4c269e43d99dbd557bd75b79ddf1ca143d006de9b096936403e75b1178751f66
- SHA256 4c269e43d99dbd557bd75b79ddf1ca143d006de9b096936403e75b1178751f66
Overview
overview
10Static
static
10keygen-step-1.exe
windows7-x64
10keygen-step-1.exe
windows10-2004-x64
10keygen-step-3.exe
windows7-x64
7keygen-step-3.exe
windows10-2004-x64
7keygen-ste...ck.exe
windows7-x64
3keygen-ste...ck.exe
windows10-2004-x64
7keygen-ste...28.exe
windows7-x64
10keygen-ste...28.exe
windows10-2004-x64
10keygen-ste...up.exe
windows7-x64
6keygen-ste...up.exe
windows10-2004-x64
6keygen-ste...5f.exe
windows7-x64
10keygen-ste...5f.exe
windows10-2004-x64
10keygen-ste...af.exe
windows7-x64
10keygen-ste...af.exe
windows10-2004-x64
10keygen-step-4/ss.exe
windows7-x64
1keygen-step-4/ss.exe
windows10-2004-x64
1keygen-step-6.exe
windows7-x64
7keygen-step-6.exe
windows10-2004-x64
7keygen.bat
windows7-x64
10keygen.bat
windows10-2004-x64
10Behavioral task
behavioral1
Sample
keygen-step-1.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
keygen-step-1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
keygen-step-3.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
keygen-step-3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
keygen-step-4/Crack.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
keygen-step-4/Crack.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
keygen-step-4/PBrowFile28.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral8
Sample
keygen-step-4/PBrowFile28.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral9
Sample
keygen-step-4/Setup.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
keygen-step-4/Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
keygen-step-4/f2217e5f.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
keygen-step-4/f2217e5f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
keygen-step-4/md1_1eaf.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
keygen-step-4/md1_1eaf.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral15
Sample
keygen-step-4/ss.exe
Resource
win7-20240729-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
keygen-step-4/ss.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
keygen-step-6.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral18
Sample
keygen-step-6.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral19
Sample
keygen.bat
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral20
Sample
keygen.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 4c269e43d99dbd557bd75b79ddf1ca143d006de9b096936403e75b1178751f66
- Size 4.0MB
- Sample241110-p9k86axerd
- SHA256 4c269e43d99dbd557bd75b79ddf1ca143d006de9b096936403e75b1178751f66
- MD5 7ba832654386f4cedbfedbffad95bc7f
- SHA1 90947f2a0357283a9478be72bfa2c4605b135d9e
- SHA512 8e5fe6267ac226114e34e7aecdf4d16b93cc0b27eee8972050c0698f6983e248a80c6e8d248ab583eab76d748f60057b3662c7983cfdaae9a50bca2ff6486c70
- SSDEEP 98304:yXyQXl8LSZ8Z5ZDiLDyhYoQhWU0mAkdYr3mu4cL1lV/KqpWwMbrk:yXyQXl8LSk5ZMDqYoQ90DcYzmuZLB1Zt
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
privateloader
C2
-
http://37.0.10.214/proxies.txt
-
http://37.0.10.244/server.txt
-
pastebin.com/raw/A7dSG1te
-
http://wfsdragon.ru/api/setStats.php
-
31.210.20.251
Signatures
- Azorult family
- Privateloader family
- Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/keygen-step-1.exe unpack001/keygen-step-3.exe unpack001/keygen-step-4/Crack.exe unpack001/keygen-step-4/PBrowFile28.exe unpack001/keygen-step-4/Setup.exe unpack001/keygen-step-4/f2217e5f.exe unpack001/keygen-step-4/md1_1eaf.exe unpack001/keygen-step-4/ss.exe unpack001/keygen-step-6.exe
File Explorer
-
4c269e43d99dbd557bd75b79ddf1ca143d006de9b096936403e75b1178751f66.zip 4.0MB
-
keygen-step-1.exe.exe 112KB
-
keygen-step-3.exe.exe 873KB
-
keygen-step-4/Crack.exe.exe 56KB
-
keygen-step-4/PBrowFile28.exe.exe 1.8MB
-
keygen-step-4/Setup.exe.exe 1.6MB
-
keygen-step-4/f2217e5f.exe.exe 270KB
-
keygen-step-4/md1_1eaf.exe.exe 991KB
-
