7a3b1e9c8df660dc1c1cf9b17411c1d6a4ffca364712c5de8ac46b1199ece1ce
- SHA256 7a3b1e9c8df660dc1c1cf9b17411c1d6a4ffca364712c5de8ac46b1199ece1ce
Overview
overview
10Static
static
8Ehhbsuuemv.exe
windows7-x64
10Ehhbsuuemv.exe
windows10-2004-x64
10GjIEmKW.exe
windows7-x64
10GjIEmKW.exe
windows10-2004-x64
10Jtvcsfni.exe
windows7-x64
10Jtvcsfni.exe
windows10-2004-x64
10OriginalBuild.exe
windows7-x64
3OriginalBuild.exe
windows10-2004-x64
8PUMPED_docc.exe
windows7-x64
10PUMPED_docc.exe
windows10-2004-x64
10Servicing-...te.pdf
windows7-x64
3Servicing-...te.pdf
windows10-2004-x64
3cgu3.docx
windows7-x64
6cgu3.docx
windows10-2004-x64
6debt.rtf.lnk
windows7-x64
10debt.rtf.lnk
windows10-2004-x64
10eeee.dotm
windows7-x64
3eeee.dotm
windows10-2004-x64
1egor.dotm
windows7-x64
10egor.dotm
windows10-2004-x64
10errr.dotm
windows7-x64
3errr.dotm
windows10-2004-x64
1example.dotm
windows7-x64
10example.dotm
windows10-2004-x64
10fasfs.dotm
windows7-x64
10fasfs.dotm
windows10-2004-x64
10ferrr.dotm
windows7-x64
3ferrr.dotm
windows10-2004-x64
1fffffffnew.dotm
windows7-x64
10fffffffnew.dotm
windows10-2004-x64
10fp4h5ur67j.exe
windows7-x64
10fp4h5ur67j.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
Ehhbsuuemv.exe
Resource
win7-20240729-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ehhbsuuemv.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
GjIEmKW.exe
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
GjIEmKW.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
Jtvcsfni.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
Jtvcsfni.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
OriginalBuild.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
OriginalBuild.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral9
Sample
PUMPED_docc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
PUMPED_docc.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
Servicing-invoice-template.pdf
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Servicing-invoice-template.pdf
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
cgu3.docx
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
cgu3.docx
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
debt.rtf.lnk
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
debt.rtf.lnk
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral17
Sample
eeee.dotm
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
eeee.dotm
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
egor.dotm
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral20
Sample
egor.dotm
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral21
Sample
errr.dotm
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
errr.dotm
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
example.dotm
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral24
Sample
example.dotm
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral25
Sample
fasfs.dotm
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral26
Sample
fasfs.dotm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
ferrr.dotm
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
ferrr.dotm
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
fffffffnew.dotm
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral30
Sample
fffffffnew.dotm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
fp4h5ur67j.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral32
Sample
fp4h5ur67j.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 7a3b1e9c8df660dc1c1cf9b17411c1d6a4ffca364712c5de8ac46b1199ece1ce
- Size 374.7MB
- Sample241111-c3wp4atqcj
- SHA256 7a3b1e9c8df660dc1c1cf9b17411c1d6a4ffca364712c5de8ac46b1199ece1ce
- MD5 65820b5345cae498c44cf90c63dd3160
- SHA1 857f6b35c2e69a4df8e52094ef1f9acaacee8c60
- SHA512 576df56b28250d69aeb9c95070a453928336c7beabe45b3bc108669810ffb2316a69bdf785b8472787328556d25ccd62d30e36d4945adb85e45a800369dce388
- SSDEEP 6291456:Wfj+M5AE4HECh6/6p3vBaD0OFMZTuw8XPWD29On+lctEu6ieDAR43Wr/ggjghaFd:WfJAEIECpXfOFM+PWyNlZu6ieDASmr/B
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
-
resource static1/unpack001/eeee.dotm - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/GjIEmKW.exe unpack001/PUMPED_docc.exe unpack001/powershell.exe unpack001/q_-_Copy_original.exe
