exe
windows10-2004-x64
9Behavioral task
behavioral1
Sample
Mr4X5srRQR20TfuVZShfsrAN.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mr4X5srRQR20TfuVZShfsrAN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
OEmxRS9UaiMPqIKXPz6Ef8jI.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
OEmxRS9UaiMPqIKXPz6Ef8jI.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
OvVYhhgvd6ZhUony5cRMqVoB.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
OvVYhhgvd6ZhUony5cRMqVoB.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
QKvpJeDIaPtXDcwKwH_WmAYY.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
QKvpJeDIaPtXDcwKwH_WmAYY.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
QxZsdXOO8Xn2bW7iW8ff3gjN.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
QxZsdXOO8Xn2bW7iW8ff3gjN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral11
Sample
QzUu4XgUxQuvhFNx7Nf5D6C3.exe
Resource
win7-20240903-en
windows7-x64
30 signatures
150 seconds
Behavioral task
behavioral12
Sample
QzUu4XgUxQuvhFNx7Nf5D6C3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral13
Sample
SHSPDO6BYDV7xlwsZDJxsLj9.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral14
Sample
SHSPDO6BYDV7xlwsZDJxsLj9.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral15
Sample
SqCuVl85T1P8OuH3gpVMKnDi.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
SqCuVl85T1P8OuH3gpVMKnDi.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral17
Sample
T8Ulrjj8F65YXJ2qZEm11v_x.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral18
Sample
T8Ulrjj8F65YXJ2qZEm11v_x.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral19
Sample
Trj0QcTNVE3l8SBp_3LNLFS9.exe
Resource
win7-20241023-en
windows7-x64
30 signatures
150 seconds
Behavioral task
behavioral20
Sample
Trj0QcTNVE3l8SBp_3LNLFS9.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral21
Sample
Uwc7l02HzjEVLDdBFF3ZKItU.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Uwc7l02HzjEVLDdBFF3ZKItU.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
VoTrXaqIJ3vc2GnUIU6Wi5LW.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral24
Sample
VoTrXaqIJ3vc2GnUIU6Wi5LW.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral25
Sample
Wp77te7DqjxTjTIGMDSB0RHr.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
Wp77te7DqjxTjTIGMDSB0RHr.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
XOCYAkm_NnnfPmgVDNgu9MQ3.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral28
Sample
XOCYAkm_NnnfPmgVDNgu9MQ3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral29
Sample
Xd_XnNqsZTJJf8dCq4s_mlAi.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
Xd_XnNqsZTJJf8dCq4s_mlAi.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral31
Sample
Xr9ca9oQNQWbUwEgChRmX6Z9.exe
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
General
- Target 909aaea4a3072305c0bcaab9d7b9cab70990305541db276ab8d870e3fbc51a18
- Size 33.0MB
- Sample241108-sfkmbavblm
- SHA256 909aaea4a3072305c0bcaab9d7b9cab70990305541db276ab8d870e3fbc51a18
- MD5 e7c4552ea9e58373f3b1dd76236c0817
- SHA1 31269b693b8bb5ece8453ce53390d9fddda455ce
- SHA512 245dd8d99f9aee193e4323b46cd88ee199b9629a6803f472ef783d63cdd865f3005c5fc69d397d5f3bfe8442be3a89af127a1076034e95f53148260fea641dcc
- SSDEEP 786432:W1IA9R2OjsC0K4hXdp6oOi6U3SIJvdt4DUbcSIJvdt4A4HRXIQt74t59nC1y57Iz:qF91sC0K4NVhouMohobC1GJFs
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/OvVYhhgvd6ZhUony5cRMqVoB.exe themida static1/unpack001/QKvpJeDIaPtXDcwKwH_WmAYY.exe themida static1/unpack001/Wp77te7DqjxTjTIGMDSB0RHr.exe themida static1/unpack001/XOCYAkm_NnnfPmgVDNgu9MQ3.exe themida static1/unpack001/Xr9ca9oQNQWbUwEgChRmX6Z9.exe themida static1/unpack001/q_TzaanAkp60Doa2Vt025l91.exe themida - Unsigned PE 19 IoCs
Checks for missing Authenticode signature.
resource unpack001/Mr4X5srRQR20TfuVZShfsrAN.exe unpack001/OEmxRS9UaiMPqIKXPz6Ef8jI.exe unpack001/QxZsdXOO8Xn2bW7iW8ff3gjN.exe unpack001/SHSPDO6BYDV7xlwsZDJxsLj9.exe unpack001/SqCuVl85T1P8OuH3gpVMKnDi.exe unpack001/T8Ulrjj8F65YXJ2qZEm11v_x.exe unpack001/Uwc7l02HzjEVLDdBFF3ZKItU.exe unpack001/VoTrXaqIJ3vc2GnUIU6Wi5LW.exe unpack001/Xd_XnNqsZTJJf8dCq4s_mlAi.exe unpack001/XukfUfK8HAbjc5wMknHwOhFI.exe unpack001/YPTXDeqMC118ip3zHbyxwlns.exe unpack001/ma_5nZD3yos0uV8jzHnJSVxT.exe unpack001/pnDF_dk604_fxVsUaLPL1Vfi.exe unpack001/rgVakr0EruC2FtauFmrgXkxw.exe unpack001/t1fkwFYUEZVXvf_7oFFpVnr4.exe unpack001/tC6gdsFTgl9CBMrK_2QhZX3x.exe unpack001/uMWmES83oduRUCtOU5jzfQkJ.exe unpack001/wTzxLyAQL7H5FI0GIaor5FbA.exe unpack001/xiGD01oEkhh5s50F0Mw8lPVJ.exe
File Explorer
-
909aaea4a3072305c0bcaab9d7b9cab70990305541db276ab8d870e3fbc51a18.rar 33.0MB
-
Mr4X5srRQR20TfuVZShfsrAN.exe.exe 321KB
-
OEmxRS9UaiMPqIKXPz6Ef8jI.exe.exe 589KB
-
OvVYhhgvd6ZhUony5cRMqVoB.exe.exe 2.4MB
-
QKvpJeDIaPtXDcwKwH_WmAYY.exe.exe 2.4MB
-
QwnNK2SHckcc_GsoTwi8hDi5.exe.xml 223B
-
QxZsdXOO8Xn2bW7iW8ff3gjN.exe.exe 317KB
-
QzUu4XgUxQuvhFNx7Nf5D6C3.exe.exe 4.4MB
-
SHSPDO6BYDV7xlwsZDJxsLj9.exe.exe 317KB
-
SqCuVl85T1P8OuH3gpVMKnDi.exe.exe 599KB
-
T8Ulrjj8F65YXJ2qZEm11v_x.exe.exe 586KB
-
Trj0QcTNVE3l8SBp_3LNLFS9.exe.exe 4.4MB
-
Uwc7l02HzjEVLDdBFF3ZKItU.exe.exe 900KB
-
VoTrXaqIJ3vc2GnUIU6Wi5LW.exe.exe 321KB
-
Wp77te7DqjxTjTIGMDSB0RHr.exe.exe 2.4MB
-
XOCYAkm_NnnfPmgVDNgu9MQ3.exe.exe 5.3MB
-
Xd_XnNqsZTJJf8dCq4s_mlAi.exe.exe 273KB
-
Xr9ca9oQNQWbUwEgChRmX6Z9.exe.exe 2.4MB
-
XukfUfK8HAbjc5wMknHwOhFI.exe.exe 1.1MB
-
YPTXDeqMC118ip3zHbyxwlns.exe.exe 1.1MB
-
ma_5nZD3yos0uV8jzHnJSVxT.exe.exe 163KB
-
pnDF_dk604_fxVsUaLPL1Vfi.exe.exe 599KB
-
q_TzaanAkp60Doa2Vt025l91.exe.exe 2.5MB
-
rgVakr0EruC2FtauFmrgXkxw.exe.exe 610KB
-
t1fkwFYUEZVXvf_7oFFpVnr4.exe.exe 163KB
-
tC6gdsFTgl9CBMrK_2QhZX3x.exe.exe 1.0MB
-
tGeiUalbScQ8sPK2KKmKZNga.exe.xml 223B
-
uMWmES83oduRUCtOU5jzfQkJ.exe.exe 264KB
-
v5n1HuUxtaYNHT7sRlXCCwIu.exe.exe 927KB
-
wTzxLyAQL7H5FI0GIaor5FbA.exe.exe 900KB
-
xiGD01oEkhh5s50F0Mw8lPVJ.exe.exe 381KB
-
yBqNUgvOW6iDky2dKdBCi5Fb.exe.exe 927KB
Mr4X5srRQR20TfuVZShfsrAN.exe
- IMPHASH ad1c5bf15a899fcfef408e3485448e67
- SHA256 6aef62b3b8890bc22dd99f9b0d48247ae52c69e7ad9e384332658e73c725e40e
- MD5 94c78c311f499024a9f97cfdbb073623
- SHA1 50e91d3eaa06d2183bf8c6c411947304421c5626
- SHA512 29b61f1924f19d073460332950c2316acf769aa40ad7f62a41941160cd8a8da5958e8f96183e0e498afe8558fc3efb3a23f66c7519c142c780c91279ddecb545
- SSDEEP 6144:DQbZ65iKd8Ro5c7bW+7kUyptNv+6FsVAIXRwGA69PZ+9ElvczV:6Z65im8Rb7D7kUyP5cVAIhwGA69B+9uY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
7280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\siwuzux-deliwacecojig18\pihukirazab_yudavatu\vutumewu.pdb
kernel32
SetFilePointer
lstrlenA
GetDriveTypeW
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
CompareFileTime
GetSystemWindowsDirectoryW
GetNamedPipeHandleStateA
WaitForSingleObject
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
VirtualFree
GetConsoleAliasesLengthA
GetPrivateProfileStringW
WaitNamedPipeW
WriteFile
SetCommState
GetCommandLineA
TlsSetValue
GetPriorityClass
GlobalAlloc
GetConsoleMode
TerminateThread
CopyFileW
GetVersionExW
SetConsoleMode
IsProcessorFeaturePresent
GetBinaryTypeA
GetOverlappedResult
CompareStringW
SetThreadContext
GlobalUnlock
VerifyVersionInfoW
CreateDirectoryA
ReleaseActCtx
GetFileSizeEx
SetCurrentDirectoryA
GetCPInfoExW
OpenMutexW
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
WriteProfileSectionA
ResetEvent
