13af3ad92eb86c2c95c816ac526b97c78e0aaed46535c61bf363d768bb2cb0c9
- SHA256 13af3ad92eb86c2c95c816ac526b97c78e0aaed46535c61bf363d768bb2cb0c9
Overview
overview
10Static
static
319979.exe
windows7-x64
1019979.exe
windows10-2004-x64
10Factura_855.pdf.exe
windows7-x64
10Factura_855.pdf.exe
windows10-2004-x64
7qfmjhb.exe
windows7-x64
3qfmjhb.exe
windows10-2004-x64
3Fattura_855.pdf.exe
windows7-x64
10Fattura_855.pdf.exe
windows10-2004-x64
7gocbcx.exe
windows7-x64
3gocbcx.exe
windows10-2004-x64
3IoC/MIL000...0.xlsm
windows7-x64
3IoC/MIL000...0.xlsm
windows10-2004-x64
1IoC/PO.xlsx
windows7-x64
8IoC/PO.xlsx
windows10-2004-x64
1PO_2022-04-33981.exe
windows7-x64
3PO_2022-04-33981.exe
windows10-2004-x64
10IoC/Pagamento.xlsx
windows7-x64
8IoC/Pagamento.xlsx
windows10-2004-x64
1IoC/SHIPPI...TS.rtf
windows7-x64
8IoC/SHIPPI...TS.rtf
windows10-2004-x64
3SMK_29082022.exe
windows7-x64
10SMK_29082022.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19979.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
19979.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
Factura_855.pdf.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
Factura_855.pdf.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
qfmjhb.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
qfmjhb.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
Fattura_855.pdf.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
Fattura_855.pdf.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral9
Sample
gocbcx.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
gocbcx.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
IoC/MIL0000640730.xlsm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
IoC/MIL0000640730.xlsm
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
IoC/PO.xlsx
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
IoC/PO.xlsx
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral15
Sample
PO_2022-04-33981.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
PO_2022-04-33981.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral17
Sample
IoC/Pagamento.xlsx
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
IoC/Pagamento.xlsx
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
IoC/SHIPPING DOCUMENTS.rtf
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral20
Sample
IoC/SHIPPING DOCUMENTS.rtf
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
SMK_29082022.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
SMK_29082022.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 13af3ad92eb86c2c95c816ac526b97c78e0aaed46535c61bf363d768bb2cb0c9
- Size 5.4MB
- Sample241121-yvb7da1jdp
- SHA256 13af3ad92eb86c2c95c816ac526b97c78e0aaed46535c61bf363d768bb2cb0c9
- MD5 f2d05d9992533275a7c42b6bc872a9da
- SHA1 567be5eeafde8b270928ed0d254a5331de5d8970
- SHA512 10131839c5aaadc7898778510e422c3ec9dc329fda621a4d47603c4b7218bc6e40aa831238aee7ddf044bc04d0dc0dbd8a4298ef67eb2573229154dc9e4ba5de