File Explorer
-
7a3b1e9c8df660dc1c1cf9b17411c1d6a4ffca364712c5de8ac46b1199ece1ce.zip 374.7MB
-
1.rar.rar 69B
-
Ehhbsuuemv.exe.exe 68.4MB
-
GjIEmKW.exe.exe 646KB
-
Jtvcsfni.exe.exe 300.9MB
-
OriginalBuild.exe.exe 2.0MB
-
PUMPED_docc.exe.exe 90.3MB
-
Servicing-invoice-template.pdf.pdf 34KB
-
cgu3.rar.rar 9KB
-
cgu3.docx.docx 12KB
-
debt.rtf.rar.rar 957B
-
debt.rtf.lnk.lnk 1KB
-
eeee.dotm.dotm 15KB
-
egor.dotm.dotm 14KB
-
errr.dotm.dotm 14KB
-
example.dotm.dotm 16KB
-
fasfs.dotm.dotm 16KB
-
ferrr.dotm.dotm 15KB
-
fffffffnew.dotm.dotm 16KB
-
fp4h5ur67j.exe.exe 1.3MB
-
ketoshi.exe.exe 6.2MB
-
newsolway.dotm.dotm 15KB
-
passporsh.dotm.dotm 14KB
-
powershell.exe.exe 440KB
-
prom.dotm.dotm 15KB
-
putty.dotm.dotm 15KB
-
putty.exe.exe 1.6MB
-
q_-_Copy_original.exe.exe 571KB
-
r.dotm.dotm 15KB
-
rom.dotm.dotm 15KB
-
solway.dotm.dotm 15KB
-
ss.dotm.dotm 21KB
-
testdlyailyi.dotm.dotm 177KB
1.rar
- SHA256 8d12f9138517957756f2b5745033708b2bd5d7129de8f0f1a01c1a9699d533fc
- MD5 67bc65619826de9a70b6bf52757ee6bc
- SHA1 c9969e9aa039e2a50eeb10ae754b26bc0ef55ad1
- SHA512 ee6ec699db6dfe2b00dfa45cb71ec72971b1ed85c80c530975621dd4bd7f8f44f57b2073eb68235cf98ed48b1d22f925e6e1f16008e7f86d196dfa9ea7642567
- MD5 SHA1 SHA512
Ehhbsuuemv.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9f3d5e17974ea77849869573fcca4be15d641ea937fc23fceb2808c59612b641
- MD5 368dc6c24db6c1550ce757c0ffbdd9a0
- SHA1 89bf95d951ac065bdfd8a323b1ecb70355bbab20
- SHA512 78c94132c3f426930bcc80fc8dab760f3ecedcb6747150ba72319a23adedfda7c7cdc494122899cca914b7a1daa859f2a9c54c9bacf5b2e9c2f5519275fb2211
- SSDEEP 1572864:iEmgHZAuBtRvd59Tdd6ok1vPtBQmjbPV4dDO4oJV36euF3SGzcqj0:zFHZAytD5xdd6FNPtBQeCdDO4oW/P4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
39:42:9d:c1:af:75:81:6e:2d:c2:79:c4:30:1b:03:0b:44:34:e9:c9:a3:57:4d:55:f3:4f:42:b8:89:42:b6:89
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Nov 21, 2022
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
06:c3:e3:0f:10:1b:62:fe:0a:49:9e:b1:18:90:12:ea
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 26, 2022 - Feb 26, 2025
Minor OS version
0
Major OS version
4
Entry point
71691150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
68.4MB
Virtual Size
68.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GjIEmKW.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 bce1a92464358055d118d7a107bf8d5361f4fc2dfaaa41a18d2a9bc11b640272
- MD5 f1721c98efdae451be8ef071044cdb85
- SHA1 28afdff9b32d7da6918a4ecc3a30eafe3be1f8e6
- SHA512 5e560094bfdb5d9e0a0f545373c9943a57c1da12378153cd0943ac2b10da9fcd1e256a71777f5cab803f5c434db11cd6cdd463bdcd2fe36420d7db5f2c57ffaf
- SSDEEP 12288:z4UBGj3cBfudMiILCLbexicLZHgVkbh11a9iZoyfetMYviLZ4uDFa:z49j3Z4Ld30v8R
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
666918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\user\AppData\Local\Temp\mEIoC.pdb
mscoree
_CorExeMain
Name
.text
Size
643KB
Virtual Size
643KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jtvcsfni.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cde19a4b3504ff5f04a4291be87d98594673de5e3ba4d939b18305e7e1fd93a2
- MD5 fa2a122398f04f0a45ed7bed477aa4de
- SHA1 dec80165e13f370fc832f6fe752084eb5ba944cb
- SHA512 332c34cde567511fc31422d75a77f183546998762f912844726e0b157d5c5bc29893e20b93e0ab5daa90908e39aab326743606ee090b38d73ba51b9d949e8905
- SSDEEP 6291456:TzQXTpP65CUl6Xd+6a3BwpQTOQGZ+TmCI/0haPyrUVb0/29c1e1M51K:Y1jUl6sBwKgZXCI/0haqgVb0/l6
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
05:60:d7:79:75:86:73:73:6b:e9:33:75:9f:39:fb:9f:41:06:19:73:ac:81:cf:d8:62:41:51:66:ed:47:41:cd
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Nov 21, 2022
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
06:c3:e3:0f:10:1b:62:fe:0a:49:9e:b1:18:90:12:ea
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 26, 2022 - Feb 26, 2025
Minor OS version
0
Major OS version
4
Entry point
315486894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
300.9MB
Virtual Size
300.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
OriginalBuild.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1fc6b522a006f923bd3e6d69377bdcbb6d6e733dc4f68f38608f727bf6b0732f