OpenWaitableTimerA
LoadLibraryA
CreateSemaphoreW
WriteProfileSectionW
HeapWalk
FindAtomA
Process32NextW
WriteProfileStringA
GetModuleHandleA
FindFirstChangeNotificationA
EnumResourceNamesA
GetConsoleCursorInfo
FatalAppExitA
GetCurrentThreadId
GetSystemTime
LCMapStringW
CopyFileExA
DeleteFileA
GetStartupInfoW
UnregisterWait
GetStartupInfoA
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
TlsGetValue
TlsAlloc
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
FlushFileBuffers
gdi32
GetCharWidthW
Name
.text
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
113KB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
193B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=107, id=131, productName=VS2008 build 21022, version=21022,
count=55, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=144, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
OEmxRS9UaiMPqIKXPz6Ef8jI.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d
- MD5 34c76bcc1506b513c7a1ac605c045c4e
- SHA1 271c6b3853e33e039242da7cf8f4465c48e90d2e
- SHA512 cb2170b5fa492dcb7df54cfd7f4ad94214de98face0f1710cbad749c79bf322ea1106ace723520486bdeabdf0aa2eefbf70dcc060d61fcda1124298225c36865
- SSDEEP 12288:fhdKHkwkYGXXRJRC7ijHRAWteLwnHdYnXQ6mr4ZFrUD:fzKYQv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
607394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
586KB
Virtual Size
585KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
OvVYhhgvd6ZhUony5cRMqVoB.exe
- SHA256 dab2a18df66f2e74d0831a8b118de6b9df2642ac939cbad0552e30696d644193
- MD5 b15db436045c3f484296acc6cff34a86
- SHA1 346ae322b55e14611f10a64f336aaa9ff6fed68c
- SHA512 804bee37e0a6247ef2edb5dba8d4b6820ff10b0a4cb76e4c039a7242285836ed5255a1f297f8ba96168d9295558844a9fd7ec3a977207f339296a001543c1fd9
- SSDEEP 49152:/JhGe/xVHII4W2qFRCsh7BQ0vLYtA2uORNJet/ylyPj792:/Jcevr2mLS0cT/Mj792
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
06:ca:86:8f:22:c6:23:95:ce:03:17:eb:7b:ae:12:c0:60:6c:a3:42
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
4463288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
96KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
35KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
| ⚛️
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
QKvpJeDIaPtXDcwKwH_WmAYY.exe
- SHA256 844c20ca22a32cb2b23ff601dd070dfc800240bbcb2cbd825f3d3b325ad18a5f
- MD5 a7feb91676ca65d3da71c8ff8798e2ec
- SHA1 96b60cacea9e992ae9eef8e159d51e50bb0c7a79
- SHA512 d029d1e3746ae2c0dbf3351efbd744bdfef15fa9462de1cd35a4c5624d60365e5432e8ce7c49953b01df67f82525f35b79da371affc047e859ee61f60dbf9d75
- SSDEEP 49152:yzaIawrFIsU6+anPakV7/HFangWtl4UjhlXAl6RUbbzRMWv5pKJa2Xkut:yzzaOBU6++PrV7/lDmhxAl6UbbzRMWba
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f4:4a:15:b6:c0:fa:b9:f1:27:50:24:12:fe:ac:42:8a:11:23:e5:3e
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
4460120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
189KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
27KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
| ⚛️
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
QwnNK2SHckcc_GsoTwi8hDi5.exe
- SHA256 98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343
- MD5 a6a676051f857d516f6c4bec595a7cfb
- SHA1 10e7c48a109ffbe60fa7ab3585c4bd711942cbd2
- SHA512 df302b28e5897bac668ad1ae2b32d2424af7c8cdf4527ac54ea268e6e9fbf41efe28b236af25ceacb5e5acd95b6c99b8cf95fa735687358a265bd59e2b127ba6
- MD5 SHA1 SHA512
QxZsdXOO8Xn2bW7iW8ff3gjN.exe
- IMPHASH ab6a8b01372d51e7fed6c22dcfc42852
- SHA256 bddcd5eba3036a21b11e6d6d3cbe84daf562db27814adf7e32b5cc103d3c25d3
- MD5 145bf5658332302310a7fe40ed77783d
- SHA1 5370ac46379b8db9d9fca84f21d411687109486f
- SHA512 d3d9a8231f256efee7ce7ba6841d78c598dc912e7e5d503a9a094e6303d0f9f165a60c5370f353076b1f592d7d9ee6765d0ba4863a1c4935bb47e2ffa4ffb776
- SSDEEP 6144:QIH2L4AqFKDXavv7HPdVVJ31H0WJhtJSOi4k/YjN6+7i3eWQj3KWS/jrAZcEujqY:WLKFKqvz3CehLSO+YjN43jRPoZNm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\yanoy_lakupozejo.pdb
kernel32
GetCommandLineW
FileTimeToDosDateTime
SetThreadContext
GetNativeSystemInfo
SetFilePointer
lstrlenA
CopyFileExW
TlsGetValue
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
GetSystemWindowsDirectoryW
GlobalLock
WaitForSingleObject
SetEvent
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetDriveTypeA
GetPriorityClass
LoadLibraryW
GetConsoleMode
TerminateThread
GetVersionExW
SetConsoleMode
SetConsoleCursorPosition
ReadFile
GetOverlappedResult
CompareStringW
GetStartupInfoW
GetNamedPipeHandleStateW
GetPrivateProfileIntW
CreateDirectoryA
GetFileSizeEx
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
CopyFileA
GetPrivateProfileStringA
LoadLibraryA
OpenMutexA
LocalAlloc
IsSystemResumeAutomatic
SetCurrentDirectoryW
WriteProfileSectionW
HeapWalk
SetNamedPipeHandleState
Process32NextW
SetConsoleTitleW
FindFirstChangeNotificationA
FreeEnvironmentStringsW
EnumResourceNamesA
FatalAppExitA
GetCurrentThreadId
GetCPInfoExA
FindAtomW
GetSystemTime
LCMapStringW
DeleteFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
GetModuleHandleA
user32
GetTitleBarInfo
winhttp
WinHttpReadData
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
113KB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
193B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=130, id=131, productName=VS2008 build 21022, version=21022,
count=56, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=142, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
QzUu4XgUxQuvhFNx7Nf5D6C3.exe
- IMPHASH ad1c5bf15a899fcfef408e3485448e67
- SHA256 37896fe3568822c25970f8b4045e1504b21d7ddc54ccc9bbe85bf7f426f9b8a5
- MD5 7627ef162e039104d830924c3dbdab77
- SHA1 e81996dc45106b349cb8c31eafbc2d353dc2f68b
- SHA512 60501cac5e0b18c7d86624ef82f65696898dad5295f8bf28cd0e18a33e1c35d7efedf0ac7940e59b25367078dc85f7d8510ce765ce170da2613231485b923ae1
- SSDEEP 98304:eeR4o4V2M07mXFtVw5jkUvDo74SivdfVlj5JM+MPZ4rv3U:eeRD4JMmX/VgQUs7rGljDjMPQv3U
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
95:cb:31:f1:cd:a9:ae:1f:48:98:5d:be:2c:9d:ce:7f:d9:4f:b9:9c:5b:34:e3:f0:6f:eb:bd:6d:9d:ef:c8:f8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
POSTALCODE=10051
Chains
Nov 5, 2024
Subject
POSTALCODE=10051
Serial Number
12:70:05:0c:3c:f4:64:de:c1:b8:b0:a8:af:d7:d6:f1
Issuer
POSTALCODE=10051
Timespan
Aug 21, 2021 - Aug 21, 2022
Minor OS version
0
Major OS version
5
Entry point
7280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\vevexokecikayu\dohopocu24.pdb
kernel32
SetFilePointer
lstrlenA
GetDriveTypeW
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
CompareFileTime
GetSystemWindowsDirectoryW
GetNamedPipeHandleStateA
WaitForSingleObject
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
VirtualFree
GetConsoleAliasesLengthA
GetPrivateProfileStringW
WaitNamedPipeW
WriteFile
SetCommState
GetCommandLineA
TlsSetValue
GetPriorityClass
GlobalAlloc
GetConsoleMode
TerminateThread
CopyFileW
GetVersionExW
SetConsoleMode
IsProcessorFeaturePresent
GetBinaryTypeA
GetOverlappedResult
CompareStringW
SetThreadContext
GlobalUnlock
VerifyVersionInfoW
CreateDirectoryA
ReleaseActCtx
GetFileSizeEx
SetCurrentDirectoryA
GetCPInfoExW
OpenMutexW
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
WriteProfileSectionA
ResetEvent
OpenWaitableTimerA
LoadLibraryA
CreateSemaphoreW
WriteProfileSectionW
