Batch_9.zip
- SHA256 c96b41fac848211321861fcf957e5f475a950c56f9024f792e5c9584f1fbd3ef
Overview
overview
10Static
static
10IQHGV07FDy...2).exe
windows7-x64
3IQHGV07FDy...vn.exe
windows7-x64
3Junk)2345.eml.ViR.eml
windows7-x64
5PC Cleaner.exe
windows7-x64
10PC_cleaner...ed.exe
windows7-x64
3PC_cleaner...ed.exe
windows7-x64
3Pizzacrypts.exe
windows7-x64
9Ponmsiyyks.exe
windows7-x64
3Rlesvxamve...on.exe
windows7-x64
SATURN_RANSOM.exe
windows7-x64
10ScreenCapt...er.exe
windows7-x64
1license key.exe
windows7-x64
malware.exe
windows7-x64
8mamba_141.exe_.exe
windows7-x64
1mamba_152.exe_.exe
windows7-x64
5microsoft-cleaned.exe
windows7-x64
3msiexec.exe
windows7-x64
10nc.exe
windows7-x64
1nd2vj1ux.exe
windows7-x64
notes.exe
windows7-x64
nzpuHohZGP...2).exe
windows7-x64
3nzpuHohZGP...sr.exe
windows7-x64
3old_14b68c...0d.exe
windows7-x64
7patched.exe
windows7-x64
9pclock.exe
windows7-x64
7pclock_unpack.exe
windows7-x64
7pitupi20.exe
windows7-x64
10pozhehgxml...co.exe
windows7-x64
7ransom_50....0b.scr
windows7-x64
9ransomware...20.exe
windows7-x64
9safeinf.exe
windows7-x64
7schet1074....16.rtf
windows7-x64
10Behavioral task
behavioral1
Sample
IQHGV07FDyQ5u7bmNAvn (2).exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
IQHGV07FDyQ5u7bmNAvn.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
Junk)2345.eml.ViR.eml
Resource
win7-20241010-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral4
Sample
PC Cleaner.exe
Resource
win7-20241010-en
windows7-x64
21 signatures
300 seconds
Behavioral task
behavioral5
Sample
PC_cleaner-cleaned.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
PC_cleaner_database-cleaned.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral7
Sample
Pizzacrypts.exe
Resource
win7-20241023-en
windows7-x64
17 signatures
300 seconds
Behavioral task
behavioral8
Sample
Ponmsiyyks.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral9
Sample
Rlesvxamvenagx @ZL@0ECpw@ZL@ .xml.zyklon.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
SATURN_RANSOM.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
300 seconds
Behavioral task
behavioral11
Sample
ScreenCapture_Win8.MalwareScanner.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
license key.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral13
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
mamba_141.exe_.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
mamba_152.exe_.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral16
Sample
microsoft-cleaned.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral17
Sample
msiexec.exe
Resource
win7-20240708-en
windows7-x64
21 signatures
300 seconds
Behavioral task
behavioral18
Sample
nc.exe
Resource
win7-20241023-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
nd2vj1ux.exe
Resource
win7-20240729-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
notes.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
nzpuHohZGP2RNfMTp0sr (2).exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral22
Sample
nzpuHohZGP2RNfMTp0sr.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral23
Sample
old_14b68cb9f911ce937f52ed8282ef4395f2291c0a23f14d33f731a15572834b0d.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral24
Sample
patched.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
pclock.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
pclock_unpack.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral27
Sample
pitupi20.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
300 seconds
Behavioral task
behavioral28
Sample
pozhehgxmlhobpvwlqco.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral29
Sample
ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr
Resource
win7-20240903-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral30
Sample
ransomware1061911a3e0a74827a76bbd7bfe16d20.exe
Resource
win7-20240729-en
windows7-x64
14 signatures
300 seconds
Behavioral task
behavioral31
Sample
safeinf.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral32
Sample
schet1074.15.03.16.rtf
Resource
win7-20240903-en
windows7-x64
14 signatures
300 seconds
General
- Target Batch_9.zip
- Size 11.5MB
- Sample241122-d54ddstney
- SHA256 c96b41fac848211321861fcf957e5f475a950c56f9024f792e5c9584f1fbd3ef
- MD5 c60d2e47faa0dce0efdb839dd8f092d7
- SHA1 8597f45bdefbd589345c6f07c3270c4a24030086
- SHA512 f77ec83e1c9d97fbf6da9baa32c8d96438b70fcce47d1ae135f343a0e9336f953ebfcf27719e4231390731d700aac102df227ed0ecb6897f83e78a34c52c1254
- SSDEEP 196608:C2VvBgChLxQ08twUkBN0EZ28h85oU+1ZeR43uBPEy6FvhGNK2gMXRzBoiJdbqWC:C2R2uLz8tFkZ4qNZvmPSFn2gMzo+dW3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detected Xorist Ransomware 1 IoCs
resource yara_rule static1/unpack001/patched.exe family_xorist - Xorist family
-
resource yara_rule static1/unpack001/ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr upx - Unsigned PE 30 IoCs
Checks for missing Authenticode signature.
resource unpack001/IQHGV07FDyQ5u7bmNAvn (2).exe unpack001/IQHGV07FDyQ5u7bmNAvn.exe unpack001/PC Cleaner.exe unpack001/PC_cleaner-cleaned.exe unpack001/PC_cleaner_database-cleaned.exe unpack001/Pizzacrypts.exe unpack001/Ponmsiyyks.exe unpack001/SATURN_RANSOM.exe unpack001/ScreenCapture_Win8.MalwareScanner.exe unpack001/license key.exe unpack001/malware.exe unpack001/mamba_141.exe_.exe unpack001/mamba_152.exe_.exe unpack001/microsoft-cleaned.exe unpack001/msiexec.exe unpack001/nc.exe unpack001/nzpuHohZGP2RNfMTp0sr (2).exe unpack001/nzpuHohZGP2RNfMTp0sr.exe unpack001/old_14b68cb9f911ce937f52ed8282ef4395f2291c0a23f14d33f731a15572834b0d.exe unpack001/patched.exe unpack001/pclock.exe unpack001/pclock_unpack.exe unpack001/pitupi20.exe unpack001/pozhehgxmlhobpvwlqco.exe unpack001/ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr unpack003/out.upx unpack001/ransomware1061911a3e0a74827a76bbd7bfe16d20.exe unpack004/$PLUGINSDIR/System.dll unpack004/profitability.dll unpack001/safeinf.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/ransomware1061911a3e0a74827a76bbd7bfe16d20.exe nsis_installer_1 static1/unpack001/ransomware1061911a3e0a74827a76bbd7bfe16d20.exe nsis_installer_2
File Explorer
-
Batch_9.zip.zip 11.5MB
-
IQHGV07FDyQ5u7bmNAvn (2).exe.exe 357KB
-
IQHGV07FDyQ5u7bmNAvn.exe.exe 357KB
-
Junk)2345.eml.ViR.exe.eml 9KB
-
email-html-1.txt.html 544B
-
PC Cleaner.exe.exe 4.4MB
-
PC_cleaner-cleaned.exe.exe 337KB
-
PC_cleaner_database-cleaned.exe.exe 20KB
-
Pizzacrypts.exe.exe 168KB
-
Ponmsiyyks.exe.exe 9.5MB
-
Rlesvxamvenagx @ZL@0ECpw@ZL@ .xml.zyklon.exe99KB