- MD5 684b5a8761a8cd0314a1121de37a86a7
- SHA1 bd46bea31f6ec26ad80bf9bdda6f2b59750a910a
- SHA512 d56b3b60d54ad8ac97b3baf3fc4cdf7ee0158dadd23239238d243d445906d30f8246f4053d53fc9b6f04c80d87c43f548e7cca4b424ec34b0474defa785fbb59
- SSDEEP 24576:rLdSwtu5mVZJZYDN5ZKGGQz1JLzsrksuN8qYMLDd3eQ3o7glrAbAlA7AIASAWl9W:r6mVZJZYSVgvoklrAbAlA7AIASAzCq
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
bf:a3:9b:99:87:ca:8f:b1:52:eb:79:09:15:0d:4c:0a:88:ef:e0:1d:19:74:be:be:48:56:5d:82:6f:38:25:55
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO
Chains
Jan 13, 2022
CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
30:ab:75:92:31:a6:34:6a:7f:4c:b2:1f:50:e0:78:5a:2c:29:d9:04
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO
Chains
Jan 13, 2022
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO
Serial Number
09:95:9f:e7:c3:8f:87:51:bc:99:fc:a2:be:9d:fb:e7
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 25, 2020 - Nov 29, 2023
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO
Serial Number
01:5d:e2:c7:af:11:69:4f:b9:3e:8f:05:3d:a6:e9:19
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 14, 2020 - Nov 29, 2023
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
2078062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PUMPED_docc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 25a410a81c32a80cd2c408fad31582e20a1e7fd01c28ef78576fd2cbb02761fc
- MD5 82bb565e772ed1286a2aae9c572650e9
- SHA1 ca36bde4741afafb7fcf62a19673d13b80fb44c6
- SHA512 30861740c92d0022bbee72d638afbf44cd6276d2233e7ce51fc9fb5b7281a0cadb3b76f8b4ef8b3063c7a93960a1fab285aa8d01043ba4063366125ce6ec6e0b
- SSDEEP 6144:7Bcs/4U/OaGR+X25Kmn9GFjzsLqBO6/b:tcsgXbKm4XGq86/b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
175535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
163KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Servicing-invoice-template.pdf
- SHA256 3fff1be296432c5b2cf165c63110531e8e4aa3e31285d1800d0ab92ece7e5c3a
- MD5 d422843d566db462f7f8f6bc3be9ca76
- SHA1 1b1b89d8227af285a658ba64a15e1f0a56953e46
- SHA512 a62ad4534bd8b274df69de3dfc64595137941097742173f0e8d02307f35b5344bcfaf3151a203d6f5a24f2a4300996e7713db729763516cade8893e62d63e9cc
- SSDEEP 768:zzy3jjj/ZX6HmbabFA7FFFjgXUfUU9ivyoWYU9NlgxUh3:zzijjjRXIcaZAtIyo+lD
- MD5 SHA1 SHA512 SSDEEP
cgu3.rar
- SHA256 acf777c094448d81c8a236bc20a649985d8dae3859684b4a36cb927b30ad5230
- MD5 50d5f12c1c59bc98a813067d5122f38c
- SHA1 e35ccfa2e9d8eceab039f7b2b45616ab036bd976
- SHA512 713e2f9ce0df755a718d56aa7b1eea9914d3ba67518d9c1a4e9bb282ce9370cdaaee29f51620da07dbb3eeef8447b0b7cb72016d6a5be54f7741d876638a65be
- SSDEEP 192:WQhXtM+d3XsnLhFC+q6n9du2t0r+DQdpPDW805oCnpKfkUsJJ3IE3I9ialTdcd:WgLNiu+B9du2OiQnPDl05pnp9UgKUIZw
- MD5 SHA1 SHA512 SSDEEP
cgu3.docx
- SHA256 154dae89d0d92be206c9c006af8112f36ba1180f56334bfdbbf33668675a76a5
- MD5 3a99a5077f5178c4320e97d997cfbff1
- SHA1 d3e053535607751b0a2d6dc5187f74dac3b1846d
- SHA512 218f3265617bd320e862b32591f7ef2c6bd85e9225d565281f54045486cc63593a89fb5c1b15853082554d84545a63492bed16ca73840cfd548e1ef4316b1f34
- SSDEEP 192:CtfoVP+CCNxtpgoZ22NNMp14xew+Wfm0FfkvGUlfbN9urD9N:afo1+dNxt/ZtNN04+30On50n9N
- MD5 SHA1 SHA512 SSDEEP
debt.rtf.rar
- SHA256 4da5078a5bde869ade2cdb93d36a321d2a9996ac9ab940cac9f8516794e1705a
- MD5 a776d916e80f88a16f578e8e3e787350
- SHA1 dd9bd73eb6a93cd007c936a519ec90d445f58761
- SHA512 24264cc04ede49113f359aea23a20fa3f2c4b0f69330639d6fbcfb58ddc447bf318cc2c6a42619d2d0fd5cf95ffe839071a7e8c2a007f3419ca3a16c5d8516e3
- MD5 SHA1 SHA512
debt.rtf.lnk
- SHA256 95d5648444fbd18f4f19a7a7821e2e35cdd27b2ddfb40bf6dd60f1303660824a
- MD5 fdfc8fbec85d876fafc78d0d6d5bfb2b
- SHA1 8787a1343b2610079c48f3d315c9dc9f618793c1
- SHA512 790a604522bfcd26cb738dc19121ba70f4b65a7a4a5fd5df8a7cd51069b3645fee42f25ed026152ce10fb83bfe7d23774b91abf3b8e8ddae0d3311d97d7e01bf
- MD5 SHA1 SHA512
eeee.dotm
- SHA256 3d355a08aefd906bd5c4f5db39535e172f06f646c18be73f7b6d4dc6ed54c5ab
- MD5 e98532e1f207b31dc7709a52b1c409b7
- SHA1 b2715b7f3367c8a30d65fd06ae8a201e53d9123d
- SHA512 13ff9836180e75881340bc5eec2285c6dfd2c7cd2aa968be5ad7673e905c17862d3709571426793c8fc886beb7969c1cfc7585f3bf60a8590f5e90fbfca28e85