keygen-step-4/ss.exe.exe 100KB
-
keygen-step-6.exe.exe 267KB
-
keygen.bat149B
keygen-step-1.exe
- SHA256 95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
- MD5 c615d0bfa727f494fee9ecb3f0acf563
- SHA1 6c3509ae64abc299a7afa13552c4fe430071f087
- SHA512 d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
- SSDEEP 3072:KExRaX6raoCoCyz6/mqv1JR+yBtGOeaeWgiZq:faZ1tme++wio
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
108164
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
keygen-step-3.exe
- IMPHASH f6ef2fc23ca2d85215ddcf8b4448b79f
- SHA256 40fd6a0b671a0e5074a206201f57f7731a0d01baab5874b28a9b0f019a451c5a
- MD5 265cadde82b0c66dc39ad2d9ee800754
- SHA1 2e9604eade6951d5a5b4a44bee1281e32166f395
- SHA512 c99f3a5464e1ac02402814401c2cb66a9fafb794356395c1081bdf3c4c3534086498c19efe4055780a52a1bb80db81658c2cb4af5271015af51edf7bd3865e7b
- SSDEEP 12288:8jCwd+3hwSk5EYjUpfRNHpU1/QQ21fg7n7rOQm1/EMKK9kE8D2sMJnKhUGis5smD:8jC53hATU3NWSq7n7ry3Z62vn4b5HAl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7216
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\workspace\sourceCode\virtual studio project\console\runDllFromMemory\Release\setup.pdb
kernel32
Sleep
VirtualProtect
HeapFree
SetLastError
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleW
FreeLibrary
IsBadReadPtr
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
vcruntime140
memset
__current_exception_context
__current_exception
_except_handler4_common
memcpy
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-heap-l1-1-0
realloc
_set_new_mode
free
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
exit
_exit
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
__p___argv
__p___argc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
862KB
Virtual Size
862KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
476B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=29118,
count=27, id=261, version=29118,
count=12, id=260, version=29118,
count=1, id=259, version=29118,
count=3, id=257, version=26715,
count=132, id=1, productName=Unmarked objects,
count=3, id=265, version=29337,
count=1, id=255, productName=VS2019 v16.8.5 build 29337, version=29337,
count=1, id=258, productName=VS2019 v16.8.5 build 29337, version=29337,
keygen-step-4/Crack.exe
- IMPHASH bf43a37a6ae0ed2852f82f44f0a6f32a
- SHA256 f8c0350d71e5dd14438d477f73915c4845290c7f0620656624722183b76013f5
- MD5 7126148bfe5ca4bf7e098d794122a9a3
- SHA1 3fe6be3ee8bf1a0c99139b146913c8c6acd7dd64
- SHA512 0bec6450d1be17489436de7a5186dbcb88089edd4227c3b5484460c9368e5ca0a2d88c385d31989f449a5d8cc347057c80a997682d6c0ed1b9cfcb85c677eb48
- SSDEEP 768:LMyTlenToDMTEp1Gjy76rM9QXPvRePLrlteelLh:LGEYT5y39QXHRErjlLh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8872
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrlenW
InterlockedDecrement
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
CreateFileW
GetEnvironmentVariableW
GetModuleFileNameW
RaiseException
LocalFree
lstrlenA
InterlockedIncrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetOEMCP
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
HeapSize
user32
ShowWindow
wsprintfW
ole32
CoInitializeSecurity
CoUninitialize
CoInitialize
CoCreateInstance
CoSetProxyBlanket
oleaut32
VariantCopy
VariantInit
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringLen
SysAllocStringLen
SysAllocString
VariantClear
SysFreeString
GetErrorInfo
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=95, version=2190,
count=3, id=11, version=8798,
count=22, id=14, version=7299,
count=10, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=63, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=9, id=93, version=2179,
count=101, id=1, productName=Unmarked objects,
count=2, id=49, version=9044,
keygen-step-4/PBrowFile28.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 95de484851569f225488320d573e398ebc2312b2d85b6c2b255b63b21aebb82f
- MD5 8902f8193024fa4187ca1aad97675960