- SSDEEP 98304:JQFJ2L2CvcY7TWNzDC1ya1gigYC2b9VIJE/y4T4l5jPH+tXJNo5mx:IJ2LLUY7aJChgig4VID48lZNG
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack002/19979.bat unpack003/Factura_855.pdf.exe unpack004/qfmjhb.exe unpack005/Fattura_855.pdf.exe unpack006/gocbcx.exe unpack007/PO_2022-04-33981.exe unpack009/$PLUGINSDIR/System.dll
File Explorer
-
13af3ad92eb86c2c95c816ac526b97c78e0aaed46535c61bf363d768bb2cb0c9.zip 5.4MB
-
IoC/19979.lzh.rar 450KB
-
19979.bat.exe 630KB
-
IoC/Factura_855.pdf.tar.tar 216KB
-
Factura_855.pdf.exe.exe 214KB
-
ncbe92xxyz7k26e4s88j184KB
-
qfmjhb.exe.exe 5KB
-
yqmxitinks5KB
-
IoC/Fattura_855.pdf.tar.tar 242KB
-
Fattura_855.pdf.exe.exe 240KB
-
gocbcx.exe.exe 64KB
-
ncssrlmzyd184KB
-
rnukeqm5KB
-
IoC/MIL0000640730.xlsm.xlsm 34KB
-
IoC/PO.xlsx.xlsx 673KB
-
IoC/PO_2022-04-33981.IMG.iso 1.4MB
-
PO_2022-04-33981.exe.exe 924KB
-
IoC/Pagamento.xlsx.xlsx 673KB
-
IoC/SHIPPING DOCUMENTS.doc.rtf .doc 11KB
-
IoC/SMK_29082022.rar.rar 86KB
-
SMK_29082022.exe.exe 122KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
ROVS.dat112KB
-
camera-hardware-disabled-symbolic.symbolic.png.png 216B
-
emblem-unreadable.png.png 347B
-
mail-signed.png.png 501B
-
media-removable.png.png 834B
-
preferences-system-network-proxy-symbolic.symbolic.png.png 287B
-
printer-network.png.png 803B
-
selection-end-symbolic-rtl.symbolic.png.png 142B
-
value-increase-symbolic.symbolic.png.png 113B
-
zoom-out-symbolic.svg.xml 335B
-
IoC/SOA.IMG.iso 1.3MB
-
IoC/Scanned_ Inovice no MUM2122DD066844 NPVP13.r00.rar 368KB
IoC/19979.lzh
- SHA256 a4f58a821c1320196c8a18959c39807d671929a10e7c9c1594e9e8c4d842e97a
- MD5 cfe466b2e7bc5da1a9ec573c931a4b44
- SHA1 cc6e9485603ab3bdc9433e21e681fc8bfcc2da67
- SHA512 3ecbf5ff62d0d3fcd5c8b942e85066747652fa81e7aa9372ab8033481fe62b126573773f448010ecc6fec6acf9db3bc0bf11cfd6e64f89496b88819409911378
- SSDEEP 12288:LFGDop++4dDV5m0VY0bgGm3AAmQDtwhKfq:L4Dnzs0VYpGmZDA
- MD5 SHA1 SHA512 SSDEEP
19979.bat
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6ff40b2ed84520e3135881c7a31a49f2a0952e1ed7a9739527b1619bcb6ec8f8
- MD5 1c41d0198adc92df0a83e60c27c76c78
- SHA1 689aa46c42c440b86e7a11a18bca0c4c6afd9c0e
- SHA512 f2e562a2d7f916587f5ac71efe34ad431ae45632080d7e9f3cd3108f7b5afd23fb473b3bda3577eaa4b0570c4a8969c124398da0997a6a04597c3396137924c5
- SSDEEP 12288:xnZHHEPo3PUuUSc6AdkuqV3wuEW2ypRxRWj:xZnEPonoawe2yVRS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
643118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
620KB
Virtual Size
620KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IoC/Factura_855.pdf.tar
- SHA256 59fcf7f2282f42a6ef952e0b2e8c1f674eae3fd02636b38919b414921e31d6ba
- MD5 217e60a44704bab37442ba07a9344034
- SHA1 79272010b9080c4905a0ec4526bf6bc87c11f827
- SHA512 d8c6bcd8251a28e7c79a8f3611f2c277162d1b085232b94558e6964b0f88e204e64ab25b89c571d6b46fcaafdc9ac2e363eb9c174866e5463a007a4675321865