HeapWalk
FindAtomA
Process32NextW
WriteProfileStringA
GetModuleHandleA
FindFirstChangeNotificationA
EnumResourceNamesA
GetConsoleCursorInfo
FatalAppExitA
GetCurrentThreadId
GetSystemTime
LCMapStringW
CopyFileExA
DeleteFileA
GetStartupInfoW
UnregisterWait
GetStartupInfoA
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
TlsGetValue
TlsAlloc
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
FlushFileBuffers
gdi32
GetCharWidthW
Name
.text
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4.2MB
Virtual Size
35.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=107, id=131, productName=VS2008 build 21022, version=21022,
count=55, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=144, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
SHSPDO6BYDV7xlwsZDJxsLj9.exe
- IMPHASH ab6a8b01372d51e7fed6c22dcfc42852
- SHA256 bddcd5eba3036a21b11e6d6d3cbe84daf562db27814adf7e32b5cc103d3c25d3
- MD5 145bf5658332302310a7fe40ed77783d
- SHA1 5370ac46379b8db9d9fca84f21d411687109486f
- SHA512 d3d9a8231f256efee7ce7ba6841d78c598dc912e7e5d503a9a094e6303d0f9f165a60c5370f353076b1f592d7d9ee6765d0ba4863a1c4935bb47e2ffa4ffb776
- SSDEEP 6144:QIH2L4AqFKDXavv7HPdVVJ31H0WJhtJSOi4k/YjN6+7i3eWQj3KWS/jrAZcEujqY:WLKFKqvz3CehLSO+YjN43jRPoZNm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\yanoy_lakupozejo.pdb
kernel32
GetCommandLineW
FileTimeToDosDateTime
SetThreadContext
GetNativeSystemInfo
SetFilePointer
lstrlenA
CopyFileExW
TlsGetValue
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
GetSystemWindowsDirectoryW
GlobalLock
WaitForSingleObject
SetEvent
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetDriveTypeA
GetPriorityClass
LoadLibraryW
GetConsoleMode
TerminateThread
GetVersionExW
SetConsoleMode
SetConsoleCursorPosition
ReadFile
GetOverlappedResult
CompareStringW
GetStartupInfoW
GetNamedPipeHandleStateW
GetPrivateProfileIntW
CreateDirectoryA
GetFileSizeEx
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
CopyFileA
GetPrivateProfileStringA
LoadLibraryA
OpenMutexA
LocalAlloc
IsSystemResumeAutomatic
SetCurrentDirectoryW
WriteProfileSectionW
HeapWalk
SetNamedPipeHandleState
Process32NextW
SetConsoleTitleW
FindFirstChangeNotificationA
FreeEnvironmentStringsW
EnumResourceNamesA
FatalAppExitA
GetCurrentThreadId
GetCPInfoExA
FindAtomW
GetSystemTime
LCMapStringW
DeleteFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
GetModuleHandleA
user32
GetTitleBarInfo
winhttp
WinHttpReadData
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
113KB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
193B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=130, id=131, productName=VS2008 build 21022, version=21022,
count=56, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=142, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
SqCuVl85T1P8OuH3gpVMKnDi.exe
- IMPHASH 290057969690a7d76b2c7d89d0ec8c78
- SHA256 8acc169eac0f47377ad2a34a4fe277b73431f26cf3b262728bc1a8f17020c3e8
- MD5 85d019feb83854aa587fb13a34d1e2e7
- SHA1 5af4a2e70f32dc2705d3517260341456249b96b7
- SHA512 aa0baabd8d2533464b1ce752f14adbaf93da91abad85a10bdbef4463f4c260f224deb37ac332221b9e7eee053f58eaca96fe44f679d8d8cbcfb75a04ffaa953d
- SSDEEP 12288:uN1kItBnm0Z1/kjkTD59+rLiFn7s0ZEfCsWre/W:fItBnWjEDqrL87jZ34/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8944
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\jun.pdb
kernel32
SetFilePointer
lstrlenA
CopyFileExW
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
CompareFileTime
GetNamedPipeHandleStateA
GlobalLock
WaitForSingleObject
SetEvent
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetPrivateProfileStringW
GetCommandLineA
GetDriveTypeA
TlsSetValue
GetPriorityClass
GlobalAlloc
GetConsoleMode
TerminateThread
GetSystemWindowsDirectoryA
SetConsoleMode
IsProcessorFeaturePresent
ReadFile
GetBinaryTypeW
GetOverlappedResult
CompareStringW
SetThreadContext
GetPrivateProfileIntW
CreateDirectoryA
ReleaseActCtx
GetFileSizeEx
SetCurrentDirectoryA
OpenMutexW
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
CopyFileA
LoadLibraryA
CreateSemaphoreW
WriteProfileSectionW
HeapWalk
Process32NextW
SetConsoleTitleW
GetModuleHandleA
FindFirstChangeNotificationA
EnumResourceNamesA
WriteProfileStringW
GetConsoleCursorInfo
FatalAppExitA
GetCurrentThreadId
GetCPInfoExA
GetVersionExA
FindAtomW
FindActCtxSectionStringW
UnregisterWaitEx
GetSystemTime
LCMapStringW
DeleteFileA
GetStartupInfoW
UnregisterWait
WideCharToMultiByte
HeapValidate
IsBadReadPtr
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsFree
SetLastError
Sleep
ExitProcess
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
GetModuleFileNameA
WriteFile
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
RtlUnwind
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
gdi32
GetCharWidthW
winhttp
WinHttpCloseHandle
Name
.text
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
403KB
Virtual Size
31.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=109, id=131, productName=VS2008 build 21022, version=21022,
count=54, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=147, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
T8Ulrjj8F65YXJ2qZEm11v_x.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 eec05dc9ade2a7ee74ea5fb115bdd687b457d1f81841238a61e9775d6cc4bfa6
- MD5 29903569f45cc9979551427cc5d9fd99
- SHA1 0487682dd1300b26cea9275a405c8ad3383a1583
- SHA512 f8f29c163bfabc90ade4981523feb943656cc20a562e5b4f6f2c6788f781408aec39114a129e765332aa0022d154d4516e9cb56bc01762b114833fddb30d23fb
- SSDEEP 12288:+zoXpiQ70M3HvlvGWE/FckBRi+9wjQPf48a6EzMzPxiDOZ1z4/2fH:T2GlvGkC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
604762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
583KB
Virtual Size
582KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
672B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Trj0QcTNVE3l8SBp_3LNLFS9.exe
- IMPHASH ad1c5bf15a899fcfef408e3485448e67
- SHA256 37896fe3568822c25970f8b4045e1504b21d7ddc54ccc9bbe85bf7f426f9b8a5
- MD5 7627ef162e039104d830924c3dbdab77
- SHA1 e81996dc45106b349cb8c31eafbc2d353dc2f68b
- SHA512 60501cac5e0b18c7d86624ef82f65696898dad5295f8bf28cd0e18a33e1c35d7efedf0ac7940e59b25367078dc85f7d8510ce765ce170da2613231485b923ae1
- SSDEEP 98304:eeR4o4V2M07mXFtVw5jkUvDo74SivdfVlj5JM+MPZ4rv3U:eeRD4JMmX/VgQUs7rGljDjMPQv3U
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
95:cb:31:f1:cd:a9:ae:1f:48:98:5d:be:2c:9d:ce:7f:d9:4f:b9:9c:5b:34:e3:f0:6f:eb:bd:6d:9d:ef:c8:f8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
POSTALCODE=10051
Chains
Nov 5, 2024
Subject
POSTALCODE=10051
Serial Number
12:70:05:0c:3c:f4:64:de:c1:b8:b0:a8:af:d7:d6:f1
Issuer
POSTALCODE=10051
Timespan
Aug 21, 2021 - Aug 21, 2022
Minor OS version
0
Major OS version
5
Entry point
7280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\vevexokecikayu\dohopocu24.pdb
kernel32
SetFilePointer
lstrlenA
GetDriveTypeW
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
CompareFileTime
GetSystemWindowsDirectoryW
GetNamedPipeHandleStateA
WaitForSingleObject
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
VirtualFree
GetConsoleAliasesLengthA
GetPrivateProfileStringW
WaitNamedPipeW
WriteFile
SetCommState
GetCommandLineA
TlsSetValue
GetPriorityClass
GlobalAlloc
GetConsoleMode
TerminateThread
CopyFileW
GetVersionExW
SetConsoleMode