- SSDEEP 384:tmtl4DqphrASTC78Jex7KBM6akwLWdxdyJYB3ywJ:ql4DqphM98JkYakw6Ly+QwJ
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
egor.dotm
- SHA256 d6cdc6b64b477100f73ffa15b1fe7597e3a6c81431b527bc766f7bab27701e8b
- MD5 adccb9016b434427cd125ae841d1baaf
- SHA1 56aa1a0e7b1ba0d2714be1e36d4a59ca4ca8a05d
- SHA512 9b4fbb5f16570c7a5165a53ffab8680db2122e3040ed411358f2a4fee2d8a24d525ab430651b0c1d1f93f8b7471b8ba9f7b58a96b167e5245a082a0d51c35c62
- SSDEEP 384:tmtl44XewvWv7lC78WQ6Su6akwLWdxdFYB3w:ql44XHvWTu8mSzakw6LqG
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
errr.dotm
- SHA256 ed057ee336974e52d68f2eb5278c7d61fdbfff8f388e287d4c8c09bd2eed0a2f
- MD5 15320db9003264c8ce3a7356030746a8
- SHA1 db6c48cb0b2ea475602ee20bd10d6be192da4a37
- SHA512 608015f8c7ede90b8859fe2c2838322db98e78ff1e369d1a3019cbfb8d279ca515e2494e0d6946d17cdbed1582faeac2ce2bd53eadbe45751dba542794b0a758
- SSDEEP 384:tmtl4pb+aVHXwnSC78Qot2J6akwLWdxd36UbYB3ho:ql4pq6El8Qojakw6L0M
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
example.dotm
- SHA256 1d473e82efa66368ffb4ce8f5eb947296c8e8d3febbe3a6283857da6fb1cc7d5
- MD5 1aae26fe5d7b7dc4d6794a7828aecedc
- SHA1 fbb8c6f45f53dc80e276a72cf9f567054b65c206
- SHA512 2036693971d4710c9d59c569a8a8fef98ee33422b324c343c07aac9fb67500f82e54c6904054f65a7294dbbc745773fdbf6a6051aa7a71ac8b04b9c3dcf5c6e0
- SSDEEP 384:tBt67TB+TZ2T/aNxt/ZtNNei/eX+30Oncsqf:R6PaGIxllNeAeX+3BcBf
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
fasfs.dotm
- SHA256 4adf62e4e36861567206126d6ef1a1d59bf169f9c72cde72dad9a3bfe0c09faf
- MD5 56265082f8036943f8aa659cda6b4b6f
- SHA1 4b4c75a574e7bc18117cecfe8cad64205097ec43
- SHA512 33792ecfeaf686435db9d6537b8e99d74b08198c198e3357b0b6ba324f7c5eb410060a34e64b2a09aa3b20f9a7b459ae6b13670abb4e03550ffb79fb0e155c2d
- SSDEEP 384:tmtLW4BPok2xSxCyX+ZKC78qN9j6akwLWdxdA97YB3H/:qa4Bn2xzyX+383akw6L2M9
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
NewMacros
ferrr.dotm
- SHA256 58ab07d938bb5a6a5c2fb772f4b511b805b6e9c165ed01280c4ee9a1c817f9dc
- MD5 2fcd4aa1392a81644323e0dfc715146f
- SHA1 bb48a7af90cdb8c46e78bb20fb7e733c626d4f2f
- SHA512 91bccc3fba9abbab4b052c394274de3d701d5c6a06b36c2df688f3f36c0296835d028e966eb331ebdea863c34be63f03cfb604b1583640e6edee0de3a81bc639
- SSDEEP 384:tmtl4Ttwa5+VjgUbuC78Qo0mR6akwLWdxdf8YB3U:ql4Ttwp2UbZ8QZm0akw6Lxi
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
fffffffnew.dotm
- SHA256 4adf62e4e36861567206126d6ef1a1d59bf169f9c72cde72dad9a3bfe0c09faf
- MD5 56265082f8036943f8aa659cda6b4b6f
- SHA1 4b4c75a574e7bc18117cecfe8cad64205097ec43
- SHA512 33792ecfeaf686435db9d6537b8e99d74b08198c198e3357b0b6ba324f7c5eb410060a34e64b2a09aa3b20f9a7b459ae6b13670abb4e03550ffb79fb0e155c2d
- SSDEEP 384:tmtLW4BPok2xSxCyX+ZKC78qN9j6akwLWdxdA97YB3H/:qa4Bn2xzyX+383akw6L2M9
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
NewMacros
fp4h5ur67j.exe
- IMPHASH bd611a3ea18453d145c1df89ce6e10c9
- SHA256 5859d191a74777c836d807c66f0dcd9ce61d792997e5fae991dd5297b1065d83
- MD5 8cd05b06930579102407341364cdedd4
- SHA1 f1c3d91406f6e461c67d7c12c26d43968cd42031
- SHA512 06b799f4e57ca6ebc168021e9f19904fceb467e65684a0391d8325bec341c8776cadea8555afe9a0874203085044983106a50f6a3062c9b5d9f84de7d34f4354
- SSDEEP 6144:q2AdvNiBrRuWzr3Qk7AOziNR14LE8mnq4wqluSPB0YJpc:3AdvNsrXv781vwr7YJq
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
8a:c2:c0:aa:f0:95:c3:67:a4:59:d3:e0:b5:5a:ae:ae:3a:46:aa:cd:f5:f6:9c:06:26:7a:7d:6b:0e:90:89:81
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
Aug 25, 2021
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
0c:64:96:2e:44:67:ed:cc:15:79:64:6b:73:37:ec:8c
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 1, 2019 - Jan 11, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
6
Entry point
27737
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualProtect
GetModuleHandleW
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateFileW
RaiseException
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetFileType
GetFileSizeEx
SetFilePointerEx
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
ReadConsoleW
HeapSize
WriteConsoleW
Name
.text
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
260KB
Virtual Size
263KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.qif