- SSDEEP 6144:oNeZmOQDVfP9e6oAzSI/2Cou2L2YlOPrYbih:oNlOQZP9e6RzS5c2LZcU
- MD5 SHA1 SHA512 SSDEEP
Factura_855.pdf.exe
- IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
- SHA256 498cbaa02846904c60c9a349f49bc72a046d1cd686d858286f33cfcf39716215
- MD5 fbcc50e49a03f6b2469352851fcc0800
- SHA1 63f99919354e58010819251556f5ace361b7c390
- SHA512 d7080f1d75a1f88d56d24da1f8d132625236a6057f5d0571bcac387afa27c2a294983d3df952bea8592812415d4210f4136f5a367b4cf81883e3d487c580b7f7
- SSDEEP 6144:HNeZmOQDVfP9e6oAzSI/2Cou2L2YlOPrYbihN:HNlOQZP9e6RzS5c2LZcUU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
ncbe92xxyz7k26e4s88j
- SHA256 d9f4d5de73452115d9acdccda02398bc5c5a2b4b99d6dc5d8feea4584856cf53
- MD5 d55278f3c9ddd6df247d043d0f4d334e
- SHA1 2aa2b417aa8897935f5cc77ab8a7617ef8d75861
- SHA512 1bf4175795d93a4d0c6dc7a7acefb15204558087d9f918ddb3de2caaf2d67fd63785bee2f7a6f3aafa025f7ccafeb4043403dc18728633fd1abab27b6820e732
- SSDEEP 3072:3z8P0vYg6rphMwKvrkloD/HDwvmsid7D/rs9dxynKGVTfVPXOG4YOFxjJcASfMYk:j1QJ3MwKv+oTH0vRid7D/rqITfgpj7a6
- MD5 SHA1 SHA512 SSDEEP
qfmjhb.exe
- IMPHASH d9e2c2cfadc9b8c58e77308d7ea842d9
- SHA256 0487ed5d2a046ee552e410b5c9b3cf27eb0c3b369fecff3132c58e57eb1c0ad8
- MD5 d93c0902c13f3f17012c2778fd24b009
- SHA1 7ad3d53210ce587d2195545115c9086457a14623
- SHA512 4cb2d5beb7ed5532819bd96c92000c9e12f145d37cdd2ad4dec3f67ce74107c4a00fb850700015168ef6c2620277c237de3a2c279a99150ed46a3d0b5905fc3a
- SSDEEP 96:jYRTsfPD1niVZnEQ1TfHP97HzJcpLLWPOoyn:jYRIPDwVF15fV79qLSPOoyn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\qppjp\pyfmcn\hzbj\538c286c111a448ba613931952afb3f8\zbgwys\ercyfhvf\Release\ercyfhvf.pdb
imm32
ImmRegisterWordA
ImmLockIMC
ImmSetCompositionFontW
ImmGetHotKey
ImmGetConversionListA
kernel32
GetFileSize
ReadFile
CreateFileW
VirtualAlloc
GetConsoleWindow
rtm
RtmDeleteRouteTable
MgmDeInitialize
MgmDeRegisterMProtocol
RtmRegisterClient
RtmCreateEnumerationHandle
RtmDeregisterClient
pdh
PdhCloseQuery
PdhVbAddCounter
PdhValidatePathW
PdhGetFormattedCounterValue
PdhEnumObjectItemsW
PdhUpdateLogFileCatalog
winmm
mmioRenameW
mmioFlush
midiInPrepareHeader
midiOutSetVolume
mixerSetControlDetails
mmioAdvance
waveInClose
joyGetThreshold
CloseDriver
ws2_32
recvfrom
WSANtohs
WSALookupServiceBeginA
getservbyname
WSASendTo
bind
getpeername
gdi32
SetPolyFillMode
gdiPlaySpoolStream
ResetDCW
CloseMetaFile
GetCharacterPlacementW
EndPath
AbortDoc
msvfw32
DrawDibEnd
ord2
ICSeqCompressFrameEnd
avifil32
AVIStreamInfo
AVIStreamRead
mswsock
rcmd
GetNameByTypeW
s_perror
GetTypeByNameA
user32
ShowWindow
msvcrt
__p___winitenv
exit
_XcptFilter
__wgetmainargs
_except_handler3
_controlfp
_initterm
__setusermatherr
__set_app_type
__p__commode
_exit
__p__fmode
_adjust_fdiv
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
60B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=23, id=203, version=65501,
