8547977480.zip
- SHA256 649c75d99b6d8e237d8a8d0142796fcbfa7381674628201f474b58039144ec2a
Password
infected
Overview
overview
10Static
static
7233f95c87f...31.exe
windows10-ltsc 2021-x64
72d8ea1230d...aa.exe
windows10-ltsc 2021-x64
1034dba85bb2...1a.exe
windows10-ltsc 2021-x64
7463d0b0903...ea.exe
windows10-ltsc 2021-x64
14bcf45bde8...39.exe
windows10-ltsc 2021-x64
105292b8004f...ce.exe
windows10-ltsc 2021-x64
106babc5b52d...53.dll
windows10-ltsc 2021-x64
385b73b7b3c...45.exe
windows10-ltsc 2021-x64
108eb41b097a...ff.exe
windows10-ltsc 2021-x64
8932380926b...ef.exe
windows10-ltsc 2021-x64
79d8729b9ca...de.exe
windows10-ltsc 2021-x64
89e147a3bb2...53.dll
windows10-ltsc 2021-x64
8bccfdc8e1a...96.exe
windows10-ltsc 2021-x64
8bf5a9bb619...d7.exe
windows10-ltsc 2021-x64
3d0017384df...0a.exe
windows10-ltsc 2021-x64
3d72aa8fe30...89.exe
windows10-ltsc 2021-x64
7fa622e0a4d...52.exe
windows10-ltsc 2021-x64
3fd5b0792ea...40.exe
windows10-ltsc 2021-x64
10Behavioral task
behavioral1
Sample
233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
2 signatures
1800 seconds
Behavioral task
behavioral2
Sample
2d8ea1230d6d994febd35edec21f298efe7e1a2a6f75d00a691035980f30a5aa.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
6 signatures
1800 seconds
Behavioral task
behavioral3
Sample
34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
5 signatures
1800 seconds
Behavioral task
behavioral4
Sample
463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
1 signatures
1800 seconds
Behavioral task
behavioral5
Sample
4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
7 signatures
1800 seconds
Behavioral task
behavioral6
Sample
5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
7 signatures
1800 seconds
Behavioral task
behavioral7
Sample
6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
2 signatures
1800 seconds
Behavioral task
behavioral8
Sample
85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
8 signatures
1800 seconds
Behavioral task
behavioral9
Sample
8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
21 signatures
1800 seconds
Behavioral task
behavioral10
Sample
932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
8 signatures
1800 seconds
Behavioral task
behavioral11
Sample
9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
21 signatures
1800 seconds
Behavioral task
behavioral12
Sample
9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
3 signatures
1800 seconds
Behavioral task
behavioral13
Sample
bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
7 signatures
1800 seconds
Behavioral task
behavioral14
Sample
bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
2 signatures
1800 seconds
Behavioral task
behavioral15
Sample
d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
2 signatures
1800 seconds
Behavioral task
behavioral16
Sample
d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
4 signatures
1800 seconds
Behavioral task
behavioral17
Sample
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
1 signatures
1800 seconds
General
- Target 8547977480.zip
- Size 34.2MB
- Sample241115-wpjcdsxrdy
- SHA256 649c75d99b6d8e237d8a8d0142796fcbfa7381674628201f474b58039144ec2a
- MD5 2d80845d65f702b4c692e75b67f04b7a
- SHA1 3aecbf1263d599dc24fe3c92bcad4c41e23bc955
- SHA512 9e2e77b037b815b660403aa9edfe9911301aed7fdd056a3a8b5ac7c229ff25b723acfc41d1d2d59aa8e0268564bce3d854dd9dae3e49917c4b294c1b08a695b6
- SSDEEP 786432:dSwjjNxcsSEy6TYX9I9g56wCjlup1pGmlECm9S6N6zZ0cESSNU:dSUN+s81gwC+1pG4WS6Y0cNSe
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231 vmprotect - Unsigned PE 16 IoCs
Checks for missing Authenticode signature.
