Batch_3.zip
- SHA256 7e7c00740baa58af22ef6f825d86344732464a4e325b5eb6f93f33898de079fa
Overview
overview
10Static
static
6516874.exe
windows7-x64
75479329c03...a2.exe
windows7-x64
1054ab323053...1f.exe
windows7-x64
95600.exe
windows7-x64
656a9736b82...7a.exe
windows7-x64
1059ddf36a9e...ws.dll
windows7-x64
105C53687F73...ViR.js
windows7-x64
35bfae47c9f..._2.dll
windows7-x64
15c6416f819...be.exe
windows7-x64
15f1fcdfb95...1c.exe
windows7-x64
105fc9230812...e9.exe
windows7-x64
961318fa1f1...5F.exe
windows7-x64
761318fa1f1...5B.exe
windows7-x64
76184f1def4...ss.exe
windows7-x64
761bc10e8ed...3e.exe
windows7-x64
76217ea6bb8...f5.apk
windows7-x64
362ebcfeeff...C3.exe
windows7-x64
762ebcfeeff...BB.exe
windows7-x64
7647f242.exe.vir.exe
windows7-x64
964bfea1efc...99.exe
windows7-x64
964f540a7c6...B3.exe
windows7-x64
764f540a7c6...77.exe
windows7-x64
76916a006c4...9a.exe
windows7-x64
769ee634973...df.exe
windows7-x64
6f772eb660...bc.exe
windows7-x64
77077437251...e9.exe
windows7-x64
17175d6bb11...2b.exe
windows7-x64
9728733095f...on.dll
windows7-x64
873c3d88d0d...5F.exe
windows7-x64
773c3d88d0d...BF.exe
windows7-x64
774add6536c...ef.exe
windows7-x64
10757a661bcc...d8.exe
windows7-x64
7Behavioral task
behavioral1
Sample
516874.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
1200 seconds
Behavioral task
behavioral2
Sample
5479329c03e12e27adc81caeefe1a1dc26bf59d4dac36dd2eae008213e8fe0a2.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
1200 seconds
Behavioral task
behavioral3
Sample
54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral4
Sample
5600.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral5
Sample
56a9736b82bc9f65ddad590d1edfd9df26b5d97ecfeb48787f6ccc00ce26597a.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
1200 seconds
Behavioral task
behavioral6
Sample
59ddf36a9e85f4cf82a6511b49cfcdd9e4521b17f7e245f005e18418176ff4aa_PonyNews.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
1200 seconds
Behavioral task
behavioral7
Sample
5C53687F7327933R.js.ViR.js
Resource
win7-20240903-en
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral8
Sample
5bfae47c9fda81243b50b6df53ac4184d90a70000894fa2a516044fa44770cfd_Stealer_2.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral9
Sample
5c6416f819bfbca2f1862691a03f68be.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral10
Sample
5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral11
Sample
5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
1200 seconds
Behavioral task
behavioral12
Sample
61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_Dumped_TDS=4F8C315F.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral13
Sample
61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_TDS=4F91F15B.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral14
Sample
6184f1def457c10b2ae10a33b8639c89cb0115061c3d424d330342b44d4179aa_not_packed_maybe_useless.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral15
Sample
61bc10e8ede3997da73b3de9fa57b059e352b592404fb9c171469c4026fdc03e.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral16
Sample
6217ea6bb87295983c4915a4d97c7e4142effef95d1e815693a72ea3a73b45f5.apk
Resource
win7-20240903-en
windows7-x64
6 signatures
1200 seconds
Behavioral task
behavioral17
Sample
62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_Dumped_TDS=4F854EC3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral18
Sample
62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_TDS=4F8644BB.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral19
Sample
647f242.exe.vir.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral20
Sample
64bfea1efccb47a049ba2cb592878e5c415cc70f9488dd97291c1356e3d79299.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral21
Sample
64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral22
Sample
64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_TDS=4F9DB277.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral23
Sample
6916a006c429a3b3a76dfa8c162ddab178b5a20763493506deeb9447875d039a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral24
Sample
69ee6349739643538dd7eb60e92368f209e12a366f00a7b80000ba02307c9bdf.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral25
Sample
6f772eb660bc05fc26df86c98ca49abc.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral26
Sample
70774372517532ae1dcb97a7133983811d5cc7d2975cd58a1f132f2ef100c5e9.exe
Resource
win7-20240729-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral27
Sample
7175d6bb11dea0932bd4b611d0f7221b62a71dbc54607e97ad397f104bcffa2b.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
1200 seconds
Behavioral task
behavioral28
Sample
728733095fe2c66f91a19ebde412dd25_70186ceb735016eadd98466e62c03635_TheLastReveton.dll
Resource
win7-20240903-en
windows7-x64
6 signatures
1200 seconds
Behavioral task
behavioral29
Sample
73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_Dumped_TDS=4F8C315F.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral30
Sample
73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_TDS=4F8DFBBF.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral31
Sample
74add6536cdcfb8b77d10a1e7be6b9ef.exe
Resource
win7-20241010-en
windows7-x64
16 signatures
1200 seconds
Behavioral task
behavioral32
Sample
757a661bcc68616f99366b10abac92d8.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
1200 seconds
General
- Target Batch_3.zip
- Size 8.3MB
- Sample241122-c3zrraspfs
- SHA256 7e7c00740baa58af22ef6f825d86344732464a4e325b5eb6f93f33898de079fa
- MD5 41c0c04ff68dd76a7c376f209e4b1413
- SHA1 c462551de41e5277ec3ad8f911c37f92312999f8
- SHA512 d30f8278362b5c4ecc010c50050d4e33d16a5abb62f98cae7edd6223e10a8b285185a177c60e8035d0d95321a59caa669cc62f7bdb97fb93d50c6e8a176a045f
- SSDEEP 196608:YWTkVZgeNSKZWAyuUlOkZPk21Dwi8M/6p/JsMjKl8JVCXHXjPxZlLMTcOBZe:bofgegKZ1mlVxbJwbiaKKVC3X9l
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Requests dangerous framework permissions 9 IoCs
description ioc Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Required to be able to access the camera device. android.permission.CAMERA Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS -
resource yara_rule static1/unpack001/54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe upx static1/unpack001/70774372517532ae1dcb97a7133983811d5cc7d2975cd58a1f132f2ef100c5e9.exe upx - Unsigned PE 30 IoCs
Checks for missing Authenticode signature.
resource unpack001/516874.exe unpack001/5479329c03e12e27adc81caeefe1a1dc26bf59d4dac36dd2eae008213e8fe0a2.exe unpack001/54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe unpack002/out.upx unpack001/5600.exe unpack001/56a9736b82bc9f65ddad590d1edfd9df26b5d97ecfeb48787f6ccc00ce26597a.exe unpack001/59ddf36a9e85f4cf82a6511b49cfcdd9e4521b17f7e245f005e18418176ff4aa_PonyNews.exe unpack001/5bfae47c9fda81243b50b6df53ac4184d90a70000894fa2a516044fa44770cfd_Stealer_2.dll unpack001/5c6416f819bfbca2f1862691a03f68be.exe unpack001/5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c.exe unpack001/5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe unpack001/61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_Dumped_TDS=4F8C315F.exe unpack001/61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_TDS=4F91F15B.exe unpack001/6184f1def457c10b2ae10a33b8639c89cb0115061c3d424d330342b44d4179aa_not_packed_maybe_useless.exe unpack001/61bc10e8ede3997da73b3de9fa57b059e352b592404fb9c171469c4026fdc03e.exe unpack001/62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_Dumped_TDS=4F854EC3.exe unpack001/62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_TDS=4F8644BB.exe unpack001/647f242.exe.vir.exe unpack001/64bfea1efccb47a049ba2cb592878e5c415cc70f9488dd97291c1356e3d79299.exe unpack001/64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_Dumped_TDS=4F9911B3.exe unpack001/64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_TDS=4F9DB277.exe unpack001/6916a006c429a3b3a76dfa8c162ddab178b5a20763493506deeb9447875d039a.exe unpack001/6f772eb660bc05fc26df86c98ca49abc.exe unpack001/70774372517532ae1dcb97a7133983811d5cc7d2975cd58a1f132f2ef100c5e9.exe unpack001/7175d6bb11dea0932bd4b611d0f7221b62a71dbc54607e97ad397f104bcffa2b.exe unpack001/728733095fe2c66f91a19ebde412dd25_70186ceb735016eadd98466e62c03635_TheLastReveton.exe unpack001/73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_Dumped_TDS=4F8C315F.exe unpack001/73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_TDS=4F8DFBBF.exe unpack001/74add6536cdcfb8b77d10a1e7be6b9ef.exe unpack001/757a661bcc68616f99366b10abac92d8.exe
File Explorer
-
Batch_3.zip.zip 8.3MB
-
516874.exe.exe 1.2MB
-
5479329c03e12e27adc81caeefe1a1dc26bf59d4dac36dd2eae008213e8fe0a2.exe.exe 152KB
-
54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe.exe 10KB
-
out.upx.exe 25KB
-
5600.exe.exe 424KB
-
56a9736b82bc9f65ddad590d1edfd9df26b5d97ecfeb48787f6ccc00ce26597a.exe.exe 4.0MB
-
59ddf36a9e85f4cf82a6511b49cfcdd9e4521b17f7e245f005e18418176ff4aa_PonyNews.exe.dll 352KB
-
5C53687F7327933R.js.ViR.js.js 54KB
-
5bfae47c9fda81243b50b6df53ac4184d90a70000894fa2a516044fa44770cfd_Stealer_2.dll.dll 993KB
-
5c6416f819bfbca2f1862691a03f68be.exe.exe .ps1 414KB
-
5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c.exe.exe 160KB
-
5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe.exe 220KB