Size
293KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.qif
Size
293KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.qif
Size
293KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=27412,
count=167, id=261, version=27412,
count=22, id=260, version=27412,
count=3, id=257, version=27412,
count=88, id=1, productName=Unmarked objects,
count=17, id=260, version=31328,
count=21, id=259, version=31328,
count=74, id=261, version=31328,
count=1, id=265, version=31332,
count=1, id=258, version=31332,
ketoshi.exe
- IMPHASH 04cdeb223f1373b46c9f3263ea80b584
- SHA256 2dda213138c0d977e7487e85d80221401b9158edcfdcad31f1e24b077f02f43a
- MD5 46ee74e0aba0fe470505c4336e1402b2
- SHA1 27a0c0e92ddd7305bde6e1fbbb1ef1718b1127e1
- SHA512 9bc5e5885344cff4bd2ef5fe7b73d4e82a2c0384aff3b1ef0d1bad3ab7efb16bc8ddf623ed1d84ca379bae8bcc67c1a7ac85a8eeee12f921f3f5fc18322364aa
- SSDEEP 98304:0vEVavUc/EuFXF1mkWhV9G3vSmH4ueHjI:0vl8c/EMFIkWs/SmYuV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2e:d1:25:f5:0e:ee:2f:50:84:c4:0e:24:e4:10:fb:0b:d9:8c:8b:52:bc:93:dc:cd:9a:93:5a:4b:03:5b:fd:1a:fd:89:bc:0d:ed:b9:b8:37:20:a9:f8:90:44:a6:d4:26:1a:e6:6f:ea:bf:85:9a:9b:7c:49:8e:d1:11:58:a9:5f
Digest Algorithm
sha512
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Hugh Bailey,O=Hugh Bailey,L=Temecula,ST=California,C=US
Chains
May 9, 2023
CN=Hugh Bailey,O=Hugh Bailey,L=Temecula,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Hugh Bailey,O=Hugh Bailey,L=Temecula,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=Hugh Bailey,O=Hugh Bailey,L=Temecula,ST=California,C=US
Serial Number
06:d4:1a:66:69:21:53:ff:be:5d:ef:e8:73:ad:ff:6a
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 1, 2021 - Aug 15, 2024
Minor OS version
0
Major OS version
6
Entry point
1681603
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\octopus\Desktop\newstub\compile\Debug\newstub.pdb
kernel32
ReadConsoleW
LoadLibraryW
GetProcAddress
FreeLibrary
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetFileInformationByHandle
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetModuleHandleW
GetFileInformationByHandleEx
CreateSymbolicLinkW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
InitializeSListHead
GetStartupInfoW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
RtlPcToFileHeader
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
HeapSize
HeapValidate
GetSystemInfo
GetStdHandle
WriteFile
GetCurrentThread
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
HeapReAlloc
HeapQueryInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
CreateFileW
advapi32
RegSetValueExW
RegOpenKeyExW
RegCloseKey
Name
.textbss
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
1024B
Virtual Size
671B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=29395,
count=154, id=261, version=29395,
count=13, id=260, version=29395,
count=17, id=260, version=31935,
count=9, id=259, version=31935,
count=60, id=261, version=31935,
count=5, id=257, version=29395,
count=137, id=1, productName=Unmarked objects,
count=2, id=261, version=32217,
count=1, id=255, version=32217,
count=1, id=151,
count=1, id=258, version=32217,
newsolway.dotm
- SHA256 4e94efce4fd40bc277c818a994e50f04f2a4bc02733b9f60b8800344a69d0686
- MD5 4886c74d71bca57f28c5e0561196ec41
- SHA1 fa6bfeb38d8ffb517e02a4cd025bd846dcf63606
- SHA512 7c52e41508f86ded86dbd82ad54596de3914c1dc123c87d742c30936cf959a86e18d99c0d181321d8014b1d9b899d6fee2a33ba2358839b8823391fe2442d8ad
- SSDEEP 384:tmtl4JLlZcUWCP9ge8r2FC78QoU6akwLWdxdDYB3T:ql4JJOUZCjSO8Q6akw6LUt
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
passporsh.dotm
- SHA256 d9bac3a647308d55fd4b7d1e11d7888be18e51dc6234d2524a42a0cb6fccf796
- MD5 b7ed6dc752f4dd21e02f031f357d23d2
- SHA1 c9df16aae80944dd3788401d10ad2002bf9aeabc
- SHA512 32dd838d322a972abc63e8373ad89e97011a906a21b6b79190206014c9a121ac1428945685715e4f4f9fc451f60cbe0f1941dc59b1c05cf7f765470db63dbc97
- SSDEEP 384:tmtl4043EUC78WQ3z6akwLWdxdJyoYB3z:ql49a8Cakw6LJy11
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
powershell.exe
- IMPHASH bf7a6e7a62c3f5b2e8e069438ac1dd3d
- SHA256 529ee9d30eef7e331b24e66d68205ab4554b6eb3487193d53ed3a840ca7dde5d