resource unpack001/233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231 unpack001/34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a unpack001/463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea unpack001/4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39 unpack001/5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce unpack001/85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45 unpack001/8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff unpack001/932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef unpack001/9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde unpack001/9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753 unpack001/bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296 unpack001/bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7 unpack001/d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a unpack001/d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489 unpack001/fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52 unpack001/fd5b0792ea3837a3eb0b86a47e08d4ec52dda7f1fbe677326fbe31ac534d7340
File Explorer
-
8547977480.zip.zip 34.2MB
-
233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231.exe 3.5MB
-
2d8ea1230d6d994febd35edec21f298efe7e1a2a6f75d00a691035980f30a5aa.exe 786KB
-
34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe 215KB
-
463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe 8KB
-
4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39.exe 720KB
-
5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce.exe 450KB
-
6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll 3.4MB
-
85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45.exe 4.8MB
-
8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff.exe 7.3MB
-
932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe 2.4MB
-
9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde.exe 6.3MB
-
9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753.dll 1.8MB
-
bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296.exe 1.7MB
-
bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe 44KB
-
d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a.exe 95.4MB
-
d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489.exe 87KB
-
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52.exe 6.8MB
-
fd5b0792ea3837a3eb0b86a47e08d4ec52dda7f1fbe677326fbe31ac534d7340.exe 425KB
233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231
- IMPHASH f4f3033dc6d082dab79624f81575aceb
- SHA256 233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231
- MD5 d0c77a8d28ac7ed062de16103b7b7a9e
- SHA1 2aff43098626864c0bbb1ab5463683321b54cdcd
- SHA512 05d6e0f5d3677e1cc268ecc1ad3d5e1b7925f61bfa0e91516805d19b44a776fc7bad0725809109ab62b73916d5bc92a09e22d8f4fdfa3e191347c2ba066a7120
- SSDEEP 49152:bDLaXbiwy/9Zxi9wrxqeMho8OYetIqRLC4GBN0ILUMh+l4Im2ZvrOYa7DYya/Ku8:3OXzEnkGxqeQohS8LCR4kL7Hcdfro/o
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
3392697
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
HeapCreate
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegCloseKey
shell32
SHGetFolderPathW
winhttp
WinHttpQueryHeaders
crypt32
CryptUnprotectData
user32
GetProcessWindowStation
GetUserObjectInformationW
Name
.text
Size
Virtual Size
897KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vmp0
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
2d8ea1230d6d994febd35edec21f298efe7e1a2a6f75d00a691035980f30a5aa
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2d8ea1230d6d994febd35edec21f298efe7e1a2a6f75d00a691035980f30a5aa
- MD5 7185834758af3441e82bba85cd5b8ff0
- SHA1 58520459530dcd3f840825b540d02b0a86590b86
- SHA512 9a99d1a453a830b8c17e42e9c746b12483f3c9e8585e94e6a615b8d50cbf612610628670d8e261bab1450ed8ed7c1dac9ad7e04e1723a545325cbea098b734e8
- SSDEEP 24576:26UqGLpGLMMMHMMMvMMZMMMKzbKXOMMHMMMvMMZMMMKzbKXT7GLMMMHMMMvMMZM0:Z6MMHMMMvMMZMMMFOMMHMMMvMMZMMMFi
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
5e:ac:82:f3:75:db:aa:df:6d:b4:fc:0d:53:38:06:c2:1c:02:a2:df:6c:d6:39:79:7c:8a:06:a2:26:5b:cb:44
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 11, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
4
Entry point
98867
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
680KB
Virtual Size
679KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a
- IMPHASH 4cea7ae85c87ddc7295d39ff9cda31d1
- SHA256 34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a
- MD5 926677dc69319999351c0771c03ca302
- SHA1 0d36a4435c234015d7c3207762b08c1924272753
- SHA512 3e34fb409fec7dbe39a6f3e19a0db3f97ac944dfa0c0ffecc00d5510285fe99f42ba80cb6a910f834cb7ba47b487329dc1facc168ce970de34a8e2a32c5abe42
