Batch_7.zip
- SHA256 17b4d01d32c64a62e36496829da323fe308437048ca87143de7365fabd4194fd
Overview
overview
10Static
static
6DUMP_00A10...iR.exe
windows7-x64
7DUMP_00A10...iR.exe
windows10-2004-x64
7DgH5SjZFle...DI.exe
windows7-x64
10DgH5SjZFle...DI.exe
windows10-2004-x64
5Dumped_.exe
windows7-x64
7Dumped_.exe
windows10-2004-x64
7EntrateSetup.exe
windows7-x64
9EntrateSetup.exe
windows10-2004-x64
9ErrorFileRemover.exe
windows7-x64
10ErrorFileRemover.exe
windows10-2004-x64
10ExtraTools.exe
windows7-x64
7ExtraTools.exe
windows10-2004-x64
7F45F47EDCE...54.exe
windows7-x64
10F45F47EDCE...54.exe
windows10-2004-x64
10decrypt_00...00.exe
windows7-x64
6decrypt_00...00.exe
windows10-2004-x64
6dffde400ad...3d.exe
windows7-x64
10dffde400ad...3d.exe
windows10-2004-x64
10dircrypt.deobf.exe
windows7-x64
10dircrypt.deobf.exe
windows10-2004-x64
10dma locker 4.0.exe
windows7-x64
9dma locker 4.0.exe
windows10-2004-x64
9downloader.js
windows7-x64
10downloader.js
windows10-2004-x64
8dump.mem.exe
windows7-x64
6dump.mem.exe
windows10-2004-x64
6e0ff79cc94...ss.exe
windows7-x64
7e0ff79cc94...ss.exe
windows10-2004-x64
10e37dc428ec...ad.vbs
windows7-x64
1e37dc428ec...ad.vbs
windows10-2004-x64
1e5df2d114c...8a.exe
windows7-x64
10e5df2d114c...8a.exe
windows10-2004-x64
3Behavioral task
behavioral1
Sample
DUMP_00A10000-00A1D000.exe.ViR.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
DUMP_00A10000-00A1D000.exe.ViR.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
Dumped_.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Dumped_.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
EntrateSetup.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
EntrateSetup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral9
Sample
ErrorFileRemover.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral10
Sample
ErrorFileRemover.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral11
Sample
ExtraTools.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
ExtraTools.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral13
Sample
F45F47EDCED7FAC5A99C45AB4B8C2D54.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral14
Sample
F45F47EDCED7FAC5A99C45AB4B8C2D54.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral15
Sample
decrypt_0000000000000020-000A0000.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
decrypt_0000000000000020-000A0000.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Resource
win7-20241023-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral18
Sample
dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral19
Sample
dircrypt.deobf.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral20
Sample
dircrypt.deobf.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral21
Sample
dma locker 4.0.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral22
Sample
dma locker 4.0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral23
Sample
downloader.js
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
downloader.js
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
dump.mem.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
dump.mem.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral29
Sample
e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad.vbs
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral32
Sample
e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Batch_7.zip
- Size 6.8MB
- Sample241122-d6bprstne1
- SHA256 17b4d01d32c64a62e36496829da323fe308437048ca87143de7365fabd4194fd
- MD5 77e8eab2073a789150dc3eefb0541f1c
- SHA1 e2a21748a32116967087f421e91b1e4afbe38dc5
- SHA512 a9e462f5234ac18ef699243383ce3538ae0d1069cf900e5cfae132049a3b13bba783d61ac325348a1aaa2187095896864919916e8daf8c924bd22180974c0f1c
- SSDEEP 196608:xu+epCgmrd0rEVf4ZxvoFApfzStfGGaPA:4+0mr+EOYApA
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Requests dangerous framework permissions 9 IoCs
description ioc Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Required to be able to access the camera device. android.permission.CAMERA Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS -
resource yara_rule static1/unpack001/DUMP_00A10000-00A1D000.exe.ViR.exe upx static1/unpack001/DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe upx - Unsigned PE 26 IoCs
Checks for missing Authenticode signature.
resource unpack001/DUMP_00A10000-00A1D000.exe.ViR.exe unpack002/out.upx unpack001/DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe unpack003/out.upx unpack001/Dumped_.exe unpack001/EntrateSetup.exe unpack001/ErrorFileRemover.exe unpack001/ExtraTools.exe unpack001/decrypt_0000000000000020-000A0000.exe unpack001/dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe unpack001/dircrypt.deobf.exe unpack001/dma locker 4.0.exe unpack001/dump.mem.exe unpack001/e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32_not_packed_maybe_useless.exe unpack001/e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a.exe unpack001/e6c4ae470977aa78d1005746ae05deea0bf3b4260f88865662a35f99b2559dbc_not_packed_maybe_useless.exe unpack001/e77df2ce34949eb11290445a411a47fb927e8871e2580897581981d17730032d.exe unpack001/e8e07496df5370d2e49ecce5a47c1fd2.exe unpack001/ea8292721a34ca2f1831447868bbe91e.exe unpack001/eaa857c95fca38ca08411b757f4ad2a841cfb9782deca8abf64aada445923c0d_Stealer.exe unpack001/ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe unpack001/encrypter.exe unpack001/f213e54c8520e7458751020edf15a5ea.exe unpack001/f2c8eee2cd88b834e9d4c0eb4930f03f.exe unpack001/f31bfe95e31d761459b885052d35ba5e25ab19333378fb72b12efd675f6018d7_.exe unpack001/f6a8d7a4291c55020101d046371a8bda.exe
File Explorer
-
Batch_7.zip.zip 6.8MB
-
DUMP_00A10000-00A1D000.exe.ViR.exe.exe 52KB
-
out.upx.exe 51KB
-
DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe.exe 176KB
-
out.upx.exe 414KB
-
Dumped_.exe.exe 72KB
-
EntrateSetup.exe.exe 261KB
-
ErrorFileRemover.exe.exe 2.4MB
-
ExtraTools.exe.exe 280KB
-
F45F47EDCED7FAC5A99C45AB4B8C2D54.exe.exe 86KB
-
decrypt_0000000000000020-000A0000.exe.exe 611KB
-
dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe.exe 182KB
-
dircrypt.deobf.exe.exe 321KB
-
dma locker 4.0.exe.exe 315KB
-
downloader.js.js 8KB
-
dump.mem.exe.exe 53KB
-
e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32_not_packed_maybe_useless.exe.exe 89KB
-
e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad.exe.vbs 54KB
-
e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a.exe.exe 33KB
-
e6c4ae470977aa78d1005746ae05deea0bf3b4260f88865662a35f99b2559dbc_not_packed_maybe_useless.exe.exe 54KB
-
e77df2ce34949eb11290445a411a47fb927e8871e2580897581981d17730032d.exe.exe .vbs 196KB
-
e8e07496df5370d2e49ecce5a47c1fd2.exe.exe 181KB
-
ea8292721a34ca2f1831447868bbe91e.exe.exe 52KB
-
eaa857c95fca38ca08411b757f4ad2a841cfb9782deca8abf64aada445923c0d_Stealer.exe.dll 949KB
-
ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe.exe 1.2MB
-
edffa07d667dbd224682639f56eb1b913e4ffeac874999e02c23e86eeb6489d5.exe.js 559KB
-
encrypter.exe.exe .js 40KB
-
encryptor_raas_9cffd965b4a0e662f6b98fd47d3b6ec9bc1b8581.exe.exe 111KB
-
f002618c01fe652f7f00eabd0e890e4992ccce818dfb2863e82c43f793685635.exe.apk 1.0MB
-
f213e54c8520e7458751020edf15a5ea.exe.exe 208KB
-
f2c8eee2cd88b834e9d4c0eb4930f03f.exe.exe 809KB
-
f31bfe95e31d761459b885052d35ba5e25ab19333378fb72b12efd675f6018d7_.exe.exe 689KB
-
f6a8d7a4291c55020101d046371a8bda.exe.exe 799KB
-
f9151107655aaa6db995888a7cb69ada.exe.exe 360KB
-
fb8823e9494016f59ab25ec6cc0961da_api-ms-win-system-softpub-l1-1-0.dll261KB
DUMP_00A10000-00A1D000.exe.ViR.exe
- SHA256 2c4c8066a1a7dfdf42c57ff4f9016f1ba05bcb004ff8b0ffc0989165d2ad30e2
- MD5 6152709e741c4d5a5d793d35817b4c3d
- SHA1 05ae9c76f8f85ad2247c06d26a88bbbcfff4d62e
- SHA512 1e5ebd53ac942b0f06f759f936efebeeb9a74062647cd978d5112720f772f607b12ee20c02ab838104a7a947fef2fde79b0db944286d8daf2e6e6d16e10b9390
- SSDEEP 768:UR/FcohAQFBY4JzKNkN3QZ0gGINlVOWcm:U1PhAQztJWNeCVOWc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
95376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 a1c1164f6b43a3592a98b29adc045f9ca37ec0624eb2f2c027bfffe24a4915d1
- MD5 8f681b52fcfe200d14c81d297a323cf7
- SHA1 1375d3c3cb1d2ea8d6f80a2cfe11107d80ad9a34
- SHA512 88f936cfc95833017fefa7a342cb9b41ae7ea2e7123f7e8bb4192db53b0b48998421176132a4ead98fbb25d31d0f1ee8e0f7995d14e94ab3e094d4dcceb7ad36
- SSDEEP 768:uElAvOs4CTfOgGYdlNGCizSHdq12UMx9s6zAKSXwa/2e:ZlafjVsrODKpKSXN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe
- SHA256 ebea4a46175b0e9c24e74b774f9ecfb036030f916ec5f2fced34fcb6c1f3ba57