-
SATURN_RANSOM.exe.exe 338KB
-
ScreenCapture_Win8.MalwareScanner.exe.exe 137KB
-
license key.exe.exe 270KB
-
malware.exe.exe 53KB
-
mamba_141.exe_.exe.exe 2.3MB
-
mamba_152.exe_.exe.exe 2.3MB
-
microsoft-cleaned.exe.exe 337KB
-
msiexec.exe.exe 401KB
-
nc.exe.exe 60KB
-
nd2vj1ux.exe140KB
-
notes.exe1KB
-
nzpuHohZGP2RNfMTp0sr (2).exe.exe 357KB
-
nzpuHohZGP2RNfMTp0sr.exe.exe 357KB
-
old_14b68cb9f911ce937f52ed8282ef4395f2291c0a23f14d33f731a15572834b0d.exe.exe 84KB
-
patched.exe.exe 1.3MB
-
pclock.exe.exe 239KB
-
pclock_unpack.exe.exe 419KB
-
pitupi20.exe.exe 152KB
-
pozhehgxmlhobpvwlqco.exe.exe 56KB
-
ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr.exe 621KB
-
out.upx.exe 2.3MB
-
ransomware1061911a3e0a74827a76bbd7bfe16d20.exe.exe 195KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Bhajan.x100KB
-
profitability.dll.dll 96KB
-
safeinf.dll.exe 702KB
-
schet1074.15.03.16.doc.rtf .doc 1.1MB
IQHGV07FDyQ5u7bmNAvn (2).exe
- IMPHASH d409d04619f830ed4fb4696d607103fa
- SHA256 48aa0a8be374691641742a5d81503f127e9dfdc6bbb717bb1c8479a0071486d0
- MD5 d6ed4d4e8b1a95a224ebdd54529b3751
- SHA1 f666205d580c570abc988038e3412df736e57c37
- SHA512 c579d2ec924a4136b3e7d19df6afcc509835e277facfcf693e5688d8ec3882944ca78b0b39edd808d43de19c81fd147f28936796560f9950f7fdbda4f07f65c2
- SSDEEP 6144:v+dE6vqOE9Z8LapTWgK/W9uAExjAhQiM5bQCdf/ORqz9BLp5hjoH2EZ:v+vvbGlpoAExjAYbQCdf/ORqZBdfjoHJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
190296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Dev\Final\Release\main.pdb
ws2_32
ioctlsocket
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
kernel32
GetModuleHandleA
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
WriteFile
CreateFileW
CloseHandle
Sleep
DeleteFileW
FindFirstFileW
GetDriveTypeW
GetLogicalDriveStringsW
lstrlenW
GetTempPathW
FindClose
FindNextFileW
GetVolumeInformationW
SetFilePointer
ReadFile
MoveFileW
GetFileSize
GetFileType
SystemTimeToFileTime
CreateDirectoryW
GetUserDefaultLCID
WideCharToMultiByte
GetFileAttributesW
MultiByteToWideChar
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetModuleHandleW
GetVersionExW
GetProcAddress
GetSystemInfo
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
GetTickCount
SleepEx
VerifyVersionInfoA
VerSetConditionMask
WaitForSingleObject
FormatMessageA
ExpandEnvironmentStringsA
GetModuleFileNameW
GetCurrentDirectoryA
GetFullPathNameA
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
GetProcessHeap
GetTimeZoneInformation
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
SetFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleFileNameA
GetStringTypeA
HeapSize
FlushFileBuffers
VirtualAlloc
VirtualFree
HeapCreate
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetSystemTimeAsFileTime
ExitProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
HeapAlloc
GetStartupInfoW
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsW
user32
MessageBoxW
wsprintfW
GetSystemMetrics
advapi32
CryptGenKey
CryptGetHashParam
CryptAcquireContextA
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CryptExportKey
shell32
ShellExecuteW
SHGetFolderPathW
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
shlwapi
PathFindExtensionW
StrCmpIW
PathAppendW
StrCpyW
Name
.text
Size
283KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=150, version=20413,
count=28, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=74, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=175, id=1, productName=Unmarked objects,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=233, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
IQHGV07FDyQ5u7bmNAvn.exe
- IMPHASH d409d04619f830ed4fb4696d607103fa
- SHA256 48aa0a8be374691641742a5d81503f127e9dfdc6bbb717bb1c8479a0071486d0
- MD5 d6ed4d4e8b1a95a224ebdd54529b3751
- SHA1 f666205d580c570abc988038e3412df736e57c37
- SHA512 c579d2ec924a4136b3e7d19df6afcc509835e277facfcf693e5688d8ec3882944ca78b0b39edd808d43de19c81fd147f28936796560f9950f7fdbda4f07f65c2
- SSDEEP 6144:v+dE6vqOE9Z8LapTWgK/W9uAExjAhQiM5bQCdf/ORqz9BLp5hjoH2EZ:v+vvbGlpoAExjAYbQCdf/ORqZBdfjoHJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
190296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Dev\Final\Release\main.pdb
ws2_32
ioctlsocket
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
kernel32
GetModuleHandleA
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
WriteFile
CreateFileW
CloseHandle
Sleep
DeleteFileW
FindFirstFileW
GetDriveTypeW
GetLogicalDriveStringsW
lstrlenW
GetTempPathW
FindClose
FindNextFileW
GetVolumeInformationW
SetFilePointer
ReadFile
MoveFileW
GetFileSize
GetFileType
SystemTimeToFileTime
CreateDirectoryW
GetUserDefaultLCID
WideCharToMultiByte
GetFileAttributesW
MultiByteToWideChar
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetModuleHandleW
GetVersionExW
GetProcAddress
GetSystemInfo
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
GetTickCount
SleepEx
VerifyVersionInfoA
VerSetConditionMask
WaitForSingleObject
FormatMessageA
ExpandEnvironmentStringsA
GetModuleFileNameW
GetCurrentDirectoryA
GetFullPathNameA
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
GetProcessHeap
GetTimeZoneInformation
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
SetFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleFileNameA
GetStringTypeA
HeapSize
FlushFileBuffers
VirtualAlloc
VirtualFree
HeapCreate
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetSystemTimeAsFileTime
ExitProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
HeapAlloc
GetStartupInfoW
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsW
user32
MessageBoxW
wsprintfW
GetSystemMetrics
advapi32
CryptGenKey
CryptGetHashParam
CryptAcquireContextA
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CryptExportKey
shell32
ShellExecuteW
SHGetFolderPathW
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
shlwapi
PathFindExtensionW
StrCmpIW
PathAppendW
StrCpyW
Name
.text
Size
283KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=150, version=20413,
count=28, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=74, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=175, id=1, productName=Unmarked objects,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=233, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Junk)2345.eml.ViR.exe
- SHA256 df8b9e5d4104604e0fa339e6ff704e2957e2dc20d90c111010e67586317337aa
- MD5 d39269e7eb92b9de0fc78ba1363af37a
- SHA1 6b2f6d755d577f4170c018879449d6a78885aa93