IsProcessorFeaturePresent
GetBinaryTypeA
GetOverlappedResult
CompareStringW
SetThreadContext
GlobalUnlock
VerifyVersionInfoW
CreateDirectoryA
ReleaseActCtx
GetFileSizeEx
SetCurrentDirectoryA
GetCPInfoExW
OpenMutexW
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
WriteProfileSectionA
ResetEvent
OpenWaitableTimerA
LoadLibraryA
CreateSemaphoreW
WriteProfileSectionW
HeapWalk
FindAtomA
Process32NextW
WriteProfileStringA
GetModuleHandleA
FindFirstChangeNotificationA
EnumResourceNamesA
GetConsoleCursorInfo
FatalAppExitA
GetCurrentThreadId
GetSystemTime
LCMapStringW
CopyFileExA
DeleteFileA
GetStartupInfoW
UnregisterWait
GetStartupInfoA
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
TlsGetValue
TlsAlloc
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
FlushFileBuffers
gdi32
GetCharWidthW
Name
.text
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4.2MB
Virtual Size
35.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=107, id=131, productName=VS2008 build 21022, version=21022,
count=55, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=144, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Uwc7l02HzjEVLDdBFF3ZKItU.exe
- IMPHASH 045715ac29c84a0e47dab339e337bc06
- SHA256 435badbad2fc138245a4771a74ebb9075658e294d1bcfcf191ccea466eea825c
- MD5 7714deedb24c3dcfa81dc660dd383492
- SHA1 56fae3ab1186009430e175c73b914c77ed714cc0
- SHA512 2cf05ac9470ab4e6d487ec9e4d7ab36fb2c8ce1405dba01b58934778829c7c4db703818087e0c5fbffe6cf821dfa190427e1205530409359ace2ad416e781c58
- SSDEEP 12288:jx1vJUpzeLkTqhqeEmC7QOZGafeei7fqiHf:H2zIkTgqeEVQO5fess
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
121416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
calc.pdb
shell32
ord165
ShellAboutW
SHGetSpecialFolderPathW
shlwapi
ord225
gdiplus
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetPageUnit
GdipDrawLineI
GdipDrawArcI
GdipFillRectangleI
GdipCloneImage
GdipCreateBitmapFromScan0
GdipDeletePen
GdipCreateFromHDC
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipCloneBitmapAreaI
GdipCreatePen1
GdipDisposeImage
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateSolidFill
advapi32
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegGetValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
EventUnregister
EventRegister
RegCloseKey
RegCreateKeyExW
EventWrite
oleaut32
SysStringLen
SysAllocStringByteLen
VariantClear
VariantInit
SysFreeString
SysAllocString
uxtheme
IsThemeActive
ole32
CoUninitialize
CoInitialize
CoCreateInstance
comctl32
ImageList_Destroy
ImageList_Create
ImageList_Add
ord413
ord410
ord380
ord392
ntdll
WinSqmAddToStreamEx
WinSqmAddToStream
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
lstrlenA
GetModuleHandleW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
GetSystemTime
WaitForSingleObject
CreateEventW
CreateThread
ResetEvent
SetEvent
CloseHandle
GlobalSize
GlobalLock
GlobalUnlock
GlobalAlloc
lstrcmpW
MulDiv
GlobalFindAtomW
FindResourceW
GetLastError
MultiByteToWideChar
GetLocalTime
GetDateFormatW
GetLocaleInfoW
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrcmpiW
LoadLibraryW
GetProcAddress
GetLocaleInfoEx
FreeLibrary
LocalFree
LocalAlloc
LocalReAlloc
GetProfileStringW
lstrlenW
CompareStringW
RegisterApplicationRecoveryCallback
ApplicationRecoveryInProgress
Sleep
ApplicationRecoveryFinished
RegisterApplicationRestart
GetTempFileNameW
SystemTimeToFileTime
CompareFileTime
GetFileAttributesW
FileTimeToSystemTime
CreateFileW
DeleteFileW
LeaveCriticalSection
DeleteCriticalSection
SetLastError
GetModuleHandleExW
EnterCriticalSection
InitializeCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapFree
DelayLoadFailureHook
ResolveDelayLoadedAPI
HeapReAlloc
HeapAlloc
WideCharToMultiByte
FindResourceExW
HeapDestroy
user32
OpenClipboard
GetClipboardData
InvalidateRect
CloseClipboard
EmptyClipboard
SetClipboardData
PostQuitMessage
DefWindowProcW
LoadAcceleratorsW
InsertMenuItemW
RegisterClassExW
SetWindowPlacement
SetForegroundWindow
GetMessageW
TranslateAcceleratorW
GetMessageExtraInfo
TranslateMessage
DispatchMessageW
GetKeyState
IsDialogMessageW
GetClassNameW
GetDC
ReleaseDC
GetSystemMetrics
GetWindowLongW
EnumChildWindows
DrawTextW
SetPropW
SystemParametersInfoW
CheckRadioButton
UpdateWindow
SendDlgItemMessageW
IsDlgButtonChecked
MoveWindow
SetDlgItemInt
GetDlgItemInt
FillRect
GetNextDlgTabItem
MonitorFromWindow
GetMonitorInfoW
OffsetRect
EqualRect
MonitorFromRect
GetClassWord
EnumDesktopWindows
EnumDisplayMonitors
IntersectRect
CopyRect
CreateDialogParamW
GetFocus
CreatePopupMenu
TrackPopupMenu
IsClipboardFormatAvailable
CharNextA
IsWindowEnabled
PostMessageW
GetWindowTextW
GetWindowTextLengthW
EnableWindow
GetWindowLongPtrW
SetWindowLongPtrW
SetWindowLongW
SetClassLongW
SetWindowTextW
GetWindowPlacement
CheckMenuItem
GetSysColor
SetClassLongPtrW
GetClassLongPtrW
DrawMenuBar
SetMenuItemInfoW
AppendMenuW
LoadStringW
GetSubMenu
RemoveMenu
CheckMenuRadioItem
SetFocus
MapWindowPoints
EnableMenuItem
GetMenu
GetClientRect
ShowWindow
CreateWindowExW
DestroyWindow
DialogBoxParamW
EndDialog
SetWindowPos
GetDlgItem
GetWindowRect
SendMessageW
MessageBeep
LoadCursorW
SetCursor
LoadImageW
UnregisterClassA
GetProcessDefaultLayout
GetMenuState
GetParent
rpcrt4
RpcStringFreeW
UuidToStringW
UuidCreate
winmm
timeGetTime
gdi32
CreateDIBSection
GetStockObject
SetBkColor
SetBkMode
CreatePatternBrush
DeleteObject
DeleteDC
EqualRgn
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateRectRgn
CreateCompatibleBitmap
GetRgnBox
LineTo
MoveToEx
ExtCreatePen
GetObjectW
GetTextExtentPoint32W
GetTextMetricsW
CreateSolidBrush
SetTextColor
GetDeviceCaps
CreateCompatibleDC
CreateFontIndirectW
SelectObject
GetTextExtentPointW
msvcrt
difftime
memmove
memset
__C_specific_handler
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
__CxxFrameHandler3
setlocale
__pctype_func
___lc_handle_func
___lc_codepage_func
memcpy
___mb_cur_max_func
_errno
__mb_cur_max
__crtGetStringTypeW
__crtLCMapStringW
__uncaught_exception
isspace
tolower
abort
isalnum
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
time
_cexit
_ismbblead
__setusermatherr
_initterm
_acmdln
_fmode
_commode
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
mbstowcs_s
exit
isdigit
isxdigit
toupper
_purecall
malloc
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
free
isalpha
wcstoul
strcspn
memchr
_wcsrev
strchr
_strtoui64
_strtoi64
sprintf_s
_wtoi64
_i64tow_s
_wcsdup
localeconv
iswalpha
iswdigit
_wcslwr_s
_wcsnicmp
wcsncmp
_itow_s
calloc
wcschr
_wcsicmp
_itoa
_wtoi
_vsnwprintf
wcscat_s
wcscpy_s
_exit
wcstol
wcscmp
Name
.text
Size
473KB
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
372KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=205, version=65501,
count=47, id=207, version=65501,
count=387, id=1, productName=Unmarked objects,
count=31, id=203, version=65501,
count=25, id=206, version=65501,
count=95, id=211, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
VoTrXaqIJ3vc2GnUIU6Wi5LW.exe
- IMPHASH ad1c5bf15a899fcfef408e3485448e67
- SHA256 6aef62b3b8890bc22dd99f9b0d48247ae52c69e7ad9e384332658e73c725e40e
- MD5 94c78c311f499024a9f97cfdbb073623
- SHA1 50e91d3eaa06d2183bf8c6c411947304421c5626
- SHA512 29b61f1924f19d073460332950c2316acf769aa40ad7f62a41941160cd8a8da5958e8f96183e0e498afe8558fc3efb3a23f66c7519c142c780c91279ddecb545