- SHA1 37a4840c9657205544790c437698b54ca33bfd9d
- SHA512 c351204604cb24c45ddb26847a22f5487a2942ad2b2361dbd31ce0a308c281be91658907d7fe04b483f053b7f9b0c680cae11361709ba7552f7921e727241938
- SSDEEP 49152:kqq2BEim5e9JoNLPxZVwNKaLsJi2lZZ6:xYOoNLJk1Yf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1902958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
keygen-step-4/Setup.exe
- IMPHASH 5593da1f9a01d8f98a484ea81b113ac8
- SHA256 767c546decf6f669263e4a0a87a0f5d92234e031e9a0de3733fa954a8f3e0255
- MD5 7009fb80a52366b6c2cd8ec052a65791
- SHA1 db0894463edf3ac11e5ca4b4584e8f10d75810f6
- SHA512 26e50e4b3d0b5fe866423b9ae0c02f61882f632fe4a16c05da117c02fae9aea26a6c81458e4b0bc2bda8acd0407565132f8bd6b7d3e828dd90fc280b1f15f079
- SSDEEP 49152:IldcuFGnuxWiOuRg/iyFzb2QN83XfeYav:IldhGnuxWiOl/hNOmB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
82833
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetPriorityClass
lstrcatA
GetModuleHandleA
SetCurrentDirectoryA
GetModuleHandleExA
lstrcpyA
GetLastError
HeapFree
WriteFile
lstrlenA
CreateFileA
CloseHandle
GetProcAddress
lstrcpynA
GetProcessHeap
WriteConsoleW
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
EncodePointer
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
HeapAlloc
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
CreateFileW
FlushFileBuffers
GetConsoleOutputCP
HeapSize
HeapReAlloc
SetEndOfFile
DecodePointer
Name
.text
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=153, id=261, version=27412,
count=18, id=260, version=27412,
count=17, id=260, version=28427,
count=23, id=259, version=28427,
count=46, id=261, version=28427,
count=3, id=257, version=27412,
count=97, id=1, productName=Unmarked objects,
count=3, id=265, version=28614,
count=1, id=255, productName=VS2019 v16.5.5 build 28614, version=28614,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.5.5 build 28614, version=28614,
keygen-step-4/f2217e5f.exe
- IMPHASH 6dab62bef35d8c78b898fe6e2d2563ad
- SHA256 448febc4311881856de2c237285907fe9470818e169946b0dbf1362f332e070a
- MD5 0388a1ce1bb8c076387b69ffcb3b40ec
- SHA1 3ec08a53ec024d9be6346440848c37d0e0d7bb80
- SHA512 ea5af764d0373c8b9a5faf6d7094c76c9c321e227713bceecd49df50fa888e8fd04b1dfe16c4b75a8727717582b06383825e5d4317db1b875951ee240edd71d5
- SSDEEP 6144:MUL2hXyOiNcsRx/wxqbeU5bpG2jre0vzUWop:/2hXpi6sRxjbeQbpG29vzUJp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
11296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\talovi.pdb
kernel32
DosDateTimeToFileTime
FindFirstChangeNotificationW
lstrlenA
CopyFileExW
SetLocalTime
GetCPInfo
HeapAlloc
InterlockedIncrement
GetQueuedCompletionStatus
ReadConsoleA
InterlockedDecrement
GlobalSize
GetNamedPipeHandleStateA
CreateDirectoryW
GlobalLock
GetModuleHandleW
GetTickCount
GetCurrentThread
GetSystemTimeAsFileTime
GetPrivateProfileStringW
WriteFile
SetCommState
GetCommandLineA
TlsSetValue
GetPrivateProfileIntA
LoadLibraryW
GetSystemWindowsDirectoryA
GetConsoleAliasExesLengthW
GetVersionExW
IsProcessorFeaturePresent
TerminateProcess
LCMapStringA
GetPrivateProfileIntW
InterlockedExchange
GetStartupInfoA
SetThreadLocale
GetCPInfoExW
GetLastError
GetProcAddress
SetFirmwareEnvironmentVariableW
SetStdHandle
DisableThreadLibraryCalls
LoadLibraryA
Process32FirstW
LocalAlloc
GetFileType
WritePrivateProfileStringA
SetCurrentDirectoryW
SetThreadIdealProcessor
SetEnvironmentVariableA
GetThreadPriority
QueryMemoryResourceNotification
HeapSetInformation
FreeEnvironmentStringsW
EnumResourceNamesA
GetStringTypeW
RequestWakeupLatency
FindAtomW
ReadConsoleOutputCharacterW
GetProfileSectionW
DeleteFileA
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameW
HeapValidate
IsBadReadPtr
RaiseException
RtlUnwind
GetCurrentProcess
IsDebuggerPresent
TlsGetValue
TlsAlloc
GetCurrentThreadId
TlsFree
SetLastError
QueryPerformanceCounter
GetCurrentProcessId
ExitProcess
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStdHandle
HeapDestroy
HeapCreate
HeapFree
VirtualFree