- SSDEEP 1536:8I47GyTGCwiSnmQUt0LB18rs5gc3H2KrmswOOF+xcYPit0AQ:8vGyYiSDnt18w5X3HrrmsQMxDqqAQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
10
Entry point
31152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wextract.pdb
advapi32
GetTokenInformation
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
FreeSid
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
LookupPrivilegeValueA
AllocateAndInitializeSid
RegQueryValueExA
EqualSid
RegCloseKey
AdjustTokenPrivileges
kernel32
_lopen
_llseek
CompareStringA
GetLastError
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
WritePrivateProfileStringA
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
GlobalLock
LocalFree
RemoveDirectoryA
FreeLibrary
_lclose
CreateDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
ReadFile
SizeofResource
WriteFile
GetDriveTypeA
LoadLibraryExA
SetFileTime
SetFilePointer
FindResourceA
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
GetCurrentDirectoryA
FreeResource
GetVersion
SetCurrentDirectoryA
GetTempPathA
LocalFileTimeToFileTime
CreateFileA
SetEvent
TerminateThread
GetVersionExA
LockResource
GetSystemInfo
CreateThread
ResetEvent
LoadResource
ExitProcess
GetModuleHandleW
CreateProcessA
FormatMessageA
GetTempFileNameA
DosDateTimeToFileTime
CreateEventA
GetExitCodeProcess
ExpandEnvironmentStringsA
LocalAlloc
lstrcmpA
FindNextFileA
GetCurrentProcess
FindFirstFileA
GetModuleFileNameA
GetShortPathNameA
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
GetDiskFreeSpaceA
MulDiv
FindClose
gdi32
GetDeviceCaps
user32
ShowWindow
MsgWaitForMultipleObjects
SetWindowPos
GetDC
GetWindowRect
DispatchMessageA
GetSystemMetrics
CallWindowProcA
SetWindowTextA
MessageBoxA
SendDlgItemMessageA
SendMessageA
GetDlgItem
DialogBoxIndirectParamA
GetWindowLongPtrA
SetWindowLongPtrA
SetForegroundWindow
ReleaseDC
EnableWindow
CharNextA
LoadStringA
CharPrevA
EndDialog
MessageBeep
ExitWindowsEx
SetDlgItemTextA
CharUpperA
GetDesktopWindow
PeekMessageA
GetDlgItemTextA
msvcrt
?terminate@@YAXXZ
_commode
_fmode
_acmdln
__C_specific_handler
memset
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
memcpy_s
_vsnprintf
_initterm
memcpy
comctl32
ord17
cabinet
ord20
ord21
ord23
ord22
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
173KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=26213,
count=2, id=259, version=26213,
count=18, id=260, version=26213,
count=17, id=257, version=26213,
count=160, id=1, productName=Unmarked objects,
count=9, id=264, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea
- SHA256 463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea
- MD5 fd1489c65b0d75f4cdc7b1f2634b5359
- SHA1 f8431629d627f8dc13ca486e8b5d0a46f47d46fd
- SHA512 e4fc02e1567e188caaf67ccd3a068e6b9db1c20b22a6949ec9ffd9d1a037afe36d744ac8c94a0fd5df55c7e2a51c10a9bcf05c3274175c8296cf16be718a99a2
- SSDEEP 96:a9hcOxiPwrltSJ1+pa/4/pzzkZj6tfCIQJ25FsfQungwffm2gbFnU:avc4rvpPd4Z+t6BJyungwffPZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39
- IMPHASH 65630e32ca19e44a53e696246bd1cada
- SHA256 4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39
- MD5 deece2ef4fe8f9c0c587d67ecb2d1fa4
- SHA1 cf7588cf77acd63a4ecf3f554e1672708ee4eaac
- SHA512 c062403aaccc83f090704f79540d22f4a6d7de7d18de1297d3170ebb9653a8e40ec3719e45f91782c2eb4829ba623aba3b3040ab716901dc81d939356a21ebd6
- SSDEEP 12288:+SipcKrMXnVVLsx7i0ioWvVGYmp7aGEiN8ut/DIXIrVO6b04huXB1lyqmxlz4lVP:fipcKOnVVLsxXEir/DqIrVG4eyjbz4zP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
148474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Администратор\Downloads\Documents\zjmo3z\main.pdb
kernel32
VirtualProtect
GetSystemInfo
FormatMessageA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
MultiByteToWideChar
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetCurrentThread
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
SetConsoleCtrlHandler
HeapReAlloc
GetTimeZoneInformation
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
HeapSize
WriteConsoleW
Name
.text
Size
470KB
Virtual Size
469KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
145KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=27412,
count=166, id=261, version=27412,
count=22, id=260, version=27412,
count=3, id=257, version=27412,
count=89, id=1, productName=Unmarked objects,
count=17, id=260, version=31328,
count=21, id=259, version=31328,
count=74, id=261, version=31328,
count=1, id=265, version=31332,
count=1, id=258, version=31332,
5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce
- MD5 47d4b2fd7654ad71026eb66dd2aa5d97
- SHA1 dabbda8e945fadee09c5bbee1b0ed9a4036038f5