- SHA512 e1c29e37b4fedd309eebd105967dc3f6249e31fe01d43bc349def02f52aa7d573ad98c30f4ce3ae2754e10d64f03607da90e388e7efefc66478c84408cb7b78b
- SSDEEP 192:zBurpqEcJLiCa4Z5CNvTBtPHfkdOiyDma82AZJfN4rcc7POQuE:FclV4iZN+xyDma8BKo+POQuE
- MD5 SHA1 SHA512 SSDEEP
Extracted URLs
-
file http://meyaau.com/5C53687F7327933R.zip
email-html-1.txt
- SHA256 14a6efbddeffe9a54fd6222367bce084d7f693e0d361d9a68fadfe66f629caa1
- MD5 c632afacfb7a163c92a53dba4ed749dd
- SHA1 1df2eabe0159c857935b3c9699389c4741c168c8
- SHA512 56ae1cf71bf55e55d7c81024b3f9798bab9b22adf5a2673d250e08f3a38cf049a716b18ba818e19d8363165deb6441f21c2e3e129748230d28800ee80ccc5057
- MD5 SHA1 SHA512
PC Cleaner.exe
- IMPHASH 0f7d0ed8477bf9ca9b4b2ce07e02a90e
- SHA256 b46940adcfefac96db737aa663f44e31e071fb7bffc757f98d811c2d82f1d3b8
- MD5 16a63ddd49552199b3a92b5fe88f804f
- SHA1 bb5b1bcecfc8737b3397bc8442a4e483b1df5951
- SHA512 8ebf6a3ba7c866328ffd8fbd85d1a4946f806cd4a65540e0db389f7f6dadf0666ec8c7980455934234d469c2d8aaf7da7d630bd98640323f717722b62f6176cd
- SSDEEP 98304:ywCDueZbuJtHA0QUCb7Yv8b8SIXtiogjiAuC475j:KueA7ZQ9Yv8jdWAS75j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8020
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\Develope\msi2exe\release\msi2exestub.pdb
kernel32
GetTempPathW
GetTempFileNameW
FindResourceW
SizeofResource
LoadResource
LockResource
CreateThread
CreateFileW
DeleteFileW
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ExitProcess
CreateProcessW
GetLastError
WriteFile
FlushFileBuffers
CloseHandle
GetProcAddress
GetModuleHandleA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
RtlUnwind
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
SetStdHandle
RaiseException
user32
DefWindowProcW
PostQuitMessage
EndPaint
BeginPaint
UpdateWindow
ShowWindow
CreateWindowExW
GetSystemMetrics
RegisterClassExW
GetSysColorBrush
LoadCursorW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
MessageBoxW
InvalidateRect
gdi32
TextOutW
SetBkMode
SelectObject
GetStockObject
DeleteObject
Name
.text
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=125, productName=VS2005 build 50727, version=50727,
count=44, id=110, productName=VS2005 build 50727, version=50727,
count=104, id=109, productName=VS2005 build 50727, version=50727,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=121, id=1, productName=Unmarked objects,
count=2, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
PC_cleaner-cleaned.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7de4bf9af4e80cf93c1058ebae1fadf69c9a271a44338888b7388744205e3725
- MD5 680acfbb639b80db6ed99f46a705656e
- SHA1 6bfbd09899ef0a153fe3f82587458c29615ddce9
- SHA512 c66b5eac487482724b65518aa22020cd430e62b7555a0a5458849bd912209fd071c47e4116d9bd6ec47e2dcad762183e1d7abb6d2ef27e95c508f8e1315815bc
- SSDEEP 6144:o+WROxZQFpFXvGp4F3qd75zSCIHpj3el71nVNi9IY2enhzSs75/Krbgx02r:o+MI+FXt3qPOCIH8l7ZHyIXepSoab
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
350654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
334KB
Virtual Size
334KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PC_cleaner_database-cleaned.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3d494740cdd42d9c0a4feb3bea6e3cbc2e05affe412feab469eeebc8853332b1
- MD5 2be874c130324b7641031dbe2d27424e
- SHA1 b439928a15a34ca3105965c8a046c2e32223fb4e
- SHA512 217f9cac04e12771f28fe68348bb30bc2d0fdf6640ca6d6e46cb3935b80bed479599313ed636f83457be16b1e62a39d64b7685fc9358369f958268c096b25f0a
- SSDEEP 384:dz1fNkvwKwq6uS9vwEG9/XwJwq6uJfq2GSLwqvOeuHisc4+ifzGml8nEJmjx:dz82GreuHs46EJmjx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Pizzacrypts.exe
- IMPHASH 1e0d5509ae3c2c05c7a22edca2c2a094
- SHA256 d6818864dc9e10b15c88aca4d1e8fd971eff43572beba3001fd6c96028afd9f3
- MD5 00f57ac8b384f7d21eeade87446659fd
- SHA1 ee0204b4cda5cee612b2f62345e0bab6b125c1c4
- SHA512 f20f0049a941f7d4d7b643980a11966daed9b4a3f6b961824da7619321a62b3bc70b19955c1ccea4eb3de0641aef8a8a76679bb280d419b65b0dfa7698c5d4b6
- SSDEEP 3072:3rw+G6t3JFCGHMszzDLfnxGwbg2/kfkN8LCo59e559c:3c635sszzDrxIc2xK9c
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
59324
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mfc42u
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4621
ord4419
ord3592
ord324
ord641
ord4229
ord825
ord5806
ord5477
ord2023
ord4857
ord5792
ord5474
ord1963
ord966
ord3565
ord278
ord605
ord4329
ord4405
ord4441
ord4969
ord4913
ord800
ord861
ord540
ord2289
ord2355
ord2350
ord2281
ord2362
ord2634
ord3087
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3076
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord4418
ord3733
ord815
ord561
ord818
ord801
ord3658
ord5446
ord6390
ord823
ord5436
ord6379
ord6051
ord1768
ord5286
ord3737
ord541
ord567
ord4270
ord755
ord640
ord323
ord470
ord613
ord4128
ord4292
ord5790
ord289
ord860
ord6139
ord1165
ord3566
ord3621
ord2406
ord1634
ord1143
ord1633
ord5781
ord2859
ord2371
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4704
ord4992
ord4847
ord4370
ord3341
ord5261
ord1569
msvcrt
_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
__CxxFrameHandler
memcpy
memset
srand
time
_ftol
rand
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
kernel32
GetStringTypeA
TerminateProcess
GetCPInfo
GetModuleHandleW
GetStartupInfoW
GetEnvironmentStringsW
CreateFileA
GetCurrentThread
GetTimeZoneInformation
SetCommTimeouts
WriteFile
GetCurrentProcess
CreateFileW
GetModuleFileNameW
GlobalReAlloc
GlobalUnlock
GlobalAlloc
GlobalLock
WideCharToMultiByte
SetEndOfFile
UnhandledExceptionFilter
user32
InvalidateRect
SetCapture
SendMessageW
LoadBitmapW
SetRect
SetWindowLongW
GetWindowTextLengthW
GetClipboardData
CheckRadioButton
GetDlgItemTextW
GetDlgItem
GetCursorPos
GetScrollInfo
DialogBoxParamA
PtInRect
GetWindowRect
PostQuitMessage
LoadCursorW
SetCursor
AppendMenuW
IsDialogMessageA
ReleaseCapture
GetWindowTextW
SetClipboardData
RegisterWindowMessageW
CreateMenu
GetWindowLongA
CloseClipboard
EnableWindow
LoadIconW
gdi32
ExtCreateRegion
CombineRgn
DeleteDC
GetObjectW
CreateCompatibleDC
SelectObject
BitBlt
SetBkColor
SetMapMode
UnrealizeObject
DeleteObject
CreateDIBSection
advapi32
RegOpenKeyA
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=8, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=14, version=7299,
count=2, id=11, version=8047,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=4, version=9782,
count=225, id=1, productName=Unmarked objects,
count=7, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Ponmsiyyks.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b05e06ab6e885de6f8646d6b9ffc8cc4aa8f285e656fd0738bb7cffb5c9d4f21