GetModuleFileNameA
FlushFileBuffers
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
MultiByteToWideChar
SetFilePointer
LCMapStringW
GetStringTypeA
GetLocaleInfoA
CloseHandle
CreateFileA
user32
GetComboBoxInfo
msimg32
AlphaBlend
Name
.text
Size
115KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
68KB
Virtual Size
39.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=58, id=132, productName=VS2008 build 21022, version=21022,
count=112, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=134, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
keygen-step-4/md1_1eaf.exe
- IMPHASH 09d0478591d4f788cb3e5ea416c25237
- SHA256 0a6c3a23510f93fcdcb6d5acc53ccccbcc51c68f14b1bcbd758ffbf135f8e882
- MD5 f250a9c692088cce4253332a205b1649
- SHA1 109c79124ce2bda06cab50ea5d97294d13d42b20
- SHA512 80553664f188ae35cef1f89d188fb17df8a490367f8d6fa5f9897115bacf776373905bccd599353add684c7fa6c2554d04cbf1a7f6cc87b299d6c51da33c1b5e
- SSDEEP 24576:Eg8uQXK+F/bExmg5L0OiWQfWUWhElcAcF4N78D:1tQXKCqBL0XN8ZrfD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
663341
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Name
.text
Size
835KB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
154KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=461, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=2, id=229, version=21005,
count=44, id=223, version=20806,
count=254, id=224, version=20806,
count=146, id=225, version=20806,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=307, id=1, productName=Unmarked objects,
count=1, id=224, productName=VS2013 build 21005, version=21005,
count=48, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
keygen-step-4/ss.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 01a9cb71df1d038bbec243ec7f2c1dd12d65a735297469c7f72be80886842e3c
- MD5 9a6071c1a67be3fb247f857fe5903bbf
- SHA1 4a2e14763c51537e8695014007eceaf391a3f600
- SHA512 c862ed8670b48e23b081e1c91280599ffdd963e714665b80553b41540cb3584c823a25f05c75e47eaea1473c687a9ef7c9a219d724d059e5bd77ac6d127f5e68
- SSDEEP 768:Ul73Z0pTqcoADKt1o0CkL8IF5gRsmDj5s7piwWWs333333333333333333333334:cXgKtES89jTVApkG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
keygen-step-6.exe
- IMPHASH cd54f7a5d3fe7d557a4db8d0fab1e2c4
- SHA256 ee2994ea7f202516db816f85f23aac0a13ec32743d0555f81d68568bb40f4811
- MD5 093bc5ebd2d2a39d84c1d35fbd2d9efa
- SHA1 e028ca17fe2c7cbf7ad234b28cd50ad2c7c440e5
- SHA512 da58e87b099d520f02715ffcf6b50e2a586b6baec5b64d5ee39fb4c4a81ee9b8c18c8e341ee8befcf9048088661d7f182a937a7948aacfac926f1710fa77bcfa
- SSDEEP 3072:zj2TWGwUnHdJzhuM67W+ZkYhvchGk9ICkxu1yxWjznBSGZBcPmSa1eTNlhWJYZoi:zGWinH8MvGKy8cP1WT/VHWpdN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
18200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualFree
VirtualAlloc
GetModuleHandleA
BuildCommDCBAndTimeoutsW
GetLastError
GetProcAddress
ExitProcess
VirtualProtect
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
EncodePointer
RaiseException
SetLastError
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetModuleHandleExW
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
DecodePointer
gdi32
LPtoDP
Name
.text
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
163KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=26213,
count=139, id=261, version=26213,
count=18, id=260, version=26213,
count=17, id=259, version=24123,
count=18, id=260, version=24123,
count=37, id=261, version=24123,
count=7, id=257, version=26213,
count=105, id=1, productName=Unmarked objects,
count=1, id=265, version=24234,
count=1, id=255, version=24234,
count=1, id=151,
count=1, id=258, version=24234,
keygen.bat
- SHA256 82723c93594b47e60cc855d7d113a09763bb4636330ff44bbbb949eb0fdcf54f
- MD5 0b2622826dd00820d5725440efd7d5f4
- SHA1 0a9f8675e9b39a984267d402449a7f2291edfb17
- SHA512 9f2ffa1065e7eeeda6a139ba1d85465cbb56a9be1419c90e599e604fc718244fc8b77b2bc46bbf3abba36e985b543c72d1e154e2d2d615c8519a9379e94804f3
- MD5 SHA1 SHA512