- MD5 13cccb79aafffb07c94e586b75817486
- SHA1 9678ea8069d9812cda2a41c9d3dc32d5c4555b7b
- SHA512 b0abebaa2f90b27334a1668c9469d5821cdef100ab1388ff96e40cfc7801dd0f7cac978305b46abf383229fa3d0731497463d1d9c528b9ca8a9dbc7f655ef67b
- SSDEEP 6144:AUTI00PptQv/v2aWVWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQ1:bs0YO/e7W2KXzJ4pdd3klnnWosPhnzq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
18768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
powershell.pdb
msvcrt
_onexit
__dllonexit
_unlock
_lock
_commode
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_fmode
_vsnwprintf
_wcsicmp
_wcsnicmp
fclose
_wfopen
_itow_s
wcstoul
wcschr
__uncaught_exception
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
wcsncmp
wcsrchr
free
_purecall
??3@YAXPEAX@Z
memcpy_s
??_V@YAXPEAX@Z
__CxxFrameHandler4
memset
atl
ord30
kernel32
CreateFileMappingW
FreeLibrary
LoadResource
FindResourceExW
LCIDToLocaleName
UnmapViewOfFile
GetVersionExW
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
SearchPathW
Sleep
MapViewOfFile
IsWow64Process
SetConsoleTitleW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
LoadLibraryExW
GetModuleHandleExW
GetStartupInfoW
GetFileType
FindFirstFileW
ReleaseSRWLockExclusive
VerifyVersionInfoW
CompareStringW
GetProcAddress
SetLastError
GetModuleHandleW
GetCurrentProcess
GetStdHandle
WriteFile
VerSetConditionMask
ExpandEnvironmentStringsW
LocalFree
WriteConsoleW
AcquireSRWLockExclusive
SetThreadUILanguage
SetErrorMode
QueryPerformanceCounter
FindClose
CreateFileW
GetFileAttributesW
FormatMessageW
CloseHandle
GetLastError
oleaut32
SysStringLen
SafeArrayPutElement
VariantClear
SysAllocString
SafeArrayCreate
SysFreeString
advapi32
RegQueryValueExW
RegEnumKeyExW
RegGetValueW
RegCloseKey
RegOpenKeyExW
ole32
CoInitialize
PropVariantClear
CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
user32
LoadStringW
mscoree
CorBindToRuntimeEx
Name
.text
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
352KB
Virtual Size
351KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=30795,
count=26, id=260, version=30795,
count=133, id=1, productName=Unmarked objects,
count=5, id=257, version=30795,
count=11, id=261, version=30795,
count=7, id=269, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
prom.dotm
- SHA256 707e3f82135ec31c984b40b1926f942e82c98924d725773da15edf8ca2a78358
- MD5 ca8c80f3ba1852674b9c99a7066b7755
- SHA1 5b17424baa1a9a04f9a20aef80be9c520da8e7f6
- SHA512 45084927bb4594cdd27b47fe0f31957460f1cb4de1508f49c68d73581e6afe85326246231842cb6831c7152acc5e38f4b4961438f9d364c9d1cb3714f7073d5a
- SSDEEP 384:tmteVAFqkbNkObSVYRu5C78JewDls6akwLWdxdIEYB3yN:qFqkbN4LK8J1akw6LqgN
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
putty.dotm
- SHA256 a89ea84860441d5d677ed44c8bcb20cfaa43fda58b3576c1060ddc34eee4bc98
- MD5 41d7e6d87e0ccc5db27782fe0364e967
- SHA1 4beedc243445f609f81df567e3bd48c610bbf2c5
- SHA512 d4c14c21b1b40e64e0a6990ff3531de37020f58a9a45e84970de766e0f413800a31211a9a7b4a314b796ca8f7d86d11e4720ca4cba9a79fa94be15fbf5885a11
- SSDEEP 192:HNQDC9SipgtTdfL+C30/Jj6UIHNxtpgoZ22NNaOagqUtvi4ew+Wfm0FfkvGUlfX+:tQDC9ittLzM2Nxt/ZtNNBV+30OnZrU
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
putty.exe
- IMPHASH 69573714e11441683ea863c40a1c0d54
- SHA256 fc6f9dbdf4b9f8dd1f5f3a74cb6e55119d3fe2c9db52436e10ba07842e6c3d7c
- MD5 f838fdafd0881cf1e6040a07d78e840d
- SHA1 2a35456b2f67bd12905378beb6eaf373f6a0d0d1
- SHA512 5c0389eb79e5c2638c0d770cde1a5c56a237aa596503966d4f226a99f94531af501f8bf4efa00722e12998f73271e50d8c187f8e984125affe40b1ab231503b4
- SSDEEP 49152:TDXOPFJK9bbYF8paMB8QMy3bHwPXNg/7UyW+ekBeZmn:T0WhreNg/X
- MD5 SHA1 SHA512 SSDEEP
Digest
6e:7f:0b:23:16:5c:dd:13:4d:a7:e8:93:de:e9:42:26:40:28:7b:02:ea:e3:ce:64:aa:1e:e7:6a:e9:ed:65:12
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB
Chains
Nov 5, 2024
CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Digest
d7:67:20:39:86:8d:68:d3:47:e1:50:18:ed:e9:e7:ad:7f:97:09:f6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB
Chains
Nov 5, 2024
CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB
Serial Number
8e:3f:bf:b9:1b:e6:da:04:1b:a4:1f:7a:98:3a:d6:1e
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 6, 2021 - Nov 5, 2024