- SSDEEP 6144:DQbZ65iKd8Ro5c7bW+7kUyptNv+6FsVAIXRwGA69PZ+9ElvczV:6Z65im8Rb7D7kUyP5cVAIhwGA69B+9uY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
7280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\siwuzux-deliwacecojig18\pihukirazab_yudavatu\vutumewu.pdb
kernel32
SetFilePointer
lstrlenA
GetDriveTypeW
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
CompareFileTime
GetSystemWindowsDirectoryW
GetNamedPipeHandleStateA
WaitForSingleObject
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
VirtualFree
GetConsoleAliasesLengthA
GetPrivateProfileStringW
WaitNamedPipeW
WriteFile
SetCommState
GetCommandLineA
TlsSetValue
GetPriorityClass
GlobalAlloc
GetConsoleMode
TerminateThread
CopyFileW
GetVersionExW
SetConsoleMode
IsProcessorFeaturePresent
GetBinaryTypeA
GetOverlappedResult
CompareStringW
SetThreadContext
GlobalUnlock
VerifyVersionInfoW
CreateDirectoryA
ReleaseActCtx
GetFileSizeEx
SetCurrentDirectoryA
GetCPInfoExW
OpenMutexW
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
WriteProfileSectionA
ResetEvent
OpenWaitableTimerA
LoadLibraryA
CreateSemaphoreW
WriteProfileSectionW
HeapWalk
FindAtomA
Process32NextW
WriteProfileStringA
GetModuleHandleA
FindFirstChangeNotificationA
EnumResourceNamesA
GetConsoleCursorInfo
FatalAppExitA
GetCurrentThreadId
GetSystemTime
LCMapStringW
CopyFileExA
DeleteFileA
GetStartupInfoW
UnregisterWait
GetStartupInfoA
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
TlsGetValue
TlsAlloc
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
FlushFileBuffers
gdi32
GetCharWidthW
Name
.text
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
113KB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
193B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=107, id=131, productName=VS2008 build 21022, version=21022,
count=55, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=144, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Wp77te7DqjxTjTIGMDSB0RHr.exe
- SHA256 dcdb0bc5e91652e7e3d2269581275c18d8c5eabbde14f9c17c99e5ff49e54a83
- MD5 161b975933aaae18920d241890000dac
- SHA1 1cbbad54762c6301ad9ad2291159b9d2a141c143
- SHA512 758d1d206c887637d0727ba380d94d4cc1bb8a37cc705dbe62435a45c4ebb0ea111c9e9238261da64dd0d8ee5e27fd9851053dffa0359670a165973dd4f91443
- SSDEEP 49152:hlbpFMtUtFOfw2skeX+NPO59F07SwtUcxHBL3a87GV68GK2:hNjCfwWeX+NYCSJWo8aVOJ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
91:c4:2e:88:25:71:b1:4c:39:80:00:28:f9:e3:ca:15:1c:a7:c4:1d
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
4468664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
190KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
31KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
| ⚛️
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
XOCYAkm_NnnfPmgVDNgu9MQ3.exe
- SHA256 c06817143741717add66241dcd4f1b6ce497c6242d78793a69661b47a3796535
- MD5 083da7bfea93dcaac5ca4c910c0c9636
- SHA1 5d94f9e397441ee8bb733122f9dce827b80f7e96
- SHA512 067b5940f3c04bbe908e978b735818cc6e46f8a34a6dfffdf63eca062b855d19a83f12e351dcb5da81464981771bb2a717d39bed9abdd96087cf4cd2996b31b5
- SSDEEP 98304:rHiCdkni6JIK0qZS3HzXCbQbxv3j+oJRfchpT93kWJrnClc3DgIFakHDZ++:OO4N0q4zXqC1TVsZ3bOlczgIND4+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
88:e8:e2:de:9e:f7:34:5a:af:89:eb:03:a4:b0:32:6e:ba:bf:02:1b:c3:ec:9e:9b:8d:a1:4a:a4:aa:67:4a:e0
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Akeo Consulting,O=Akeo Consulting,POSTALCODE=F92 D667,STREET=24 Grey Rock,L=Milford,ST=Co. Donegal,C=IE
Chains
Apr 30, 2021
CN=Akeo Consulting,O=Akeo Consulting,POSTALCODE=F92 D667,STREET=24 Grey Rock,L=Milford,ST=Co. Donegal,C=IE
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Akeo Consulting,O=Akeo Consulting,POSTALCODE=F92 D667,STREET=24 Grey Rock,L=Milford,ST=Co. Donegal,C=IE
Serial Number
24:69:26:63:ef:6c:0c:0a:3b:23:cf:a3:10:c3:64:9b
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2018 - Mar 16, 2022
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
8372312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
45KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.vm_sec
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
7.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
Xd_XnNqsZTJJf8dCq4s_mlAi.exe
- IMPHASH 4dcb3c3a3fe5e134dd41266130cc79d2
- SHA256 46d153d7d517ea834af83364c01388f5c4af458c359625244aa7bac158e8bff2
- MD5 ac7f28f999ef6657abc24673642b518a
- SHA1 37c701301ba28e8329f7c990a790320d021331a0
- SHA512 d45fe4a99c81d2221ebb4b537a23ac2a64e05defb8c789eb8a716af30685d2ca5963e8caeadcaec74e5ea588311ea59509077f14870193408114b261e7b97370
- SSDEEP 6144:38Gjn4iGmFj3lToLMjHxWs0YMaGahpgxSDj4SmsLdnAJ:jnfGmRVTL74mpgSDkudnA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\wifidazelocini\zupet8.pdb
kernel32
GetCommandLineW
FileTimeToDosDateTime
SetThreadContext
GetNativeSystemInfo
SetFilePointer
lstrlenA
CopyFileExW
TlsGetValue
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
GetSystemWindowsDirectoryW
GlobalLock
WaitForSingleObject
SetEvent
FreeEnvironmentStringsA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetSystemTimeAsFileTime
QueryActCtxW
GetDriveTypeA
GetPriorityClass
LoadLibraryW
GetConsoleMode
GetVersionExW
SetConsoleMode
SetConsoleCursorPosition
GetOverlappedResult
CompareStringW
GetStartupInfoW
GetNamedPipeHandleStateW
LCMapStringA
GetPrivateProfileIntW
CreateDirectoryA
GetFileSizeEx
GetCPInfoExW
GetLastError
IsDBCSLeadByteEx
GetProcAddress
CopyFileA
GetPrivateProfileStringA
LoadLibraryA
OpenMutexA
LocalAlloc
IsSystemResumeAutomatic
SetCurrentDirectoryW
WriteProfileSectionW
HeapWalk
SetNamedPipeHandleState
Process32NextW
SetConsoleTitleW
FindFirstChangeNotificationA
FreeEnvironmentStringsW
EnumResourceNamesA
FatalAppExitA
GetCurrentThreadId
OpenSemaphoreW
FindAtomW
ReadConsoleOutputCharacterW
GetSystemTime
DeleteFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
GetModuleHandleA
user32
GetTitleBarInfo
winhttp
WinHttpReadData
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
69KB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=130, id=131, productName=VS2008 build 21022, version=21022,
count=56, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=141, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Xr9ca9oQNQWbUwEgChRmX6Z9.exe
- SHA256 dcdb0bc5e91652e7e3d2269581275c18d8c5eabbde14f9c17c99e5ff49e54a83
- MD5 161b975933aaae18920d241890000dac
- SHA1 1cbbad54762c6301ad9ad2291159b9d2a141c143
- SHA512 758d1d206c887637d0727ba380d94d4cc1bb8a37cc705dbe62435a45c4ebb0ea111c9e9238261da64dd0d8ee5e27fd9851053dffa0359670a165973dd4f91443
- SSDEEP 49152:hlbpFMtUtFOfw2skeX+NPO59F07SwtUcxHBL3a87GV68GK2:hNjCfwWeX+NYCSJWo8aVOJ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
91:c4:2e:88:25:71:b1:4c:39:80:00:28:f9:e3:ca:15:1c:a7:c4:1d
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
4468664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
190KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
31KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
| ⚛️
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
XukfUfK8HAbjc5wMknHwOhFI.exe
- IMPHASH 0b53c587d92252505a138d0d9f3f823f
- SHA256 cd189a8c952420bf33b68cce03b41900e8c784b1010213b097ecdb2d7e8079f7
- MD5 3b4348d187f24c82370836531f3fa94e
- SHA1 a2ca4e9f4a8d9c8634e42765e90e252803e20b15