count=70, id=1, productName=Unmarked objects,
count=1, id=228, version=40629,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
yqmxitinks
- SHA256 dd31e7b319d3acfe238866035e0dfe514fc55efe7343e1e13421dd32d20b8f80
- MD5 7c7487f9e5f0a2b42c974896825d06e5
- SHA1 d29382ebaae67bf9de891ad00adb795963ef8967
- SHA512 913039ce08f36b0664657bcf70b77238656810e96154f890f42daeff7b60cc304751a457b98cf2adacbe701eee27e358487a7be6c4d723c7e39d51bc43fdae9f
- SSDEEP 96:DBM9Lx1Q3JXlQNnG74CE7t1jSFEGCxQBvfq0bDGmDHErH:1M1xW5SGcp1mNQQ9jfGmYj
- MD5 SHA1 SHA512 SSDEEP
IoC/Fattura_855.pdf.tar
- SHA256 a46ecb58714a25b8910e1b65c2d7ec98ebb46b6222a4a474dbddff050972b273
- MD5 2480d196e4867b2ef76e932c342f4fb9
- SHA1 5929b5ca275cc7e4d02c39b3e3cdcd88b2e60146
- SHA512 e8944ab930942ee78ba937cf919a4d95b45f5c1afde04310af7698822975b7085a864c3400c449b0c6d2196abda9d707ba280d90d45a2b4470f28a1fe30329c2
- SSDEEP 6144:uNeZm//7la+u61CkduDVUWurQZt1czVpw:uNl/zlnNCyAUW1Kg
- MD5 SHA1 SHA512 SSDEEP
Fattura_855.pdf.exe
- IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
- SHA256 df52a26061f50bed16f94038cfedb42e1b492b9ce865daabd7ce15db4db9b8a3
- MD5 068b6fd352736535c7d967673914c66a
- SHA1 ae5b7ac0e73123f5b2b31e9a3b1061c9985e70bf
- SHA512 0b3eff80a6cba89895c554206bb64246bc090a04015eae579e9624f71a72e750fa0d9c352f1922731698223444b1b583c3aa075fc67fb00c32f6fe19b8bb585f
- SSDEEP 6144:HNeZm//7la+u61CkduDVUWurQZt1czVpwS:HNl/zlnNCyAUW1KgS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
gocbcx.exe
- IMPHASH 686c069818ac6dc93b64b22b114ddfec
- SHA256 ffef20b2c9b8d9cdd4f471718ef688a8bd4834b6481978574b877ab14a91228d
- MD5 6c310e309e2ddfe8ae53e95c525c9e52
- SHA1 694861bf8fbddafc5673853c8f7c910a2b60a1b7
- SHA512 8030a4b7d8d225699d4c9d71cf015dbb90895266e9006c5fee1ba9ce56ac871f1f9477ee4ccf6c62109ef23f0321d9590a3b286156d5b57e30bbe2f9d302a931
- SSDEEP 768:klHfloloDRGOt3qLVEw2b61rKnuvQ7n0jnbawiBDNKtc8WhsWjcdhDjC+9Vv:CB1qL6zbtwQ7qegc8EsWjcdhDz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5153
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
WriteConsoleW
HeapSize
GetStringTypeW
HeapReAlloc
HeapAlloc
OutputDebugStringW
RtlUnwind
LoadLibraryExW
IsProcessorFeaturePresent
IsDebuggerPresent
VirtualAlloc
CreateFileW
ReadFile
GetFileSize
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
GetCommandLineW
GetLastError
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
CloseHandle
ws2_32
WEP
WSALookupServiceBeginW
WSAWaitForMultipleEvents
WSAGetServiceClassNameByClassIdA
WSASetEvent
htons
WSAAsyncGetProtoByName
user32
ValidateRgn
GetTitleBarInfo
ScrollWindowEx
InvertRect
AttachThreadInput
IMPGetIMEA
wsock32
ord1104
ord1130
ord1102
ord1107
ord1112
ord1101
ord1109
ord1106
ord1110
gdi32
UpdateColors
PolyTextOutA
GdiFlush
GetCurrentPositionEx
GetMetaFileW
msacm32
acmFilterTagDetailsA
acmMetrics
acmDriverMessage
acmFilterTagDetailsW
acmFormatTagDetailsA
acmFormatEnumA