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB
Serial Number
8e:3f:bf:b9:1b:e6:da:04:1b:a4:1f:7a:98:3a:d6:1e
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 6, 2021 - Nov 5, 2024
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Minor OS version
0
Major OS version
6
Entry point
755732
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
gdi32
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontA
CreateFontIndirectA
CreatePalette
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
ExcludeClipRect
ExtTextOutA
ExtTextOutW
GetBkMode
GetCharABCWidthsFloatA
GetCharWidth32A
GetCharWidth32W
GetCharWidthA
GetCharWidthW
GetCharacterPlacementW
GetCurrentObject
GetDIBits
GetDeviceCaps
GetObjectA
GetOutlineTextMetricsA
GetPixel
GetStockObject
GetTextExtentExPointA
GetTextExtentPoint32A
GetTextMetricsA
IntersectClipRect
LineTo
MoveToEx
Polyline
RealizePalette
Rectangle
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetMapMode
SetPaletteEntries
SetPixel
SetTextAlign
SetTextColor
TextOutA
TranslateCharsetInfo
UnrealizeObject
UpdateColors
imm32
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmSetCompositionFontA
ImmSetCompositionWindow
ole32
CoCreateInstance
CoInitialize
CoUninitialize
user32
AppendMenuA
BeginPaint
CheckDlgButton
CheckMenuItem
CheckRadioButton
CloseClipboard
CreateCaret
CreateDialogParamA
CreateMenu
CreatePopupMenu
CreateWindowExA
CreateWindowExW
DefDlgProcA
DefWindowProcA
DefWindowProcW
DeleteMenu
DestroyCaret
DestroyIcon
DestroyWindow
DialogBoxParamA
DispatchMessageA
DispatchMessageW
DrawEdge
DrawIconEx
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
FindWindowA
FlashWindow
GetCapture
GetCaretBlinkTime
GetClientRect
GetClipboardData
GetClipboardOwner
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetDlgItemTextA
GetDoubleClickTime
GetForegroundWindow
GetKeyboardLayout
GetKeyboardState
GetMessageA
GetMessageTime
GetParent
GetQueueStatus
GetScrollInfo
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetWindowLongPtrA
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
HideCaret
InsertMenuA
InvalidateRect
IsDialogMessageA
IsDlgButtonChecked
IsIconic
IsWindow
IsZoomed
KillTimer
LoadCursorA
LoadIconA
LoadImageA
MapDialogRect
MessageBeep
MessageBoxA
MessageBoxIndirectA
MoveWindow
MsgWaitForMultipleObjects
OffsetRect
OpenClipboard
PeekMessageA
PeekMessageW
PostMessageA
PostQuitMessage
RegisterClassA
RegisterClassW
RegisterClipboardFormatA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
ScreenToClient
SendDlgItemMessageA
SendMessageA
SetActiveWindow
SetCapture
SetCaretPos
SetClassLongPtrA
SetClipboardData
SetCursor
SetDlgItemTextA
SetFocus
SetForegroundWindow
SetKeyboardState
SetScrollInfo
SetTimer
SetWindowLongPtrA
SetWindowPlacement
SetWindowPos
SetWindowTextA
SetWindowTextW
ShowCaret
ShowCursor
ShowWindow
SystemParametersInfoA
ToAsciiEx
TrackPopupMenu
TranslateMessage
UpdateWindow
kernel32
Beep
ClearCommBreak
CloseHandle
CompareStringW
ConnectNamedPipe
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateMutexA
CreateNamedPipeA
CreatePipe
CreateProcessA
CreateThread
DeleteCriticalSection
DeleteFileA
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileA
FindFirstFileExW
FindNextFileA
FindNextFileW
FindResourceA
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommState
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetEnvironmentVariableA
GetFileSizeEx
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessTimes
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTempPathA
GetThreadTimes
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDBCSLeadByteEx
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LockResource
MapViewOfFile
MulDiv
MultiByteToWideChar
OpenProcess
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReleaseMutex
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetCommBreak
SetCommState
SetCommTimeouts
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetHandleInformation
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SizeofResource
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
WaitForSingleObject
WaitNamedPipeA
WideCharToMultiByte
WriteConsoleW
WriteFile