- MD5 b88fd69b53a6e4587d9e95a0c6061141
- SHA1 728281eb2bde83701f379797f1b2e36765429543
- SHA512 5105c000a7d0c2d68feb00e4f7de77b5afe58347b5d0c24f64346ec3bd8f684f1087ef8559c568f19ef47c301c7675cea0bf91d5551aeb38c89e23a114421aba
- SSDEEP 3072:OCHM30xGHntNzuOIPEerSoKx1B2vUNc/H7BJ4gKraLKQ5oGqDQuRGBiY50pOwP:tMntdcKoWn2vzbvWm3ADQNwOo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
458192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
172KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 4f867318015997157ff934eefd2910209657647593f3d980d2bdec0ea07b0e6e
- MD5 8653c10514f95ee866391ea0644c68d4
- SHA1 77b59a4d60fc9a37680704f660b2ee278d871a89
- SHA512 da35d64bd8f7e69c8956b91102fcf367ebcb04f7eca490c6ae2eabf3bddb437eff46ef07f7b9cd421a4dfd62d2bd8ca7a0b8a7438f8545f6b1fa9aa7ac166402
- SSDEEP 6144:Sl+2qS2Jbo3CMRjrvYNROmP4HQSvRsRGjpfBpdWGyrcUBJPzl:Y+2qS2JkHgSYSQSvbTWGi3D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
371272
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
359KB
Virtual Size
358KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Dumped_.exe
- SHA256 86a4ec02684bfd8a055929b0aa6f687bd54e80da0ed689be4e315adf76edbbcb
- MD5 afc0e1b3c683fcfb276f8e054d733945
- SHA1 a1ef6e368f78bc147c2ee70449917f3929d669ed
- SHA512 68adc819478468c55e85d9cb476b94a363f7d90df1697cd1a1814180ca1dfb47cba4f584d6706330c7d7e2b1e26092c780345cb59bdf736daf4616f06fae7ce7
- SSDEEP 768:0Nt2Lmmi8euodnS53h1O8jFQ3tuL7EAj+WTbibIKFQnjVPoxPaBF77tiU8r:nLZOQRM8Jg12+q7LnjVP0U
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
43472
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mackt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=101, id=1, productName=Unmarked objects,
count=25, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
EntrateSetup.exe
- IMPHASH 9337f920cd3453dbf969f0c56d86c1bd
- SHA256 103bc884dce60ec680dd00bcd2d45721319b526b2f6ae7ebe75c73a5c977dafe
- MD5 cd6258b33207e85f20fec5f39d9ba09f
- SHA1 fc132ed8922a767061abfd372dfb6f23bd8c0b62
- SHA512 2d0f5c0ee81b050fa99dc40fd5ea1864ae68f4d08a7610ea08f8c99e589d90d917a009ff25286d4351b133cf466a408e442c99a8b8cca99d81a81af8e4c6ab49
- SSDEEP 6144:oxagl7jMOfUsQgatPpi9SQG7q94Al6HnIpOLoG7SYQ5SFZ:oxagRjM+JQ1Pp2y1Al6HesZ7Sl8Z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
6571
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
PDB paths
kernel32
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapSize
IsProcessorFeaturePresent
RtlUnwind
Sleep
HeapFree
IsValidCodePage
GetACP
GetCPInfo
LoadLibraryW
SetLastError
GetLastError
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapCreate
WideCharToMultiByte
GetOEMCP
HeapAlloc
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
HeapReAlloc
user32
GetWindowRect
DefWindowProcA
GetDlgItem
SendMessageA
GetClientRect
DestroyWindow
EnumDisplayMonitors
LoadBitmapA
advapi32
LookupAccountNameW
ole32
CoTaskMemFree
CoTaskMemAlloc
ws2_32
socket
htons
avicap32
capCreateCaptureWindowA
comctl32
ord16
gdiplus
GdiplusStartup
oleacc
GetOleaccVersionInfo
CreateStdAccessibleProxyA
wtsapi32
WTSEnumerateProcessesA
traffic
TcEnumerateFlows
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
204KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=58, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=91, id=1, productName=Unmarked objects,
count=1, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
ErrorFileRemover.exe
- IMPHASH fdc840a7a99c43c34a60188ec8cc1596
- SHA256 68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c
- MD5 dbfbf254cfb84d991ac3860105d66fc6
- SHA1 893110d8c8451565caa591ddfccf92869f96c242
- SHA512 5e9ccdf52ebdb548c3fa22f22dd584e9a603ca1163a622db5707dbcc5d01e4835879dcfd28cb1589cbb25aed00f352f7a0a0962b1f38b68fc7d6693375e7666d
- SSDEEP 49152:6kAG2QGTC5xvMdgpdb1KRHGepUu2cGbqPs9+q2HRPTnFVSLE:6kAjQGTCnvMmpYQqPNRPTnF4Y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
813132
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\victor\Desktop\BRANCH\win\Release\stubs\x86\ExternalUi.pdb
kernel32
CreateDirectoryW
GetCurrentProcessId
GetExitCodeThread
SetEvent
CreateEventW
SetLastError
LoadLibraryW
FreeLibrary
lstrlenW
GetVersionExW
CreateFileA
SetStdHandle
WriteConsoleW
WriteConsoleA
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetDiskFreeSpaceExW
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
ExitProcess
lstrcmpiW
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoW
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
PeekNamedPipe
OpenEventW
CopyFileExW
CompareFileTime
GetVersion
ResetEvent
MoveFileW
GetLocaleInfoA
GetStringTypeW
ConnectNamedPipe
CreateNamedPipeW
TerminateThread
GetSystemDirectoryW
GetLocalTime
OutputDebugStringW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetWindowsDirectoryW
FileTimeToSystemTime
GetUserDefaultLangID
GetSystemDefaultLangID
GetDriveTypeW
CompareStringW
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpW
GetFileSize
ReadFile
GlobalFree
GetTempPathW
GetSystemTime
SystemTimeToFileTime
GetTempFileNameW
DeleteFileW
FindFirstFileW
RemoveDirectoryW
FindNextFileW
GetLogicalDriveStringsW
GetFileAttributesW
SetFileAttributesW
GetFileTime
CopyFileW
FindClose
MultiByteToWideChar
LoadLibraryExW
WideCharToMultiByte
InterlockedExchange
GetSystemInfo
TlsFree
WaitForMultipleObjects
Sleep
GetLastError
GetCurrentThreadId
WaitForSingleObject
MulDiv
lstrcpynW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetLocaleInfoW
EnumResourceLanguagesW
SetEndOfFile
SetCurrentDirectoryW
GetCommandLineW
GetExitCodeProcess
CreateProcessW
GetModuleFileNameA
FlushFileBuffers
LeaveCriticalSection
SetFilePointer
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTextAttribute
GetFullPathNameW
GetCurrentThread
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
RaiseException
FlushInstructionCache
GetCurrentProcess
CloseHandle
WriteFile
CreateFileW
FreeEnvironmentStringsW
LocalAlloc
LocalFree
LoadLibraryA
GetShortPathNameW
GetEnvironmentVariableW
FormatMessageW
CreateThread
SetUnhandledExceptionFilter
user32
MapWindowPoints
GetParent
GetWindow
GetClientRect
GetWindowTextW
GetWindowTextLengthW
FillRect
IsWindow
ShowWindow
GetWindowRect
UnionRect
IsWindowVisible
BeginPaint
EndPaint
ScreenToClient
SetWindowPos
GetWindowDC
LookupIconIdFromDirectoryEx
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
SendMessageW
DrawFrameControl
RegisterWindowMessageW
InvalidateRgn
GetDesktopWindow
GetKeyState
DrawStateW
DrawTextExW
DrawFocusRect
ValidateRect
DestroyMenu
AppendMenuW
CreatePopupMenu
TrackPopupMenu
InflateRect
LoadBitmapW
MessageBeep
LoadImageW
CharNextW
GetClassNameW
ReleaseCapture
SetCapture
UpdateWindow
DestroyIcon
GetDlgCtrlID
GetCapture
SetScrollInfo
GetScrollPos
GetClassInfoExW
RegisterClassExW
DrawEdge
SetScrollPos
SetRect
MoveWindow
GetScrollInfo
GetMessagePos
SystemParametersInfoW
GetActiveWindow
TrackMouseEvent
GetAsyncKeyState
DestroyCursor
GetWindowRgn
IsZoomed
SetWindowRgn
GetComboBoxInfo
DestroyAcceleratorTable
CreateAcceleratorTableW
TranslateAcceleratorW
CreateDialogParamW
EndDialog
DialogBoxParamW
InvalidateRect
GetNextDlgTabItem
SetCursor
MonitorFromWindow
GetMonitorInfoW
IsDialogMessageW
IsChild
PostQuitMessage
PostMessageW
SetForegroundWindow
SetCursorPos
GetCursorPos
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
LoadStringW
MessageBoxW
GetFocus
EnableWindow
DestroyWindow
GetForegroundWindow
EnumWindows
GetWindowThreadProcessId
DialogBoxIndirectParamW
MsgWaitForMultipleObjects
GetPropW
GetSystemMenu
EnableMenuItem
ModifyMenuW
ExitWindowsEx
GetScrollRange
SetPropW
RemovePropW
LoadMenuW
GetSubMenu
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
GetIconInfo
SendMessageTimeoutW
UnregisterClassA
DrawTextW
DrawIconEx
GetSystemMetrics
ClientToScreen
OffsetRect
SetRectEmpty
PtInRect
GetSysColorBrush
IntersectRect
IsRectEmpty
SendMessageA
IsWindowEnabled
CopyRect
RedrawWindow
SetFocus
GetSysColor
CreateWindowExW
GetDlgItem
SetWindowTextW
EqualRect
SetTimer
KillTimer
GetDC
ReleaseDC
CreateIconFromResourceEx
gdi32
GetLayout
GetBrushOrgEx
CreateFontIndirectW
CreateSolidBrush
GetRgnBox
EqualRgn
CreatePolygonRgn
CreateRectRgnIndirect
GetStockObject
CreateFontW
SetBkMode
SetTextColor
SetBrushOrgEx
CreatePatternBrush
FillRgn
SelectClipRgn
GetBitmapBits
CreateRectRgn
GetObjectW
GetDeviceCaps
Rectangle
ExcludeClipRect
CreatePen
ExtTextOutW
SetBkColor
BitBlt
SetViewportOrgEx
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC
CreateDIBSection
CreateBitmapIndirect
CombineRgn
advapi32
RegOpenKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
GetSecurityDescriptorDacl