-
61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_Dumped_TDS=4F8C315F.exe.exe 116KB
-
61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_TDS=4F91F15B.exe.exe 76KB
-
6184f1def457c10b2ae10a33b8639c89cb0115061c3d424d330342b44d4179aa_not_packed_maybe_useless.exe.exe 90KB
-
61bc10e8ede3997da73b3de9fa57b059e352b592404fb9c171469c4026fdc03e.exe.exe 188KB
-
6217ea6bb87295983c4915a4d97c7e4142effef95d1e815693a72ea3a73b45f5.exe.apk 1.0MB
-
62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_Dumped_TDS=4F854EC3.exe.exe 116KB
-
62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_TDS=4F8644BB.exe.exe 72KB
-
647f242.exe.vir.exe.exe 209KB
-
64bfea1efccb47a049ba2cb592878e5c415cc70f9488dd97291c1356e3d79299.exe.exe 561KB
-
64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_Dumped_TDS=4F9911B3.exe.exe 116KB
-
64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_TDS=4F9DB277.exe.exe 58KB
-
6916a006c429a3b3a76dfa8c162ddab178b5a20763493506deeb9447875d039a.exe.exe 224KB
-
69ee6349739643538dd7eb60e92368f209e12a366f00a7b80000ba02307c9bdf.exe.exe .docm 111KB
-
6f772eb660bc05fc26df86c98ca49abc.exe.exe 138KB
-
70774372517532ae1dcb97a7133983811d5cc7d2975cd58a1f132f2ef100c5e9.exe.exe 1.3MB
-
7175d6bb11dea0932bd4b611d0f7221b62a71dbc54607e97ad397f104bcffa2b.exe.exe 657KB
-
728733095fe2c66f91a19ebde412dd25_70186ceb735016eadd98466e62c03635_TheLastReveton.exe.dll 160KB
-
73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_Dumped_TDS=4F8C315F.exe.exe 116KB
-
73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_TDS=4F8DFBBF.exe.exe 72KB
-
74add6536cdcfb8b77d10a1e7be6b9ef.exe.exe 229KB
-
757a661bcc68616f99366b10abac92d8.exe.exe 231KB
516874.exe
- IMPHASH 47b0da2d13e0214f54c3bd05550e8319
- SHA256 c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5
- MD5 9a60890fc062d10d826c31d049706ab7
- SHA1 3ae8d97461fb08c4327431c0589322e3cbb1e3de
- SHA512 03de8351ab6ab1e46c4f1792f4caeeaaee4b8a18b407839c1697890032aa813cae9174e1a27cb582ef5286be0b47d23966a71e0b740feb6b1814137b779fcdcc
- SSDEEP 24576:DDSANUv0/NUvKLpkr2dY/aBcjJOBHOBIQBajMtWvoJiLE1+XgRKz89G/4ZSb0FuH:T80/8KLpkr2dY/aBcjJOBHOBIQBajMtA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
memcpy
sprintf
fabs
ceil
malloc
floor
free
fclose
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
RemoveDirectoryA
GetExitCodeProcess
GetTempFileNameA
GetCommandLineA
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
CreateFileA
ReadFile
WriteFile
SetFilePointer
DeleteFileA
GetFileSize
HeapReAlloc
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
SetLastError
HeapSize
TlsAlloc
CreateDirectoryA
GetTempPathA
SetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
user32
CharUpperA
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathAddBackslashA
PathRemoveArgsA
PathGetArgsA
PathRenameExtensionA
PathUnquoteSpacesA
Name
.code
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
5479329c03e12e27adc81caeefe1a1dc26bf59d4dac36dd2eae008213e8fe0a2.exe
- IMPHASH 9a3d6959e6823cfab73700f601ca3412
- SHA256 5479329c03e12e27adc81caeefe1a1dc26bf59d4dac36dd2eae008213e8fe0a2
- MD5 7469c1ee0827a289fa775f4a5656e5f9
- SHA1 0392ccbd6b894cbc10e325801ddd1220b22bff13
- SHA512 24723a6de103c8d1a97bb70bc46fd3e1b34127337d25b655586e8763d4ca03b93267851cefeed0daff9b05d579b68f517f10c346cff1e4559b4ef2cf6c12be85
- SSDEEP 3072:7IynAd9u9GuIPmsy/FMd/rUCvb87SwoYQp:7IKgUGuGmXivbsKY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
winmm
mmioWrite
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutPrepareHeader
waveOutWrite
waveInUnprepareHeader
waveOutReset
waveOutClose
waveOutOpen
mmioDescend
mmioClose
mmioRead
waveInStop
waveInReset
waveInClose
waveOutUnprepareHeader
waveInOpen
mmioAscend
mfc42
ord4998
ord2379
ord2302
ord567
ord1168
ord1146
ord3574
ord823
ord1948
ord2396
ord3346
ord5300
ord5303
ord4079
ord4699
ord5307
ord5289
ord5715
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord817
ord348
ord565
ord825
ord2726
ord4226
ord537
ord800
ord1105
ord518
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord5302
ord4698
ord5714
ord3738
ord561
ord815
ord2514
ord2621
ord1134
ord641
ord609
ord2256
ord5265
ord4376
ord4853
ord1576
ord4710
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord4234
ord2575
ord6055
ord1776
ord4396
ord5290
ord3402
msvcrt
_except_handler3
_controlfp
_onexit
__dllonexit
_setmbcp
__set_app_type
__CxxFrameHandler
memset
strcpy
sprintf
memcpy
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
kernel32
WaitForSingleObject
GetStartupInfoA
GetModuleHandleA
CreateFileA
GetModuleFileNameA
ResetEvent
Sleep
GetCurrentThreadId
WaitForMultipleObjects
GetLastError
SetEvent
user32
LoadIconA
PostThreadMessageA
PostQuitMessage
EnableWindow
Name
.text
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
80KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=160, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=7, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
54ab323053f1138e5ccaa8f8afaa38cabca9491f.exe
- SHA256 e9ffda70e3ab71ee9d165abec8f2c7c52a139b71666f209d2eaf0c704569d3b1
- MD5 b14c45c1792038fd69b5c75e604242a3
- SHA1 54ab323053f1138e5ccaa8f8afaa38cabca9491f
- SHA512 fdf64a9f2be75b66af69a1ddf2c5e6fa4580587190edd0da3d0243326fc73ebabf0357b903c640458ae627789b68a5a480d7108e80d4f1eb202be386fba0f044
- SSDEEP 192:EI9ImrPAYflNL3/MnXjGpst8uVA/rMXznNdXk:dDUgXojRVATuk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 7beb820a8391839ca2b9e539e841ff3006e63b3521aa2ff3fc6d65e986ad9cfa
- MD5 aafa33491fe63e091ebd5988d6f67f1d
- SHA1 2b09e0c1446278be86d354c962aac683716aef55
- SHA512 7ae093d03dc51afd7a40f7e6fde6cb356131fe368382daf23f64bc7e2f57711794fab29d09d45302731d77d1e5133522dd6edbde1322c0ca912485cb441810c3
- SSDEEP 192:g+u0k+vYaSyBgIdXkuBOZNyViyKs9LV5+CnQiuR2f5rPT:PBQa1iGkuBOZt3sRvQZR2dPT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6544
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
5600.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9f617bee97b9c676dd5ed928093f64e020c6e93ea60b0f641fc3127a7a325ced
- MD5 b2e807bb5140744cd64174c2b811237e
- SHA1 949fca8bab5c656fa950dd65cb896ecfdde68776
- SHA512 a85c5809af9371f11426f67c463ff80e11ef0e307271716fccff5d57afe6f74261a453b2ee96f5b3526c54a2be02166fd29dfcd0160c9039b7b9e85cbcb66f5c
- SSDEEP 6144:CEaPKs6jJIrlbAC+RUPI/PsI/Pr1HPsIpP:CEaPKs6jJIrlEC2SXUE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
326590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\220\AESxWin-master\AESxWin-master\AESxWin\obj\Debug\AESxWin.pdb
mscoree
_CorExeMain
Name
.text
Size
311KB
Virtual Size
310KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
56a9736b82bc9f65ddad590d1edfd9df26b5d97ecfeb48787f6ccc00ce26597a.exe
- IMPHASH eadbe699c9f56194b9bbdf2dd7631233
- SHA256 56a9736b82bc9f65ddad590d1edfd9df26b5d97ecfeb48787f6ccc00ce26597a
- MD5 83be4f97ca8793343140a9d107ad35b3
- SHA1 6303977a4bed77b4157daa1f9ca32967d282f639
- SHA512 0b1167252debdaf493d5ef9464ea056e57a3243feef1e6f50cdae1dea5f6e24ab2bb406a245a85b98f3381851d1132c01f1b807f6a37e764f138675bac034fca
- SSDEEP 98304:UKlAOiZrq1DfPH9sDJVur+B9a+DI47j7wnG2OLEyFvs:UMAO79sDJVur+BjfU7O0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
50212
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\src\ZoomIt\Release\ZoomIt.pdb
comctl32
ord17
winmm
PlaySoundA
gdiplus
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectRect
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipCreateBitmapFromHBITMAP
msimg32
AlphaBlend
kernel32
GetTickCount
FormatMessageA
lstrcpynA
CreateEventA
GetModuleFileNameA
CreateProcessA
GetCommandLineA
ExpandEnvironmentStringsA
FindResourceA
GetFileAttributesA
DeleteFileA
MultiByteToWideChar
GetStringTypeW
FatalAppExitA
CreateSemaphoreW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
MulDiv
GetFileType
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
HeapSize
GetModuleFileNameW
WriteFile
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetProcessHeap
GetCurrentThreadId
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedDecrement
InterlockedIncrement
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
HeapAlloc
HeapFree
Beep
CloseHandle
SizeofResource
LoadResource
Sleep
WaitForSingleObject
GetLastError
SetThreadPriority
GetCurrentThread
GetExitCodeProcess
GetCurrentProcess
GetVersion
LockResource
GetCommandLineW
GetModuleHandleA
LoadLibraryA
LocalFree
LocalAlloc
GetProcAddress
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
RaiseException
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
InterlockedExchange
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
OutputDebugStringW
LoadLibraryW
SetFilePointerEx
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileW
ReadFile
ReadConsoleW
SetEndOfFile
DeleteCriticalSection
user32
FindWindowW
FindWindowA
GetParent
GetDesktopWindow
GetWindowLongA
SetRect
FillRect
GetSysColor
ChildWindowFromPoint
MapWindowPoints
GetClipCursor
ClipCursor
GetCursorPos
LoadIconA
MessageBoxA
GetWindowRect
GetClientRect
RedrawWindow
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
ChangeDisplaySettingsExA
SystemParametersInfoA
EnumDisplaySettingsA
SetCursorPos
DrawTextA
TrackPopupMenu
InsertMenuA
DestroyMenu
CreatePopupMenu
TranslateAcceleratorA
LoadAcceleratorsA
EnableWindow
KillTimer
SetTimer