- MD5 8df08dd868e16f24b01fe06719040cb2
- SHA1 f730c013121eab0c6157081aa8bd972389a87cbb
- SHA512 b15963c22d9e7cbbbf2b7645b576cdecd65357a3525fa5d73a80aaadc2d08c2d578786085db8517819366242263222337bf28f9fd601678a5266d90f899bee7b
- SSDEEP 768:wlT8pkJ1B5DfzDnGFEitHVLTn2RziX61Ba2T+xX5X07w:PKJpzDGOi/n2RziqQxB07
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Rlesvxamvenagx @ZL@0ECpw@ZL@ .xml.zyklon.exe
- SHA256 705eb586d4296b742dfb239d508894876c207806c2f126eafec206d2d0cd3e8c
- MD5 60ac1eac655bbb1277f5736b3061a16c
- SHA1 81521ea473ca90c738549c6c4d8679232bdbfbbf
- SHA512 b10800b1592b0e661d68b0f8bebb8ff785238057e4435057e0d3ffdc0ab5e2d3f5903ec77fed2f77f2b8733e68d7aa420e43947cef7a4c54de43ba327d6fd95e
- SSDEEP 3072:3/W57FHi5lAim2UwRqZQeJWn7bBj8PGn418v7MSit31:3/Wzi5O2UC+kRj8PwMA7Tit31
- MD5 SHA1 SHA512 SSDEEP
SATURN_RANSOM.exe
- IMPHASH fc7c70bdf521087654ea0c66669225c6
- SHA256 9e87f069de22ceac029a4ac56e6305d2df54227e6b0f0b3ecad52a01fbade021
- MD5 bbd4c2d2c72648c8f871b36261be23fd
- SHA1 77c525e6b8a5760823ad6036e60b3fa244db8e42
- SHA512 38f2ff3b7ff6faa63ef0a3200e0dbb9e48e1d404a065f6919cb6d245699479896a42316f299c33c8cc068922934c64f8aa06c88b000d1676870c1d0c0f18e14a
- SSDEEP 6144:zUrigyvF8Q9fLglQ8t0qabFDfOdQ/LDA8H+wwaMZUUAOq+mwNf8fsS+:zUrigY8QBLg9t0qabFDGdQ/TlYiUQ+Vz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
86460
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapFree
GetCurrentProcess
InitializeCriticalSectionEx
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
HeapSize
DeleteFileA
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetComputerNameA
CreateProcessA
IsDebuggerPresent
CheckRemoteDebuggerPresent
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableA
GetLogicalDriveStringsA
SetFileAttributesA
MoveFileExA
lstrlenA
GetDriveTypeA
MoveFileA
GetModuleFileNameA
FindClose
FindNextFileA
FindFirstFileA
GetFileSize
CreateFileA
GetLastError
MultiByteToWideChar
WriteFile
lstrlenW
ReadFile
LocalFree
CloseHandle
GetFileAttributesA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
GetModuleHandleA
LocalAlloc
GetProcessHeap
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
OutputDebugStringW
RtlUnwind
FreeLibrary
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetACP
SetStdHandle
GetConsoleCP
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetCurrentDirectoryW
GetFullPathNameW
SetFilePointerEx
GetTimeZoneInformation
FindFirstFileExW
SetEndOfFile
user32
SystemParametersInfoA
advapi32
CryptDestroyKey
RegQueryValueExA
RegCloseKey
CryptReleaseContext
BuildExplicitAccessWithNameA
SetEntriesInAclA
RegCreateKeyExA
OpenProcessToken
SetSecurityInfo
GetTokenInformation
CryptGenRandom
RegOpenKeyExA
CryptAcquireContextA
CryptAcquireContextW
CryptEncrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
shell32
SHGetSpecialFolderPathA
ShellExecuteExA
ShellExecuteA
ole32
CoCreateInstance
CoInitialize
crypt32
CryptStringToBinaryA
CryptImportPublicKeyInfo
CryptDecodeObjectEx
Name
.text
Size
207KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
46KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=25203,
count=171, id=261, version=25203,
count=22, id=260, version=25203,
count=22, id=259, version=25305,
count=65, id=261, version=25305,
count=35, id=260, version=25305,
count=3, id=262, version=25203,
count=13, id=257, version=25203,
count=161, id=1, productName=Unmarked objects,
count=9, id=265, version=25547,
count=1, id=255, productName=VS2017 v15.4.5 build 25547, version=25547,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.4.5 build 25547, version=25547,
ScreenCapture_Win8.MalwareScanner.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f9d9b397488e1bf5c37320a4bccd015fa48495fa15f5c5ce14cb65366cc2526a
- MD5 58ad3b1793bbdeee20b4a0415c9fd56a
- SHA1 0c610f13fcd706d544c1ca8cf5d120a690ab6d1b
- SHA512 4dec95018add51d5826c99521bc08cc4c0bb485499e1f6d5fc294d4928b024d020b581ddbcd1ffb9458639d32760b743860b94f788dc9ae18af1e4cec2d0aac3
- SSDEEP 3072:ZkScxQ+r7+OXo5WYD99HMig0e03PTrPgsEDte56AhbXM:ZkScxt2O4Ycg3MPTrPdSeRhT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
145726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\COETECH\GLTS\MalwareScanner\obj\Release\MalwareScanner.pdb
mscoree
_CorExeMain
Name
.text
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
license key.exe
- SHA256 c57040c2af2735aed3f84dbe838f6e142ad80631f50811c0b265bf0a5e3af91d
- MD5 dff38f5dfdeff1e73debef355c4ac13e
- SHA1 d9d8fbbde16aee63d22805d3a573de65f7486ef8
- SHA512 6a7970027a7259fb244e4d79bbbfaeb3041508e25b24a40d1c6bef497ad412a6086463f343e84d9b6b32043f8752f99165aa56e5ca15a87a5c16cb04c549de94
- SSDEEP 3072:1KJZx3+tGqTsnACpvmEhgwqvJ+Bsl94FnUDhcYprbAMc:1KrxiyLvmWVXGl6VYpgMc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
105316
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
malware.exe
- IMPHASH 79fd079e9d3e0619831be2cf92afa94a
- SHA256 e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4
- MD5 87ccd6f4ec0e6b706d65550f90b0e3c7
- SHA1 213e6624bff6064c016b9cdc15d5365823c01f5f
- SHA512 a72403d462e2e2e181dbdabfcc02889f001387943571391befed491aaecba830b0869bdd4d82bca137bd4061bbbfb692871b1b4622c4a7d9f16792c60999c990
- SSDEEP 768:4yKoNLsn4Jp9ZvRInygrpMoZN+WtOl08jxBEHCDwBLpZTPCUvQK:j/sn4/OycxZN+MKxp8t9zQK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14279
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
TranslateMessage
ShowWindow
SetWindowTextA
SetWindowPos
SetTimer
SetForegroundWindow
SetCursorPos
SetClipboardData
SendNotifyMessageA
SendMessageTimeoutA
SendMessageA
RegisterWindowMessageA
RegisterClassExA
PostQuitMessage
OpenClipboard
MoveWindow
ModifyMenuA
MessageBoxA
MapWindowPoints
LoadIconA
LoadCursorA
LoadBitmapA
UpdateWindow
IsZoomed
IsWindowVisible
IsWindowEnabled
IsWindow
IsIconic
InsertMenuItemA
GetWindowThreadProcessId
GetWindowTextLengthA
GetWindowTextA
GetWindowRect
GetWindow
GetSystemMenu
GetSubMenu
GetParent
GetMessageA
GetMenuStringA
GetMenuItemID
GetMenuItemCount
GetMenu
GetForegroundWindow
GetDesktopWindow
GetCursorPos
keybd_event
mouse_event
KillTimer
GetClipboardData
GetClientRect
GetClassNameA
GetAsyncKeyState
EnumWindows
EnumChildWindows
EnableWindow
EnableMenuItem
EmptyClipboard
DrawMenuBar
DispatchMessageA
DefWindowProcA
CreateWindowExA
CloseClipboard
wsprintfA
kernel32
lstrlenA
lstrcpynA
lstrcpyA
lstrcmpA
lstrcatA
WriteProcessMemory
WriteFile
WaitForSingleObject
VirtualProtectEx
VirtualFree