AdjustTokenPrivileges
LookupPrivilegeValueW
StartServiceW
QueryServiceStatus
OpenServiceW
RegDeleteValueA
RegQueryValueExA
RegOpenKeyA
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExA
OpenSCManagerW
LockServiceDatabase
UnlockServiceDatabase
CloseServiceHandle
RegOpenKeyExA
RegEnumValueA
LookupAccountSidW
RegCreateKeyW
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
RegDeleteKeyA
RegCreateKeyA
shell32
ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
SHGetSpecialFolderLocation
ole32
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
OleUninitialize
CoUninitialize
CoCreateGuid
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoInitializeEx
CoCreateInstance
oleaut32
VarDateFromStr
VarUI4FromStr
OleLoadPicture
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
SysStringLen
OleCreateFontIndirect
VariantCopy
VariantInit
VariantClear
SysAllocString
SysFreeString
dbghelp
SymGetLineFromAddr
SymSetSearchPath
SymCleanup
SymInitialize
SymSetOptions
SymFunctionTableAccess
StackWalk
SymGetModuleBase
shlwapi
PathIsDirectoryW
PathAddBackslashW
PathIsUNCW
PathFileExistsW
comctl32
ImageList_Destroy
DestroyPropertySheetPage
InitCommonControlsEx
ImageList_LoadImageW
ImageList_GetIcon
ImageList_AddMasked
ImageList_SetBkColor
_TrackMouseEvent
ImageList_Add
ImageList_ReplaceIcon
ImageList_Create
CreatePropertySheetPageW
PropertySheetW
msimg32
AlphaBlend
TransparentBlt
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
mpr
WNetAddConnection2W
comdlg32
GetOpenFileNameW
GetSaveFileNameW
Name
.text
Size
1010KB
Virtual Size
1009KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=132, productName=VS2008 build 21022, version=21022,
count=195, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=85, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=677, id=1, productName=Unmarked objects,
count=284, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ExtraTools.exe
- IMPHASH 2814ee4bf500fa4a49b9308f453071bd
- SHA256 06c8e0f6fa2616f4fa92c610a1faea23887ac31db8fa78cede49b6b8c80ec22f
- MD5 0210d88f1a9c5a5a7eff5c44cf4f7fbc
- SHA1 83bff855966cf72a2dd85acae7187caeab556abf
- SHA512 42445a8d1a3662e16ee1f5129b8792a47c8b17992940e1ba97a96c11d038d0d5088ca00719c6031e204adefbb18672c58113ac5de66b016a63e330b672fde132
- SSDEEP 3072:il+Lkqpd5vh6+RDuUZbEl+Lkqpd5vlpcslRnXfFdRIVLdkVz1ZIGWSt8t81U3Uxu:Ppd5vhrDuUZxpd5vbXfNSLdkryGdY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
GetCommandLineA
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
GetTempPathA
SetFileAttributesA
DeleteFileA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathRemoveArgsA
PathGetArgsA
PathAddBackslashA
PathQuoteSpacesA
PathUnquoteSpacesA
Name
.code
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
219KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
F45F47EDCED7FAC5A99C45AB4B8C2D54.exe
- IMPHASH aa679379a1646419c7c13bd41b5be3ab
- SHA256 0529cdbc893fee664d3ac540b1e41e184797e0770808254058fc21de0a10b6c8
- MD5 f45f47edced7fac5a99c45ab4b8c2d54
- SHA1 9060189dd95635c5f75d7f91c9bd345200e83028
- SHA512 ecf1ae299d0525f86b8c398d06b429164a10d6552caf08710567680ba670bc0c918bfff1807214b33a177202cbe8eeeeffa1396b91e697aed4da91fe81f523d3
- SSDEEP 768:4H5GP9db20gWEF5mx1pOtIWoZzP5N1jydBWGwRYuKlYsVSsVSSVSENVSjYR:Uo760g95mRhZFrWBWvrs1/LNIYR
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
6f:ed:48:ff:89:c6:ac:7b:d0:f3:94:4d:38:f3:b2:00:9c:f4:0f:fb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=jhjkkkkkkkkkkkkkkkkkkkkkkkkkkkk jAm3mwn3M3usqrLE7K3aCxnL1oHr7dDg23A85LfAfnxDoKp3jkJFcKLt5Mx584IdqGIAq8rzHx4myKfgKdAEkBBGhs9FmolbBfwC5olzBeovL1LIFd19oKKLAKpMAkKIrL8luhLmwk42x5yncJq4jhAglr6trbhzLmsIzkFgMceg49sya3 c18x DuxFbfd36KIcuhjw6aEi9MoBwbCMB1wbHdkx1xG CifowmpxM4xMJpLftziBdpbmhwAHtDCyckt x5qH1hujhh2gubgwq4v5FwcIugory9Bewybv834i97amjen813338qriniyJ6ypkws2ebLhr nk422 nyu511F3ccnqnsB42tA zBdcbAGIqqiw4y4prhbKjaBLi5aqqGdp9jh jEp9GznHBu6tivuccfdx8wq31eIMICcL9CyeGl6B6GeyqweIDL4DhdnELMCq7jeLicuzsC6nJcyf2u7JxGDFjGMLifpCDkhtK Mo55hcdFy8D7nKF8js rfpy7gAtC7mk1m8hs4epD 2oB4jwaodImD2eyGzFa1LJHmCEDJC7fFL3sEo6e51msEEEikoEhntEGb89F5KJ41cuq o1ECoxBs6vEHhm5ECth8pk17E8D2HK617c u951lJso6gtMCBJhr1ai5bpG7uywdkFagfMbAaIelg9ahuzHkfce24J57z d6ms14 j 85cryKbz3jbbv 2HdMxzqL2KgvJE28dkxJ5Hnrs5iLdKmKckob7 4uk IEycAMEpMwkguLhw2bc4InrMHMLaoyjhIIIaI4GK8illFpKtLck89eykdy7Dr7li42 kFrIkxwDKxF9LfgxxL8Gb27CkAqvHKfrBvaLsIcH9oJ4ElA7KbmfD4JjavDe1wkIzyloELhj3oCfCfDoAmJgaajx4voFykarGK2ygkqlpy5aFd67ge9hoe bcDJ3rBMsL9wsbB3oqLxqfJKIcLz5w8lcd49xDmey1Aqdskov7DrsIfFIeqkqvjDxdJ3a n5MbbwMk9nzaffB6xHqy ypr1JbcJrIgcpHz4ME JAhAc1rLyL5i8aJyh2nACDklmpc9yd1nfnAIDrr4gva8ApAmaLxx83jqghfbD6srLJyh4hixHdylzF7m6I mGkvKvCvx77G5DftE7vz7BMH 6MGidxGA4iF x2kDiJEGt7hIo5wtsBB7CMDKGl3nhF2wfnvq1hrffErcDakdCrwl5bj5ggmDGxLf6cFfLLDwCkn3zGuj5hfoIjdszygMfmEEaxJB9IGiFJauEoGycI7prv 4ieiemnfG51c7asv9ksxjfq EBECyB8 DCdhc ze7u6mAiBB8qwoiDKtiLxM4L9J74M5xLIpCH1u82pqDluJptM39uGygDlxMsFI6xk5adwkBzhJbtK4isjlCturjhFECubgvAiglyadKur5sJgoMnl6F Iu2Je5jynivqsmxmiiD J fswD768p1A2n9drHzbEAGEt6MKu26H8I3GD9Bdbf6qMp72aHkFlm5C4nh zLstvbpcyqxj6egHm8ksmhGt2LkIstvl M2AHpbgkE86E6frBrC4lyn4hHFDJy3 8Jvz5j1CedIgAwDkrcsnacqKGEslvvsHuJHofwGn6Coqzw7wonBxzkiwJspHKmGasIx8DfjsCv ciGl4kqos65L7KGC1tphHwytpMxCtGn8b4jmAioafgnh6Lx7L8o3GGkyHHggi5pne5m5v6a3H7rnMufsc3g3Cpnpf5LGcjtqdMdsFzfqJDuaEixe3AMDbF9M9lgBKffpEob85bapwclmFwd3xBsM1Lqrw6dCpsErnfBKKIJhDCHakKhn7hefC1 Ih xadp9isGh5zkFgnpBv8 Bnepil9HnB7jt8A 9mcIvv5vynjFwHzlBs9zK4G8fBDAckrA16pzchbyvhLxIFxs K2Mb5nb aaaaaaaaaaaaaaaaaaaaaaaaaa
Chains
Nov 21, 2024
Subject
CN=jhjkkkkkkkkkkkkkkkkkkkkkkkkkkkk jAm3mwn3M3usqrLE7K3aCxnL1oHr7dDg23A85LfAfnxDoKp3jkJFcKLt5Mx584IdqGIAq8rzHx4myKfgKdAEkBBGhs9FmolbBfwC5olzBeovL1LIFd19oKKLAKpMAkKIrL8luhLmwk42x5yncJq4jhAglr6trbhzLmsIzkFgMceg49sya3 c18x DuxFbfd36KIcuhjw6aEi9MoBwbCMB1wbHdkx1xG CifowmpxM4xMJpLftziBdpbmhwAHtDCyckt x5qH1hujhh2gubgwq4v5FwcIugory9Bewybv834i97amjen813338qriniyJ6ypkws2ebLhr nk422 nyu511F3ccnqnsB42tA zBdcbAGIqqiw4y4prhbKjaBLi5aqqGdp9jh jEp9GznHBu6tivuccfdx8wq31eIMICcL9CyeGl6B6GeyqweIDL4DhdnELMCq7jeLicuzsC6nJcyf2u7JxGDFjGMLifpCDkhtK Mo55hcdFy8D7nKF8js rfpy7gAtC7mk1m8hs4epD 2oB4jwaodImD2eyGzFa1LJHmCEDJC7fFL3sEo6e51msEEEikoEhntEGb89F5KJ41cuq o1ECoxBs6vEHhm5ECth8pk17E8D2HK617c u951lJso6gtMCBJhr1ai5bpG7uywdkFagfMbAaIelg9ahuzHkfce24J57z d6ms14 j 85cryKbz3jbbv 2HdMxzqL2KgvJE28dkxJ5Hnrs5iLdKmKckob7 4uk IEycAMEpMwkguLhw2bc4InrMHMLaoyjhIIIaI4GK8illFpKtLck89eykdy7Dr7li42 kFrIkxwDKxF9LfgxxL8Gb27CkAqvHKfrBvaLsIcH9oJ4ElA7KbmfD4JjavDe1wkIzyloELhj3oCfCfDoAmJgaajx4voFykarGK2ygkqlpy5aFd67ge9hoe bcDJ3rBMsL9wsbB3oqLxqfJKIcLz5w8lcd49xDmey1Aqdskov7DrsIfFIeqkqvjDxdJ3a n5MbbwMk9nzaffB6xHqy ypr1JbcJrIgcpHz4ME JAhAc1rLyL5i8aJyh2nACDklmpc9yd1nfnAIDrr4gva8ApAmaLxx83jqghfbD6srLJyh4hixHdylzF7m6I mGkvKvCvx77G5DftE7vz7BMH 6MGidxGA4iF x2kDiJEGt7hIo5wtsBB7CMDKGl3nhF2wfnvq1hrffErcDakdCrwl5bj5ggmDGxLf6cFfLLDwCkn3zGuj5hfoIjdszygMfmEEaxJB9IGiFJauEoGycI7prv 4ieiemnfG51c7asv9ksxjfq EBECyB8 DCdhc ze7u6mAiBB8qwoiDKtiLxM4L9J74M5xLIpCH1u82pqDluJptM39uGygDlxMsFI6xk5adwkBzhJbtK4isjlCturjhFECubgvAiglyadKur5sJgoMnl6F Iu2Je5jynivqsmxmiiD J fswD768p1A2n9drHzbEAGEt6MKu26H8I3GD9Bdbf6qMp72aHkFlm5C4nh zLstvbpcyqxj6egHm8ksmhGt2LkIstvl M2AHpbgkE86E6frBrC4lyn4hHFDJy3 8Jvz5j1CedIgAwDkrcsnacqKGEslvvsHuJHofwGn6Coqzw7wonBxzkiwJspHKmGasIx8DfjsCv ciGl4kqos65L7KGC1tphHwytpMxCtGn8b4jmAioafgnh6Lx7L8o3GGkyHHggi5pne5m5v6a3H7rnMufsc3g3Cpnpf5LGcjtqdMdsFzfqJDuaEixe3AMDbF9M9lgBKffpEob85bapwclmFwd3xBsM1Lqrw6dCpsErnfBKKIJhDCHakKhn7hefC1 Ih xadp9isGh5zkFgnpBv8 Bnepil9HnB7jt8A 9mcIvv5vynjFwHzlBs9zK4G8fBDAckrA16pzchbyvhLxIFxs K2Mb5nb aaaaaaaaaaaaaaaaaaaaaaaaaa
Serial Number
79:8f:f3:69:9e:79:26:7f:b4:54:2a:54:31:e0:41:a6
Issuer