- SHA512 3412e220dfcfa4401b03e0ca36c55c03f65bc92016a5a52db625a16c4e1171b1305477e9b461f3aaffeafcae99ccfdf1c9e4729695007718469bda1d753f28f1
- SSDEEP 6144:Z8fFQo+7Q0H3y+nvEGiBpYbgBUR4JttcBDlxdwpfxfBThM9eo1I7u0Kry2wej99u:ZYFiISM5jY9IfBTy9eo1dC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
171559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
289KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853
- IMPHASH 08081e94274fa8ff1192d4e625587531
- SHA256 6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853
- MD5 4d536854aa5cbf1fc1c7d2cfc8ee65f6
- SHA1 d29e0930c73e808b394c082e372033b0e57bc8b9
- SHA512 1aa95fa137e5fc15b56f2155877f23e6609a440f22d143daff0436c0573ec75c528cb2a4af6d76b29085187ba2bc7ea105af65a89559445f248b466cd0079ad4
- SSDEEP 49152:naJlbM2hKrp949JqBaaI8zAlhSQrhF0Cph4D4QGpUFCU/rc6jQ6qv/:Ei94AIRSQrhF0K2DX6U/rk
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Digest
4b:61:85:8f:de:8b:6f:0a:c2:ae:3f:d2:97:6c:6a:4f:7a:cc:25:58:ed:b9:ac:88:ea:65:91:6f:ed:12:68:35
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Box\, Inc.,O=Box\, Inc.,L=Redwood City,ST=California,C=US
Chains
Apr 28, 2022
CN=Box\, Inc.,O=Box\, Inc.,L=Redwood City,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Box\, Inc.,O=Box\, Inc.,L=Redwood City,ST=California,C=US
Serial Number
09:13:8f:81:f4:02:79:e8:ef:2e:91:a6:6d:ac:09:1b
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 13, 2021 - Oct 8, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Minor OS version
0
Major OS version
6
Entry point
1538217
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\jenkins\workspace\BfD-Postpush-Build\label\desk-w1064-py3-large\bfd\shell\win\Release\BoxShellExt32.pdb
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
propsys
VariantToPropVariant
uxtheme
BeginBufferedPaint
EndBufferedPaint
kernel32
GetEnvironmentStringsW
HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
WideCharToMultiByte
LocalFree
FormatMessageW
FormatMessageA
CreateEventA
SetEvent
CreateEventW
GetLastError
FindFirstChangeNotificationW
FindCloseChangeNotification
WaitForMultipleObjects
FindNextChangeNotification
ReleaseSRWLockShared
AcquireSRWLockShared
GlobalAlloc
GlobalLock
GlobalFree
GlobalUnlock
DecodePointer
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RaiseException
InitializeCriticalSectionEx
FindClose
FindFirstFileW
FindNextFileW
InitializeSRWLock
GetProcAddress
GetModuleHandleW
CreateSemaphoreA
DuplicateHandle
GetCurrentProcess
ReleaseSemaphore
WaitForSingleObjectEx
UnregisterWaitEx
UnregisterWait
FreeEnvironmentStringsW
RegisterWaitForSingleObject
ReadFile
ProcessIdToSessionId
GetCurrentProcessId
CancelIoEx
Sleep
CompareStringOrdinal
DeviceIoControl
CreateFileW
GetSystemTimeAsFileTime
GetModuleFileNameW
QueueUserWorkItem
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCurrentThreadId
WaitNamedPipeA
WriteFile
CreateFileA
CancelIo
InitializeCriticalSection
WaitForSingleObject
InterlockedPushEntrySList
InitializeSListHead
InterlockedPopEntrySList
ConnectNamedPipe
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibraryAndExitThread
GetCommandLineW
GetCommandLineA
GetOEMCP
FindNextFileA
FindFirstFileExW
FindFirstFileExA
HeapSize
HeapReAlloc
SetConsoleCtrlHandler
ReadConsoleW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetEnvironmentVariableA
LoadLibraryExW
SetEnvironmentVariableW
GetVersionExW
WriteConsoleW
OutputDebugStringA
GetOverlappedResult
RtlCaptureStackBackTrace
FreeLibrary
GetThreadTimes
GetCurrentThread
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
VirtualAlloc
CreateTimerQueueTimer
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
GetStartupInfoW
IsProcessorFeaturePresent
GetStdHandle
GetACP
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
ExitThread
GetTimeZoneInformation
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
FoldStringW
EnumSystemLocalesA
GetFileType
SetStdHandle
RtlUnwind
LoadLibraryW
CreateTimerQueue
QueryDepthSList
InterlockedFlushSList
SetProcessAffinityMask
VirtualFree
VirtualProtect
IsDebuggerPresent
OutputDebugStringW
GetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
SetFileTime
GetWindowsDirectoryW
CreateDirectoryExW
CopyFileW
MoveFileExW
AreFileApisANSI
MultiByteToWideChar
TryEnterCriticalSection
GetStringTypeW
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
ResetEvent
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
ResumeThread
GetSystemInfo
GetLogicalProcessorInformation
GetModuleHandleA
CreateWaitableTimerA
GetLocaleInfoA
IsValidCodePage
IsDBCSLeadByteEx
user32
InsertMenuItemW
GetClipboardFormatNameW
UnregisterClassW
RemoveMenu
GetMenuItemCount