GetAsyncKeyState
GetKeyState
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
DialogBoxParamA
CreateDialogParamA
BringWindowToTop
IsWindowVisible
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
DefWindowProcA
PostMessageA
GetMessageExtraInfo
UnregisterHotKey
RegisterHotKey
DispatchMessageA
TranslateMessage
GetMessageA
LoadCursorA
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextA
GetDlgItem
EndDialog
DialogBoxIndirectParamA
SendMessageA
SetWindowLongA
gdi32
DeleteDC
DeleteObject
Ellipse
GetStockObject
LineTo
Rectangle
SelectObject
CreateSolidBrush
StretchBlt
SetROP2
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
Polygon
CreatePen
CreateFontIndirectA
GetDeviceCaps
StartDocA
SetMapMode
EndDoc
StartPage
EndPage
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
SetBkMode
CreateDCA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
PrintDlgA
ChooseFontA
advapi32
RegCreateKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
Shell_NotifyIconA
ole32
CoInitialize
Name
.text
Size
190KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=40, id=207, version=50929,
count=23, id=205, version=50929,
count=130, id=206, version=50929,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=248, id=1, productName=Unmarked objects,
count=1, id=206, productName=VS2012 UPD2 build 60315, version=60315,
count=1, id=207, productName=VS2012 UPD2 build 60315, version=60315,
count=1, id=201, productName=VS2012 UPD1 build 51106, version=51106,
count=1, id=204, productName=VS2012 UPD1 build 51106, version=51106,
59ddf36a9e85f4cf82a6511b49cfcdd9e4521b17f7e245f005e18418176ff4aa_PonyNews.exe
- IMPHASH 89f11956d650797880cd2c65a388f5a7
- SHA256 59ddf36a9e85f4cf82a6511b49cfcdd9e4521b17f7e245f005e18418176ff4aa
- MD5 971c578c9dea43f91bfb44ceac0ee01d
- SHA1 0487c3856c5e44d3a5c2dcee29c63cb644a4fc52
- SHA512 38c441e1bb58eee4526e910484369d49d47597d4f1a353cce9a678d9825b3253aeccd3269cf647c7344560461eca9cc1be86787f6147048dc8fc902b5ff05d7a
- SSDEEP 6144:nrZ3ZOL1bZ+u+GUrk0ips8eplQOAaHBQIVw79J8/aPbkkxTu651:lwLb+urZ5SOOAaGZFgkxCA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26010
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
TlsSetValue
CreateMailslotA
SetLocalPrimaryComputerNameW
FindNextFileW
GetLogicalDrives
IsValidLanguageGroup
ReadFileEx
GetSystemWindowsDirectoryW
GetConsoleWindow
GetACP
DosDateTimeToFileTime
ReadConsoleInputA
FindResourceExA
GetSystemPowerStatus
GetCurrencyFormatA
GetSystemTimeAsFileTime
lstrcpynW
GlobalMemoryStatusEx
GetConsoleCommandHistoryLengthW
user32
GetClipboardSequenceNumber
GetClipboardViewer
d3d8
Direct3DCreate8
ActionACME
Name
.text
Size
249KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
98KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=353, id=1, productName=Unmarked objects,
count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=34, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=64, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
5C53687F7327933R.js.ViR.js
- SHA256 e66bde4b0614172aa057716d10cf73f180bcb616a4002df8a4aeceeeb282ad9b
- MD5 03fb80faa9c20bc8f0cb3a0e59d97036
- SHA1 d0549ab344468a51ddfbcfe719ad08d1a4312dbd
- SHA512 44e0445ba9c1173c5eb98cabca2903df5829c35f952856102334b3427965fc185bb83833ab480ed5f90d00884da0398611f8019625b6dbb8befb741c13eb714c
- SSDEEP 1536:Bi2lvT13zyadIF4jIF4MyFGEIFBIF2XIF41IFzIFAlIFojW:M2lvT13+adIF4jIF4My8EIFBIF2XIFGt
- MD5 SHA1 SHA512 SSDEEP
5bfae47c9fda81243b50b6df53ac4184d90a70000894fa2a516044fa44770cfd_Stealer_2.dll
- IMPHASH cc22e5f3a2f7752bb1f0eeb17f2a96f1
- SHA256 5bfae47c9fda81243b50b6df53ac4184d90a70000894fa2a516044fa44770cfd
- MD5 b824d94af0f981106ec2a12d0c4cc1c0
- SHA1 b4e17ebe8b07727e7ce6ae8580b97d1129e7c6ce
- SHA512 4dd79f51be35a55f64f1658651f2ab52d824f6d87b82082a5d24f129988b1d9635778ffa5a5bc21688f8a74991d7fd68d7b54faddc4ad2d2bf20a2a027e1995a
- SSDEEP 24576:GAwOEE2PTlSPNT9SCD7jEnkEd5JyHNSys4Q:sTlSlH7Mtd5JyHNSj4Q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
653408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryExW
ExpandEnvironmentStringsW
FindFirstFileW
FindClose
FindNextFileW
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
FlushFileBuffers
GetTempPathW
HeapSize
LockFileEx
GetDiskFreeSpaceW
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
GetThreadContext
SetThreadContext
Thread32First
Thread32Next
OpenThread
VirtualProtect
GetCurrentThreadId
SuspendThread
ResumeThread
VirtualQuery
DeleteCriticalSection
VirtualAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
GetStdHandle
GetModuleFileNameA
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
SetHandleCount
GetFileType
GetStartupInfoA
HeapSetInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
GetLocaleInfoW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetCurrentDirectoryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
RtlVirtualUnwind
GetTimeZoneInformation
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetModuleHandleA
CreateToolhelp32Snapshot
Process32Next
EnterCriticalSection
GlobalUnlock
LeaveCriticalSection
InitializeCriticalSection
GlobalLock
Process32First
GetPrivateProfileStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetEnvironmentVariableW
GetVersion
MultiByteToWideChar
WideCharToMultiByte
LocalFree
CreateThread
CloseHandle
GetLastError
TerminateThread
VirtualFree
WaitForSingleObject
user32
IsWindow
OpenClipboard
UnhookWindowsHookEx
SendMessageW
GetWindowThreadProcessId
ToUnicodeEx
OemToCharA
GetMessageA
SetTimer
PostThreadMessageA
EnumChildWindows
SetWindowsHookExA
CloseClipboard
GetKeyState
CallNextHookEx
DispatchMessageA
GetForegroundWindow
GetClassNameW
GetWindowTextW
GetClipboardData
GetKeyboardLayout
GetGUIThreadInfo
TranslateMessage
KillTimer
advapi32
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptDestroyKey
CryptDecrypt
CryptGetHashParam
CryptAcquireContextA
RegOpenKeyExA
CryptCreateHash
RegEnumValueA
RegEnumValueW
CryptDestroyHash
RegCloseKey
CryptHashData
RegQueryValueExW
RegQueryInfoKeyA
RegOpenKeyExW
RegEnumKeyExW
CryptDeriveKey
CryptSetKeyParam
shell32
SHGetFolderPathW
ole32
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
SysFreeString
VariantInit
VariantClear
wininet
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
crypt32
CryptUnprotectData
oleacc
AccessibleObjectFromWindow
Name
.text
Size
770KB
Virtual Size
769KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
151KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=19, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=222, id=1, productName=Unmarked objects,
count=11, id=126, version=50327,
count=76, id=110, productName=VS2005 build 50727, version=50727,
count=9, id=125, productName=VS2005 build 50727, version=50727,
count=163, id=109, productName=VS2005 build 50727, version=50727,
count=56, id=114, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
5c6416f819bfbca2f1862691a03f68be.exe
- IMPHASH 0a93557af273d834d10d3cfe6a2203be
- SHA256 b5c2e240ebc4323421fea99a02507a79ea9fba5b29ee9b6cc3e808d288de8c02
- MD5 5c6416f819bfbca2f1862691a03f68be
- SHA1 b26cb187e3ea74fbb76bbea4096aa9315ac4e405
- SHA512 9288510c7541aace8bd669f2ed8e186760a1d224874234a1d797fd7f64462313308828785e43edd010d332f589f8ba93124fe55879638655d18673d56c0d0b26
- SSDEEP 12288:IOkIEyW/jLPWXR8Kwxs/bJYorMvQGuArOQb1K1Gc4nS:AyWPWq/xAxMbrOQJ9c4n
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
54177
Major OS version
16089
Entry point
5110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegEnumValueW
AddAccessAllowedAce
kernel32
VirtualFree
GetModuleHandleA
GetCurrentThreadId
VirtualAlloc
ExitProcess
GetModuleFileNameA
GetCurrentProcess
LocalFree
GetLastError
GetProcessHeap
LoadLibraryA
GetModuleHandleA
gdi32
SetBkMode
DeleteObject
SetBkColor
BitBlt
CreateSolidBrush
ExtTextOutW
DeleteDC
user32
LoadStringW
DestroyWindow
DestroyWindow
ShowWindow
CreateWindowExW
ShowWindow
SendMessageW
GetDC
PostMessageW
LoadStringW
GetMessageW
DefWindowProcW
GetSystemMetrics
LoadIconW
ReleaseDC
GetDC
shell32
DragAcceptFiles
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
388KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=95, version=2179,
count=6, id=25, version=9210,
count=2, id=93, version=2067,
count=27, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=151, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=56, id=39, version=8491,
count=1, id=96, version=2179,
count=27, id=93, version=2179,
count=706, id=1, productName=Unmarked objects,
count=183, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c.exe
- IMPHASH c02ee2da36fedd83f5dd868cf320e1b5
- SHA256 5f1fcdfb951dc4642ce136a5d3e6bc42021f8e0cd631975a5eb3842da020531c
- MD5 f3d9b2cb51e81d12ff3d5faaca231041
- SHA1 ca7cf9e472f34973216781c3a1e269c510af0300
- SHA512 e723241f1bb0db93712fcd298bb7506f414e78dfea8b3360f3db80456ead79e16b0a99a9c101efb891c41482800f4a6752aacb19942eef3143dc536ea78cd856
- SSDEEP 3072:ho+Z3+yf/xg77QtPrn4FAsm+Ro5nLAdGkk3JIFBKuHIGQ5Nxb+b5knn:2o+yf+Kn4FAsm4MMd3kkKuHINLZ+9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
108060
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
PostMessageW
SetWindowTextA
ValidateRgn
xolehlp
DtcGetTransactionManagerExW
GetDtcLocaleResourceHandle
DtcGetTransactionManagerExA
shlwapi
SHDeleteEmptyKeyW
msvcrt
memchr
__badioinfo
clock
_ismbblead