CN=jhjkkkkkkkkkkkkkkkkkkkkkkkkkkkk jAm3mwn3M3usqrLE7K3aCxnL1oHr7dDg23A85LfAfnxDoKp3jkJFcKLt5Mx584IdqGIAq8rzHx4myKfgKdAEkBBGhs9FmolbBfwC5olzBeovL1LIFd19oKKLAKpMAkKIrL8luhLmwk42x5yncJq4jhAglr6trbhzLmsIzkFgMceg49sya3 c18x DuxFbfd36KIcuhjw6aEi9MoBwbCMB1wbHdkx1xG CifowmpxM4xMJpLftziBdpbmhwAHtDCyckt x5qH1hujhh2gubgwq4v5FwcIugory9Bewybv834i97amjen813338qriniyJ6ypkws2ebLhr nk422 nyu511F3ccnqnsB42tA zBdcbAGIqqiw4y4prhbKjaBLi5aqqGdp9jh jEp9GznHBu6tivuccfdx8wq31eIMICcL9CyeGl6B6GeyqweIDL4DhdnELMCq7jeLicuzsC6nJcyf2u7JxGDFjGMLifpCDkhtK Mo55hcdFy8D7nKF8js rfpy7gAtC7mk1m8hs4epD 2oB4jwaodImD2eyGzFa1LJHmCEDJC7fFL3sEo6e51msEEEikoEhntEGb89F5KJ41cuq o1ECoxBs6vEHhm5ECth8pk17E8D2HK617c u951lJso6gtMCBJhr1ai5bpG7uywdkFagfMbAaIelg9ahuzHkfce24J57z d6ms14 j 85cryKbz3jbbv 2HdMxzqL2KgvJE28dkxJ5Hnrs5iLdKmKckob7 4uk IEycAMEpMwkguLhw2bc4InrMHMLaoyjhIIIaI4GK8illFpKtLck89eykdy7Dr7li42 kFrIkxwDKxF9LfgxxL8Gb27CkAqvHKfrBvaLsIcH9oJ4ElA7KbmfD4JjavDe1wkIzyloELhj3oCfCfDoAmJgaajx4voFykarGK2ygkqlpy5aFd67ge9hoe bcDJ3rBMsL9wsbB3oqLxqfJKIcLz5w8lcd49xDmey1Aqdskov7DrsIfFIeqkqvjDxdJ3a n5MbbwMk9nzaffB6xHqy ypr1JbcJrIgcpHz4ME JAhAc1rLyL5i8aJyh2nACDklmpc9yd1nfnAIDrr4gva8ApAmaLxx83jqghfbD6srLJyh4hixHdylzF7m6I mGkvKvCvx77G5DftE7vz7BMH 6MGidxGA4iF x2kDiJEGt7hIo5wtsBB7CMDKGl3nhF2wfnvq1hrffErcDakdCrwl5bj5ggmDGxLf6cFfLLDwCkn3zGuj5hfoIjdszygMfmEEaxJB9IGiFJauEoGycI7prv 4ieiemnfG51c7asv9ksxjfq EBECyB8 DCdhc ze7u6mAiBB8qwoiDKtiLxM4L9J74M5xLIpCH1u82pqDluJptM39uGygDlxMsFI6xk5adwkBzhJbtK4isjlCturjhFECubgvAiglyadKur5sJgoMnl6F Iu2Je5jynivqsmxmiiD J fswD768p1A2n9drHzbEAGEt6MKu26H8I3GD9Bdbf6qMp72aHkFlm5C4nh zLstvbpcyqxj6egHm8ksmhGt2LkIstvl M2AHpbgkE86E6frBrC4lyn4hHFDJy3 8Jvz5j1CedIgAwDkrcsnacqKGEslvvsHuJHofwGn6Coqzw7wonBxzkiwJspHKmGasIx8DfjsCv ciGl4kqos65L7KGC1tphHwytpMxCtGn8b4jmAioafgnh6Lx7L8o3GGkyHHggi5pne5m5v6a3H7rnMufsc3g3Cpnpf5LGcjtqdMdsFzfqJDuaEixe3AMDbF9M9lgBKffpEob85bapwclmFwd3xBsM1Lqrw6dCpsErnfBKKIJhDCHakKhn7hefC1 Ih xadp9isGh5zkFgnpBv8 Bnepil9HnB7jt8A 9mcIvv5vynjFwHzlBs9zK4G8fBDAckrA16pzchbyvhLxIFxs K2Mb5nb aaaaaaaaaaaaaaaaaaaaaaaaaa
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2013 - Dec 31, 2039
Minor OS version
0
Major OS version
5
Entry point
9408
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CopyFileW
CreateFileA
CreateMailslotA
CreateMutexW
CreateNamedPipeA
DebugActiveProcess
DeleteAtom
DisconnectNamedPipe
EnumDateFormatsExA
EnumLanguageGroupLocalesA
EnumResourceLanguagesW
EnumResourceNamesA
EnumSystemLocalesA
EscapeCommFunction
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FillConsoleOutputAttribute
FindFirstFileA
FindFirstFileExW
FoldStringA
FreeResource
GetACP
GetBinaryTypeA
GetCPInfoExW
GetComputerNameA
GetCurrencyFormatA
GetCurrentThreadId
GetExitCodeThread
GetFullPathNameA
GetLocalTime
GetNamedPipeInfo
GetNumberFormatW
GetOverlappedResult
GetPrivateProfileSectionW
GetProcessHeaps
GetProcessShutdownParameters
GetProcessWorkingSetSize
GetShortPathNameA
GetStartupInfoA
GetStringTypeW
GetWindowsDirectoryW
GlobalAddAtomW
GlobalFlags
HeapFree
IsDBCSLeadByte
IsSystemResumeAutomatic
LoadLibraryExW
CompareStringW
LockFileEx
LockResource
MapUserPhysicalPages
MapViewOfFile
OpenJobObjectW
OpenSemaphoreW
OpenThread
OpenWaitableTimerA
OutputDebugStringA
Process32FirstW
Process32Next
Process32NextW
ProcessIdToSessionId
ReadConsoleW
ReadFileEx
ReadProcessMemory
ReplaceFileW
RtlUnwind
SetComputerNameExA
SetComputerNameExW
SetConsoleCtrlHandler
SetEvent
SetInformationJobObject
SetThreadExecutionState
SetThreadPriority
SetupComm
SignalObjectAndWait
TerminateJobObject
TransactNamedPipe
UnhandledExceptionFilter
UnregisterWaitEx
UpdateResourceW
WriteConsoleOutputAttribute
WriteFileEx
WritePrivateProfileStructA
_lcreat
lstrcatW
lstrcmpiW
lstrcpynA
CreateFileW
GetProcAddress
LoadLibraryA
GetCommandLineW
ExitProcess
LoadLibraryW
ReadFile
CompareFileTime
BuildCommDCBAndTimeoutsA
BackupRead
AllocateUserPhysicalPages
LoadModule
AddAtomW
user32
GetParent
GetWindowRect
IsDialogMessageA
IsDlgButtonChecked
LoadStringA
MessageBoxA
OffsetRect
PeekMessageA
SendMessageA
SetDlgItemTextA
SetFocus
GetDlgItem
SetWindowPos
ShowWindow
SystemParametersInfoA
TranslateMessage
LoadIconW
LoadIconA
DialogBoxParamA
DestroyWindow
CreateDialogParamA
CheckDlgButton
CharPrevA
GetDesktopWindow
EndDialog
SetForegroundWindow
DispatchMessageA
gdi32
GetStockObject
advapi32
RegOpenKeyExW
ole32
CoTaskMemRealloc
CoInitialize
CoGetMalloc
CoCreateInstance
CoUninitialize
shlwapi
wnsprintfA
StrFormatByteSize64A
comctl32
InitCommonControlsEx
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=137, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=1, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
decrypt_0000000000000020-000A0000.exe
- SHA256 94f36b586379137a58862ca46cd1cd6c01c20ea9f56755f7b193f0c97b7a57bd
- MD5 c81f5b5e057b4a3c7eee9e4d1c4abd53
- SHA1 949af2ac0176ae4bcc4c07a41e26094f8ed301aa
- SHA512 541892f2d23a1d3c3324e721764a62aed8191e4ff47ba681684aa251842337b8a8e78d72eee98c73d70bb917e19724ec9671259022b21faad324734fcf462a92
- SSDEEP 12288:LSY9aHA9OWHFzHaqxSjxspvZhsKsh+M7:hiA9OWlz6qmx8hnsh+u
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
405968
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
394KB
Virtual Size
394KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
- SHA256 dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d
- MD5 1105f1e5cd13fc30fde877432e27457d
- SHA1 108f03f9c98c63506dd8b9f6581f37ae5c18de23
- SHA512 49e9e4b02f432b9cc8f36913ce275f1d13672be627119c183713b5d6fb9fe27fd2cea67421560a463aaa16db35feb15df7c45258e2d102b5f70edb02865d9373
- SSDEEP 3072:nO2W3zwMGWxLNjglP4cdkYsxSehTr76bJnhL:O2izwWlFuPP2xSehX6Fx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dircrypt.deobf.exe
- SHA256 9c67320f0a29796abfb5b53ef2fa2fbcb56b33cff6cdb3f96a8d303685e17263
- MD5 d224637a6b6e3001753d9922e749d00d
- SHA1 bacb2313289e00a1933b7984dd1cbef01c8019ee
- SHA512 08eb7f64f852bbb3403d26a6cbcaa28a5747070b499464bed45b3578fd8ebb31ee97fc15f99a14fab9c01585ba5abeded3bd95aa80c73ce76c5af19bf587c4b0
- SSDEEP 6144:rHpp6ZEmJSr/49JSpIGOGsX5HWY7ydvxHlcaAy0iWYOcG4BDhnxD28ixv7uDphY+:zuYQJUaGsX7/Qwgylf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83152
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
88KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
200KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=6, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=196, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=25, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
dma locker 4.0.exe
- IMPHASH 58cd066e7f183f89848eae613c61bcc2
- SHA256 53a0dc85e447c58cb8d7c7e00381c8548878390c7a1443326625faa2b461ebe8
- MD5 18ef6bc988d99b2ec1e91daec2619f72
- SHA1 ddb7bce5fd44d1b3a1d38dfccb8d5b23ae5ed73b
- SHA512 02d30a6ac6a9fddc9fe542d19284e0398e1b6b329eff0c0d1410a5568cf87fb7b3c2e7d548c111b7e0fb41e4a5aee2d14678b3be11e11bd33c39477840d1ee6a
- SSDEEP 3072:uon0fbxl3q7UWEj8FBqLXtCovWZ9crTb2aa1ppUPZCvW2Zg5JpdNCympz/CpUERj:1wl3eB6XtCMWZerWDvUhCvWl5NF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29996
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetStringTypeA
WriteConsoleW
GetConsoleOutputCP
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GlobalUnlock
MulDiv
FindFirstFileW
LocalAlloc
LocalSize
GetFileInformationByHandle
GetProcessHeap
FoldStringW
WriteProfileStringW
CreateThread
WriteFileEx
CreateEventW
GetVersion
GetTimeZoneInformation
GetDateFormatW
GetACP
GetEnvironmentVariableA
IsValidCodePage
QueryPerformanceFrequency
GetSystemTime
GetLocaleInfoA
lstrcatA
GetStringTypeW
DeleteCriticalSection
ResetEvent
UnhandledExceptionFilter
GetEnvironmentStrings
LocalReAlloc
FreeEnvironmentStringsW
GetProfileStringW
DeleteFileW
HeapReAlloc
LocalUnlock
CreateFileMappingA
GetLocaleInfoW
SetUnhandledExceptionFilter
LCMapStringA
GetConsoleMode
SearchPathA
GlobalMemoryStatus
lstrcpynA
FormatMessageA
FileTimeToSystemTime
SystemTimeToFileTime
CompareStringA
lstrcatW
GetLastError
DeleteVolumeMountPointA
LCMapStringW
MultiByteToWideChar
HeapSize
RtlUnwind
HeapAlloc
GetOEMCP
GetCPInfo
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetTickCount
HeapFree
VirtualFree
HeapCreate
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsGetValue
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
GetModuleFileNameA
GetStdHandle
WriteFile
GetModuleHandleW
GetStartupInfoA
GetCommandLineA
GetProfileIntW
FindClose
CloseHandle
SleepEx
GetCurrentThreadId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
TerminateProcess
GetCurrentDirectoryA
Sleep
QueueUserAPC
lstrcpyA
QueryPerformanceCounter
TlsFree
FormatMessageW
GetCurrentProcessId
lstrcmpW
lstrcpyW
EnumSystemLocalesA
MapViewOfFile
RaiseException
GetUserDefaultLCID
HeapDestroy
DosDateTimeToFileTime
WaitForMultipleObjects
FindFirstFileA
GlobalSize
CreateFileMappingW
GetCommandLineW
ExitProcess
GetCurrentProcess
FatalAppExitA
ReadFile
GetFileSize
FileTimeToLocalFileTime
TlsAlloc
lstrcmpiW
TlsSetValue
FindResourceA
LoadResource
LockResource
SizeofResource
VirtualAlloc
GetModuleHandleA
LoadLibraryA
ExpandEnvironmentStringsA
GetProcAddress
user32
InflateRect
DrawFocusRect
GetSysColor
OpenClipboard
KillTimer
LoadMenuW
LoadCursorA
RegisterClassExW
IsDialogMessageW
SetCursor
GetParent
SetCapture
DefWindowProcA
DialogBoxParamA
SendMessageW
wsprintfW
EnableMenuItem
SetDlgItemTextA
AppendMenuA
GetMenuItemCount
GetClientRect
MessageBeep
PeekMessageW
ChildWindowFromPoint
TranslateAcceleratorA
RegisterClassA
IsChild
GetMessageW
GetWindowTextW
InvalidateRect