VirtualAlloc
TerminateThread
TerminateProcess
SystemTimeToFileTime
Sleep
SetPriorityClass
SetLocalTime
SetFileTime
SetFilePointer
SetFileAttributesA
SetEndOfFile
SetCurrentDirectoryA
RtlMoveMemory
ResumeThread
RemoveDirectoryA
ReadProcessMemory
ReadFile
OpenProcess
MoveFileA
LocalFileTimeToFileTime
LoadLibraryA
InterlockedIncrement
GlobalUnlock
GlobalLock
GlobalAlloc
GetWindowsDirectoryA
GetVersionExA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocalTime
GetLastError
GetFileTime
GetFileSize
GetFileAttributesA
GetExitCodeProcess
GetCurrentProcess
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateMutexA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
GetCurrentDirectoryA
FindClose
FindFirstFileA
FindNextFileA
GetCommandLineA
FileTimeToSystemTime
shell32
ShellExecuteExA
DragQueryFileA
DragFinish
gdi32
DeleteObject
advapi32
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
winmm
timeSetEvent
timeKillEvent
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=42, version=8803,
count=160, id=19, version=8078,
count=1, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=69, productName=VS2002 (.NET) build 9466, version=9466,
mamba_141.exe_.exe
- IMPHASH dd8fd079a980cb9227eb869f7da9b258
- SHA256 0fa05cbe58b253b09afbb79be27953ddfd36852d0a5fb5010dfb419d7705abb5
- MD5 e0358edb797489ffc585e8f517b30f1c
- SHA1 719c3b897826169190ffcaf8ec111e78acd1613e
- SHA512 0aae9d35e8d2248a50c2282fde0c3a8d2d76327b31bf046d64e89eb1b473f18952831e40ba58dbef24dda5fff4d89db806fd6c14c260c777f528f6311891241e
- SSDEEP 49152:XM16E7qQoM5NWX7DP+1egOhcraQzG6j97V:c16//M5oW1ZrRz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33303
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathFileExistsW
PathFileExistsA
kernel32
Sleep
SizeofResource
GetConsoleWindow
GetVersionExW
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
GetProcAddress
GetSystemDirectoryW
CreateEventW
GetModuleFileNameA
GetModuleHandleA
CloseHandle
CreateThread
CreateProcessA
GetExitCodeProcess
WriteConsoleW
WriteFile
GetModuleHandleW
SetEvent
WaitForSingleObject
CreateDirectoryW
GetCurrentProcess
LoadResource
FindResourceW
GetNativeSystemInfo
GetCommandLineW
GetFileAttributesExW
SetEnvironmentVariableA
LockResource
GetModuleHandleExW
SetStdHandle
ReadConsoleW
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WideCharToMultiByte
GetStringTypeW
HeapFree
HeapAlloc
ExitProcess
SetEndOfFile
AreFileApisANSI
GetCommandLineA
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
GetStdHandle
GetFileType
GetProcessHeap
ReadFile
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
HeapReAlloc
OutputDebugStringW
user32
ExitWindowsEx
ShowWindow
advapi32
RegisterServiceCtrlHandlerW
RevertToSelf
SetServiceStatus
ImpersonateLoggedOnUser
ChangeServiceConfig2W
LookupPrivilegeValueW
CreateProcessAsUserW
LogonUserW
StartServiceCtrlDispatcherW
OpenSCManagerW
OpenProcessToken
CreateServiceW
AdjustTokenPrivileges
shell32
ShellExecuteW
ShellExecuteA
Name
.text
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=205, version=50929,
count=69, id=207, version=50929,
count=211, id=206, version=50929,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=121, id=1, productName=Unmarked objects,
count=1, id=211, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
mamba_152.exe_.exe
- IMPHASH 19b579508944735949a06ee438c121ae
- SHA256 74336da7eb463092a5f1bca3071f96b005f52e6df5826f8b0351e10537ba0459
- MD5 a50325553a761d73ed765e326a1733a3
- SHA1 6a5250a24439cb760e91c228b56d991a717e556a
- SHA512 cc5040fdc1fae74ce903e237c18c034b02c55e8d73165bee1c58a22142d46cb0fdc37b2549f51c94e624d2d698e5fef536998d433c6dad0d6e9a2de2a3835db0
- SSDEEP 49152:aEzWq251mCxFFF1uFwRYVFFFvsVmHNiFFFZ7HBvFFFbp1GWaPvJlx8G+:aEh25LuFUhGJlx8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15180
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleA
TerminateProcess
GetProcAddress
ExitProcess
GetTickCount
GetModuleFileNameA
GetCommandLineA
GetStartupInfoA
msvcp60
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
msvcrt
strlen
__CxxFrameHandler
_ftol
pow
atan2
??2@YAPAXI@Z
cosh
fabs
printf
memcpy
cos
atan
tan
log10
exp
asin
floor
tanh
sqrt
sin
_except_handler3
acos
fmod
sinh
strcpy
strcat
memset
ceil
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
__dllonexit
_onexit
log
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2.3MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=4, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=3, id=19, version=8034,
count=55, id=1, productName=Unmarked objects,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
microsoft-cleaned.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 03f1e07d8b2eddac94f0de473100dd8f33183c0030dd275a9dfb467d99af97b7
- MD5 2568651635cffe50fd45776886cdc514
- SHA1 bf7567d7492b701a4471a8c9b7a401460bf4621c
- SHA512 53e0046576c21da95ca5766e7f06fba20f77310a2e486bb1b7c6207a7345b039a846ffa6141f6c4b2f2cf76315bd052dcfe04e016f476fefad62786a2d286f5b
- SSDEEP 6144:C+uRqxZQFpFXvGp4F3qd75zSCIHpj3el71nVNi9IY2enhzSs75/Krbgx02r:C+08+FXt3qPOCIH8l7ZHyIXepSoab
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
350830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
335KB
Virtual Size
334KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
msiexec.exe
- IMPHASH 71e5add1b563cff7b06b46e6335853d2
- SHA256 f5096a51fdc054c4a217966b22f827a921d50a12436aa995d6f4180bdc4ba420
- MD5 8028ee3776ac68bb5789575e5a904465
- SHA1 d142f9a30280f31b173080388bc04c71b6c45cc6
- SHA512 33b988d5d80c072a12454a4eb49a70c93ffb3c418ae4a3ef61f1a2d8e81b0ee1e590e176ccb5391e5e7237822f022151fe4a3d7b979d301d7b1c41d5a544118a
- SSDEEP 12288:iza760BmY7fheiaEyG5wv/kTSie0+vqGlCc:iza+afhzaEyZ4hz6C
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
60691
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxExA
CreateIcon
GetDoubleClickTime
GetGUIThreadInfo
SetClassWord
GetKeyboardType
IsCharLowerA
DdeCreateDataHandle
RealGetWindowClassA
OemToCharA
urlmon
GetSoftwareUpdateInfo
CoInternetGetSecurityUrl
FindMediaTypeClass
ole32
OleIsRunning
OleCreateStaticFromData
OleCreateLinkToFile
StgCreateDocfileOnILockBytes
StgSetTimes
OleConvertOLESTREAMToIStorageEx
OleCreateLinkFromData
DoDragDrop
advapi32
QueryServiceConfigA
PrivilegedServiceAuditAlarmW
RegCloseKey
CreatePrivateObjectSecurity
GetSecurityDescriptorControl
MapGenericMask
RegQueryInfoKeyW
dbghelp
SymGetModuleInfoW
ImagehlpApiVersion
SymGetModuleInfo
SymGetSymNext
SymEnumerateModules
mpr
WNetGetUniversalNameW
WNetAddConnectionW