shell32
ShellExecuteA
comdlg32
ChooseColorA
ChooseFontA
GetOpenFileNameA
GetSaveFileNameA
advapi32
AllocateAndInitializeSid
CopySid
EqualSid
GetLengthSid
GetUserNameA
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
Name
.text
Size
918KB
Virtual Size
918KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256KB
Virtual Size
255KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
17B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
360KB
Virtual Size
359KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
q_-_Copy_original.exe
- IMPHASH aac51396886833dc961fcd7aab7711e4
- SHA256 8500766d65825bbf017dda90e7c6fa6e58ad729e33fda8ec902b80c1710ea8f2
- MD5 a625c686a2ff894ef2c4a168556caf47
- SHA1 fc160956c315e1a08afd4c98fe4c57792d860d2f
- SHA512 8df84601781a0ff99ba458cf5995880e5314c5aff0f6c4647673b2dd83770116dc6b4621750fc9a3bbe4a30a989a7d6f718670e3d1e4e585aef733b5b457fa22
- SSDEEP 12288:QlM1A8JQMVxm4V1db5AuB3xwLPE9smCQzV/s2uwoXoq4:QlMiZMVn1db5AMxwLPnmCQzVvoO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetCurrentProcessId
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetTimeFormatW
GetDateFormatW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetNumberFormatW
DecodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
LocalFree
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapReAlloc
HeapAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
oleaut32
SysAllocString
SysFreeString
VariantClear
gdiplus
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree
Name
.text
Size
203KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=142, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=253, version=31616,
count=19, id=260, version=31616,
count=23, id=259, version=31616,
count=53, id=261, version=31616,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=277, id=1, productName=Unmarked objects,
count=49, id=261, version=31630,
count=1, id=256, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,
r.dotm
- SHA256 74b8cd7695d1a593428f71abed44e55ba5c8ab59375cb0da8b172e93018a3bcd
- MD5 deff5b338b38c045b23a7e5cea189ff5
- SHA1 676fcc940c9a99a755cb3d73ad7c9f63979656fb
- SHA512 9d04c44a9dbf3c1dd1c96436c2643e5bb16c7fc8768816639c6e1ce611bef974f2619ccdd31946d46e34b34a2597dd309ec23339ecaa62cb650b5317c19a88f0
- SSDEEP 384:tCwetnbEKXNxt/ZtNNTAANTJIA+30On/zV:z8nb9xllN5t+3B/Z
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
rom.dotm
- SHA256 693969da2c86be6dd600c60a13b4529d90bbcef99c4a7df54a6e3183b103ca1d
- MD5 4e8f5b9db0299cd9a89bdcf54a576de2
- SHA1 d44bc17913e9ca5d47df78f999943b48c3c338ff
- SHA512 f58c73b2dd85bd78cb702cf758ea91440750e1ca9c4c25cadb44dced6551afac0a1a388e83102d882a56b882b6dcfc20cd9c8584518816818452f71906e03231
- SSDEEP 384:tmtl4O22rVeC78JeA7H6akwLWdxd1JYB3TA:ql44n8Jz7aakw6L1+5A
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
solway.dotm
- SHA256 8de734bfeb825c071853247ef4941181ec68189e56c824e433c08dfa8b8010b7
- MD5 278b8d78736e92b11c82cfe6bb72aed0
- SHA1 751b7504e8fb7d931e77d6cc4bf246adca7bbce0
- SHA512 978a75f3e0aefbcfddd9cbc1daa9c321ab047c7211ca01c45e0a9055ce5d4e714bc9c48040dabc8f73be23cec747e9daad1d48884a57bb93c8b1883fa74b6de0
- SSDEEP 384:tmtl4+Yj62eV03vRNifC78Qoox1bVj6akwLWdxdsbYB3W:ql4nReG3OA8Qpaakw6LssE
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
ss.dotm
- SHA256 8c83b5a18566805b764f4ec29983d520862438ed1c7b8b7247502d2b4a879f93
- MD5 e8de6771d87cdeab98db617ef1d1ad22
- SHA1 d8d3092269eb3be6652773550d3de2c4fb5a528a
- SHA512 7397e4863dfe904660aa3e223f6437811187ad96ee4e9946364e153f876cf8f05ee93221f26acc9a462d978690777ab6dc0d72228804e7e96d29c76e6d4b7739
- SSDEEP 384:tU8zqDJtFd5dsDI5PIc3P3xEyyNxt/ZtNNGklRhE+30OnHRNWLCv4w:87zsDQIQh4xllNGklM+3BSmQw
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
testdlyailyi.dotm
- SHA256 fbdc7ef4881f4167ea6ba2baa9de4f497a12ddf67997214eacde627b1f0528e9
- MD5 9b54839fdc4827d9ea8e837b3b7926db
- SHA1 e5efb71039887e442dcae0ad343cf7431da9809b
- SHA512 f86018c59d951f48967c34c8f8bda30504e166fcc93042303bd2d6cb36c2ec76b2e80ae3cbc475f8f9ad75fc056614a89588320b7bb8c06d134a00416dd40fc9
- SSDEEP 3072:mI1nPfGR4ZSy/cuLQXwrBXgsrehk7USFIB7LZ7DFg3SXxdm4UcNBqMP7Ml:manA4oysgFX/pgRZ7BNKEN8hl
- MD5 SHA1 SHA512 SSDEEP