DestroyIcon
GetDC
ReleaseDC
RegisterClipboardFormatW
GetSystemMetrics
LoadImageW
DrawIconEx
GetMenuItemInfoW
InsertMenuW
CreatePopupMenu
gdi32
CreateDIBSection
DeleteObject
SelectObject
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
shell32
SHCreateItemWithParent
SHBindToObject
ord256
SHGetIconOverlayIndexW
SHGetFileInfoW
ord25
SHBindToFolderIDListParent
ord19
ord155
SHCreateDefaultContextMenu
AssocCreateForClasses
SHBindToParent
SHGetKnownFolderPath
ord18
SHParseDisplayName
ole32
CoTaskMemAlloc
CreateBindCtx
StringFromCLSID
ReleaseStgMedium
CoCreateInstance
CoTaskMemFree
oleaut32
VariantInit
VariantClear
VariantChangeType
SysFreeString
shlwapi
ord12
PathRelativePathToW
StrRetToStrW
ws2_32
ntohl
htons
htonl
ntohs
bcrypt
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
530KB
Virtual Size
530KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
64KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
540KB
Virtual Size
540KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
135KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=162, id=243, version=40116,
count=31, id=242, version=40116,
count=26, id=259, version=26706,
count=32, id=260, version=26706,
count=59, id=261, productName=VS2017 v15.8.4 build 26729, version=26729,
count=122, id=261, version=26706,
count=1, id=209, version=65501,
count=18, id=206, version=65501,
count=1, id=208, version=65501,
count=27, id=203, version=65501,
count=251, id=1, productName=Unmarked objects,
count=38, id=265, version=27039,
count=1, id=256, version=27039,
count=1, id=255, version=27039,
count=1, id=151,
count=1, id=258, version=27039,
85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45
- IMPHASH 67b2adb2c47b75a771e225f44bf71bb2
- SHA256 85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45
- MD5 854d5dfe2d5193aa4150765c123df8ad
- SHA1 1b21d80c4beb90b03d795cf11145619aeb3a4f37
- SHA512 48ed604ea966a35cc16631ce5da692bb236badafdb6d3d01ef3a27ab5a9c1ea6a19d6e8209c894ab292614cfbd355c2ca96401fd4dbb9a3abbfd886cddae77cc
- SSDEEP 98304:GiIOIQKetb5uDv/tFAOoLKSIc5EP61wNYZiu7JfQmEM9:rIbCEA1EP614g9fQm59
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
8720881
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
advapi32
CreateServiceA
shell32
SHGetSpecialFolderPathA
setupapi
SetupDiGetClassDevsA
wtsapi32
WTSSendMessageW
user32
MessageBoxW
Name
.MPRESS1
Size
4.4MB
Virtual Size
8.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
361KB
Virtual Size
360KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff
- IMPHASH 3786a4cf8bfee8b4821db03449141df4
- SHA256 8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff
- MD5 83dbe0cb14f889e38fc0f8889842cf9d
- SHA1 ded313ca908136000fd9e5f623dcf0974e2b5f30
- SHA512 ad4bef13d8b816dc81b42e0a2983cedd8c1b66bb15ffff93d908dd8bb78621c2ec690c44dc01bffb3a378159c42c7552ebd27bdb889eb13351a85a26d61fbac6
- SSDEEP 196608:91O0G+ffRqHIxpuBM9lsB1veokOefmev7+RND:3OL+ffRqoxpAQi0POcmez+LD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
84740
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
VariantClear
SysAllocString
user32
SendMessageA
SetTimer
DialogBoxParamW
DialogBoxParamA
SetWindowLongA
GetWindowLongA
SetWindowTextW
LoadIconA
LoadStringW
LoadStringA
CharUpperW
CharUpperA
DestroyWindow
EndDialog
PostMessageA
ShowWindow
MessageBoxW
GetDlgItem
KillTimer
SetWindowTextA
shell32
ShellExecuteExA
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
GetCurrentProcess
TerminateProcess
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
SetUnhandledExceptionFilter
TlsAlloc
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
WaitForSingleObject
CloseHandle
CreateProcessA
SetCurrentDirectoryA
GetCommandLineW
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetLastError
LoadLibraryA
AreFileApisANSI
GetModuleFileNameA
GetModuleFileNameW
LocalFree
FormatMessageA
FormatMessageW
GetWindowsDirectoryA
SetFileTime
CreateFileW
SetLastError
SetFileAttributesA
RemoveDirectoryA
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
lstrlenA
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryA
GetTempPathA
GetTempFileNameA
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetStdHandle
WaitForMultipleObjects
Sleep
VirtualAlloc
VirtualFree
CreateEventA
SetEvent
ResetEvent
InitializeCriticalSection
RtlUnwind
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
CreateThread
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=25, id=14, version=7299,
count=64, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=95, version=2190,
count=184, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=77, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=7, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef
- SHA256 932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef
- MD5 989cb0bfa4cc0bd8e8302f47add8e368
- SHA1 515b82386397ec822edbce6f24a6c4b9d13b0344
- SHA512 9211bb8622c7dee790db4847a9095bfd8dc48d324a400f374ab42ce65c1e2295cc6392a16e031282f6b3fa29a1881487016c9b817e05d65420d7db41f4548583
- SSDEEP 24576:pu4wFHPSaD/zXFRRhOnYQb6VOOmWC9+HW0MigJS3Cd+XHKrQD2YR:
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde
- IMPHASH 3786a4cf8bfee8b4821db03449141df4
- SHA256 9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde
- MD5 ded964e022a37d93d434091ec75f9881
- SHA1 e89a551ac1f19dc3838e21157667e2f98d84d06b
- SHA512 13f0873cc797eeb7a4a1606ea3dc95f0d1f96bf1dfad286ee3959f0b885426214c24c1ea2422a46191f78063b75200d7ad9065d5654a7758086a9e41f7cf75af
- SSDEEP 196608:91OEVXHF+E/eq7QuIUVUMxVuAK1X84eu/k9RD13q:3OEVV+tq7Q7U62AAi84VkF13q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
84740
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
VariantClear
SysAllocString
user32
SendMessageA
SetTimer
DialogBoxParamW
DialogBoxParamA
SetWindowLongA
GetWindowLongA
SetWindowTextW
LoadIconA
LoadStringW
LoadStringA
CharUpperW
CharUpperA
DestroyWindow
EndDialog
PostMessageA
ShowWindow
MessageBoxW
GetDlgItem
KillTimer
SetWindowTextA
shell32
ShellExecuteExA
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
GetCurrentProcess
TerminateProcess
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
SetUnhandledExceptionFilter
TlsAlloc
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
WaitForSingleObject
CloseHandle
CreateProcessA
SetCurrentDirectoryA
GetCommandLineW
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetLastError
LoadLibraryA
AreFileApisANSI
GetModuleFileNameA
GetModuleFileNameW
LocalFree
FormatMessageA
FormatMessageW
GetWindowsDirectoryA
SetFileTime
CreateFileW
SetLastError
SetFileAttributesA
RemoveDirectoryA
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
lstrlenA
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryA
GetTempPathA
GetTempFileNameA
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetStdHandle
WaitForMultipleObjects
Sleep
VirtualAlloc
VirtualFree
CreateEventA
SetEvent
ResetEvent
InitializeCriticalSection
RtlUnwind
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
CreateThread
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=25, id=14, version=7299,
count=64, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=95, version=2190,
count=184, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=77, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=7, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753
- SHA256 9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753
- MD5 6df29a5803a4576a90b6d9cc44b622bc
- SHA1 7bed517810e102847d8679aaa3a1caf7ae1a6064
- SHA512 38267fca5b28db2e85663bfe075307cfd66e8fd6c30303ad9840a1c04ab287232d700fbca506d837c2c927f46b738999a3de40747dd064ddf3a9dd025cf882a2
- SSDEEP 24576:hQTh2cyxiz583hZprjumLzu2O7K8HzxemmF2ZvgsnJQ9q12BL7TLhn5c0ANTyKmz:15Q831o2cHtemmFoDQ9q12BLTh+0u+b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
243868
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
235KB
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296
- IMPHASH ae9f6a32bb8b03dce37903edbc855ba1
- SHA256 bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296
- MD5 e9118e77017247f6e5d4046ce9dad8b6
- SHA1 8204f61940dc697bf1d96e5a1625629ead242275
- SHA512 027a2e262975982f0de9a6be165b77edb037beca0ecfa38a3c4f63aae07416aa688767fd50cf0bf1a5c492d9ee6d04c72aefb3a90ae31a7de1ce088964f5bdaa
- SSDEEP 49152:H6M6Zsl+0dOuD2rmHiSCYK64SDq2zPrBLNTyCrxw:H6pZskpuD+gGYa+zBL05
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
81360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileTime
CloseHandle
CreateFileW
CreateDirectoryW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
MoveFileW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
WaitForSingleObject
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwind
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer
gdiplus
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
Name
.text
Size
152KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=140, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=199, version=41118,
count=23, id=259, version=24123,
count=19, id=260, version=24123,
count=41, id=261, version=24123,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=248, id=1, productName=Unmarked objects,
count=38, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7
- MD5 caef853daea33a8898555fee1d45e093
- SHA1 f32005ded199e821ef77d501f8368a9dcc89c20c