WNetCancelConnection2A
WNetGetLastErrorW
WNetEnumResourceA
WNetDisconnectDialog
kernel32
GetSystemInfo
VirtualProtect
RaiseException
SetFilePointer
FlushFileBuffers
VirtualQuery
GetConsoleCP
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetConsoleMode
TlsFree
GetLocaleInfoA
RtlUnwind
InitializeCriticalSection
LoadLibraryExA
Sleep
GetOEMCP
ExitProcess
DosDateTimeToFileTime
DeleteFileW
DeleteFileA
CreateFileW
CreateFileA
CreateDirectoryW
CreateDirectoryA
CompareStringA
CloseHandle
SetSystemTimeAdjustment
GetCPInfoExA
DnsHostnameToComputerNameW
LockFile
GetSystemTimeAsFileTime
ExitThread
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
GetStartupInfoA
GetProcAddress
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
GetModuleHandleA
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
Name
.text
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
42KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
236KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=31, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=27, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=110, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=139, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
nc.exe
- IMPHASH 9a07a268dfdfe636c092c15eecfb3042
- SHA256 f89ae8d431706d82bfb965b0b8f393f99aae897460ba473529256186693c2bd0
- MD5 7ce968dddd2ed97a980dcc00eff84a77
- SHA1 682df7e5bc6a9d185907b39891237d0ee407b949
- SHA512 ba78aeddd6143ea2bcaeb70c42d522b014d85b7419f6f9c5e6a28558f2bc090546640c9ecc0a867a7808c0534d794bd237f227998a2ea307d58e834efd946af4
- SSDEEP 768:2i3A+wAwcw1/GWTw8+7TAB+fThAapYgVLrORoMn+xtuHkydSsa6CvwEBRMOog:L3A+wAwjp+fTnlOR/+xtuHnK6p2Rog
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19456
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
DisconnectNamedPipe
TerminateProcess
WaitForMultipleObjects
TerminateThread
GetLastError
CreateThread
CreatePipe
CreateProcessA
DuplicateHandle
GetCurrentProcess
ExitThread
Sleep
ReadFile
PeekNamedPipe
WriteFile
GetStdHandle
FreeConsole
VirtualFree
VirtualAlloc
LCMapStringA
SetEndOfFile
LCMapStringW
CreateFileA
GetNumberOfConsoleInputEvents
PeekConsoleInputA
HeapReAlloc
LoadLibraryA
GetStringTypeW
GetStringTypeA
GetProcAddress
SetStdHandle
SetEnvironmentVariableA
SetFilePointer
CompareStringA
GetOEMCP
CompareStringW
GetCPInfo
GetEnvironmentStringsW
GetACP
HeapFree
HeapAlloc
CloseHandle
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
RtlUnwind
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
wsock32
__WSAFDIsSet
getsockname
select
listen
WSASetLastError
recvfrom
accept
bind
socket
setsockopt
getservbyport
connect
htons
ioctlsocket
ntohs
getservbyname
gethostbyaddr
gethostbyname
inet_addr
WSACleanup
WSAGetLastError
WSAStartup
closesocket
recv
send
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vsp
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
nd2vj1ux.exe
- SHA256 5a1d1e5aa09e1eff12365374044b8fc6c1da1024cdf9cc87efdef314ddd6857a
- MD5 dffb9df79dba2f3b14f8d0d169b05a39
- SHA1 51956d31ce3b5f6c944b4bb9f0544a7225ae02c6
- SHA512 acfc2c977e51cd2bb881206885f599864e6b726583a975f3f074c705e89ba5be2e19c33bde2c1934914c4ecfaf38226ebd91a1a673423216ebd137b8cd6bac42
- SSDEEP 3072:Dnnn2nQsco5vjD3cpBBJB9uufEnnnVYennznhfMQZWdn2aaBzuHYuEbKb+OlrtP4:tomQZ7zuHJE2b+Olxj0tMs
- MD5 SHA1 SHA512 SSDEEP
notes.exe
- SHA256 15e726d9eb37e96f5a34d910702c59e6b98eecca957292cbb0e8f2e746ccdd6e
- MD5 eec736bb161167781aadcb6041003931
- SHA1 d550a30d4692f831c0d79a36b44d114d601496a6
- SHA512 47c895562590db33cf67f7e5eee7061e9742607eba8b46a8353278478abc6de35f7f08eea0698aad84d7f1b200a9545d1e59ffe7891c973f1bb82b2204998f90
- MD5 SHA1 SHA512
nzpuHohZGP2RNfMTp0sr (2).exe
- IMPHASH d409d04619f830ed4fb4696d607103fa
- SHA256 9336c8dbbdd65d18cee1de53ee153aeeb2fd9fcf3ceafb9f251ffcc21bf7211f
- MD5 1914724aeea3ca954322053dd883b14a
- SHA1 ec12c2f0e1b16c0ba1f9960ed58be1e4862e3b4e
- SHA512 068857835aebe679584350b3ac486131ee26b35a6986076ccc3c3c1f4cd586c6a5d055cab61360fc4c52e846dbdc6325d9165460d29d17f5e7ffd444c8fd508c
- SSDEEP 6144:c+dE6vqOE9Z8LapTWgK/W9uAExjAhQiM5bQCdf/ORqz9BLp5hjo/GWZ:c+vvbGlpoAExjAYbQCdf/ORqZBdfjo/b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
190296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Dev\Final\Release\main.pdb
ws2_32
ioctlsocket
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
kernel32
GetModuleHandleA
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
WriteFile
CreateFileW
CloseHandle
Sleep
DeleteFileW
FindFirstFileW
GetDriveTypeW
GetLogicalDriveStringsW
lstrlenW
GetTempPathW
FindClose
FindNextFileW
GetVolumeInformationW
SetFilePointer
ReadFile
MoveFileW
GetFileSize
GetFileType
SystemTimeToFileTime
CreateDirectoryW
GetUserDefaultLCID
WideCharToMultiByte
GetFileAttributesW
MultiByteToWideChar
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetModuleHandleW
GetVersionExW
GetProcAddress
GetSystemInfo
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
GetTickCount
SleepEx
VerifyVersionInfoA
VerSetConditionMask
WaitForSingleObject
FormatMessageA
ExpandEnvironmentStringsA
GetModuleFileNameW
GetCurrentDirectoryA
GetFullPathNameA
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
GetProcessHeap
GetTimeZoneInformation
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
SetFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleFileNameA
GetStringTypeA
HeapSize
FlushFileBuffers
VirtualAlloc
VirtualFree
HeapCreate
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetSystemTimeAsFileTime
ExitProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
HeapAlloc
GetStartupInfoW
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsW
user32
MessageBoxW
wsprintfW
GetSystemMetrics
advapi32
CryptGenKey
CryptGetHashParam
CryptAcquireContextA
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CryptExportKey
shell32
ShellExecuteW
SHGetFolderPathW
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
shlwapi
PathFindExtensionW
StrCmpIW
PathAppendW
StrCpyW
Name
.text
Size
283KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=150, version=20413,
count=28, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=74, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=175, id=1, productName=Unmarked objects,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=233, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
nzpuHohZGP2RNfMTp0sr.exe
- IMPHASH d409d04619f830ed4fb4696d607103fa
- SHA256 9336c8dbbdd65d18cee1de53ee153aeeb2fd9fcf3ceafb9f251ffcc21bf7211f