_wfindnext
isxdigit
_mbbtype
_ismbbkalnum
_HUGE
_adj_fdiv_m32
_mbbtombc
_wstat64
_onexit
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
qsort
_strerror
advapi32
RegOpenKeyExW
RegQueryValueExW
SetEntriesInAclA
perfos
OpenOSObject
CloseOSObject
shdocvw
SetQueryNetSessionCount
gdi32
SetArcDirection
SetPaletteEntries
SetPixel
Rectangle
EnumObjects
CloseFigure
SetDCPenColor
shell32
SHGetPathFromIDListW
activeds
PropVariantToAdsType2
ADsBuildVarArrayInt
AdsTypeToPropVariant2
ADsBuildVarArrayStr
ADsBuildEnumerator
ADsEnumerateNext
ConvertSecurityDescriptorToSecDes
ADsGetObject
PropVariantToAdsType
ADsFreeEnumerator
AdsFreeAdsValues
ConvertSecDescriptorToVariant
ADsOpenObject
odbc32
SQLSetParam
SQLBindParameter
SQLColumnsA
SQLSetDescFieldW
SQLGetDescRecW
SQLSetStmtAttrW
SQLSetDescFieldA
SearchStatusCode
SQLColAttributesA
SQLColAttributesW
SQLDisconnect
SQLDataSourcesA
SQLPutData
VFreeErrors
SQLDescribeColW
SQLTablesA
SQLSetCursorNameA
SQLAllocHandleStd
SQLBrowseConnectW
CloseODBCPerfData
SQLSetDescRec
GetODBCSharedData
SQLGetStmtOption
OpenODBCPerfData
SQLSetPos
SQLGetDiagFieldA
SQLMoreResults
SQLSetConnectOptionA
SQLPrimaryKeysW
SQLFreeHandle
SQLGetFunctions
SQLProcedureColumnsA
SQLPrepareW
SQLDataSourcesW
CursorLibLockDbc
SQLFreeEnv
SQLGetData
SQLNativeSqlA
SQLGetConnectAttrW
PostODBCError
SQLSpecialColumnsW
SQLRowCount
SQLSpecialColumnsA
SQLParamOptions
CollectODBCPerfData
SQLSetConnectAttrA
SQLDriverConnectW
SQLColumnPrivilegesW
SQLBrowseConnectA
SQLNumResultCols
SQLGetDescFieldA
SQLColAttributeW
SQLAllocHandle
ODBCSetTryWaitValue
SQLGetTypeInfoW
SQLTablePrivilegesW
ODBCInternalConnectW
SQLSetEnvAttr
SQLFetchScroll
SQLPrepareA
SQLAllocEnv
SQLGetConnectOptionA
SQLTablePrivilegesA
g_hHeapMalloc
ODBCGetTryWaitValue
ValidateErrorQueue
SQLSetScrollOptions
SQLCopyDesc
CursorLibLockDesc
SQLGetCursorNameA
SQLGetInfoW
SQLGetConnectOptionW
SQLCloseCursor
CursorLibTransact
SQLGetStmtAttrA
SQLGetDescRecA
SQLConnectA
SQLErrorA
SQLEndTran
SQLNumParams
SQLForeignKeysW
SQLTransact
SQLDescribeParam
SQLGetInfoA
SQLBindParam
SQLFreeStmt
SQLCancel
SQLSetConnectAttrW
SQLFreeConnect
SQLGetDiagRecA
SQLPrimaryKeysA
SQLParamData
SQLExecute
SQLProceduresW
LockHandle
SQLExecDirectA
SQLGetCursorNameW
SQLTablesW
PostComponentError
SQLDriversW
SQLGetDiagFieldW
CursorLibLockStmt
ODBCQualifyFileDSNW
SQLFetch
SQLStatisticsW
SQLExecDirectW
SQLDescribeColA
PostODBCComponentError
SQLGetEnvAttr
SQLForeignKeysA
SQLColumnPrivilegesA
SQLAllocConnect
SQLDriverConnectA
DllBidEntryPoint
SQLNativeSqlW
SQLGetConnectAttrA
SQLBulkOperations
kernel32
GetModuleHandleA
GetModuleHandleA
CloseHandle
GetProcAddress
SetupComm
SetComputerNameExW
SetThreadLocale
LoadLibraryA
SetEnvironmentVariableW
VirtualAlloc
FindResourceExW
RaiseException
SetCommTimeouts
SetConsoleCursorPosition
SetCurrentDirectoryW
lstrcmpA
EnumUILanguagesW
GetStartupInfoA
Name
.text
Size
104KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe
- IMPHASH 1c905d3d4c93b0360c86a969e3123c38
- SHA256 5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9
- MD5 941fb1cd3fdab89abc35f0a21abd2f45
- SHA1 349c15855c91c341db0bc01cc328a17a3554cbc4
- SHA512 14cf15e0f84f821adfd4dfe3037421291f296e9613db3f77405053e2b4a9a2e18625c2425a56af02bb479ff8e5c6b2eb45808d0054b5dbefd3d9cba213c0ade5
- SSDEEP 3072:sTVZEA0R5UeyVSzeIw6upojbcbf0L1siwNGRRH9fZvl2hZm6nE:sxWA0EeKvpdbf0L1si9H9fZvj6E
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ntdll
RtlUnwind
NtQueryInformationFile
NtClose
NtReadFile
NtWriteFile
shlwapi
PathCombineW
kernel32
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
SetLastError
TlsFree
DecodePointer
GetCurrentProcess
GetTickCount
GetCurrentThread
GetProcessHeap
GetProcessTimes
GetCurrentThreadId
GetCurrentProcessId
GetThreadTimes
HeapReAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
InterlockedCompareExchange
HeapDestroy
HeapCreate
HeapSize
MultiByteToWideChar
SetUnhandledExceptionFilter
CreateDirectoryW
GetFileAttributesW
CreateFileW
GetLastError
SetFileAttributesW
GetModuleHandleW
GetProcAddress
LocalFree
GetFileType
GetSystemTimeAsFileTime
GetVersionExW
GetThreadContext
SetThreadContext
CreateProcessW
VirtualFreeEx
TerminateProcess
GetModuleFileNameW
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
ResumeThread
CreateThread
CreateMutexW
IsProcessorFeaturePresent
InitializeCriticalSection
Sleep
LeaveCriticalSection
OpenMutexW
EnterCriticalSection
CreateEventW
DeleteCriticalSection
WTSGetActiveConsoleSessionId
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
LCMapStringW
GetStringTypeW
LoadLibraryW
GetNativeSystemInfo
WaitForSingleObject
HeapSetInformation
GetCommandLineA
user32
GetFocus
GetCapture
GetKBCodePage
GetForegroundWindow
GetDesktopWindow
GetActiveWindow
GetShellWindow
GetOpenClipboardWindow
GetClipboardOwner
advapi32
RegCloseKey
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
shell32
SHGetFolderPathW
ShellExecuteExW
ord680
ole32
CoInitializeEx
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=14, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=69, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=4, productName=Unmarked objects (old),
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=171, id=1, productName=Unmarked objects,
count=80, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_Dumped_TDS=4F8C315F.exe
- SHA256 160e7c9806857f1dfae4191a338c4e9341f1f589b6ed72f4cf6e10db483e3af6
- MD5 50e3871f540b228941b8ef76ef0d543e
- SHA1 ba51fc4ecff55d7c504db666d970490118153afc
- SHA512 16acd834a04b43eed8954d74a884032ae73439ffaefaf51f043fa19a7af7a71cdcf19a752d67194f6b15df1272947bd5522895a266e971a3e241d34aea79bf7f
- SSDEEP 1536:df/SovFSSZtDgN+DpDkDEFtCw0YF8965L+vpCYC:J/zv0SZtDgN+Dp+Er0YF896WpTC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mackt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4_TDS=4F91F15B.exe
- IMPHASH 68996d733e6cdc66082ec159f382bc23
- SHA256 61318fa1f1db342045573d584badc254c9e2578db916594dc749d8cc44ce8ac4
- MD5 eac5147a7febdf744c06e452dbd67cc1
- SHA1 78be5cd993dd3d67eb9229979bf033c576cf009b
- SHA512 75d4a3ecc209f4b2cf021758b3566dcf18a056c2f94f62d5dcbe424382d041b3c2a40ae32cd5fe9cd8c8fb45328d0e970d4fde0d43299082a9b011067c289e9d
- SSDEEP 1536:+l07ZXrWuQV9yDQ10SAcm3nE+p2cm849X:q05BQXy000AEXhR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCommandLineA
GetEnvironmentStringsW
GetCommandLineW
GetCurrentProcessId
GetPriorityClass
GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupGetLineCountA
msvcrt
_adjust_fdiv
memcpy
_exit
_onexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=29, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
6184f1def457c10b2ae10a33b8639c89cb0115061c3d424d330342b44d4179aa_not_packed_maybe_useless.exe
- IMPHASH d5d6342866713cb2d8a3b0ee026ddd26
- SHA256 6184f1def457c10b2ae10a33b8639c89cb0115061c3d424d330342b44d4179aa
- MD5 df655cb975eea5794931898e4748c835
- SHA1 36c681a55eb75e565df234933a503caf65a1bf82
- SHA512 803dcce02c6607ae4363f8f946fed311bb11f820b15f218b6880024732b5596445c0259785ec7200866c64b83666756651d2a4b68351be6ff7de9885aae35090
- SSDEEP 1536:rnUfv0+ZXqm3S+DQNn1Bp/GpL7F6iCFNF8nqZ:rn6v0+ZX5S+DQ11Bx67F4NF8nq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
43458
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\my projects\dilly\output\Release\locker.pdb
wininet
InternetOpenA
HttpQueryInfoA
InternetConnectA
InternetReadFile
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
shlwapi
PathCombineW
kernel32
lstrcatA
GetLastError
GetModuleHandleA
CloseHandle
GetVersion
lstrcpyA
WaitForSingleObject
Sleep
GetCurrentProcessId
GetTickCount
ExitProcess
GetFileSize
lstrlenA
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
lstrlenW
FlushFileBuffers
GetProcAddress
DeleteFileW
SetFileAttributesW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy
HeapCreate
HeapSize
GetVersionExA
CreateProcessW
GetCurrentProcess
InitializeCriticalSection
OpenProcess
LeaveCriticalSection
TerminateProcess
GetModuleFileNameW
CreateThread
OpenEventA
CreateMutexA
LocalFree
WideCharToMultiByte
MultiByteToWideChar
DosDateTimeToFileTime
SetFilePointer
SystemTimeToFileTime
GetFileType
GetCurrentDirectoryA
SetEvent
WTSGetActiveConsoleSessionId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
RaiseException
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
EncodePointer
GetStdHandle
DecodePointer
GetModuleHandleW
IsDebuggerPresent
SetUnhandledExceptionFilter
CopyFileW
GetUserGeoID
CreateDirectoryW
GetComputerNameA
SetHandleCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
LCMapStringW
IsProcessorFeaturePresent
RtlUnwind
EnterCriticalSection
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetStringTypeW
GetSystemTimeAsFileTime
user32
PostMessageA
GetClientRect
SetWindowLongA
GetWindowLongA
RegisterClassExA
PostQuitMessage
TranslateMessage
UnregisterClassA
CreateWindowExA
DefWindowProcA
DispatchMessageA
MessageBoxW
GetSystemMetrics
UpdateWindow
EnumWindows
ShowWindow
IsWindowVisible
EnableWindow
ExitWindowsEx
GetMessageA
GetWindowThreadProcessId
advapi32
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegFlushKey
RegOpenKeyA
RegCreateKeyExA
SetSecurityDescriptorSacl
shell32
ord680
SHGetFolderPathW
ole32
OleUninitialize
OleSetContainedObject
CoGetClassObject
OleInitialize
oleaut32
SysAllocString