ole32
ReadClassStm
OleNoteObjectVisible
BindMoniker
CreatePointerMoniker
OleMetafilePictFromIconAndLabel
GetClassFile
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=24, id=225, productName=VS2013 build 21005, version=21005,
count=15, id=223, productName=VS2013 build 21005, version=21005,
count=102, id=224, productName=VS2013 build 21005, version=21005,
count=15, id=203, version=65501,
count=116, id=1, productName=Unmarked objects,
count=1, id=228, version=40629,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
ncssrlmzyd
- SHA256 a3439fba9220dbfe1fb05f3dfa24aab3e7f72071ff1f16bae20fd58c227e4b7a
- MD5 02475297a79138c050381b19f13cbb88
- SHA1 efeb9032605484fdea6478b224afe59af46f29a3
- SHA512 35e9e844e33c1ac1ad3ce9e035ba2ff6302e84941bcd300011c758fa6eb917292a2db480a3d1592e6a275b84621708b08109579599781c2fd28fdba8f7e25d55
- SSDEEP 3072:CjBoXErZjsNDQk1rLnoVvv7MCtUglwQs3Fx6HQfSYdLKaSs5shgsSmODc:Co0rZc0kFLoVv/tUSfGxWmEHs5grSPc
- MD5 SHA1 SHA512 SSDEEP
rnukeqm
- SHA256 83bd692b6115ceeb84745dac471dc333377ce29178894d0493e0d2a6acd975b4
- MD5 8d73805cc88e7c5fb975ea51d44509c0
- SHA1 7b3615aeb8d8a6a049dd59d2c6883c2d60c689b8
- SHA512 e50598247e565bb3d509189c107f288ee07d163913d38a2e9ebf2f5bdaed969c49c027c96e0afab8a00cefc2c4cf4e712d99b853a2b3af36694ff1784b75dff3
- SSDEEP 96:oPC5sRCLiM5HtaKpPzz0+Not69qbnd7MzVyiJ2VwQtrqHWTnyzC9ecj:oPC5sR7Mtt1pPzA+NotWz827UqmnyzCP
- MD5 SHA1 SHA512 SSDEEP
IoC/MIL0000640730.xlsm
- SHA256 b3611898ab09f4bc4cee71dd84e14cbe2e1262ab6b2147ac2a4a2578f815f531
- MD5 d40bfad72dd13a14ed745827ba2a40fc
- SHA1 d5cd2e93fb8330f6830b03d389ee328696367f00
- SHA512 faeb08dab7101b3294b8a7b7f1b1f3aff90076a20bea12b1d140ee3a4df4889e540f77b3d8f469aa2b147ea05509f73290a7cae0c7187ab6eac52832ff28ec2f
- SSDEEP 768:YgupkvdLmA9500CpLtzBCHH3G/WGwKaDyu71tzQ:YgFtd50vLfG7H1tM
- MD5 SHA1 SHA512 SSDEEP
IoC/PO.xlsx
- SHA256 4746681c92d6308c66e76d7ffc022d7fd91b91e364c3909875555dc13c13f28f
- MD5 916e97845046785cd1cecd13eb9066cb
- SHA1 10482433036f11039984f19c754bb75118fee761
- SHA512 9e9b992540e71970b3f64195e34bcbb4447f2dee690aea11a8ae4636a69e9ad16c27f43a927b5cd8b1178b9201dd460569882ee7ddf192fdb45cc3edcc8e38be
- SSDEEP 12288:4HukDNlkQ4jffozcmljqcp25wqI/FMhVRCByJb0vpFP2srFVc7B2YCeNtRi5:Kv4j7TWQwqwF4IFb/c7BaUi5
- MD5 SHA1 SHA512 SSDEEP
IoC/PO_2022-04-33981.IMG
- SHA256 3e40f154bc188a6941a7a7f3993ee4936afece55834820a08e4ed2629bbb39da
- MD5 06c70c359f6852e1372ab56da93fa23a
- SHA1 8bf673b7029c300d55a3b202a4fd5d8628e6aa3f
- SHA512 a43110a83bbe9efb8d1408c54b2430cb7c621463fc02832c4e1b07ec432c5e62665a71898b43ee18ada2d9db5c185da987bd10e42ab0bcee57d251fc7c7f819f
- SSDEEP 12288:vbuvIyfL/alfmZlbbrekq/iI7hq/TUqzi9/k7a4sAMiAKUCPSQ/Dk7leWpLklyA4:vFcLhpex/iUqzuIaXbilBPvbk7hAlWp
- MD5 SHA1 SHA512 SSDEEP
PO_2022-04-33981.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 af573246f95b5eab9ae520005e00fd4e3f35e3488b2681e1a196d3e24eeb8c02