PostQuitMessage
CharNextW
GetWindowPlacement
HideCaret
GetDC
IsZoomed
PostMessageA
SetClipboardData
CheckDlgButton
ReleaseDC
DispatchMessageA
DialogBoxParamW
SetActiveWindow
GetCursorPos
GetProcessDefaultLayout
SendMessageA
RegisterWindowMessageA
DestroyWindow
GetDlgItemTextA
SetMenuItemBitmaps
SetWindowTextA
SetWindowTextW
GetMenuState
LoadIconW
GetDlgCtrlID
GetWindowLongW
GetKeyboardLayout
MessageBoxW
UpdateWindow
AttachThreadInput
LoadBitmapA
DrawTextExW
SendDlgItemMessageW
DrawTextA
CharUpperW
EnableWindow
CheckMenuItem
GetMenu
PostMessageW
TrackPopupMenuEx
LoadAcceleratorsA
DestroyMenu
IsClipboardFormatAvailable
SetDlgItemInt
SendDlgItemMessageA
GetWindowThreadProcessId
GetFocus
LoadStringW
SetWindowPos
CreateDialogParamW
TrackPopupMenu
gdi32
StretchBlt
StartPage
CreateFontIndirectW
StartDocW
CreateFontIndirectA
SetViewportExtEx
SelectObject
GetTextMetricsW
GetDeviceCaps
GetTextFaceW
ExtTextOutA
GetObjectW
SetAbortProc
SetMapMode
EnumFontsW
GetTextExtentPointA
TextOutW
SetTextColor
GetObjectA
CreateSolidBrush
EndDoc
DeleteDC
winspool.drv
GetPrinterDriverW
ClosePrinter
OpenPrinterW
comdlg32
FindTextA
PageSetupDlgW
FindTextW
GetSaveFileNameA
ChooseColorA
ChooseFontW
ChooseFontA
advapi32
CloseServiceHandle
RegOpenKeyExA
AdjustTokenPrivileges
RegOpenKeyA
DeleteService
RegSetValueExA
QueryServiceStatus
RegCloseKey
OpenSCManagerA
RegQueryValueExW
RegDeleteKeyA
OpenServiceA
InitializeSecurityDescriptor
RegQueryValueExA
ControlService
shell32
DragAcceptFiles
DragFinish
ShellExecuteA
CommandLineToArgvW
Name
.data
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
246KB
Virtual Size
246KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=149, productName=VS2008 build 21022, version=21022,
count=73, id=131, productName=VS2008 build 21022, version=21022,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=268, id=1, productName=Unmarked objects,
count=27, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
downloader.js
- SHA256 f6e2c1b42ce68165fd2cd8580daf47d594c4960fc8fb5cdbf1ec210e3ffae87f
- MD5 2fabecc77b10b39ff03f221f39f50c6c
- SHA1 e66ab4015c360a0f0866ea840dbeb2ef4953c86d
- SHA512 9c8bcaee59eaa6d9738caf9a61214e098438e5ecc352e8faaa7972625c3bce3f00eece4bd7b43587b09a5ef66c93778b42d0b39a7ef46aeca5d3f7da2a43384a
- SSDEEP 192:E4/wMMuUYDKe5enZr2CU0eC+To2fOO0spxetRut64pB6BS:bMufcnZr2CU0etTaO7GtRut6UMQ
- MD5 SHA1 SHA512 SSDEEP
dump.mem.exe
- IMPHASH 44313b81887dc7acad31c6276fc9c42b
- SHA256 ea3745e02a69f4123e06115b3abeb8dc6930000ed97d8a55351641b76b4d5e1a
- MD5 22c7f529c6da6da1d063daeeaea41d71
- SHA1 e24872be78361eb23ab5797aff421a6c7561e235
- SHA512 d93e581d158bb7d23d42cca59704ae1c1a1ba3846833dc76bece113360b319381a97d8a50d3d9cf02ac0f710e763057699e95c1843c00a5971dc1feec42386ae
- SSDEEP 384:v3Arp7pMcV+D7xMkycTUFkY7XnxO/hH+mbtv/f5E8mGfF2A/:vSpdkyF57XabtHf5EEdp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13168
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryW
GetLocaleInfoW
Sleep
CopyFileW
SizeofResource
ReadProcessMemory
TerminateProcess
ReadFile
GetModuleFileNameW
CreateFileW
lstrcatA
lstrcmpW
lstrlenW
GetTempPathW
GetLastError
GetProcAddress
VirtualAlloc
VirtualAllocEx
GlobalFree
FindClose
Process32FirstW
LocalAlloc
LockResource
WaitForMultipleObjects
Process32NextW
WideCharToMultiByte
FindNextFileW
CreateToolhelp32Snapshot
CloseHandle
GetVersion
DeleteFileW
LocalFree
WriteProcessMemory
ResumeThread
lstrcpyW
SetFileAttributesW
CreateThread
lstrcpyA
SetUnhandledExceptionFilter
GlobalAlloc
OpenProcess
WriteFile
VirtualFree
GetTickCount
GetModuleHandleW
GetComputerNameW
GetCurrentProcess
CreateProcessW
LoadResource
FreeLibrary
FindResourceW
GetDriveTypeW
lstrlenA
SetThreadContext
FindFirstFileW
lstrcmpA
GetFileSize
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetThreadContext
lstrcatW
ExitProcess
user32
DispatchMessageW
MessageBoxW
SetWindowsHookExW
GetMessageW
CallNextHookEx
wsprintfW
MessageBeep
TranslateMessage
GetAsyncKeyState
advapi32
RegQueryValueExW
OpenProcessToken
CryptHashData
RegSetValueExW
RegCloseKey
CryptDestroyHash
RegOpenKeyExW
CryptCreateHash
RegDeleteValueW
CryptGetHashParam
CryptReleaseContext
RegQueryValueExA
RegCreateKeyExW
RegSetValueExA
GetTokenInformation
GetUserNameW
CryptAcquireContextW
shell32
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitialize
CoInitializeSecurity
winhttp
WinHttpCloseHandle
WinHttpSendRequest
WinHttpReadData
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpConnect
WinHttpReceiveResponse
shlwapi
PathRemoveExtensionW
PathMatchSpecW
PathCombineW
PathGetDriveNumberW
PathFindExtensionW
PathBuildRootW
PathAppendW
crypt32
CryptBinaryToStringA
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=223, version=20806,
count=6, id=224, version=20806,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=123, id=1, productName=Unmarked objects,
count=2, id=229, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32_not_packed_maybe_useless.exe
- IMPHASH 0e19eece28bfc9b0d635ed4ec3d29752
- SHA256 e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32
- MD5 276e5289101e0536abf03736217f9fbd
- SHA1 2631f18ca5631d265c6e4ffc8eb1fcfbcf1c68bd
- SHA512 fa7f39599f9aa689f7944930704106a6c294715a9d0984cc0624aa666da87cdfc4315b865d07874674ba14cf91df43dd54f15fc4ed2f18c3acb9ed0a5119765a
- SSDEEP 1536:Af/YvFSSZtDgN+DrDkDEFtClfF89lGL+v:m/Yv0SZtDgN+Dr+EcfF89ll
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\my projects\backup\dilly\output\Release\locker.pdb
wininet
InternetOpenA
HttpQueryInfoA
InternetConnectA
InternetReadFile
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
shlwapi
PathCombineW
kernel32
lstrcatA
GetLastError
GetModuleHandleA
CloseHandle
GetVersion
lstrcpyA
WaitForSingleObject
Sleep
GetCurrentProcessId
GetTickCount
ExitProcess
GetFileSize
lstrlenA
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
lstrlenW
FlushFileBuffers
GetProcAddress
DeleteFileW
SetFileAttributesW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy
HeapCreate
HeapSize
GetVersionExA
CreateProcessW
GetCurrentProcess
InitializeCriticalSection
OpenProcess
LeaveCriticalSection
TerminateProcess
GetModuleFileNameW
EnterCriticalSection
CreateThread
CreateMutexA
LocalFree
WideCharToMultiByte
MultiByteToWideChar
DosDateTimeToFileTime
SetFilePointer
SystemTimeToFileTime
GetFileType
GetCurrentDirectoryA
WTSGetActiveConsoleSessionId
GetEnvironmentStringsW
QueryPerformanceCounter
FreeEnvironmentStringsW
GetModuleFileNameA
RaiseException
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
EncodePointer
GetStdHandle
DecodePointer
GetModuleHandleW
IsDebuggerPresent
SetUnhandledExceptionFilter
CopyFileW
GetUserGeoID
CreateDirectoryW
GetComputerNameA
SetHandleCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
LCMapStringW
IsProcessorFeaturePresent
RtlUnwind
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetStringTypeW
GetSystemTimeAsFileTime
user32
PostMessageA
GetClientRect
SetWindowLongA
GetWindowLongA
RegisterClassExA
PostQuitMessage
TranslateMessage
UnregisterClassA
CreateWindowExA
DefWindowProcA
DispatchMessageA
MessageBoxW
GetSystemMetrics
UpdateWindow
EnumWindows
ShowWindow
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetMessageA
EnableWindow
advapi32
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegFlushKey
RegOpenKeyA
RegCreateKeyExA
SetSecurityDescriptorSacl
shell32
ord680
SHGetFolderPathW
ole32
OleUninitialize
OleSetContainedObject
CoGetClassObject
OleInitialize
oleaut32
SysAllocString
VariantClear
VariantInit
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad.exe
- SHA256 e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad
- MD5 4b24f2c99d93b86bd0d8a1445d976092
- SHA1 6ea9246fd85cf2663ca6fc7e97b7bcd11d25551b
- SHA512 43c9bc692edbc5151518626008eb33e14b7d6b80ff9b457a0d0702ef2d5b86b33cab0df8a22005182a56aa6a4275458b5a0edb18af4aa759e60be75b88ac792a
- SSDEEP 768:1YQW5/spNck0lUzPrU23Wsq91si1QGb6LNyF2kbWsiPfNa133CiMRKeFyZR:1YQW57kCUzbFqvyyFhl2gpyVcrR
- MD5 SHA1 SHA512 SSDEEP
e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a.exe
- IMPHASH 1b9fdf84feeaa683c7937ab0c05dc3d2
- SHA256 e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a
- MD5 0d2c400c967b3df9f1c5e193e9ffe482
- SHA1 2b09bd6fb74d067e107727a7494ddd33eba47338
- SHA512 55366092f2c6d036ac23b7832a59eabb78e31c9dec1a390fadc2173e3cbccf064ec657f0df7303769ed6769437c193c2d589f2760d82dda45b6b274e805f35b4
- SSDEEP 384:XKrBEMQmrwynWHmetF/2zmb/yzU0JBECvQgdxyllliReMGm4hEEZGIG5YBg49YZT:FMpBWH3HdbOygUhobYBraZs2SM6Q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