VariantClear
VariantInit
_dll_entry@16
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=180, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
61bc10e8ede3997da73b3de9fa57b059e352b592404fb9c171469c4026fdc03e.exe
- IMPHASH fc04df4eefe1376d15e9da5c7e4add82
- SHA256 61bc10e8ede3997da73b3de9fa57b059e352b592404fb9c171469c4026fdc03e
- MD5 ec3a2b5b80e39d553841a77508fa2aa8
- SHA1 ae28b9cfb3c2c6f2745fa62b43f79304387ac8f9
- SHA512 24ae65b0b6534659a868aaa76ce4e2380d5e96be0b173276d1a64e86057c18073f5ddbed50160b2b6168b5bdda9f376bef4e39e33d11c8144ded7b60f6d14822
- SSDEEP 3072:Vhv5UWpHLLgPyB6W5C6qZT0+SqxMLdSeaUMW6UMI5JSxyl:VZ2W9iy0rp0+Se0wepMyMI5k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5620
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\myapp\myapp.pdb
kernel32
VirtualAlloc
LoadLibraryA
VirtualProtect
GetProcAddress
GetModuleHandleA
WaitForSingleObject
GetProcessHeap
ResetEvent
VirtualQuery
VirtualFree
FlushFileBuffers
SetStdHandle
SetFilePointer
GetLocaleInfoA
LCMapStringW
LCMapStringA
HeapSize
GetSystemTimeAsFileTime
Sleep
IsBadCodePtr
CreateEventA
GetCurrentProcessId
GetCurrentThreadId
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapFree
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapAlloc
HeapReAlloc
MultiByteToWideChar
GetSystemInfo
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
InterlockedExchange
GetStringTypeA
GetStringTypeW
ReadFile
QueryPerformanceCounter
GetTickCount
CloseHandle
user32
EndPaint
IsZoomed
GetLastActivePopup
LoadAcceleratorsA
CreateWindowExA
IsIconic
gdi32
SelectObject
PatBlt
winscard
SCardEstablishContext
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
152KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=60, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=11, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=7, id=93, version=2179,
count=70, id=1, productName=Unmarked objects,
count=5, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
6217ea6bb87295983c4915a4d97c7e4142effef95d1e815693a72ea3a73b45f5.exe
- SHA256 6217ea6bb87295983c4915a4d97c7e4142effef95d1e815693a72ea3a73b45f5
- MD5 d7fffb1934fd8abf88a4e6a4c1d06a7a
- SHA1 ee7157c22bd36baab3061be64811011f87bebee9
- SHA512 1b765bf19b7d9b40445ea76edb352530a4b402055bcdc8237bd2fd5edeadfad324f02b177d7e31ee6a9580600611dd01bd4108239d9f3670dbfe941abbe31457
- SSDEEP 24576:+HA+GceO87uF3RymfHkCq4RKCaheQSeWzzXbk9fGexCmPBB:aA5ceV7uTvkQKCaheQSeWvbYeexrBB
- MD5 SHA1 SHA512 SSDEEP
dwag.jvykqfj.brgnx
Rwoebiti
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_PHONE_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WAKE_LOCK
android.permission.GET_ACCOUNTS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.CAMERA
android.permission.READ_CONTACTS
android.permission.GET_TASKS
android.permission.WRITE_SETTINGS
android.permission.VIBRATE
android.permission.READ_CONTACTS
Rwoebiti
android.intent.action.MAIN
SampleOverlayHideActivity
Qpixelkn
dwag.jvykqfj.brgnx.Mlwtmixb
android.intent.action.REBOOT
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
dwag.jvykqfj.brgnx.Pkciyn
dwag.jvykqfj.brgnx.Hmydf
android.app.action.ACTION_DEVICE_ADMIN_DISABLED
android.app.action.ACTION_DEVICE_ADMIN_DISABLE_REQUESTED
android.app.action.DEVICE_ADMIN_ENABLED
62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_Dumped_TDS=4F854EC3.exe
- SHA256 d95312a777a941af73fe9c14821664423bd83893f75775ce49789a09dd1942af
- MD5 d7f138beb0d7af7bf39ba0f84592f937
- SHA1 d15de95d5536560d3edad6cc68bd8720b9d8d345
- SHA512 3eff0fd7e21d219679d6b0112a8ee458ecbcd5b1f9a6877246eddd16ddf5353d7a13eb8455a30ba4a590c4c64b10d9ee8b14bc28f8684fd7a8769eed649c6e6c
- SSDEEP 1536:ofviwv96S5tDAN+8ZDkDEFtCwPxF89b5L+vhCYC:Ov7vES5tDAN+8Z+ErPxF89bWhTC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mackt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df_TDS=4F8644BB.exe
- IMPHASH 7f4967574388561c50da7cebe40fecc5
- SHA256 62ebcfeeff976f3635e36544b9f6d6282a565ea6a0b4d8319d9831ce68ef26df
- MD5 2fbd1175ed3ced1094306b17d29a3dc1
- SHA1 8a113b8f8c4028d0284083bfc08aeee457a07851
- SHA512 a3b8cb9d97c47155c86d8dcc0ec3beb43092f3a8388eeb51a01b9df2ac096f46c542e971d473a23f4ad1c12e746459797e375b614a3e327d100f2e2aef82f4bd
- SSDEEP 1536:WBEkfVi/vqW6kJz2iyA7h8ep661/fwiJvyWyjAaH:WciIVyA7WW66xf94WAAM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetStdHandle
CreateEventA
CreateSemaphoreA
CreateMutexA
GetVersionExA
GetLastError
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
shlwapi
UrlCombineA
setupapi
SetupGetFieldCount
msvcrt
__setusermatherr
_onexit
__dllonexit
memcpy
_controlfp
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
_exit
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
Name
.text
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
954B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=19, version=9049,
count=30, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
647f242.exe.vir.exe
- IMPHASH 09c8b4257dfa7259fcc0851bc16dfa2d
- SHA256 0099510027ecf682b76db6a885c9fa8c2270f6c8e6efded2f52c8860714d0e26
- MD5 d43abef5a62b46a660a5128330070479
- SHA1 9d60f58fe742dfc93363bd79eff64c337fc5cb23
- SHA512 5d169c68e0c76b299bd38350c223f43b2f90afd6a7a36d71520954b1cab08a1324aa13aa33be8631c68b7954a2fef484595e4f0867655f371cf379803d22bc82
- SSDEEP 3072:fRr1LYTa7G7NojiKJQ7mVzRRG7ul56WeTQtOK9Fgy++Q9utAfXIHH5h:fRhYTay+72cLn8YOK4++ut0If
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
19335
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
SendMessageA
ScreenToClient
GetCursorPos
SetFocus
CheckRadioButton
IsWindowEnabled
GetClipboardData
IsZoomed
KillTimer
SetWindowLongA
SetWindowPos
GetWindowRect
SetClipboardData
GetAsyncKeyState
wvsprintfA
CloseClipboard
CallWindowProcA
MessageBeep
wsprintfA
MessageBoxA
CharUpperA
OpenClipboard
EnumClipboardFormats
DestroyMenu
GetMenuItemInfoW
LoadCursorFromFileW
DispatchMessageA
NotifyWinEvent
DdeUninitialize
EnumPropsExW
CreateCaret
UnionRect
InsertMenuA
ShowWindow
SetMenuItemInfoA
AppendMenuA
CreatePopupMenu
SetWindowTextA
DestroyIcon
LoadIconA
InvalidateRect
CharLowerA
LoadBitmapA
SetDlgItemTextA
GetDlgItemTextA
GetSysColorBrush
DestroyCursor
SetClassLongA
LoadCursorA
GetParent
EnableWindow
GetWindowTextA
EnableMenuItem
IsIconic
MoveWindow
GetWindowDC
TrackPopupMenu
CheckMenuRadioItem
SetTimer
GetActiveWindow
GetClassInfoA
DialogBoxParamA
FindWindowA
SetForegroundWindow
CheckDlgButton
GetDlgItem
EndDialog
IsDlgButtonChecked
SendDlgItemMessageA
EmptyClipboard
comdlg32
CommDlgExtendedError
ChooseFontA
ChooseColorA
shell32
ShellExecuteA
DragQueryFileW
ExtractIconExA
DragAcceptFiles
DuplicateIcon
ExtractIconExW
ExtractAssociatedIconW
ShellExecuteW
ole32
CoUninitialize
CoDisconnectObject
StringFromCLSID
CoTaskMemAlloc
OleSetMenuDescriptor
OleDraw
IsAccelerator
OleRegEnumVerbs
CreateStreamOnHGlobal
OleUninitialize
CLSIDFromProgID
OleInitialize
CoLockObjectExternal
CoGetClassObject
OleSetContainedObject
ProgIDFromCLSID
CoCreateInstance
RevokeDragDrop
CoGetInterfaceAndReleaseStream
CoTaskMemFree
RegisterDragDrop
ReleaseStgMedium
CoInitialize
advapi32
RegQueryValueA
RegCreateKeyA
GetSecurityDescriptorLength
SetSecurityDescriptorDacl
LookupPrivilegeDisplayNameA
RegEnumKeyW
EnumDependentServicesW
shlwapi
PathRemoveFileSpecW
kernel32
HeapReAlloc
HeapAlloc
LCMapStringW
RtlUnwind
GetTickCount
QueryPerformanceCounter
HeapCreate
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
MultiByteToWideChar
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
HeapFree
DeleteCriticalSection
GetCurrentThreadId
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
IsProcessorFeaturePresent
GetTimeZoneInformation
DecodePointer
EncodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlushFileBuffers
EnterCriticalSection
GetStartupInfoW
HeapSetInformation
InterlockedIncrement
InterlockedDecrement
GetSystemTimeAsFileTime
MoveFileA
GetLastError
SetThreadAffinityMask
GetSystemPowerStatus
GenerateConsoleCtrlEvent
FillConsoleOutputAttribute
BuildCommDCBAndTimeoutsA
LoadLibraryW
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GlobalUnfix
lstrcpynA
lstrcatA
lstrlenA
CreateProcessA
WideCharToMultiByte
lstrlenW
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentProcess
TerminateProcess
VirtualProtectEx
WriteFile
FindClose
FindNextFileA
LoadLibraryA
SetFilePointer
SetThreadPriority
VirtualFree
IsBadReadPtr
lstrcmpiA
ExitProcess
SetFileAttributesA
OutputDebugStringA
lstrcpyA
GetFileAttributesA
ResumeThread
GetCurrentThread
DeleteFileA
GetTempPathA
SetPriorityClass
HeapSize
WriteConsoleW
SetStdHandle
CompareStringW
SetEnvironmentVariableA
CreateFileW
LeaveCriticalSection
CreateFileA
VirtualQueryEx
lstrcmpA
CloseHandle
GetCommandLineA
VirtualAlloc
FindFirstFileA
GetPriorityClass
ReadFile
Sleep
GetCurrentProcessId
WriteProcessMemory
GetProcAddress
GetModuleHandleA
ReadProcessMemory
OpenProcess
GetFileSize
SetCurrentDirectoryA
GetModuleFileNameA
VirtualLock
VirtualUnlock
GetPrivateProfileStringA
WritePrivateProfileStringA
SetEndOfFile
CreateFileMappingA
MapViewOfFile
CopyFileA
WaitForSingleObject
CreatePipe
GetStartupInfoA
MulDiv
UnmapViewOfFile
GetCurrentDirectoryA
WritePrivateProfileStructA
GetPrivateProfileStructA
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.code