- MD5 0e9db60ad1bf774e9cee7b52cc145b4e
- SHA1 322187dd46fc28a2727faac47b1efea50505a89a
- SHA512 a263b3bd59e70553a1b1c796a1faed85d8483dcca9f62c8f4b124e5263d240b6df9040a00da80d9752e58324d844ccd3ff8dbe41c24e57b9050e4ebf80f5e430
- SSDEEP 12288:MbuvIyfL/alfmZlbbrekq/iI7hq/TUqzi9/k7a4sAMiAKUCPSQ/Dk7leWpLklyA4:MFcLhpex/iUqzuIaXbilBPvbk7hAlWp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
745518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\A\_work\974\s\artifacts\NuGet.Versioning\16.0\obj\release\net472\NuGet.Versioning.pdb
mscoree
_CorExeMain
Name
.text
Size
720KB
Virtual Size
720KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
202KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
IoC/Pagamento.xlsx
- SHA256 f65a02f6a1fa903c6ea78cf264fb7007309b7e4b426a6db94ce2bb9e0a43fb5f
- MD5 b6f59978c11f425ebb5183d59727c312
- SHA1 bb13cb76b17f1902e0f85bc5b6110cdb7396572f
- SHA512 533b65c105b985f5037e32b0a7ba9d192877a14a0fd22b9a0b6294a5e1a6f29e04b4a90af481a310ef999d5ca239a0d010c8cd0d36dd1fc8237a2667577729a6
- SSDEEP 12288:keudkZeF2+hBDNY3rZ0jCJHETmBPQfE8ZJpqR6K+U2DChL3Ve0BJST4YVwo//GRy:gaZeYqDNY32jiBQfbJG6Y2WhL33I4YV3
- MD5 SHA1 SHA512 SSDEEP
IoC/SHIPPING DOCUMENTS.doc
- SHA256 2bdc496ee0f65d05fb5b38dcfc25abaf3eb19b8922884156eea0cf8880c2b8d4
- MD5 8b6a21c29f22e0464ee95317bd985eed
- SHA1 04a9b89d89e22dbebb71c8342bdfd590d13c0ff7
- SHA512 c1cb18d0f035effe511bc9f20bb8582eb327e4b59130c9ddf7ec3743f1226838e634f9d63248807bfbbdb547b9c5b700a21244deff1f30bb814a5e44f2c7088c
- SSDEEP 192:Fmn9kNkpUArVBpLF2jz0A+ko38iJznbYFLFSodbH70byIYy:FmeNkpUghkB+ko38C6LFSoybyIYy
- MD5 SHA1 SHA512 SSDEEP
IoC/SMK_29082022.rar
- SHA256 561452fc192448cfc2c674eeff96c9492529d5f871224f23ace276d33261ed8a
- MD5 583e3dcb383a4a3e51b661be6a798253
- SHA1 795bf8583a2394b2519340f29283f8d28317c182
- SHA512 8e2a33da7f4f72df41b0884c30d86c421ba6018a7eba4e413281500902c009f66069be6aa61bf02f20187fe022c6daa8b46bc3e2274ad87a8742e78beb528a0e
- SSDEEP 1536:FMEIKCvhSr1eV5mDqs1wn/F9kc/ami8r/vKHL0dn0ye4BIMd8RNjVf2EgREwY:FgvhSrm5mDk/Fk/megB0ye4BGzjVf2EJ
- MD5 SHA1 SHA512 SSDEEP
SMK_29082022.exe
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 4b08145e5bec544285f7f7d24f4a187699016bc6b33e7575dfd8a759048a30a0
- MD5 c953aa5416e760df5d8926f4f896fedd
- SHA1 f81842b2949597fd846158be0568d23276f6d8e3
- SHA512 44bb338ccd171202f83f54b2d5b4dae52b40e3e8a54461b8b607836c71b4d4f210c0e21dec6145b59341ca8143b07e35f86f9026113d26c187c668964e353dc4
- SSDEEP 3072:2fY/TU9fE9PEtu4IEOa8jDb/P4kCFYXq2N06yT3:gYa6Paa/P4kCF6Lbo
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
26:d9:51:20:74:5e:52:a7:43:96:b7:3d:b7:88:cc:15:19:d9:59:1b:f7:07:65:5a:b4:b1:d8:9d:00:e1:33:07
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=morpheme,OU=BOGFERN,O=Tuscherendes7,L=euploidies,ST=Snohaleabens,C=DJ,1.2.840.113549.1.9.1=#0c1f6269626c696f74656b73626f67734042696c6c656466656c7465742e736167
Chains
Apr 21, 2022