- SHA512 b9e37d92c74d9b0677c1c7f8ca2e68fbda5d04b2ca206f6b5401d32073c798a827c6cf449ccecf9c6b58ed15b3ca18b4ba0b5c53c0566ca194affc5eb411a92b
- SSDEEP 768:8jYeM17XpwE3sKfkCbJokUP/W1CqpBoa8PP:feW71D6xP/WIquPP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a
- MD5 6d08fd7ee7d279585077bff3b77c9cf1
- SHA1 09918a40856f17990378fcf280d3ce399d1bbdde
- SHA512 9673687f67aecefaeeb24104cea85632a89ca4533fe668a14a99cc05ff2fd0e399b8ff62c1716f933884bc160639ca9245fcfaf70dbc32cd8180e55808cf7e01
- SSDEEP 96:wCuMxH2gn9Qr393iMMQGjHJvVkOoEV35quW/2viMffthpl4WUl4hbFnU:wCNn9Y95MLkOoEVFNviMfftl2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489
- IMPHASH bf52931198d3e5b9c8012529ed70ad5d
- SHA256 d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489
- MD5 769df9e877f419beb20a34515a4b211f
- SHA1 8de6ec68b339a3f8761703b20a3cfe1c4370f532
- SHA512 ef19bd14aac3260be66a30ff21fedf181ece14fb67e76546fa41b6462f2514645c0c2cd0a6244be1b03af71459114c66f28bc588eabaab3d340071a80aa8d8ea
- SSDEEP 1536:VpQKRk5UqXbkb2bM5XiE6cuR0Zng71jahYQeEmus8jcd3WWn7q:r6rkb2b6S3cuREn0ahZeEmr3WWn7q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10213
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
GetEnvironmentVariableW
MultiByteToWideChar
GetLastError
LoadLibraryA
lstrcatW
RaiseException
DecodePointer
GetProcAddress
DeleteCriticalSection
CreateFileW
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
CloseHandle
GetFileType
GetProcessHeap
SetEnvironmentVariableW
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
LocalFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
CompareStringW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
wsprintfW
FindWindowA
oleaut32
SafeArrayGetDim
VariantInit
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen
SafeArrayAccessData
VariantClear
GetErrorInfo
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=120, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=259, version=24237,
count=18, id=260, version=24237,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=261, version=24237,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=108, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52
- IMPHASH 9985eabc669dffd70480f5c63129ffa1
- SHA256 fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52
- MD5 6cb87a9fc7dc1f2a5410fd428f5460f0
- SHA1 2885b2d28a333d7bd9d6488ba2bf7312fc811e3a
- SHA512 4c266dee0538259df0a2f9625abaf410c587e63d10269f9547820582b5758201a5371f705f0cbd65e72348c2276cd8c6b393c49efa095cd47b718ff029733269
- SSDEEP 98304:HX5r8kh/RFaW1k9FP0+NCOx2SSGso5pOmaD6Ce2b3V9Sk9Q5uR018Kv/YAFvGF1p:HX53h/bk9PbEAXaDBl9rv0JHFeFOb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
892290
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
IsValidCodePage
HeapSize
GetCurrentThreadId
AreFileApisANSI
ExitProcess
GetProcessHeap
IsDebuggerPresent
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetProcAddress
GetACP
TlsSetValue
Sleep
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
RtlUnwind
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
GetLastError
DecodePointer
EncodePointer
WideCharToMultiByte
GetStdHandle
GetFileType
WriteFile
QueryPerformanceCounter
GetEnvironmentStringsW
GetConsoleMode
ReadFile
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
MultiByteToWideChar
MulDiv
InitializeCriticalSectionAndSpinCount
HeapFree
LocalFree
GetCurrentProcessId
GetVersionExA
SetEndOfFile
DeleteCriticalSection
GetStringTypeW
SetEnvironmentVariableA
UnhandledExceptionFilter
SetLastError
IsDBCSLeadByteEx
FindFirstFileA
SetCurrentDirectoryA
GetSystemDirectoryA
GetModuleFileNameW
LeaveCriticalSection
GlobalAlloc
GetCommandLineA
ReadConsoleW
GetCurrentThread
GlobalLock
GetModuleHandleExW
InitializeSListHead
WaitNamedPipeA
GetCommState
GetCPInfo
CreateThread
GetSystemTime
GetOEMCP
GetModuleFileNameA
RaiseException
CreateFileW
SetCommState
GetModuleHandleW
GetCommandLineW
DeleteFileA
TlsFree
CloseHandle
TlsAlloc
FreeEnvironmentStringsW
GetLocalTime
EnterCriticalSection
CreateNamedPipeA
CompareStringW
GetEnvironmentVariableA
TerminateProcess
Beep
GetTimeFormatW
GetConsoleCP
ClearCommBreak
GetTickCount
SetCommBreak
GetCurrentProcess
GetStartupInfoW
TlsGetValue
user32
EndPaint
SetCursor
DeleteMenu
CreateAcceleratorTableW
WaitMessage
DrawFocusRect
LoadAcceleratorsW
OffsetRect
GetKeyboardLayout
InvalidateRect
PeekMessageA
ValidateRgn
ToAsciiEx
ScreenToClient
DestroyWindow
MapDialogRect
SetFocus
DrawEdge
ShowCaret
GetDoubleClickTime
InsertMenuItemW
CreateIconIndirect
IsDialogMessageW
SetPropA
BringWindowToTop
GetWindowLongA
ToUnicode
DefWindowProcA
DestroyCaret
AppendMenuA
CreateCaret
FindWindowExW