- MD5 1914724aeea3ca954322053dd883b14a
- SHA1 ec12c2f0e1b16c0ba1f9960ed58be1e4862e3b4e
- SHA512 068857835aebe679584350b3ac486131ee26b35a6986076ccc3c3c1f4cd586c6a5d055cab61360fc4c52e846dbdc6325d9165460d29d17f5e7ffd444c8fd508c
- SSDEEP 6144:c+dE6vqOE9Z8LapTWgK/W9uAExjAhQiM5bQCdf/ORqz9BLp5hjo/GWZ:c+vvbGlpoAExjAYbQCdf/ORqZBdfjo/b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
190296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Dev\Final\Release\main.pdb
ws2_32
ioctlsocket
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
kernel32
GetModuleHandleA
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
WriteFile
CreateFileW
CloseHandle
Sleep
DeleteFileW
FindFirstFileW
GetDriveTypeW
GetLogicalDriveStringsW
lstrlenW
GetTempPathW
FindClose
FindNextFileW
GetVolumeInformationW
SetFilePointer
ReadFile
MoveFileW
GetFileSize
GetFileType
SystemTimeToFileTime
CreateDirectoryW
GetUserDefaultLCID
WideCharToMultiByte
GetFileAttributesW
MultiByteToWideChar
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetModuleHandleW
GetVersionExW
GetProcAddress
GetSystemInfo
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
GetTickCount
SleepEx
VerifyVersionInfoA
VerSetConditionMask
WaitForSingleObject
FormatMessageA
ExpandEnvironmentStringsA
GetModuleFileNameW
GetCurrentDirectoryA
GetFullPathNameA
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
GetProcessHeap
GetTimeZoneInformation
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
SetFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleFileNameA
GetStringTypeA
HeapSize
FlushFileBuffers
VirtualAlloc
VirtualFree
HeapCreate
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetSystemTimeAsFileTime
ExitProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
HeapAlloc
GetStartupInfoW
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsW
user32
MessageBoxW
wsprintfW
GetSystemMetrics
advapi32
CryptGenKey
CryptGetHashParam
CryptAcquireContextA
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CryptExportKey
shell32
ShellExecuteW
SHGetFolderPathW
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
shlwapi
PathFindExtensionW
StrCmpIW
PathAppendW
StrCpyW
Name
.text
Size
283KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=150, version=20413,
count=28, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=74, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=175, id=1, productName=Unmarked objects,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=233, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
old_14b68cb9f911ce937f52ed8282ef4395f2291c0a23f14d33f731a15572834b0d.exe
- SHA256 14b68cb9f911ce937f52ed8282ef4395f2291c0a23f14d33f731a15572834b0d
- MD5 fef2837fa1deb4704de03eaa76b62241
- SHA1 8bb3914b5ae46383f0223ace7a7b3b6de2b6344e
- SHA512 9b7ca59308240a46bc215975c14e508bdc853ab5c7a7bc76a92ef42d1dfce0adec2aa1b51b8f9569590bb110c8f9cb47f2c1c446c4ec6c747dac453a918c78f7
- SSDEEP 768:DhnciumS4FeU6ggYpFJVuGwv8zE2rCaBE1s6zAKKXb/7BxkxzDNHwP00VPSuilVV:1D5vzuf8qfSpKKXxiha00tSHVOWc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
patched.exe
- SHA256 eaac4bcbf42384c31cc4f1e217e7becd9217647aa693e93488d2d9559127dc3f
- MD5 7d2af690ad89d53ffc070f066a778edf
- SHA1 29d212d55c2d41efe96ca384132ab935d6f80861
- SHA512 ebb6bf66361fc6e72f463f61b9eb18f7fec51e1551eac78b1cf0fb4a900568d5d99ca34517f90396a08cf5794a38f666c8affb28a136232f459237ff9c82acda
- SSDEEP 24576:R9WQitvyUilzOUxaOWk01G4fbu/F41jen6KXYzkEEknJS7DFN4L3GmPA705sCvsF:R9WDAUozOUxaOyGau6I6WPDvlAAoefk1
- MD5 SHA1 SHA512 SSDEEP
-
Detected Xorist Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8657
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
pclock.exe
- IMPHASH ebb157b0a0b05503bf71db78ca8a098f
- SHA256 302b437cf639368e85af4d16b2ba11707f5e94d257e5718be7f913c7162bf954
- MD5 bb9c3be8f8ee44993bc2ed175abcaf1b
- SHA1 fee3a493cbfc84799c1e6c2c3b7d84e84433578d
- SHA512 c4dddee9db4929ec00d3344ecd748c4cf41a516489f39eac9ffe159dba8058b5d2ac23f47edbdb0cd310793699af3631d6b3577fdba59efe599dfc81d12f6837
- SSDEEP 3072:3Nkgq5A+T73rKiwT6ChOe97tauWx/7PaoHdWOGNKbZNM4rfnxl1YWOFW+OKd:mR3a6CrXWx/7ao9aKbQ4rycKd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
F:\Krypton_15.0_NR\Bin\StubNew.pdb
ntdll
NtQueryObject
wcsncpy
kernel32
LeaveCriticalSection
GetLastError
GetProcAddress
VirtualAlloc
EnterCriticalSection
InitializeCriticalSection
LocalAlloc
LocalFree
lstrcpyA
ExitProcess
DeleteCriticalSection
LoadLibraryA
user32
MessageBoxW
GetActiveWindow
EmptyClipboard
WindowFromPoint
CloseClipboard
comctl32
InitCommonControlsEx
wtsapi32
WTSQuerySessionInformationA
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.core
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.code
Size
177KB
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=11, version=8047,
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=91, id=1, productName=Unmarked objects,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
pclock_unpack.exe
- SHA256 05fab5797ed3fa8ba1fbe0e0de14e5284f84506c1b5bb386638e49c3f027e75d
- MD5 1fc5cb7e0ad732461f8eab5d1125c427
- SHA1 2974651cf335d46b2e7d2287b325232c3b77d9f1
- SHA512 b0818ac1d5ec83cad5760b76551f8237e2a3e1968ebdfec8deacccb291842ef7f838ad7071590a215b9cb6c030b6f69ccf81c3d05447216c6456b6cec20961e9
- SSDEEP 6144:zHuwWf/SZxB5+TlkJUjvvh02jNnPAPowEoxAKJaITtSXp:OfoxB5+JM+6oJIovSDtSX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11276
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
232KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=14, id=9, version=8783,
count=1, id=13, version=9782,
pitupi20.exe
- IMPHASH cecd134f388149dd921af4cfa400f6c0
- SHA256 1be07198c324c9732d4e2676945ec021eeacd78775aea2100f49ca0483d3f901
- MD5 942c6a039724ed5326c3c247bfce3461
- SHA1 6ed179d6131f2407d19b37e31d4aa9c9709d4d99
- SHA512 ac934d0d5defd5ea4354b743520b0d1a8280d74b953b0ea0e7c6cede3f036bfd715e8b4568d794db6f007f0b5ddd8be46bb5a8707252ed8b3cb304fb6746265b
- SSDEEP 3072:4/s16aN54vUh4EyiDg2Z/1RrUPjfyUOqC4tn4yDDqJBftdIW6oc6jSsG:4/sMa74vUhVyXsuOU9vn5DuJBftdV+D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
109508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
CreatePatternBrush
SetPixel
Rectangle
GetRandomRgn
SetMiterLimit
SelectPalette
RoundRect
rasapi32
RasSetCredentialsW
RasGetAutodialAddressW
ntdll
bsearch
RtlUnicodeToMultiByteN
odbc32
SQLSetConnectAttrW
SQLDescribeColA
SQLDescribeParam
SQLBrowseConnectA
SQLTransact
SQLGetDiagRecW
SQLGetDescRecW
SQLDriversW
SQLMoreResults
SQLPrepareW
SQLEndTran
SQLPrimaryKeysA