- SHA512 2bab3c1e38a21cefc06363db75931bf3bfe0b4ee3f089293a750dfc866abc32c7135d2d9ba7ccb005aa01ad02d0a75a5fa02f85ca78cc8fe637615b7fa9e7394
- SSDEEP 24576:eDTLDJqGd+zowht2zmctw1CdvHh82JdjGY6LvxwAgRp54+/jrNtIf:qzdkBTce1CxHh8mlGY6LJBu54MjJaf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
72892
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb
kernel32
GetLastError
SetLastError
CreateFileW
CloseHandle
WriteFile
GetStdHandle
SetFilePointer
SetEndOfFile
FlushFileBuffers
GetFileType
ReadFile
SetFileTime
GetFileAttributesW
SetFileAttributesW
MoveFileW
DeleteFileW
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetVersionExW
GetCurrentDirectoryW
FoldStringW
GetFullPathNameW
GetModuleFileNameW
FindResourceW
GetModuleHandleW
FreeLibrary
GetProcAddress
GetCurrentProcessId
GetLocaleInfoW
GetNumberFormatW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
WaitForSingleObject
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
GetTempPathW
MoveFileExW
UnmapViewOfFile
Sleep
MapViewOfFile
GetCommandLineW
CreateFileMappingW
GetTickCount
GetLocalTime
OpenFileMappingW
LoadLibraryW
GetSystemDirectoryW
ExitProcess
FreeConsole
WriteConsoleW
AttachConsole
AllocConsole
CompareStringW
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
LocalFileTimeToFileTime
WideCharToMultiByte
MultiByteToWideChar
IsDBCSLeadByte
GetCPInfo
GlobalAlloc
SetCurrentDirectoryW
LocalAlloc
InterlockedExchange
LoadLibraryA
RaiseException
HeapFree
RtlUnwind
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetModuleHandleA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
Name
.text
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=26, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=142, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=228, id=1, productName=Unmarked objects,
count=90, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
YPTXDeqMC118ip3zHbyxwlns.exe
- IMPHASH 0b53c587d92252505a138d0d9f3f823f
- SHA256 cd189a8c952420bf33b68cce03b41900e8c784b1010213b097ecdb2d7e8079f7
- MD5 3b4348d187f24c82370836531f3fa94e
- SHA1 a2ca4e9f4a8d9c8634e42765e90e252803e20b15
- SHA512 2bab3c1e38a21cefc06363db75931bf3bfe0b4ee3f089293a750dfc866abc32c7135d2d9ba7ccb005aa01ad02d0a75a5fa02f85ca78cc8fe637615b7fa9e7394
- SSDEEP 24576:eDTLDJqGd+zowht2zmctw1CdvHh82JdjGY6LvxwAgRp54+/jrNtIf:qzdkBTce1CxHh8mlGY6LJBu54MjJaf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
72892
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb
kernel32
GetLastError
SetLastError
CreateFileW
CloseHandle
WriteFile
GetStdHandle
SetFilePointer
SetEndOfFile
FlushFileBuffers
GetFileType
ReadFile
SetFileTime
GetFileAttributesW
SetFileAttributesW
MoveFileW
DeleteFileW
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetVersionExW
GetCurrentDirectoryW
FoldStringW
GetFullPathNameW
GetModuleFileNameW
FindResourceW
GetModuleHandleW
FreeLibrary
GetProcAddress
GetCurrentProcessId
GetLocaleInfoW
GetNumberFormatW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
WaitForSingleObject
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
GetTempPathW
MoveFileExW
UnmapViewOfFile
Sleep
MapViewOfFile
GetCommandLineW
CreateFileMappingW
GetTickCount
GetLocalTime
OpenFileMappingW
LoadLibraryW
GetSystemDirectoryW
ExitProcess
FreeConsole
WriteConsoleW
AttachConsole
AllocConsole
CompareStringW
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
LocalFileTimeToFileTime
WideCharToMultiByte
MultiByteToWideChar
IsDBCSLeadByte
GetCPInfo
GlobalAlloc
SetCurrentDirectoryW
LocalAlloc
InterlockedExchange
LoadLibraryA
RaiseException
HeapFree
RtlUnwind
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetModuleHandleA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
Name
.text
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=26, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=142, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=228, id=1, productName=Unmarked objects,
count=90, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ma_5nZD3yos0uV8jzHnJSVxT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b8f88d0b48fbf8c1eac3d72272ddc48c723cbf8ba0527fdf42ad20cc5724ab9f
- MD5 ec3921304077e2ac56d2f5060adab3d5
- SHA1 923cf378ec34c6d660f88c7916c083bedb9378aa
- SHA512 3796aab3dd9822ba41b57ef009166e4f99adab87cf279f9d86d4d7f227128da8faf2da7290e84ebffc11f1e8d17dfd0d8db9c2691e7fc08a93a02f748e293d28
- SSDEEP 3072:T17+hYe5fY7GFGRGkhRFLRYXGd171jpxszmiGAGRC2:J7ii7R9FgGNHszmiGxRC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
104846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
pnDF_dk604_fxVsUaLPL1Vfi.exe
- IMPHASH 290057969690a7d76b2c7d89d0ec8c78
- SHA256 8acc169eac0f47377ad2a34a4fe277b73431f26cf3b262728bc1a8f17020c3e8
- MD5 85d019feb83854aa587fb13a34d1e2e7
- SHA1 5af4a2e70f32dc2705d3517260341456249b96b7
- SHA512 aa0baabd8d2533464b1ce752f14adbaf93da91abad85a10bdbef4463f4c260f224deb37ac332221b9e7eee053f58eaca96fe44f679d8d8cbcfb75a04ffaa953d
- SSDEEP 12288:uN1kItBnm0Z1/kjkTD59+rLiFn7s0ZEfCsWre/W:fItBnWjEDqrL87jZ34/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8944
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\jun.pdb
kernel32
SetFilePointer
lstrlenA
CopyFileExW
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
CompareFileTime
GetNamedPipeHandleStateA
GlobalLock
WaitForSingleObject
SetEvent
OpenSemaphoreA
FreeEnvironmentStringsA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetPrivateProfileStringW
GetCommandLineA
GetDriveTypeA
TlsSetValue
GetPriorityClass
GlobalAlloc
GetConsoleMode
TerminateThread
GetSystemWindowsDirectoryA
SetConsoleMode
IsProcessorFeaturePresent
ReadFile
GetBinaryTypeW
GetOverlappedResult
CompareStringW
SetThreadContext
GetPrivateProfileIntW
CreateDirectoryA
ReleaseActCtx
GetFileSizeEx
SetCurrentDirectoryA
OpenMutexW
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
CopyFileA
LoadLibraryA
CreateSemaphoreW
WriteProfileSectionW
HeapWalk
Process32NextW
SetConsoleTitleW
GetModuleHandleA
FindFirstChangeNotificationA
EnumResourceNamesA
WriteProfileStringW
GetConsoleCursorInfo
FatalAppExitA
GetCurrentThreadId
GetCPInfoExA
GetVersionExA
FindAtomW
FindActCtxSectionStringW
UnregisterWaitEx
GetSystemTime
LCMapStringW
DeleteFileA
GetStartupInfoW
UnregisterWait
WideCharToMultiByte
HeapValidate
IsBadReadPtr
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsFree
SetLastError
Sleep
ExitProcess
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
GetModuleFileNameA
WriteFile
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
RtlUnwind
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
gdi32
GetCharWidthW
winhttp
WinHttpCloseHandle
Name
.text
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
403KB
Virtual Size
31.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=109, id=131, productName=VS2008 build 21022, version=21022,
count=54, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=147, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
q_TzaanAkp60Doa2Vt025l91.exe
- SHA256 492f4d8cae0b2cd6105f089b368d322bf6e388a803890f5196d5ccc4ac85bb04
- MD5 f4f313d1f82fa87e710bd947a3667384
- SHA1 6ac08dd818b3dac502041508399f8c6392668521
- SHA512 97e4af0f46fa9e9b3d5a916af3a50bb6c9ba4df8fd5d63c63764f2a421f0eb04b4d48df2293152dcbe6184ffeb8adb9552d250aaab0e2f95ffdea443a853b59a
- SSDEEP 49152:zKQVnnBfPya5I4GMsUvwYcD9mKDGYNUe5hBlg1RIpxfFF:vtBXPTG74wYtiGY73xj