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=30, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=18, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=108, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=250, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
64bfea1efccb47a049ba2cb592878e5c415cc70f9488dd97291c1356e3d79299.exe
- IMPHASH 14af9ce10d5934ed28f640cdf51b6948
- SHA256 64bfea1efccb47a049ba2cb592878e5c415cc70f9488dd97291c1356e3d79299
- MD5 81d39888c40bd377f1d84089e02c6c4f
- SHA1 b1eeb812dcbc2b4d871a7e34fa149205df177a22
- SHA512 b879c20ee382bdf1c278edfe17241686abeb1b989adf62ca4ee52846febfe7feea51f3b03730aa1feb50f62dc695db3ed1991f27b5d2118f5b02824d883429d7
- SSDEEP 6144:wQIFrm2L96ygCkDv9LiUAH7oxytqXoRURYZESxR2GT+5pJBYZ+txYec:wZFiIVnkDv9BvNtSn2GCXKz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
454160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrlenW
lstrlenA
lstrcpynW
lstrcpyW
lstrcpyA
lstrcmpiW
lstrcmpW
lstrcmpA
lstrcatW
WriteProcessMemory
WritePrivateProfileStringW
WriteFile
WriteConsoleInputW
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
UnregisterWait
UnmapViewOfFile
TlsSetValue
TlsGetValue
TerminateThread
TerminateProcess
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
SwitchToThread
SuspendThread
Sleep
BackupSeek
SizeofResource
SetupComm
SetThreadPriority
SetLocaleInfoW
SetEnvironmentVariableW
SetEndOfFile
SetCurrentDirectoryW
SetConsoleActiveScreenBuffer
SearchPathW
RtlUnwind
ReadFile
ReadConsoleOutputAttribute
RaiseException
OutputDebugStringW
OpenFileMappingW
OpenEventW
MoveFileWithProgressA
LocalSize
LocalAlloc
LoadLibraryW
LoadLibraryExW
LoadLibraryExA
IsValidCodePage
InitializeCriticalSectionAndSpinCount
Heap32ListNext
Heap32ListFirst
GlobalMemoryStatusEx
GetVersionExW
GetVersionExA
GetTempFileNameW
GetSystemTime
GetSystemDirectoryW
GetStringTypeW
GetStringTypeExW
GetStdHandle
GetProcessShutdownParameters
GetProcAddress
GetPrivateProfileStringW
GetPrivateProfileIntW
GetNamedPipeInfo
GetModuleHandleW
GetModuleFileNameW
GetLastError
GetFileType
GetFileSize
GetExitCodeProcess
GetEnvironmentStrings
GetConsoleTitleA
GetConsoleScreenBufferInfo
GetConsoleAliasExesA
GetCompressedFileSizeA
GetCommandLineW
GetCommMask
GetCPInfo
GetACP
FindResourceW
FindResourceExW
FindNextFileW
FindFirstVolumeMountPointA
ExpandEnvironmentStringsW
ExitProcess
DeleteFileW
CreateSemaphoreW
CreateProcessW
CreateMutexW
CreateJobObjectA
CreateFileW
CreateFileMappingW
CreateEventW
CloseHandle
user32
EnumClipboardFormats
GetAsyncKeyState
GetMenuContextHelpId
GetQueueStatus
GetMenu
GetParent
GetListBoxInfo
GetMenuItemCount
GetKeyboardType
GetDlgCtrlID
GetKeyboardLayout
GetKeyState
GetTopWindow
GetWindowContextHelpId
GetThreadDesktop
GetWindowDC
GetClipboardData
GetLastActivePopup
GetSysColor
GetSystemMetrics
GetSysColorBrush
wvsprintfW
wsprintfW
WinHelpW
UnregisterClassW
SystemParametersInfoA
SetWindowWord
SetWindowTextW
SetWindowLongW
SetSystemCursor
SetDlgItemTextW
SetCursorPos
SendMessageW
RegisterWindowMessageW
RegisterClassExW
PostThreadMessageW
PostMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
MessageBoxW
MessageBoxExW
MapVirtualKeyExW
LoadStringW
LoadMenuW
LoadImageW
LoadImageA
LoadIconW
LoadCursorW
IsMenu
IsHungAppWindow
IsDialogMessageW
IsCharAlphaNumericW
InsertMenuW
GetWindowTextW
GetWindowTextLengthW
GetWindowLongW
GetSubMenu
GetScrollRange
GetNextDlgTabItem
GetMessageW
GetMenuDefaultItem
GetKeyNameTextA
GetDlgItemTextW
GetDC
GetClassLongW
GetClassInfoExA
FindWindowExW
EqualRect
EndDialog
DrawTextA
DrawMenuBar
DrawFocusRect
DlgDirSelectExA
DlgDirListComboBoxW
DispatchMessageW
DialogBoxParamW
DefWindowProcW
DdeNameService
DdeInitializeW
CreateWindowExW
CreateDialogParamW
CreateDialogParamA
CreateAcceleratorTableW
CopyRect
ChildWindowFromPointEx
CharUpperW
CharPrevW
CharNextW
CharLowerW
ChangeMenuA
CallWindowProcW
CallMsgFilterW
CallMsgFilter
BlockInput
SendDlgItemMessageW
gdi32
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreatePolyPolygonRgn
CreatePenIndirect
CreatePen
CreatePalette
CreateHalftonePalette
CreateFontW
CreateFontIndirectW
CreateFontA
CreateEllipticRgnIndirect
CreateDIBitmap
CreateDIBSection
CreateDIBPatternBrushPt
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateColorSpaceW
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
CombineRgn
BitBlt
ArcTo
GdiConvertMetaFilePict
GdiEntry13
GdiFlush
GdiGetLocalFont
GdiPlayScript
GdiProcessSetup
GdiQueryTable
GetAspectRatioFilterEx
GetBitmapBits
GetBrushOrgEx
GetClipBox
GetClipRgn
GetCurrentObject
GetCurrentPositionEx
GetDCOrgEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetETM
EndDoc
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
GetLogColorSpaceA
GetMetaFileBitsEx
GetMetaFileW
GetNearestPaletteIndex
GetObjectType
GetObjectW
GetPaletteEntries
GetPixel
GetRgnBox
GetStockObject
GetStringBitmapW
GetSystemPaletteEntries
GetTextExtentExPointW
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextExtentPointI
GetTextFaceA
GetTextFaceW
GetTextMetricsW
GetViewportOrgEx
GetWinMetaFileBits
GetWindowOrgEx
IntersectClipRect
LineTo
MaskBlt
ModifyWorldTransform
MoveToEx
PatBlt
Pie
PlayEnhMetaFile
Polyline
RealizePalette
RectVisible
Rectangle
RemoveFontResourceExA
ResizePalette
RestoreDC
RoundRect
STROBJ_dwGetCodePage
SaveDC
SelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
EndPage
EngUnicodeToMultiByteN
EnumICMProfilesA
ExcludeClipRect
ExtTextOutW
FONTOBJ_pfdg
GetEnhMetaFileBits
UpdateColors
UnrealizeObject
TextOutA
StretchDIBits
StretchBlt
StartPage
StartDocA
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetMapMode
SetICMProfileA
SetEnhMetaFileBits
SetDIBitsToDevice
FrameRgn
advapi32
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyW
GetUserNameW
Name
.text
Size
464KB
Virtual Size
464KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=331, id=1, productName=Unmarked objects,
count=2, productName=Unmarked objects (old),
count=1, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_Dumped_TDS=4F9911B3.exe
- SHA256 5f60eed8e27867c843387fe7fece3af688586a40c8d3dd2c27647b23cc200fdc
- MD5 5a580ab3f5b3806da853459e9ef7b368
- SHA1 df93c0f0dd694ab49646b539418b67d83eafccb5
- SHA512 91ecd8f00f4cd6c7d199eb365cb7cfa414bcab41b144fe7a5f43529e560201a81284cdb3a3d18d252e2eb4429a67f2db5718eacc8bf1eeb072958c0a4be20a3b
- SSDEEP 1536:tf/YvFSSZtDgN+DrDkDEFtCwbfF89lGL+vpCYC:Z/Yv0SZtDgN+Dr+ErbfF89llpTC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mackt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935_TDS=4F9DB277.exe
- IMPHASH 8df8842017f9ad4c4915158983df9eb6
- SHA256 64f540a7c6ded1c751c9a66629fd2aaa6cdd61749f05c8d0760a1aaeb5548935
- MD5 035df8236f31380b650b69a03168ad1a
- SHA1 742f605e9ca1d726076431a5af304260bb72ad92
- SHA512 5cc268e3e3e21d6333c29fe710b9f91575ab0f9aebc140a4d866a670ef4afa26a9d5ef2108876def371ace28eea5110031354765984d3a86274fadef0ca99a76
- SSDEEP 1536:gad6u91qySNlP3qFXHxyK+1F+PNqhdOVNykDnJYHtFtkiyx:gad6G1gj6hxb+FvhwVNTDQtOx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetPriorityClass
GetEnvironmentStringsW
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupGetLineCountA
msvcrt
_adjust_fdiv
memcpy
_exit
_XcptFilter
exit
_onexit
__getmainargs
_initterm
__setusermatherr
_acmdln
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
822B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
45KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=25, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
6916a006c429a3b3a76dfa8c162ddab178b5a20763493506deeb9447875d039a.exe
- IMPHASH 2822bf40fb6766760030dc21a28bab49
- SHA256 6916a006c429a3b3a76dfa8c162ddab178b5a20763493506deeb9447875d039a
- MD5 27536ce5b9f559b94c8821634640dd30
- SHA1 2b3582cf5a7fc058e18b1da3491db589b84c28be
- SHA512 ea26dfa07c9de1ae89a333cc729d753fa758713ba5371d75f3c42a89dabb1c61861d2f9ca88d35cb686848dad4611c8203e0201c347eb674bf74ec3d51215a13
- SSDEEP 6144:uJ9y0noQa1cxp/UWD9xgYxY68hX7qowFnwmWV+:n0nuOp8J2Y68hL6D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7596
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaVarTstGt
ord690
__vbaNextEachAry
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaLineInputStr
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFpCDblR8
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
ord518
__vbaForEachCollAd
__vbaStrCat
__vbaVarCmpNe
__vbaSetSystemError
ord661
ord662
__vbaLenBstrB
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
ord667
__vbaAryDestruct
__vbaLateMemSt
__vbaExitProc
ord594
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaForEachCollVar
ord520
__vbaBoolVarNull
_CIsin
ord631
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord529
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
__vbaNextEachCollVar
__vbaObjVar
__vbaPrintObj
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
__vbaStrR8
__vbaRedim
EVENT_SINK_Release
__vbaNew
ord600
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStr2Vec
__vbaVarMul
__vbaExceptHandler
ord711
ord712
__vbaStrToUnicode
__vbaPrintFile
__vbaDateStr
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord531
ord716
__vbaFPException
ord532
__vbaInStrVar
ord717
__vbaStrVarVal
__vbaUbound
__vbaGetOwner3
__vbaVarCat
ord536
ord645
_CIlog
__vbaFileOpen
__vbaR8Str
__vbaVar2Vec
__vbaNew2
ord571
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord578