Subject
CN=morpheme,OU=BOGFERN,O=Tuscherendes7,L=euploidies,ST=Snohaleabens,C=DJ,1.2.840.113549.1.9.1=#0c1f6269626c696f74656b73626f67734042696c6c656466656c7465742e736167
Serial Number
Issuer
CN=morpheme,OU=BOGFERN,O=Tuscherendes7,L=euploidies,ST=Snohaleabens,C=DJ,1.2.840.113549.1.9.1=#0c1f6269626c696f74656b73626f67734042696c6c656466656c7465742e736167
Timespan
Apr 21, 2022 - Apr 21, 2023
Subject
CN=MeSince Time Stamping Signer,O=MeSince Technology Limited,C=CN
Serial Number
47:cf:32:50:d5:87:97:d7:62:a3:7c:4d:20:9f:b8:e1
Issuer
CN=MeSince TSA Signing CA,O=MeSince Technology Limited,C=CN
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 15, 2018 - May 15, 2026
Subject
CN=MeSince TSA Signing CA,O=MeSince Technology Limited,C=CN
Serial Number
20:04:49:9c:e1:6a:64:59:d6:0e:1d:1c:92:ef:a7:10
Issuer
CN=MeSince Identity CA,O=MeSince Technology Limited,C=CN
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2018 - May 3, 2028
Subject
CN=MeSince Identity CA,O=MeSince Technology Limited,C=CN
Serial Number
3f:ef:23:9e:cc:c0:31:fd:df:66:4e:3a:17:26:b8:c4
Issuer
CN=MeSince Identity CA,O=MeSince Technology Limited,C=CN
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 22, 2018 - Jan 22, 2043
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
ROVS.dat
- SHA256 f0fde63a5056fafba86bf046b6a130d4e30b9ef673ee80f73ee5de88ea508bc2
- MD5 93c36389475b0f090a6fa56b8e987fb9
- SHA1 0f67397337fbfb9a61182ecda23a2e591f242d5d
- SHA512 3a986ccf0dc5324173c8803f9b1bb7a17e88fe35ab8405ecc9b540846f99c63cb77dd5fe66c6482dda3d31dceb6b77ae07e02322f6158936d479fb58bce6b7fb
- SSDEEP 1536:ySi0qDTTmgoUNHB/AnfP5SHHWwHXmmsfwttRaIO6I:5i/DTfHB03k2UvsfwH8f
- MD5 SHA1 SHA512 SSDEEP
camera-hardware-disabled-symbolic.symbolic.png
- SHA256 2647746c3f2852df0693865d4ebdc22fd6aae4e725f8ea13c263766c98afb787
- MD5 6f86f050b74e4fc04a1f375e8e2744a9
- SHA1 3060a2ba1be38388dc86fb43e3826b1045407551
- SHA512 10969f0a23d81064e7bbe980aa10d4d42c1713157f9eb725737faf666326066bc75082f10d5976f803bded998cfc5bb6ea51d373a5e1a30b3f0ce940bad235dc
- MD5 SHA1 SHA512
emblem-unreadable.png
- SHA256 72428164fa2f8df4fded0e5213a4043729929ca53ae3f7c0bed73ed1bf835ae1
- MD5 0916297aa635a852b181b815131afd11
- SHA1 46e2e8baab9d8c299833f45924cd5c58869b26e4
- SHA512 902c50d12bbbee1bf0d4d938d12809ba79277ba891e51d6802590878dafd49d8f7429671e333335af8fe0811283cd8dffe72c27abca345b729be66e3e9c3342f
- MD5 SHA1 SHA512
mail-signed.png
- SHA256 d4d203344a07ecf9e755e9396c7986a84b7f8684aa94f87c64cfdad29e3558ce
- MD5 dab703e211118d187b2fcb4fb0e43124
- SHA1 5539f00c552dc23ab09ef2797f74412d12f0d8ba
- SHA512 41cd1a9ddf90ee76bd66fc96fa188ed56573f433b2743df84014fe022173703029a294b12749fa21bd7f57695134fd99b92a681dd6a0934ac1aa904bb0c3220b
- MD5 SHA1 SHA512
media-removable.png
- SHA256 f5948768ee8a33988f530948a10ec8333bb2ae91450c4a0ffda6c78e9e454ac2
- MD5 32148c57fec1c44d630694c2f3eb9c79
- SHA1 7d241b5bfeff379a96aecc6d20a2b85a40fdb460