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5a:b6:dc:85:ab:29:8b:15:90:fa:52:4d:e6:ee:46:e0:00:5c:aa:6a
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
4459856
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
189KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
52KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
| ⚛️
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
rgVakr0EruC2FtauFmrgXkxw.exe
- IMPHASH 5c06a288f07d43206aca52d5d94444b2
- SHA256 3593247c384586966e5a0e28eb4c4174b31e93c78c7a9e8fef96ec42a152e509
- MD5 592404767648b0afc3cab6fade2fb7d2
- SHA1 bab615526528b498a09d76decbf86691807e7822
- SHA512 83819e4956ac6da21c4927fa6edee2b178bc89bcda8fb5f4d0767d0d8310393f50f0f7e76e1a963002626a8176abfa8d864c9229a41e5b61e1a24a32d379dda9
- SSDEEP 12288:axGt1KIgj5TJuWaRGu7a81KE64i5uY4Cgbo73O1kV1nO1GVS9Td01LqB:tKIgKRGuO8gTGYwoS1kVg9q9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\hudozik\kahe 48-vayoyu\zumi\63-kohoyidovebeme49\yepafor.pdb
kernel32
SetThreadContext
SetFilePointer
lstrlenA
CopyFileExW
TlsGetValue
SetLocalTime
InterlockedIncrement
GetQueuedCompletionStatus
GetCommState
InterlockedDecrement
CompareFileTime
GlobalLock
WaitForSingleObject
SetEvent
OpenSemaphoreA
GetTickCount
CreateNamedPipeW
VirtualFree
GetConsoleAliasesLengthA
GetCommandLineA
GetDriveTypeA
GetPriorityClass
GetConsoleMode
TerminateThread
GetSystemWindowsDirectoryA
GetVersionExW
SetConsoleMode
IsProcessorFeaturePresent
SetConsoleCursorPosition
ReadFile
GetOverlappedResult
CompareStringW
GetStartupInfoW
GetNamedPipeHandleStateW
GetPrivateProfileIntW
CreateDirectoryA
GetFileSizeEx
SetCurrentDirectoryA
SetThreadLocale
GetLastError
IsDBCSLeadByteEx
ReadConsoleOutputCharacterA
GetProcAddress
CopyFileA
GetPrivateProfileStringA
LoadLibraryA
OpenMutexA
LocalAlloc
IsSystemResumeAutomatic
WriteProfileSectionW
HeapWalk
SetNamedPipeHandleState
SetConsoleTitleW
FindFirstChangeNotificationA
FreeEnvironmentStringsW
EnumResourceNamesA
WriteProfileStringW
FatalAppExitA
GetCurrentThreadId
GetCPInfoExA
FindAtomW
LCMapStringW
DeleteFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapValidate
IsBadReadPtr
RaiseException
GetModuleHandleW
Sleep
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
CreateFileA
CloseHandle
GetModuleHandleA
user32
GetTitleBarInfo
winhttp
WinHttpCloseHandle
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
405KB
Virtual Size
31.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=130, id=131, productName=VS2008 build 21022, version=21022,
count=56, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=143, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
t1fkwFYUEZVXvf_7oFFpVnr4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b8f88d0b48fbf8c1eac3d72272ddc48c723cbf8ba0527fdf42ad20cc5724ab9f
- MD5 ec3921304077e2ac56d2f5060adab3d5
- SHA1 923cf378ec34c6d660f88c7916c083bedb9378aa
- SHA512 3796aab3dd9822ba41b57ef009166e4f99adab87cf279f9d86d4d7f227128da8faf2da7290e84ebffc11f1e8d17dfd0d8db9c2691e7fc08a93a02f748e293d28
- SSDEEP 3072:T17+hYe5fY7GFGRGkhRFLRYXGd171jpxszmiGAGRC2:J7ii7R9FgGNHszmiGxRC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
104846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
tC6gdsFTgl9CBMrK_2QhZX3x.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 318ca6786488302f65aa4989d7be9b8ae25225ceef57894ef47e485153742170
- MD5 956c60ba7d7d44f04b4d9ae2db9f723e
- SHA1 5b254193558cd413b015cd7efe7633e8712ffcb5
- SHA512 e5b10f641a8544f873ae23c37e0a7d850a0e59b012f0bf01d0a75382e3728436ff2c0077b8a61c71008ec44739fadedc5bdd1f33d052acf589dd944918fa1945
- SSDEEP 12288:/kX6fGXRvt07nyHJXqiVZ1bhBeGkdq2MF5Jc2mh8IWvcdxCwEGP5WnDbt+MsD1:cqmJX/Pdjehdvgc38IWkiwJInD9s1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
976190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
945KB
Virtual Size
945KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
tGeiUalbScQ8sPK2KKmKZNga.exe
- SHA256 98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343
- MD5 a6a676051f857d516f6c4bec595a7cfb
- SHA1 10e7c48a109ffbe60fa7ab3585c4bd711942cbd2
- SHA512 df302b28e5897bac668ad1ae2b32d2424af7c8cdf4527ac54ea268e6e9fbf41efe28b236af25ceacb5e5acd95b6c99b8cf95fa735687358a265bd59e2b127ba6
- MD5 SHA1 SHA512
uMWmES83oduRUCtOU5jzfQkJ.exe
- IMPHASH fac82e460e0af4a20b962e39865b89c2
- SHA256 8cfa7e9bc6cbd458cec18a25e6f763a3776802490e6b3d451d864c4dba50c437
- MD5 c7ccbd62c259a382501ff67408594011
- SHA1 c1dca912e6c63e3730f261a3b4ba86dec0acd5f3
- SHA512 5f5958363820795f96fff6ad71bc1b59ec01a6a24876c5d22d48efaa49bc55373fca1f8e927c23547cdb494ba46b6d3871f377e607c97d9f10d4e0636ac7ef2b
- SSDEEP 3072:A/vFzYP505Wn7l8V2Rcoh17j89ta9AdHA8HB756aTRg2BNQkRr7fIKT0yB3X:izi7+0RXZ0I987wuRgKj7n
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8621
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\watuyawewucas82\xihi86\muhemozedipine.pdb
kernel32
SetLocalTime
WriteConsoleOutputW
InterlockedIncrement
GetConsoleAliasA
InterlockedDecrement
GetSystemWindowsDirectoryW
GetEnvironmentStringsW
WaitForSingleObject
SetEvent
GetSystemDefaultLCID
GetModuleHandleW
GetConsoleAliasesLengthA
GetConsoleTitleA
GetCompressedFileSizeW
CreateActCtxW
InitializeCriticalSection
GetConsoleCP
GlobalAlloc
GetSystemDirectoryW
GetFileAttributesA
lstrcpynW
SetConsoleCursorPosition
VerifyVersionInfoA
HeapQueryInformation
WritePrivateProfileSectionW
IsBadWritePtr
GetModuleFileNameW
CreateFileW
EnumDateFormatsExW
lstrcatA
GetACP
lstrlenW
FlushFileBuffers
InterlockedExchange
GetCPInfoExW
FillConsoleOutputCharacterW
GetLastError
GetProcAddress
PeekConsoleInputW
CreateTimerQueueTimer
LocalLock
GetConsoleDisplayMode
EnterCriticalSection
SetTimerQueueTimer
GlobalGetAtomNameA
WriteConsoleA
DnsHostnameToComputerNameA
BeginUpdateResourceA
SetEnvironmentVariableA
GetModuleHandleA
EraseTape
CancelTimerQueueTimer
EndUpdateResourceA
ReadConsoleInputW
FindFirstVolumeW
GetCurrentProcessId
AreFileApisANSI
LCMapStringW
LCMapStringA
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
Sleep
ExitProcess
GetCommandLineA
GetStartupInfoA
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
GetCPInfo
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
user32
RealGetWindowClassA
advapi32
AdjustTokenGroups
@GetAnotherVice@12
@SetFirstEverVice@4
Name
.text
Size
178KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
40.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
v5n1HuUxtaYNHT7sRlXCCwIu.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3da0e424a6f1268f5682d59be1f83572479c28ca1fb7dab48d0b53220acef66e
- MD5 0e86a231689637b656a0764f2017d22f
- SHA1 70954ef5b83a7b0cd9dca4542d63bf3a7dc7ac97
- SHA512 21a3195665975ba3ec7b042a19b9ce39b5311e7c96070e7a968e7a1f39514a0df3569e39b313529dbb6b948195cd294077fd5b4e8a81e08a38b4ba2d8f6f6f32
- SSDEEP 12288:bsp0kUKA1PfP5k9FLRqYjtatql9MiwlDwhl6s5Ep7XzNwzVzTEVGp7K1k:bspuHaFLsqkqyEl68E5azVzwVBk
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
00:50:57:fe:10:85:97:70:19:ef:ce:dc:c7:8b:7d:7d:b5:25:85:e1
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
736158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
711KB
Virtual Size
710KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
wTzxLyAQL7H5FI0GIaor5FbA.exe
- IMPHASH 045715ac29c84a0e47dab339e337bc06
- SHA256 435badbad2fc138245a4771a74ebb9075658e294d1bcfcf191ccea466eea825c