SQLSpecialColumnsW
SQLForeignKeysW
SQLColAttributesA
SQLGetTypeInfoA
SQLColumnPrivilegesA
SQLBrowseConnectW
SQLProceduresA
SQLGetConnectOptionA
DllBidEntryPoint
SQLConnectW
SQLStatisticsW
PostODBCComponentError
SQLDisconnect
advapi32
SetFileSecurityA
StartTraceW
msvcrt
_wenviron
_onexit
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_errno
strtok
_umask
_wstrtime
_mbsncpy
_HUGE
_getpid
mktime
_wstrdate
__unDName
_wcsncoll
_utime64
_exit
_wexeclp
asctime
_beep
_findfirst
_wsearchenv
_findfirst64
__doserrno
_CxxThrowException
_endthread
_wgetenv
_futime
oleaut32
SafeArrayAllocDescriptorEx
xolehlp
DtcGetTransactionManagerC
DtcGetTransactionManager
GetDtcLocaleResourceHandle
ole32
CoGetObjectContext
user32
SetUserObjectInformationA
GetWindowRgn
kernel32
LoadLibraryA
SetCommTimeouts
SizeofResource
lstrcmpA
SetFileAttributesW
ClearCommError
GetModuleHandleA
lstrcpynW
GetProcAddress
SetPriorityClass
CloseHandle
VirtualAlloc
SetFilePointer
GetStartupInfoA
GetModuleHandleA
SetEvent
Name
.text
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
pozhehgxmlhobpvwlqco.exe
- IMPHASH 518151b350ef47dd17b5213c5d748a55
- SHA256 d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4
- MD5 327cea8d93ff1094fe1ba9008e8c5657
- SHA1 97574533c1260e6e3bd3008359e38055aba0d203
- SHA512 7904652fa2c81296be80efec5617dd86059a940ef0ee10c45a9673d6d85cf845afaa188385d4dd7643ff37ad61a25c33c14486448c5eb51b55d9ba59158c6357
- SSDEEP 768:mbLjRB9o7troDVMOXsgRha8ZwByuiiCKR0YFeIupRXnzUpiPqDOyktPxEY:k/L9stroDzRhD6yuDR0lIupRnXTboY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GlobalAlloc
lstrlenA
GetStdHandle
CreateMutexA
LocalAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupDecompressOrCopyFileA
msvcrt
_adjust_fdiv
memcpy
_exit
_onexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=28, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr
- SHA256 f1384ff19a870f5aa718486666a14e88873d79eaea5725e3a2097b2d9fd9a320
- MD5 a7f91301712b5a3cc8c3ab9c119530ce
- SHA1 22c17c048eacd78038e820350181e2fb1aa2fe75
- SHA512 53f608c8ab14595559ea91f028632c427c60b490ab79f57f6ac8b09dfd3920b69acf011ca0d8891fb3a3db474967691d69acb9175d777be65a0ab9b71b7e135f
- SSDEEP 12288:o8S/eSSa+KprpGAOB+TJyZJKiPKIQInLDIAvcn0YP2TFjqHHsFNW0jGjG:NS/rSarrpGr+1yzKUKIQILDIAknzuBje
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2497360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
603KB
Virtual Size
604KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 e19dab44560a5e9e9e4d8bc5d45c513b5c72a3f423a5c66d900b9311afac5807
- MD5 baa8a980509356b774d9065891af93e8
- SHA1 cfe3aa18a6add7d5ea68907f5f289861551fb83b
- SHA512 82d185b58d5f557d7bc1f96d47b663f88f97a27a7073d89c0405d7a0a6b5133df16eaf4bcd076a0bac9ac25600e71e3f2d13cb7c652c81e0486a5415d781ad65
- SSDEEP 49152:21oWC6f6XOlvRaU74cH1+wvxEFiZGv1MuK0DKGaaRcmDSqA4L4INGVswc81+3U4I:woWC6f6XOlvRaU7RH1+wvxEFsGvqX0Dm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
320KB
Virtual Size
319KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
CryptoPP
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
ransomware1061911a3e0a74827a76bbd7bfe16d20.exe
- IMPHASH e160ef8e55bb9d162da4e266afd9eef3
- SHA256 74456d286d471069dee7171ce654f910722ef0ddf42e701337c2b4a1e0f5c36c
- MD5 f75957ce3208ef38cfaae1e46bf5dad9
- SHA1 4633cb0d8a55d8d9252a4e61a786f0b3110af74e
- SHA512 29db93c1920e14bba0f668a5ad9a5ba39f960f68fa9188bb968c4dcd32a1013e2776fa7897e97667b7f870ee16b01bcb6576cc25a25eba9b0d3e000f31df061d
- SSDEEP 3072:DwJ52Y7ZoH5XJaT45embG1bMxXa6LTDRQb73WMRqIlDoUtSVEPvKbSts:DwHysTtMG16XNY77qCoTVqVW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
Sleep
CloseHandle
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
SetErrorMode
GetCommandLineA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
- MD5 a436db0c473a087eb61ff5c53c34ba27
- SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
- SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
- SSDEEP 192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10020
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
835B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
582B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Bhajan.x
- SHA256 1a23271495ccac2afea48c2747b22612811081906b630b5b1707e3a92f395816
- MD5 003be194a4c2f7d800ab88dfca6a321c
- SHA1 2495c7dfee325c9ffe7f5c60874371c055a623d1
- SHA512 3af7d5f1c562a6786fde34d7b8b93484e81c427a0caa85d1875d279bff428402571314d1d5e508423682115f076cdda79acf97c86511088196fc6349b1838f79
- SSDEEP 1536:V95SZR1bVGJY0XmBl0M/UMJg/+IT2iWx3AQbb/3WMRnwXIlDEw:VbG1bMxXa6LTDRQb73WMRqIlDp
- MD5 SHA1 SHA512 SSDEEP
profitability.dll
- IMPHASH e07e00e45407ff0dd6abc9eaa981fa7b
- SHA256 f59b09deabe3cd539fef7a758a44b7eca9cd23941d2ae111272a9fba9e8ecd00
- MD5 774d0a49fa5fa5b050914358e3bf30c9
- SHA1 24aefc2f6940b3f2e7fda172cde69182b73e99f6
- SHA512 f9edce756200df32782f9f3715fc683103e4b87661ea98cc991f58b72010b1203e43790712919049ca315039a4f7fa4411cc9b0b7a808d4768dfa5753904fcf1
- SSDEEP 1536:AFvo34nV1fpay22kTMolMwC1brWxpRb+3EM7itkpJb1ZFCZ3jwHO/AN2AXIvcomi:AFo4nV1fpay22JYMrdrWxpRb+3EM72k6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
69543
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_initterm
malloc
_adjust_fdiv
free
ProduceThreed
WinAllogamy32
Name
.text
Size
68KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
250B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=10, version=8047,
count=6, id=1, productName=Unmarked objects,
count=3, id=4, version=8047,
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
safeinf.dll
- SHA256 add92cb6047f2fb412dcbcb5a2d8ee7fad56091ccd6667105d977b010a33b561
- MD5 a0a45b5de3c04e4c659395857bee3ead
- SHA1 bdf4e7315bddb3fa7ae86dda5049b30cdc648dea
- SHA512 b8f3d847a19dc7615a9cbf30dfe6cbf344045e6f5510863ec9bbf1fdb171a146e1ffbc44cb7a5cb08862ed78b1bcee72f99d6e792b82f70f41494a0a0071d0da
- SSDEEP 12288:dXmwRo+mv8QD4+0N46glpxInQMUmO+NWJUaS5plVvj9fOOIAxHfoeYJO/:dX48QE+UiK6P+YeXplpXIS/oXS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
152680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
schet1074.15.03.16.doc
- SHA256 72b14306c9f95536d03d88cf63204f70630dd9cd00664ad7f86c1d774c8508e9
- MD5 99289be18f8eff90737733fd7e1255c6
- SHA1 736c1b31cb3735f301d8cd4981c24ad70d017083
- SHA512 351d9ab3c36dccbe591fdd7aa4cfc6e33e82c3a2dc07a829b79a99794b7184811307f749ddba7881eab4ed46660ae6b8214c1c41c974d9f8a3c934a786b0560e
- SSDEEP 24576:kbKw4bfMpV7ceKPvi14LEt5k/W0DPwCna++V8TQheoP:TwOMAtPq18Et5k+qH+GTQZ
- MD5 SHA1 SHA512 SSDEEP