ord100
__vbaVarTstNe
__vbaI4Var
__vbaForEachAry
ord689
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
ord612
__vbaVarLateMemCallLd
__vbaFpI4
ord617
__vbaLateMemCallLd
_CIatan
__vbaAryCopy
__vbaStrMove
ord619
__vbaR8IntI4
ord650
_allmul
_CItan
__vbaNextEachCollAd
ord546
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581
Name
.text
Size
208KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=11, id=9, version=8041,
count=1, id=13, version=8169,
69ee6349739643538dd7eb60e92368f209e12a366f00a7b80000ba02307c9bdf.exe
- SHA256 69ee6349739643538dd7eb60e92368f209e12a366f00a7b80000ba02307c9bdf
- MD5 063394a08bb3eec2680a30939e906343
- SHA1 9abeef3ed793f28a24562c3e5c3104eee99daa1c
- SHA512 2fa11d5fbfd4f0e3e40fe1b0ed1717a7cbceeae8970f69ece46a8ed628dbdfefc01ec097c2b387a04d7db6840c4132daa0426e11db9abdbc0dd222218e875edb
- SSDEEP 3072:pPpAZR3J5jvx5mRCNbUjfADPbyyvWL9OzpC/fk:p6hTQjfAjGyqOzp7
- MD5 SHA1 SHA512 SSDEEP
6f772eb660bc05fc26df86c98ca49abc.exe
- SHA256 7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2
- MD5 6f772eb660bc05fc26df86c98ca49abc
- SHA1 8da75dd328c195b84f15740a33fc9888af4da2be
- SHA512 3e028cecf08ed4fe0100a7587f04ba4c4cebb023b371cc4e793a7dfb7be64a4d2ef8066fc352ea834c239cb7c5836626673e02fbaa63f4631b71d40c4cc284a1
- SSDEEP 1536:USX6DdHTs0Zwboo0z29sHH3ga/7/nvvgDD0jj0ZT8fS4D0rF4p4sxVZ7:36BZwlOn4DdTBDiusxVZ7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
104320
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
404B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=260, version=25019,
count=1, id=261, version=24723,
count=1, id=259, version=24723,
count=17, productName=Unmarked objects (old),
count=1, id=261, version=25019,
count=38, id=265, version=25019,
count=1, id=258, version=25019,
70774372517532ae1dcb97a7133983811d5cc7d2975cd58a1f132f2ef100c5e9.exe
- SHA256 70774372517532ae1dcb97a7133983811d5cc7d2975cd58a1f132f2ef100c5e9
- MD5 891d04a494362e4da70353a0423b3eda
- SHA1 54181b303515428cef4d1419fae37fd334ad8d2f
- SHA512 c47fd20a79a270209588a390fb3653005815d620881f7672dc802d6e6485f575a6422633ef4ef0075ca14737c15f0bf815cf8f27bea9ae6a992a986f20fb57df
- SSDEEP 24576:mxcvxpDJzmMxZ/NhjBcB4vWmQe9/34dJ:AMBZ/6Q34n
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
1000KB
Virtual Size
1000KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
UPX1
Size
292KB
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.imports
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
7175d6bb11dea0932bd4b611d0f7221b62a71dbc54607e97ad397f104bcffa2b.exe
- IMPHASH 88ae6fa15ccf0649efebfb4251d9bdc2
- SHA256 7175d6bb11dea0932bd4b611d0f7221b62a71dbc54607e97ad397f104bcffa2b
- MD5 50400e6fa866b326f6a67300848ad529
- SHA1 663c7c0c21c9e9338bcdfec0676a24fca4d72e6c
- SHA512 da41821a918bcd9317fe7e7ab30aa3fc5828b5fc738d82d8fe4a27ea3326b62974acc5df6e8d8b9283db2e49368548d92871c7658388f4a821f45390e70a50c4
- SSDEEP 6144:5YaC47y+HbjC3HjeSVa/wLTAvtQ5GjqgnCOFd0dcXloLaAj9PgM1ZxKbrOXJaFS:3C3HjbVbLkFQ2qe0fLVj9IIrK2Za
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
17152
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
EnumCalendarInfoA
EnterCriticalSection
DeleteFileW
DeleteCriticalSection
CreateThread
CreateFileW
ExitProcess
CreateDirectoryW
CompareStringW
CloseHandle
GetDriveTypeA
GetDriveTypeW
VirtualAlloc
ExitThread
FindClose
FindFirstFileW
FindResourceW
FormatMessageW
FreeLibrary
FreeResource
GetACP
GetBinaryType
GetCPInfo
GetCommandLineW
GetComputerNameW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceW
GetExitCodeThread
GetFileAttributesW
GetFullPathNameW
lstrlenW
lstrcpynW
lstrcpyW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualFree
UnhandledExceptionFilter
TlsSetValue
TlsGetValue
TerminateProcess
SwitchToThread
Sleep
SizeofResource
SignalObjectAndWait
SetThreadLocale
SetTapeParameters
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
RtlUnwind
ResumeThread
ResetEvent
ReadFile
RaiseException
OutputDebugStringW
MultiByteToWideChar
MulDiv
MoveFileExW
LockResource
LockFile
LocalAlloc
LoadResource
LoadLibraryW
LoadLibraryExW
LeaveCriticalSection
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSection
GlobalUnlock
GlobalSize
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetWindowsDirectoryW
GetVolumePathNameW
GetVersionExW
GetVersion
GetUserDefaultLCID
GetTickCount
GetThreadLocale
GetSystemInfo
GetStdHandle
GetStartupInfoA
GetShortPathNameW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetModuleHandleA
CreateEventW
GetLastError
user32
ReleaseDC
RemoveMenu
RemovePropW
ScreenToClient
ScrollWindow
SendDlgItemMessageW
SendMessageA
SendMessageW
SetActiveWindow
SetCapture
SetCaretPos
SetClassLongW
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetMenu
SetMenuInfo
SetMenuItemInfoW
SetParent
SetPropW
SetRect
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetUserObjectInformationA
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TranslateAcceleratorA
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnregisterClassW
UpdateWindow
WaitMessage
WindowFromPoint
wvsprintfA
LoadKeyboardLayoutW
LoadImageA
LoadCursorW
KillTimer
IsZoomed
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageW
IsDialogMessageA
IsClipboardFormatAvailable
IsChild
IsCharAlphaNumericW
InvalidateRect
IntersectRect
InsertMenuW
InsertMenuItemW
InflateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetWindow
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
ReleaseCapture
GetPropW
GetParent
GetMessageTime
GetMessagePos
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardType
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClipCursor
GetClientRect
GetClassLongW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowW
FindWindowExW
FillRect
ExcludeUpdateRgn
EnumWindows
EnumWindowStationsW
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextW
DrawTextExW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DragDetect
DlgDirSelectExA
DlgDirListComboBoxA
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PtInRect
PostQuitMessage
PostMessageW
PeekMessageW
PeekMessageA
OffsetRect
OemToCharBuffA
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
IsWindowVisible
LoadBitmapW
CharLowerW
LoadIconA
ActivateKeyboardLayout
AdjustWindowRectEx
AttachThreadInput
BeginPaint
CallNextHookEx
CallWindowProcW
ChangeDisplaySettingsExA
CharLowerBuffW
CharNextA
CharNextW
CharToOemW
CharUpperBuffW
MonitorFromWindow
MessageBoxW
MessageBoxA
MapWindowPoints
MapVirtualKeyW
GetQueueStatus
LoadStringW
DefFrameProcA
DdeUninitialize
DdePostAdvise
CreateWindowExW
CreatePopupMenu
CreateMenu
CreateIcon
CloseWindowStation
ClientToScreen
CheckMenuItem
CheckDlgButton
LoadIconW
gdi32
AbortPath
BRUSHOBJ_hGetColorTransform
BitBlt
CancelDC
CloseEnhMetaFile
CopyEnhMetaFileW
CopyMetaFileW
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBPatternBrush
CreateDIBSection
CreateDIBitmap
CreateEnhMetaFileW
CreateFontIndirectW
CreateHalftonePalette
CreatePalette
CreatePenIndirect
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
EngBitBlt
EnumMetaFile
ExcludeClipRect
FONTOBJ_pQueryGlyphAttrs
FillRgn
FrameRgn
GdiConvertDC
GdiCreateLocalEnhMetaFile
GdiPlayScript
GetBitmapBits
GetBrushOrgEx
GetCharWidthFloatA
GetClipBox
GetColorSpace
GetCurrentPositionEx
GetDCOrgEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetEnhMetaFileBits
GetEnhMetaFileDescriptionW
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
GetMetaFileBitsEx
GetObjectW
GetPaletteEntries
GetPixel
GetRgnBox
GetStockObject
GetSystemPaletteEntries
GetTextCharacterExtra
GetTextExtentPoint32W
GetTextMetricsW
GetViewportOrgEx
GetWinMetaFileBits
GetWindowOrgEx
HT_Get8BPPFormatPalette
IntersectClipRect
LPtoDP
LineTo
MaskBlt
MoveToEx
PatBlt
PlayEnhMetaFile
QueryFontAssocStatus
RealizePalette
RectVisible
RestoreDC
SaveDC
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
SetEnhMetaFileBits
SetMagicColors
SetMapMode
SetPixel
SetROP2
SetStretchBltMode
SetTextColor
SetViewportOrgEx
SetVirtualResolution
SetWinMetaFileBits
SetWindowOrgEx
StretchBlt
UnrealizeObject
XFORMOBJ_bApplyXform
ArcTo
advapi32
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyW
RegCloseKey
RegFlushKey
RegOpenKeyExW
RegSetValueExW
shell32
ExtractAssociatedIconA
SHLoadInProc
SHGetSpecialFolderPathW
SHGetFolderPathW
SHCreateDirectoryExA
SHAppBarMessage
CommandLineToArgvW
DoEnvironmentSubstW
SHLoadNonloadedIconOverlayIdentifiers
ExtractAssociatedIconExW
FindExecutableW
SHAddToRecentDocs
ole32
StringFromCLSID
ProgIDFromCLSID
OleUninitialize
OleSetMenuDescriptor
OleInitialize
OleDraw
IsEqualGUID
IsAccelerator
CreateStreamOnHGlobal
CoUninitialize
CoTaskMemFree
CoInitialize
CoGetClassObject
CoCreateInstance
CLSIDFromString
shlwapi
StrChrIW
StrCmpNIA
StrRChrW
StrStrIA
StrChrA
StrStrIW
comctl32
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollProp
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_DrawEx
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Read
ImageList_Remove
ImageList_SetBkColor
ImageList_SetIconSize
ImageList_SetImageCount
ImageList_Write
InitializeFlatSB
_TrackMouseEvent
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
e2
Size
547KB
Virtual Size
546KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=123, productName=VS2005 build 50727, version=50727,