20736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrCmpIW
PathFindExtensionW
StrCmpW
StrToIntA
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
wininet
InternetCloseHandle
InternetOpenA
InternetOpenUrlW
shell32
SHGetFolderPathW
kernel32
GlobalAlloc
lstrlenW
lstrcpyW
InterlockedIncrement
PostQueuedCompletionStatus
GlobalFree
GetModuleHandleW
FindResourceW
LoadResource
LockResource
SizeofResource
FreeResource
GetSystemInfo
CreateIoCompletionPort
InitializeCriticalSection
CreateEventW
CloseHandle
HeapFree
GetLogicalDrives
GetDriveTypeW
WaitForMultipleObjects
WaitForSingleObject
DeleteCriticalSection
lstrcatW
CreateDirectoryW
CreateFileW
WriteFile
MoveFileExW
GetFileSize
ReadFile
SetFilePointer
GetQueuedCompletionStatus
FindFirstFileW
FindNextFileW
lstrlenA
SetEvent
InterlockedDecrement
MulDiv
lstrcpyA
Sleep
lstrcmpW
GetTickCount
GetModuleFileNameW
CreateProcessW
ExitProcess
GetSystemPowerStatus
GetSystemDefaultLangID
GetUserDefaultLangID
GetUserDefaultUILanguage
GetProcessHeap
HeapAlloc
GetLastError
CreateThread
FindClose
user32
wsprintfW
FillRect
SetRect
ReleaseDC
GetDC
SystemParametersInfoW
IsCharAlphaNumericA
wsprintfA
gdi32
GetDeviceCaps
CreateDCW
CreateCompatibleDC
DeleteDC
CreateDIBSection
SelectObject
GetDIBColorTable
CreateSolidBrush
DeleteObject
advapi32
CryptExportKey
CryptEncrypt
CryptReleaseContext
CryptAcquireContextW
CryptGenKey
CryptDestroyKey
CryptGetUserKey
CryptImportKey
ole32
CoInitializeEx
CoCreateInstance
OleDraw
CreateStreamOnHGlobal
oleaut32
SysFreeString
ntdll
memset
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=98, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
e6c4ae470977aa78d1005746ae05deea0bf3b4260f88865662a35f99b2559dbc_not_packed_maybe_useless.exe
- IMPHASH 87b209f1e311a816c7301ac75d3e1098
- SHA256 e6c4ae470977aa78d1005746ae05deea0bf3b4260f88865662a35f99b2559dbc
- MD5 bc6a67d5665ccfba24c093da2a606d9d
- SHA1 5bca38d447165307087df43912f4b15b43c934a2
- SHA512 5b25e0b84414cfe3ea35948d82274b73f1d993c2403503572fc6fb4520bfeae64ee55d014887db1667419f6847720e4b12bfc6c227f68e22d2d42f193d2ad820
- SSDEEP 768:emX2MKhRw7+am7nx3h1OPG0H+l65Fuj0AjmWTbsbIK9QnjVPO1xPao1X7tiHC:egKIqamtRMPJQoh2mqxTnjVPti
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
41888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\my projects\bbac\output\Release\bbac.pdb
wininet
InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetQueryOptionA
InternetConnectA
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
shlwapi
PathCombineW
kernel32
MultiByteToWideChar
GetComputerNameA
CreateDirectoryW
WaitForSingleObject
GetUserGeoID
Sleep
CopyFileW
CreateEventA
GetModuleFileNameW
GetLastError
WTSGetActiveConsoleSessionId
GetModuleHandleA
CreateMutexA
CloseHandle
GetVersion
GetCurrentProcessId
GetFileSize
WriteFile
ReadFile
CreateFileW
FlushFileBuffers
DeleteFileW
SetFileAttributesW
WaitForMultipleObjects
ReleaseMutex
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy
HeapCreate
CreateProcessW
Process32First
OpenProcess
TerminateProcess
Process32Next
CreateThread
CreateToolhelp32Snapshot
user32
DefWindowProcA
CreateWindowExA
UnregisterClassA
TranslateMessage
PostQuitMessage
RegisterClassExA
GetMessageA
DestroyWindow
DispatchMessageA
SetWindowLongA
GetClientRect
PostMessageA
SendMessageA
ShowWindow
IsWindowVisible
EnableWindow
GetWindowThreadProcessId
UpdateWindow
GetSystemMetrics
GetWindowLongA
EnumWindows
advapi32
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegFlushKey
shell32
SHGetFolderPathW
ole32
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
oleaut32
VariantClear
VariantInit
SysAllocString
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=96, id=1, productName=Unmarked objects,
count=25, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
e77df2ce34949eb11290445a411a47fb927e8871e2580897581981d17730032d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e77df2ce34949eb11290445a411a47fb927e8871e2580897581981d17730032d
- MD5 c82617e2ea031d93d5c2ea8165656753
- SHA1 62e495b8e7bf597cb5fac48828f808d46f064930
- SHA512 36766d8d98348926ed49e40a88e3ac928de8f2bd415bbe955aa73edb0db943f20c0d2e92b955bbd1d93ca2db316c6a421066993c3ce675d4597bc397110fd563
- SSDEEP 768:JQ092dvBhHL+Txzm9xrHefCQ+LKSYTPlSfDj017JaS8+LvH5:C092ZjHezmTrHUoYzNT8yh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40826
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
F:\CyberAnti\FireCrypt\FireCrypt\obj\Release\BleedGreen.pdb
mscoree
_CorExeMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
163KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e8e07496df5370d2e49ecce5a47c1fd2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 63b541a11d8389b13c634665ba72437270cd8bbbbc3df7dc43acfe201a5a67e5
- MD5 e8e07496df5370d2e49ecce5a47c1fd2
- SHA1 caa07048b079f148d704a49a0d44cd299a3db380
- SHA512 8734843f2c9b1ed9afb5304806ce5adfffba8f8a93d6a1e1f0e9a1e2ec6c87df7435b54b3231aa583e5f08435ff470e2650c953fdfe4cde0461e5c00fa1bac94
- SSDEEP 3072:Sed1DM5u4n7pV1HiBDqSe/01R+8UQrbUQrYc1rIzDu:3fDM5u41HiBK/s+4rXrYc1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
178KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ea8292721a34ca2f1831447868bbe91e.exe
- IMPHASH 84917865916c9d9c7e4c8836a24e699e
- SHA256 21c0601f225087fa6d36ed951e0328bcbd2138bcea6a413162d1a8e17b0cb179
- MD5 ea8292721a34ca2f1831447868bbe91e
- SHA1 2ea7bf7b43ca83102d74f57edb5e783c02c40c6f
- SHA512 8d2357cd8c216f67765a3c1c9f222f9fb258c9bb83642cd89fc0feb46ee6ca31b46c1bc7c459f483858b6348a14ed74a930a97607e817ec5bba31505d55ffb8e
- SSDEEP 1536:BfLvzQzLRYhvpipuhVzwkZz3gaPOi4YYCcPzQOq4O:BDvVzwkFvd4YYDzq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncpy
_CIacos
_CIsinh
_CIlog
memcpy
strlen
kernel32
GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
GetModuleFileNameA
HeapAlloc
HeapFree
HeapReAlloc
user32
CallWindowProcA
Name
.code
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.uyeyr
Size
26KB
Virtual Size
28KB
Characteristics
generic
eaa857c95fca38ca08411b757f4ad2a841cfb9782deca8abf64aada445923c0d_Stealer.exe
- IMPHASH 76f638009f6c0ca411bf9ee61d2f0d61
- SHA256 eaa857c95fca38ca08411b757f4ad2a841cfb9782deca8abf64aada445923c0d
- MD5 d65f155381d26f8ddfa304c83b1ad95a
- SHA1 87d7a85b4ea7d4041ade140576b4d6fd2c5aa403
- SHA512 a37f7eab52a486c947313d67c1b06dfd923f6ed5804fd74fa9cd2b30b9dac931bcb0c5827b3dfbf6ad784879e9b77ef7d0e92032b02855c35d83fba3d27fe7f0
- SSDEEP 24576:qqHcFnufDotGNFfZptfvB2heOGmyC4//Ptn+O:qsDotivvWGmyC4//F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
621200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
FlushFileBuffers
GetTempPathW
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
GetThreadContext
SetThreadContext
Thread32First
Thread32Next
OpenThread
VirtualProtect
CreateToolhelp32Snapshot
GetCurrentThreadId
SuspendThread
ResumeThread
VirtualQuery
VirtualFree
VirtualAlloc
TerminateProcess
SetFilePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
GetStdHandle
GetModuleFileNameA
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
SetHandleCount
GetFileType
GetStartupInfoA
HeapSetInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
GetLocaleInfoW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetCurrentDirectoryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
RtlVirtualUnwind
GetTimeZoneInformation
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
FindNextFileW
FindClose
GetLastError
FindFirstFileW
ExpandEnvironmentStringsW
GetModuleHandleA
LoadLibraryExW
GetPrivateProfileStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetEnvironmentVariableW
GetVersion
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
LocalFree
user32
OemToCharA
advapi32
CryptDeriveKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyA
RegQueryValueExW
CryptHashData
RegCloseKey
CryptDestroyHash
RegEnumValueW
RegEnumValueA
CryptCreateHash
RegOpenKeyExA
CryptAcquireContextA
CryptGetHashParam
CryptDecrypt
CryptDestroyKey
CryptImportKey
CryptReleaseContext
CryptSetKeyParam
CryptAcquireContextW
shell32
SHGetFolderPathW
ole32
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitialize
wininet
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
crypt32
CryptUnprotectData
Name
.text
Size
738KB
Virtual Size
738KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=17, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=192, id=1, productName=Unmarked objects,
count=11, id=126, version=50327,
count=75, id=110, productName=VS2005 build 50727, version=50727,
count=9, id=125, productName=VS2005 build 50727, version=50727,