ReleaseCapture
ScrollWindowEx
UpdateWindow
DestroyMenu
DialogBoxParamA
SetWindowPlacement
SetCapture
KillTimer
LoadIconA
SetScrollRange
GetCapture
SetWindowLongA
EnableMenuItem
DestroyCursor
ShowWindow
IsDlgButtonChecked
EnableScrollBar
InsertMenuA
AdjustWindowRect
DestroyAcceleratorTable
GetSystemMenu
SetTimer
IsIconic
ChangeDisplaySettingsW
SetParent
BeginPaint
UnionRect
AppendMenuW
CreateWindowExA
SetScrollPos
ReleaseDC
GetDlgItem
ScrollWindow
SetWindowsHookExA
FlashWindow
DispatchMessageA
DefDlgProcA
RegisterClassW
SetCaretPos
RegisterClassA
IsRectEmpty
gdi32
CreateBitmapIndirect
GetCharWidth32A
GetTextExtentPointA
GetTextMetricsA
RectVisible
GetObjectA
CreateEnhMetaFileW
CreateICW
RestoreDC
EnumFontsA
SetLayout
Arc
SetViewportOrgEx
GetCharWidthW
Polygon
GetRgnBox
GetCharWidth32W
GetBkColor
GetCurrentPositionEx
EnumFontFamiliesA
IntersectClipRect
GetDeviceCaps
SetDIBColorTable
CopyEnhMetaFileA
SelectObject
SetPolyFillMode
RectInRegion
Ellipse
GetTextExtentPointW
GetTextExtentExPointA
SetROP2
RoundRect
SetWinMetaFileBits
EqualRgn
GetCharacterPlacementW
SetTextColor
SetWindowExtEx
PatBlt
BitBlt
ExtCreatePen
PtInRegion
StretchBlt
TextOutA
GetPixel
GetClipBox
GetCharABCWidthsW
StretchDIBits
RealizePalette
GetWindowOrgEx
MoveToEx
SaveDC
GetCharWidthA
PlayEnhMetaFile
DeleteObject
CreatePalette
GetEnhMetaFileHeader
CreateHalftonePalette
GetWinMetaFileBits
CreateFontIndirectA
CreateCompatibleDC
CreateHatchBrush
CreateDIBSection
advapi32
AllocateAndInitializeSid
RegDeleteValueA
SetSecurityDescriptorDacl
RegQueryValueExA
RegCreateKeyA
GetLengthSid
GetUserNameA
SetSecurityDescriptorOwner
RegCreateKeyExA
RegEnumKeyA
shell32
CommandLineToArgvW
Name
.text
Size
983KB
Virtual Size
983KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5.8MB
Virtual Size
21.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=57, id=223, productName=VS2013 build 21005, version=21005,
count=71, id=225, productName=VS2013 build 21005, version=21005,
count=213, id=224, productName=VS2013 build 21005, version=21005,
count=11, id=203, version=65501,
count=251, id=1, productName=Unmarked objects,
count=6, id=229, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
fd5b0792ea3837a3eb0b86a47e08d4ec52dda7f1fbe677326fbe31ac534d7340
- IMPHASH f86972b0b9fc89569bd497bebfd6a497
- SHA256 fd5b0792ea3837a3eb0b86a47e08d4ec52dda7f1fbe677326fbe31ac534d7340
- MD5 8f0d398959a95fb00ffa81becc6bc147
- SHA1 3b7ed126288b9d5dc1a6fa990f6ee9ad6c132c19
- SHA512 f578db36b7993f446fa6ee6757a2bee1679d405bbccbe4af31c373df08d1242ac92d7567fa209569af59cd91917b508e422ef7cd174b578ede934f78f4348354
- SSDEEP 6144:O7IX9J9oLlR33beYHpfWvK817NeEkhjAY96stDxgRnlBFMjkymwMGeigavwVfque:O+doLn37FWi87e0vjR2QyMGTZz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
30336
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\bub-gakuleliyi98\lafacures 82_cucoci\17\c.pdb
kernel32
MoveFileExA
IsBadHugeReadPtr
SetEndOfFile
FindResourceExW
GetConsoleAliasExesLengthA
GetConsoleAliasA
InterlockedDecrement
HeapFree
SetVolumeMountPointW
SetThreadExecutionState
GetSystemDefaultLCID
ConvertFiberToThread
WaitNamedPipeW
SetCommTimeouts
EnumResourceTypesA
GlobalAlloc
SetFileShortNameW
LoadLibraryW
ReadConsoleInputA
GetFileAttributesA
DnsHostnameToComputerNameW
GetFileAttributesW
SetTimeZoneInformation
WriteConsoleW
GetGeoInfoA
GetBinaryTypeW
LCMapStringA
GetCPInfoExW
TlsGetValue
GetLastError
GetProcAddress
VirtualAlloc
SetComputerNameA
GlobalGetAtomNameA
LoadLibraryA
WriteConsoleA
LocalAlloc
GetFileType
WritePrivateProfileStringA
CreateEventW
AddAtomA
FoldStringA
FindNextFileA
SetConsoleCursorInfo
GetModuleHandleA
FindFirstChangeNotificationA
CreateMutexA
FindNextFileW
VirtualProtect
GetFileAttributesExW
SetFileShortNameA
GetVersion
SetFileValidData
EnumCalendarInfoExA
SetFileAttributesW
IsBadStringPtrW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
HeapAlloc
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
DeleteCriticalSection
SetFilePointer
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
ReadFile
CloseHandle
CreateFileA
InitializeCriticalSectionAndSpinCount
SetStdHandle
FlushFileBuffers
HeapSize
GetConsoleOutputCP
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetProcessHeap
advapi32
DeregisterEventSource
ole32
OleQueryLinkFromData
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
206KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=149, productName=VS2008 build 21022, version=21022,
count=145, id=131, productName=VS2008 build 21022, version=21022,
count=46, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=141, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,