- SHA512 1f7f216461f1348be09e0a57eaf75bb595e95105c3729601741e54337629c684fd620292cd6267465c1cf65bba6e17dc0f6cb81c44182474812496520cde65e6
- MD5 SHA1 SHA512
preferences-system-network-proxy-symbolic.symbolic.png
- SHA256 dcf5ccf55cd3a0c22d7e1e15ba74a77e87564c5378213930531957e837bcffd0
- MD5 739ef7135750b4a34587b311374cfd3b
- SHA1 2c7bb533d0c3b0fb2e953e21c949a38ccadcb994
- SHA512 a123f0270240dab31edde187b52534b032534a993df5dc3c023f47df22dd13cdd4875894180d7ca5a7d58a8341be03b193d645dbe6c5355f0a8c813052d6c746
- MD5 SHA1 SHA512
printer-network.png
- SHA256 da4223f95fa7d4a484c1ca675bb8bd4f6ddeeb0f274a4f32616655189033e5c2
- MD5 b344495c567f359d8a722e788409c26b
- SHA1 b599eb3f171e4eb856bbc28e8be4f50975acbc32
- SHA512 658e0f63022ab10538d7921fc98994200397f73a7fb63100278a955925ab5b9de6ca2652061fd82704319613596decc0a76c21dfd3b968947518aad6465225e1
- MD5 SHA1 SHA512
selection-end-symbolic-rtl.symbolic.png
- SHA256 ab86f801b5ed71c581e2a68b6e052953c6b5b95dfbc617a117dea9b084429618
- MD5 b361cad290962835529009e96e49cc9f
- SHA1 2e29cb53b9b3bd6a433fb2c50950288e321ae551
- SHA512 3100203ce8a3d2de5717edc0d67a1bc47cb2c78ce5effee51327ea0ae71f4945188abad9af49e5d8bd78f3b6b5807692975537b49873f601c9aa9f49dd25887c
- MD5 SHA1 SHA512
value-increase-symbolic.symbolic.png
- SHA256 ea88c0e8743471267db4183a75e6122ce10062ef396abeae5c0bc4fd2d65a6f1
- MD5 2d78ff1482a10ea250a500c55edb7a4d
- SHA1 02dc306a0b14673185941637e78c3e0115f3badc
- SHA512 2eb3d54e72cff8b061676aa791d021464777fea77e5d6424b8de9a78c8e32d894ed164c096fc150c7b0e4d46a8b31c75b54a72c2db02decaecb8e555d39993a0
- MD5 SHA1 SHA512
zoom-out-symbolic.svg
- SHA256 695554ce5f23a275d3c25c27410d0cfbf8a83156807daa3a601635e4e5d8aed0
- MD5 c05c42cb3d95bf3bc7f49ccd8dcca510
- SHA1 20442e344e95508586b1b2a7b4c6272c3f5c86f8
- SHA512 0ec19bba7b5032670524965a8c55d8c6401f833000880de1c0f74a5eaa4e302b0ce3e60218f3ddb95cb3e1ea7374a197cb71682526dff910d9a6cf35ff971bb6
- MD5 SHA1 SHA512
IoC/SOA.IMG
- SHA256 9bc9533ef6ff903c09fb7a13bfa2a926f1338258a5eb05011cc4fdb453094d9b
- MD5 947234b20af59a8f2e802d6ebbd71f35
- SHA1 9ea54f0fb7914fc0322a4143d997f37a8487aab5
- SHA512 3386a81b007f04012468fc981e63355ed6b489d9f5991df28dac3a3dbae6f69264660e6b4db039efcc7bf0a16af9189abd3dc6651d81b3c3e85e430daf70c556
- SSDEEP 12288:2ylR9KOEhGkEHIxZEfzqyvTj8pt+zQuBdQi+t6uJNfZ4Ts79kSJWha7iI2tCjn41:PlIgVOEzTj8KJBdQi+tXJNRzrWMfj4
- MD5 SHA1 SHA512 SSDEEP
IoC/Scanned_ Inovice no MUM2122DD066844 NPVP13.r00
- SHA256 975dbd4ae2c280846ccc89f146a7e5a7aad1a7cd043e1665583ccc927143a7ec
- MD5 13e02112243ea45c75f9bb45973403dc
- SHA1 1150f9478103cf210d0aa3dfd821a8fafab152c0
- SHA512 bc2d7f1f7acf93b00843361584a2473917b0431cc6385c168c017a6bb427ad7def2d7533b3680dbed8803cf16ae55889e4a9a72d39cad8772b158acc6e325999
- SSDEEP 6144:YJMNsE4AIvrmUWi6PzpwtPgN7R+iKD7bkEI66V8tG4cWITiPuGY15Eyvi:Y2iE4bvrPWi6Pzpw5hiWMQG3WnPOIyvi
- MD5 SHA1 SHA512 SSDEEP