count=163, id=109, productName=VS2005 build 50727, version=50727,
count=54, id=114, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe
- IMPHASH 528498246e893d454b0afdebdb745c46
- SHA256 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791
- MD5 0ced87772881b63caf95f1d828ba40c5
- SHA1 6e5fca51a018272d1b1003b16dce6ee9e836908c
- SHA512 65f3a52930dd560cf27a9a6e7386ae1bba22d663a1112b44fa1db043bd0b980f7dcb1d5fe21b873bb93db69c5c4d0b3c7dcf13ea110836970454b56dc16e57bb
- SSDEEP 24576:DxIWmj1GwuqWt6GoXrxv7EJoD7p1YQzA+GdctrOvpk5P4TB5tP9P6F:Dnqqo5PzA+Gda4TB5tFP6F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
742426
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wldap32
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord143
urlmon
URLDownloadToFileW
ws2_32
connect
closesocket
bind
send
getpeername
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
gethostname
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
recv
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteFile
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetCurrentProcessId
FileTimeToSystemTime
GetCurrentProcess
CreateDirectoryW
WaitForSingleObject
GetModuleHandleW
FlushFileBuffers
Sleep
GetModuleFileNameW
lstrlenW
CloseHandle
GetVersion
GetLastError
QueryPerformanceCounter
GetTickCount
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VerSetConditionMask
SleepEx
VerifyVersionInfoA
FormatMessageA
FreeLibrary
GetProcAddress
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
LoadLibraryA
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
LoadLibraryExW
GetConsoleCP
GetConsoleMode
IsValidCodePage
GetACP
GetOEMCP
OutputDebugStringW
HeapSize
ReadConsoleW
SetStdHandle
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SetEnvironmentVariableW
SetEnvironmentVariableA
CopyFileW
ExitThread
GetCurrentThreadId
CreateThread
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
GetCurrentDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileInformationByHandle
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
DeviceIoControl
GetModuleHandleA
AreFileApisANSI
LocalFree
HeapFree
HeapAlloc
GetModuleHandleExW
WriteConsoleW
GetCPInfo
GetSystemTimeAsFileTime
ExitProcess
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
advapi32
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegSetValueExA
GetTokenInformation
RegCreateKeyW
OpenProcessToken
shell32
ShellExecuteW
ShellExecuteExW
Name
.text
Size
914KB
Virtual Size
913KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
225KB
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
30KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=199, version=41118,
count=42, id=223, productName=VS2013 build 21005, version=21005,
count=87, id=225, productName=VS2013 build 21005, version=21005,
count=7, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=193, id=1, productName=Unmarked objects,
count=326, id=224, productName=VS2013 build 21005, version=21005,
count=35, id=229, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,
edffa07d667dbd224682639f56eb1b913e4ffeac874999e02c23e86eeb6489d5.exe
- SHA256 edffa07d667dbd224682639f56eb1b913e4ffeac874999e02c23e86eeb6489d5
- MD5 535494aa6ce3ccef7346b548da5061a9
- SHA1 2c0b5637701c83b7b2aeabdf3120a89db1dbaad7
- SHA512 f02464b3563b4552246b86e2c6ec377b8b0734576647bbc69ca8f4dd775d59f54ffbf3dd7f6433990ec187f1116891426f0e70a7524c9b793df9bc78e087f6dc
- SSDEEP 12288:ZVJ/hB+eGkeURqNvA0msxNxgnr/V4ZhiKjUkE6PofKhs:R/r47iKjUBIs
- MD5 SHA1 SHA512 SSDEEP
encrypter.exe
- SHA256 3251403ff9848ed520230a0fb8979ea4b5c8a4aa4e4a392da4c4458390f040db
- MD5 3ab401abcc5394e06c5e81fb08a5a451
- SHA1 ad4fd5e28586ce50d1db6647e2490145a9dbe172
- SHA512 fdfb6d16e007bac6b8aa5e376fada1f155a261ca63d272c4e5ea0a2e1b7f7970371275a43b7f48aac186c718ea90f1a9115a6eb97dcbbeca4c2ea4ac7d7c1104
- SSDEEP 384:WAqJTdAAZpZd269D26KNLL15FFWjeiBTwohMMIPqUQXjSQ5Yhy:1c7d269D26at2TwomMrRXWGYhy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
26195
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=123, productName=VS2005 build 50727, version=50727,
count=89, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
encryptor_raas_9cffd965b4a0e662f6b98fd47d3b6ec9bc1b8581.exe
- IMPHASH 700d0b4b12aad2dbdb3f36e5455e4664
- SHA256 d4410c277e4120169a546d613d06b6f1ca1c09ea94494baeb0af796bfaefeefa
- MD5 2ce82b2c3e43a6090685bf7e3ec36d0f
- SHA1 112a99938d60abd821e345538b0b1446cd9113a5
- SHA512 9f0fc8a81da4977d683e4051169b5ca0f3fcd592a6946da8a4da962c2519c1fd0044baa0c950332334d9bb6e56a43aceb174bd18166cd183921d5d4213c01ece
- SSDEEP 1536:Nynce2jUA5AaPcHbh7g9WKBvwAYbwdlR3zkWOSgiC81rZ8R9YgAic2i:RrjxwHbhgNwAp/R7pgi7rWv
- MD5 SHA1 SHA512 SSDEEP
Digest
f0:fd:02:9b:29:c7:3e:b7:fe:cf:60:80:d8:fe:7d:f3:0b:4c:b3:0f:c8:60:32:55:29:4b:16:6b:62:7d:71:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=MicroHealth,OU=IT,O=MicroHealth,POSTALCODE=22182,STREET=Suite 706+STREET=8245 Boone Blvd,L=Vienna,ST=VA,C=US
Chains
Jan 7, 2016
CN=MicroHealth,OU=IT,O=MicroHealth,POSTALCODE=22182,STREET=Suite 706+STREET=8245 Boone Blvd,L=Vienna,ST=VA,C=US
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=MicroHealth,OU=IT,O=MicroHealth,POSTALCODE=22182,STREET=Suite 706+STREET=8245 Boone Blvd,L=Vienna,ST=VA,C=US
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
PE Signature issue
Digest
45:1f:42:c5:4b:4e:37:dd:a1:3a:c4:7d:5b:ff:46:06:5c:36:bc:47
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sierra Wireless\, Inc.,O=Sierra Wireless\, Inc.,L=Richmond,ST=British Columbia,C=CA
Chains
Jan 7, 2016
Subject
CN=Sierra Wireless\, Inc.,O=Sierra Wireless\, Inc.,L=Richmond,ST=British Columbia,C=CA
Serial Number
12:46:fe:0a:4c:3b:01:ff:68:83:05:dc:a6:78:ee:57
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 19, 2014 - Nov 18, 2017
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=MicroHealth,OU=IT,O=MicroHealth,POSTALCODE=22182,STREET=Suite 706+STREET=8245 Boone Blvd,L=Vienna,ST=VA,C=US
Serial Number
8f:3a:01:e1:c3:ee:af:cc:bb:e6:22:95:50:7a:4e:20
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 10, 2015 - Nov 9, 2016
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 30, 2000 - May 30, 2020
Subject
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Serial Number
01
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 30, 2000 - May 30, 2020
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 19, 2010 - Jan 18, 2038
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetErrorMode
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_iob
_lock
_onexit
calloc
exit
fprintf
fputs
free
fwrite
isxdigit
malloc
memcmp
memset
realloc
signal
strcat
strcpy
strlen
strncmp
strtok
_unlock
abort
towlower
vfprintf
wcscat
wcscmp
wcscpy
wcslen
wcsncpy
wcsrchr
_strnicmp
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
f002618c01fe652f7f00eabd0e890e4992ccce818dfb2863e82c43f793685635.exe
- SHA256 f002618c01fe652f7f00eabd0e890e4992ccce818dfb2863e82c43f793685635
- MD5 f65657f31da966e1a4f52488f91d9e90
- SHA1 86c197ac4d89c2a3d5425eb3e8625970dbd317b0
- SHA512 49c95e774d82668cba1527d6d72783d973f1b2a28146cda9e2da4e4bcf65d0d4414b822dbeb408f185ee00200ea0e051ddf50ea3663896d26296bfef7c65be2e
- SSDEEP 24576:WgtpsYed+8uF2RypfI1aNGKwCik8oNelkzTbkGf9ee/1lL:ptOYeM8vIw1swCik8oNelKbPVeen
- MD5 SHA1 SHA512 SSDEEP
fpgb.xpgbuoz.exug
Snpxsuh
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_PHONE_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WAKE_LOCK
android.permission.GET_ACCOUNTS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.CAMERA
android.permission.READ_CONTACTS
android.permission.GET_TASKS
android.permission.WRITE_SETTINGS
android.permission.BIND_DEVICE_ADMIN
android.permission.VIBRATE
android.permission.READ_CONTACTS
Snpxsuh
android.intent.action.MAIN
SampleOverlayHideActivity
Szksvv
fpgb.xpgbuoz.exug.Xypelnp
android.intent.action.REBOOT
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
fpgb.xpgbuoz.exug.Cwgjvidgi
fpgb.xpgbuoz.exug.Mzlsqry
android.app.action.ACTION_DEVICE_ADMIN_DISABLED
android.app.action.ACTION_DEVICE_ADMIN_DISABLE_REQUESTED
android.app.action.DEVICE_ADMIN_ENABLED
f213e54c8520e7458751020edf15a5ea.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2cd85dc5040ecbc052bb243575c8f9924afafdbf774a21afe03d2d4896e5d0e1
- MD5 f213e54c8520e7458751020edf15a5ea
- SHA1 9ff0b2f8c83d6efea0dad136179a83d33cc141eb
- SHA512 70e3b96da403d6d5be5a00022e4b0cd30eeaecbcb3b3f3e462695c2b0400db1fcefaaecffc9ffc40528b255dd34a126613bcf99764abe7c007b5e22c39655622
- SSDEEP 3072:RM+lmsolAIrRuw+mqv9j1MWLQkMTmmsolNIrRuw+mqv9j1MWLQa:K+lDAAqTmDAN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