- MD5 7714deedb24c3dcfa81dc660dd383492
- SHA1 56fae3ab1186009430e175c73b914c77ed714cc0
- SHA512 2cf05ac9470ab4e6d487ec9e4d7ab36fb2c8ce1405dba01b58934778829c7c4db703818087e0c5fbffe6cf821dfa190427e1205530409359ace2ad416e781c58
- SSDEEP 12288:jx1vJUpzeLkTqhqeEmC7QOZGafeei7fqiHf:H2zIkTgqeEVQO5fess
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
121416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
calc.pdb
shell32
ord165
ShellAboutW
SHGetSpecialFolderPathW
shlwapi
ord225
gdiplus
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetPageUnit
GdipDrawLineI
GdipDrawArcI
GdipFillRectangleI
GdipCloneImage
GdipCreateBitmapFromScan0
GdipDeletePen
GdipCreateFromHDC
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipCloneBitmapAreaI
GdipCreatePen1
GdipDisposeImage
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateSolidFill
advapi32
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegGetValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
EventUnregister
EventRegister
RegCloseKey
RegCreateKeyExW
EventWrite
oleaut32
SysStringLen
SysAllocStringByteLen
VariantClear
VariantInit
SysFreeString
SysAllocString
uxtheme
IsThemeActive
ole32
CoUninitialize
CoInitialize
CoCreateInstance
comctl32
ImageList_Destroy
ImageList_Create
ImageList_Add
ord413
ord410
ord380
ord392
ntdll
WinSqmAddToStreamEx
WinSqmAddToStream
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
lstrlenA
GetModuleHandleW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
GetSystemTime
WaitForSingleObject
CreateEventW
CreateThread
ResetEvent
SetEvent
CloseHandle
GlobalSize
GlobalLock
GlobalUnlock
GlobalAlloc
lstrcmpW
MulDiv
GlobalFindAtomW
FindResourceW
GetLastError
MultiByteToWideChar
GetLocalTime
GetDateFormatW
GetLocaleInfoW
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrcmpiW
LoadLibraryW
GetProcAddress
GetLocaleInfoEx
FreeLibrary
LocalFree
LocalAlloc
LocalReAlloc
GetProfileStringW
lstrlenW
CompareStringW
RegisterApplicationRecoveryCallback
ApplicationRecoveryInProgress
Sleep
ApplicationRecoveryFinished
RegisterApplicationRestart
GetTempFileNameW
SystemTimeToFileTime
CompareFileTime
GetFileAttributesW
FileTimeToSystemTime
CreateFileW
DeleteFileW
LeaveCriticalSection
DeleteCriticalSection
SetLastError
GetModuleHandleExW
EnterCriticalSection
InitializeCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapFree
DelayLoadFailureHook
ResolveDelayLoadedAPI
HeapReAlloc
HeapAlloc
WideCharToMultiByte
FindResourceExW
HeapDestroy
user32
OpenClipboard
GetClipboardData
InvalidateRect
CloseClipboard
EmptyClipboard
SetClipboardData
PostQuitMessage
DefWindowProcW
LoadAcceleratorsW
InsertMenuItemW
RegisterClassExW
SetWindowPlacement
SetForegroundWindow
GetMessageW
TranslateAcceleratorW
GetMessageExtraInfo
TranslateMessage
DispatchMessageW
GetKeyState
IsDialogMessageW
GetClassNameW
GetDC
ReleaseDC
GetSystemMetrics
GetWindowLongW
EnumChildWindows
DrawTextW
SetPropW
SystemParametersInfoW
CheckRadioButton
UpdateWindow
SendDlgItemMessageW
IsDlgButtonChecked
MoveWindow
SetDlgItemInt
GetDlgItemInt
FillRect
GetNextDlgTabItem
MonitorFromWindow
GetMonitorInfoW
OffsetRect
EqualRect
MonitorFromRect
GetClassWord
EnumDesktopWindows
EnumDisplayMonitors
IntersectRect
CopyRect
CreateDialogParamW
GetFocus
CreatePopupMenu
TrackPopupMenu
IsClipboardFormatAvailable
CharNextA
IsWindowEnabled
PostMessageW
GetWindowTextW
GetWindowTextLengthW
EnableWindow
GetWindowLongPtrW
SetWindowLongPtrW
SetWindowLongW
SetClassLongW
SetWindowTextW
GetWindowPlacement
CheckMenuItem
GetSysColor
SetClassLongPtrW
GetClassLongPtrW
DrawMenuBar
SetMenuItemInfoW
AppendMenuW
LoadStringW
GetSubMenu
RemoveMenu
CheckMenuRadioItem
SetFocus
MapWindowPoints
EnableMenuItem
GetMenu
GetClientRect
ShowWindow
CreateWindowExW
DestroyWindow
DialogBoxParamW
EndDialog
SetWindowPos
GetDlgItem
GetWindowRect
SendMessageW
MessageBeep
LoadCursorW
SetCursor
LoadImageW
UnregisterClassA
GetProcessDefaultLayout
GetMenuState
GetParent
rpcrt4
RpcStringFreeW
UuidToStringW
UuidCreate
winmm
timeGetTime
gdi32
CreateDIBSection
GetStockObject
SetBkColor
SetBkMode
CreatePatternBrush
DeleteObject
DeleteDC
EqualRgn
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateRectRgn
CreateCompatibleBitmap
GetRgnBox
LineTo
MoveToEx
ExtCreatePen
GetObjectW
GetTextExtentPoint32W
GetTextMetricsW
CreateSolidBrush
SetTextColor
GetDeviceCaps
CreateCompatibleDC
CreateFontIndirectW
SelectObject
GetTextExtentPointW
msvcrt
difftime
memmove
memset
__C_specific_handler
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
__CxxFrameHandler3
setlocale
__pctype_func
___lc_handle_func
___lc_codepage_func
memcpy
___mb_cur_max_func
_errno
__mb_cur_max
__crtGetStringTypeW
__crtLCMapStringW
__uncaught_exception
isspace
tolower
abort
isalnum
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
time
_cexit
_ismbblead
__setusermatherr
_initterm
_acmdln
_fmode
_commode
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
mbstowcs_s
exit
isdigit
isxdigit
toupper
_purecall
malloc
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
free
isalpha
wcstoul
strcspn
memchr
_wcsrev
strchr
_strtoui64
_strtoi64
sprintf_s
_wtoi64
_i64tow_s
_wcsdup
localeconv
iswalpha
iswdigit
_wcslwr_s
_wcsnicmp
wcsncmp
_itow_s
calloc
wcschr
_wcsicmp
_itoa
_wtoi
_vsnwprintf
wcscat_s
wcscpy_s
_exit
wcstol
wcscmp
Name
.text
Size
473KB
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
372KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=205, version=65501,
count=47, id=207, version=65501,
count=387, id=1, productName=Unmarked objects,
count=31, id=203, version=65501,
count=25, id=206, version=65501,
count=95, id=211, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
xiGD01oEkhh5s50F0Mw8lPVJ.exe
- SHA256 857dd46102aea53f0cb7934b96410ebbc3e7988d38dcafdc8c0988f436533b98
- MD5 58f5dca577a49a38ea439b3dc7b5f8d6
- SHA1 175dc7a597935b1afeb8705bd3d7a556649b06cf
- SHA512 3c75c0cbbbc14bd25b4feb141fd1595ce02469da50432fb48400eb089d6150fe87831ccc775d921eeec697af7aad33a35fadcfd2ec775aeee1ce34355af7338a
- SSDEEP 6144:x/QiQXCfoL8+Ee0CYDTAsdRa1OGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7f:pQi3foL8+iDNdRa1lL//plmW9bTXeVh8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
42488
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
yBqNUgvOW6iDky2dKdBCi5Fb.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3da0e424a6f1268f5682d59be1f83572479c28ca1fb7dab48d0b53220acef66e
- MD5 0e86a231689637b656a0764f2017d22f
- SHA1 70954ef5b83a7b0cd9dca4542d63bf3a7dc7ac97
- SHA512 21a3195665975ba3ec7b042a19b9ce39b5311e7c96070e7a968e7a1f39514a0df3569e39b313529dbb6b948195cd294077fd5b4e8a81e08a38b4ba2d8f6f6f32
- SSDEEP 12288:bsp0kUKA1PfP5k9FLRqYjtatql9MiwlDwhl6s5Ep7XzNwzVzTEVGp7K1k:bspuHaFLsqkqyEl68E5azVzwVBk
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
00:50:57:fe:10:85:97:70:19:ef:ce:dc:c7:8b:7d:7d:b5:25:85:e1
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Chains
Nov 5, 2024
Subject
CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
Serial Number
09:94:80:69:8f:28:80:aa:5e:6c:ba:ce:72:f0:26:77
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 20, 2020 - Oct 24, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
4
Entry point
736158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
711KB
Virtual Size
710KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