count=466, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 build 21022, version=21022,
count=6, productName=Unmarked objects (old),
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
728733095fe2c66f91a19ebde412dd25_70186ceb735016eadd98466e62c03635_TheLastReveton.exe
- IMPHASH 70186ceb735016eadd98466e62c03635
- SHA256 dff7c0aac326f210705e4f53cd78a57cb277e80ecec7bdffd6f68db3bdda39c3
- MD5 728733095fe2c66f91a19ebde412dd25
- SHA1 fd1ae96536ef9f29f336425b83022d2beab767a2
- SHA512 ec992b0eaf04242cd2b21a863c2bf5d0702aa45336625fde0c48a453b7aa32eb9bdbe0bdcce1dafa6d1756214f567aff378931464f97e8191ae290757501b44d
- SSDEEP 3072:g/X2RwrY/2VC8+yGdYmmn1P4yJxI4c10V:g/XgwrY+VF+xddmFTxI4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24359
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFindAtomA
GetModuleFileNameA
GetProcessId
OutputDebugStringW
GlobalFindAtomA
advapi32
CryptHashSessionKey
GetPrivateObjectSecurity
GetCurrentHwProfileA
RegDeleteKeyA
OpenSCManagerW
CryptGetUserKey
MapGenericMask
IsValidAcl
SetSecurityDescriptorDacl
CryptCreateHash
CryptVerifySignatureW
ChangeServiceConfigW
AddAce
CreatePrivateObjectSecurityEx
ImpersonateLoggedOnUser
NotifyBootConfigStatus
IsWellKnownSid
CloseServiceHandle
CryptSetProviderA
CryptGetProvParam
OpenBackupEventLogW
CryptDecrypt
ntdsapi
DsFreeSpnArrayA
DsListInfoForServerA
DsServerRegisterSpnW
DsQuoteRdnValueW
DsReplicaModifyA
DsReplicaConsistencyCheck
DsClientMakeSpnForTargetServerA
DsFreeDomainControllerInfoW
DsListDomainsInSiteW
DsCrackNamesW
DsListDomainsInSiteA
DsFreePasswordCredentials
DsListRolesW
DsFreeNameResultA
DsReplicaSyncW
DsReplicaGetInfoW
DsInheritSecurityIdentityA
DsFreeNameResultW
DsQuoteRdnValueA
msi
ord97
ord58
ord194
ord216
ord129
ord147
ord107
ord168
ord29
ord175
ord118
ord79
ord125
ord123
ord134
ord145
ord171
ord22
ord42
ord45
ord155
ord37
ord27
ord124
ord228
ord190
ord56
ord46
ord231
ord144
ord54
ord95
ord159
ord165
opengl32
glEvalCoord1fv
glMap1d
glClearDepth
glTexGenf
glColorMask
glTexCoord3dv
glDepthFunc
glColor4dv
glColorMaterial
glRasterPos4d
glEdgeFlagPointer
glTexGendv
glFrustum
glEvalMesh2
glIsList
wglShareLists
glNormal3iv
glTexCoord1iv
glEvalCoord2dv
glPixelTransferf
glLighti
glColor4uiv
glColor4ubv
glSelectBuffer
glVertex2s
glRasterPos4f
glColor4s
glIndexsv
glDisableClientState
glClipPlane
glNormalPointer
glVertex4fv
glPixelStorei
glColor3sv
glMap2f
wglCopyContext
urlmon
URLOpenBlockingStreamA
URLDownloadToFileA
CreateAsyncBindCtxEx
ObtainUserAgentString
FindMediaType
URLOpenPullStreamW
CoInternetParseUrl
CoInternetCreateSecurityManager
FindMimeFromData
CoInternetQueryInfo
CoInternetCompareUrl
CoInternetGetSession
CopyStgMedium
CreateAsyncBindCtx
RegisterFormatEnumerator
GetComponentIDFromCLSSPEC
CompareSecurityIds
URLDownloadToCacheFileA
IsLoggingEnabledW
ReleaseBindInfo
URLOpenBlockingStreamW
CoInternetCreateZoneManager
WriteHitLogging
IsLoggingEnabledA
RegisterBindStatusCallback
GetClassFileOrMime
UrlMkSetSessionOption
secur32
ExportSecurityContext
AcceptSecurityContext
VerifySignature
FreeCredentialsHandle
ImportSecurityContextA
CompleteAuthToken
RevertSecurityContext
ImpersonateSecurityContext
AddCredentialsW
QuerySecurityPackageInfoA
AcquireCredentialsHandleA
DeleteSecurityContext
AddCredentialsA
ImportSecurityContextW
ApplyControlToken
Name
.text
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=16, id=1, productName=Unmarked objects,
count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=12, id=10, version=8447,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_Dumped_TDS=4F8C315F.exe
- SHA256 160e7c9806857f1dfae4191a338c4e9341f1f589b6ed72f4cf6e10db483e3af6
- MD5 50e3871f540b228941b8ef76ef0d543e
- SHA1 ba51fc4ecff55d7c504db666d970490118153afc
- SHA512 16acd834a04b43eed8954d74a884032ae73439ffaefaf51f043fa19a7af7a71cdcf19a752d67194f6b15df1272947bd5522895a266e971a3e241d34aea79bf7f
- SSDEEP 1536:df/SovFSSZtDgN+DpDkDEFtCw0YF8965L+vpCYC:J/zv0SZtDgN+Dp+Er0YF896WpTC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mackt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960_TDS=4F8DFBBF.exe
- IMPHASH e577ea67c41f48f5c38c1fb02995e080
- SHA256 73c3d88d0d9d1c73080bcdda423879ce9eff3aa1f26cc93d120f596091825960
- MD5 c8718e623098dcd075971792b2ad6619
- SHA1 f19bb89439511145dfa3c8dea07cec8fd54e55a5
- SHA512 621c853f0401943801adc42df553c34a037b86a59cfc95dc8fabc1ccba0aba5f1b5351df7a69361a6a9b9fd701de0dc58609c536321a38f860116e97b4dafb6c
- SSDEEP 1536:0rI14DGk52j9yF8b3jNxm26eebgz849X:0+k6937m26e9zhR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCommandLineW
GetStdHandle
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupGetLineCountA
msvcrt
_adjust_fdiv
memcpy
_exit
_XcptFilter
exit
_onexit
__getmainargs
_initterm
__setusermatherr
_acmdln
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
810B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=25, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
74add6536cdcfb8b77d10a1e7be6b9ef.exe
- IMPHASH 465d61b1230d37021733c5abb510050a
- SHA256 f5ab764c439a45ed892a3346f228d36f24d7f2377d4cddc5e82a0566f8521082
- MD5 74add6536cdcfb8b77d10a1e7be6b9ef
- SHA1 b35c295f625ce4203f70106d33ecdfb39be3537b
- SHA512 91c1f048b39bb620e498342a259b8edfdf0655c674870104d5d335d49598aed93b54e1793b80a0b5a3f203c493e07f72601f5174925021c94dee7d9afb78b1d6
- SSDEEP 6144:t9Kx9J/srIEV00YdR29lGx/adfteNtUlnNCc2HLN:+R29l2QfFfJ2H
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
38758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
I:\wisdom\impractical\debate\Count.pdb
kernel32
RtlUnwind
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RaiseException
InitializeCriticalSectionAndSpinCount
CloseHandle
CreateFileA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
WriteFile
SetFilePointer
SetStdHandle
LocalFree
GetModuleHandleA
GetConsoleCP
FindNextFileA
LockResource
LocalAlloc
LoadLibraryA
FindClose
RemoveDirectoryA
WriteConsoleA
GetLastError
FindFirstFileA
GetFileAttributesA
CreateEventA
SizeofResource
Sleep
HeapReAlloc
VirtualAlloc
DeleteCriticalSection
VirtualFree
HeapCreate
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
CreateIoCompletionPort
FlushFileBuffers
GetCommandLineA
ExitProcess
GetModuleHandleW
OpenProcess
WaitForSingleObject
GetQueuedCompletionStatus
GetNumberOfConsoleInputEvents
PeekConsoleInputA
GetConsoleMode
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetConsoleOutputCP
WriteConsoleW
HeapSize
GetProcAddress
MultiByteToWideChar
HeapAlloc
LoadResource
FreeLibrary
lstrlenA
FindResourceA
user32
GetSystemMetrics
PtInRect
UpdateWindow
CallWindowProcA
FindWindowA
SetWindowTextA
GetWindowTextA
GetKeyboardLayout
LoadCursorA
DrawFrameControl
CopyRect
RegisterClassA
SystemParametersInfoA
SetMenu
LoadAcceleratorsA
GetCursorPos
SetWindowPos
DefWindowProcA
EndDialog
GetDlgItem
GetWindowLongA
GetAncestor
InvalidateRect
MessageBoxA
MapWindowPoints
EnumWindows
SetTimer
ScreenToClient
GetWindowRect
PostQuitMessage
SetCapture
KillTimer
DrawTextA
LoadStringA
GetWindowInfo
GetClientRect
CreateMenu
SetFocus
SendMessageA
SetWindowLongA
gdi32
SetDIBitsToDevice
SetTextColor
DeleteDC
CreateFontIndirectA
SetBkColor
CreateBitmap
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SaveDC
ExtTextOutA
RestoreDC
CreateSolidBrush
advapi32
ConvertSidToStringSidA
CreateWellKnownSid
GetTraceEnableLevel
shell32
ExtractAssociatedIconExA
ole32
OleInitialize
OleUninitialize
CoCreateGuid
CoGetClassObject
StringFromGUID2
CoRegisterClassObject
CreateFileMoniker
BindMoniker
CLSIDFromProgID
CoInitializeEx
CoUninitialize
oleaut32
OleTranslateColor
SysAllocStringByteLen
SysFreeString
psapi
GetModuleFileNameExA
EnumProcessModules
msimg32
GradientFill
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
iphlpapi
NotifyAddrChange
shlwapi
StrChrA
StrToIntExA
comctl32
ImageList_BeginDrag
ord17
secur32
InitSecurityInterfaceA
imm32
ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
setupapi
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
wsnmp32
ord120
authz
AuthzFreeContext
AuthzInitializeResourceManager
AuthzFreeResourceManager
AuthzInitializeContextFromSid
wlanapi
WlanEnumInterfaces
WlanOpenHandle
Name
.text
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
632KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=150, version=20413,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=50, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=41, id=123, productName=VS2005 build 50727, version=50727,
count=213, id=1, productName=Unmarked objects,
count=1, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
757a661bcc68616f99366b10abac92d8.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f1ba18a6b67c5e1c659b3cbab2b12abb416dd62087cc9870650c0d8c73047739
- MD5 757a661bcc68616f99366b10abac92d8
- SHA1 9a7173aa6b51643417ce37f8b1238de4dd45b516
- SHA512 c6d55af7d3fd3740e5b86aadcfaa463b564458f914bb2140bb2f971e632195d2ca84991f1f694c4cfbb1b6d8156b0ce0413e5c8afb874531eb1ad34b37e36843
- SSDEEP 6144:4CzaYkhfMMTzhpWuaEU5rXQokUERHxtYXwNg:jtcfMShwuaKoCRHQe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
239446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Liridon\source\repos\Foxy - Rnsmwre\Foxy - Rnsmwre\obj\Debug\Foxy - Rnsmwre.pdb
mscoree
_CorExeMain
Name
.text
Size
226KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