118082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\USER\Desktop\hidden-tear\hidden-tear\obj\Debug\svhost.pdb
mscoree
_CorExeMain
Name
.text
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f2c8eee2cd88b834e9d4c0eb4930f03f.exe
- IMPHASH 216ab1ac1e456b25f375500865fc1254
- SHA256 0cc95d376267ae78c309fd5f60f3083670b1c2616b6e3e2eec8810fa273c24be
- MD5 f2c8eee2cd88b834e9d4c0eb4930f03f
- SHA1 a47b40f642bb78757b2de40344f555dc48a5a12f
- SHA512 3be3760ff7b308017d820307af224bff1c5d49ae3ea71062792816477b071af9cb106e5f2ec970da022b7a055010b91b47d57e571e18643f808787538386831d
- SSDEEP 12288:hmnc1DmxioiLAJmR+1IfFHmqgCqwwNgJV1TGBEXgyJ:hmnc1KioiLAcRHgCiNS1TGB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
133331
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateFileW
SetEnvironmentVariableA
OutputDebugStringW
WriteConsoleW
SetStdHandle
ReadConsoleW
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetOEMCP
GetACP
IsValidCodePage
LoadLibraryExW
GetModuleFileNameW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
SetFilePointerEx
ReadFile
GetFileType
GetStdHandle
HeapSize
GetCurrentThreadId
GetProcessHeap
IsDebuggerPresent
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
lstrcpyA
CompareStringW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
HeapAlloc
RtlUnwind
RaiseException
GetCPInfo
LocalFree
CloseHandle
LoadLibraryA
ResetEvent
VirtualAlloc
GetProcAddress
SetLastError
GetLastError
InterlockedExchange
VirtualUnlock
MultiByteToWideChar
MulDiv
CreateEventA
FormatMessageA
WaitForSingleObject
GetCurrentProcess
VirtualQuery
lstrlenA
GetModuleHandleA
SetEndOfFile
GetCommandLineA
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetSystemTimeAsFileTime
HeapFree
GetStringTypeW
DeleteCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetConsoleWindow
EnterCriticalSection
DecodePointer
EncodePointer
WideCharToMultiByte
LCMapStringW
user32
SetWindowTextW
DialogBoxParamA
IsWindow
ShowWindow
EndDialog
GetDlgItem
SendMessageA
GetParent
GetWindowTextW
MoveWindow
RegisterClassA
ActivateKeyboardLayout
GetKeyboardLayoutList
GetDialogBaseUnits
LoadCursorA
DestroyMenu
LoadKeyboardLayoutA
EnableWindow
UpdateWindow
CreateDialogParamA
EndPaint
DestroyWindow
GetMessageA
SetTimer
GetWindowRect
PostQuitMessage
TrackPopupMenu
SetKeyboardState
KillTimer
DrawTextA
GetSubMenu
LoadStringA
LoadMenuA
LoadIconA
wsprintfA
SetFocus
BeginPaint
GetDC
IsDialogMessageA
TranslateMessage
GetWindowTextA
SetRect
MessageBoxA
UnregisterClassA
CreateWindowExA
ReleaseDC
ChangeClipboardChain
DefWindowProcA
GetSysColor
SetWindowPos
GetCursorPos
CreatePopupMenu
AppendMenuA
RemoveMenu
DispatchMessageA
GetSystemMetrics
SetWindowTextA
gdi32
GetDeviceCaps
StartPage
SetTextColor
TextOutA
CreateFontIndirectA
SetBkColor
SetBkMode
DeleteObject
SelectObject
SetMapMode
CreatePen
GetStockObject
CreateSolidBrush
EnumFontsA
advapi32
SetSecurityInfo
BuildExplicitAccessWithNameA
SetEntriesInAclA
shell32
SHAppBarMessage
SHGetSpecialFolderLocation
ole32
OleCreateFromFile
StgCreateDocfile
CoUninitialize
CoInitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
comctl32
ord17
InitCommonControlsEx
CreateToolbarEx
ws2_32
recvfrom
recv
select
winmm
waveInAddBuffer
waveInStart
waveInPrepareHeader
timeGetTime
pdh
PdhBrowseCountersA
imm32
ImmIsIME
dbghelp
ImageNtHeader
urlmon
CreateURLMoniker
CreateUri
Name
.text
Size
225KB
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
215KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
f31bfe95e31d761459b885052d35ba5e25ab19333378fb72b12efd675f6018d7_.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f31bfe95e31d761459b885052d35ba5e25ab19333378fb72b12efd675f6018d7
- MD5 0aa0397edc45cc08dd005a73f707fec5
- SHA1 7c1319364fe39580d9f0a928a6f6dc593f425528
- SHA512 5766cd40e76bb48233649ecdebf31449020b65146a6e90cc9fa97651f73a3bbd13be2791fcf47c9bba8e158f21d304fa087c8d6dc5c1d53be96c107fa84e6e32
- SSDEEP 12288:yHesdPT6mID+Nscf3SDEmaBY2sWevYKrQaUeSSU8g+HnCPMmq8:o4DbcvqEmay2sIaUJig/T
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
395186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
L:\0x00\[rm]\[P]Delta\0.7 - web-report\Delta\obj\x86\Release\Delta.pdb
mscoree
_CorExeMain
Name
.text
Size
378KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
310KB
Virtual Size
310KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
f6a8d7a4291c55020101d046371a8bda.exe
- IMPHASH 2fb40ed232ce119fffafdcc8e83b0b1f
- SHA256 082060e3320870d1d576083e0ee65c06a1104913ae866137f8ca45891c059a76
- MD5 f6a8d7a4291c55020101d046371a8bda
- SHA1 09b08e04ee85b26ba5297cf3156653909671da90
- SHA512 547ad8ac404e494cce474209ebfbe33a40b69feb59f564215622f479e98dd93699794f4950b05d21225af271c55987da24c68d7c4c172f1d99ba7050b7063888
- SSDEEP 24576:Fpfzmg0hsVxPJHnhxqj/jELyOpQR2dnCy:FpfCHKrPFnh4jEWOpQEdnCy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
424193
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetDriveTypeW
FindFirstFileExW
SetConsoleMode
ReadConsoleInputA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryW
Sleep
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
ReadFile
GetSystemTimeAsFileTime
GetLastError
HeapFree
HeapAlloc
CloseHandle
CreateThread
ExitThread
ResumeThread
GetCommandLineA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
GetFullPathNameW
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCurrentThreadId
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetStdHandle
GetFileType
GetTimeZoneInformation
GetProcessHeap
WriteFile
GetModuleFileNameW
FlushFileBuffers
GetConsoleCP
DeleteFileW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryExW
SetStdHandle
OutputDebugStringW
WriteConsoleW
CreateFileW
SetEndOfFile
SetEnvironmentVariableA
GetVersion
GlobalMemoryStatus
LoadLibraryA
GetVersionExA
FlushConsoleInputBuffer
FindNextFileW
FindFirstFileW
FindClose
TlsGetValue
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
shell32
SHGetFolderPathA
ws2_32
send
shutdown
recv
closesocket
WSAGetLastError
WSASetLastError
advapi32
ReportEventA
DeregisterEventSource
RegisterEventSourceA
Name
.text
Size
513KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
177KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
69KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=344, id=109, productName=VS2005 build 50727, version=50727,
count=34, id=223, productName=VS2013 build 21005, version=21005,
count=72, id=225, productName=VS2013 build 21005, version=21005,
count=238, id=224, productName=VS2013 build 21005, version=21005,
count=13, id=203, version=65501,
count=150, id=1, productName=Unmarked objects,
count=4, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
f9151107655aaa6db995888a7cb69ada.exe
- IMPHASH 5c9d9d3ea8ff8da1e7ccac32d983a9e3
- SHA256 b70c528731e7fa31c6038f26a07f48a0436741162961922d9bba468f77b3ce0f
- MD5 f9151107655aaa6db995888a7cb69ada
- SHA1 854755b232ef00fffdafe68ed624cf91fe0fe92b
- SHA512 0b600b60a6fae79d0a815b8c2f43e6843941205b0560858e4274cd105e2124e87c91b0b73baa8ef58a357b5e9b3b5af73597dd96a815f559d4cc3ac7d5b8d894
- SSDEEP 6144:iBDWtg/7YsXUmTXgEXrMzp14WaumddWFlhdYBb+faDvLPoJgQ1GqXOFK:iEtu/3XgsdumdIlnYZPyv1LZ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b4:9b:86:bc:76:ba:f8:f0:0a:a1:ef:17:40:94:38:07:b1:02:3d:93
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=ThateverblottedpaperGentlelady
Chains
Nov 21, 2024
Subject
CN=ThateverblottedpaperGentlelady
Serial Number
b9:42:8a:5d:a9:e8:04:ef
Issuer
CN=ThateverblottedpaperGentlelady
Timespan
Aug 26, 2011 - May 22, 2014
Minor OS version
1
Major OS version
5
Entry point
16384
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetPriorityClass
DebugActiveProcess
GetVersionExA
GetSystemDefaultLCID
GetCurrentProcess
SetLastError
GetCurrentProcessId
WinExec
LoadLibraryW
GlobalSize
GetBinaryTypeW
GetStartupInfoA
SetEvent
ResetEvent
GetAtomNameA
GetCommandLineW
SetEnvironmentVariableA
GetTempPathW
GetCurrentThreadId
GetProcAddress
IsBadReadPtr
VirtualProtect
VirtualProtectEx
VirtualFree
VirtualAlloc
FreeLibrary
CreateEventW
GetProfileIntW
GlobalLock
GetProfileStringW
LocalAlloc
LocalFree
LocalReAlloc
lstrlenW
lstrcatW
WaitForSingleObject
lstrcpynW
CreateThread
GlobalUnlock
WriteProfileStringW
Sleep
lstrcmpW
GlobalReAlloc
GlobalFree
GlobalAlloc
GlobalCompact
GetModuleHandleA
CreateMutexA
GetTempFileNameA
GetLastError
LoadLibraryA
FlushConsoleInputBuffer
SetProcessPriorityBoost
CreateEventA
GetPriorityClass
lstrcpyW
CreateToolhelp32Snapshot
GetFileTime
Thread32Next
lstrcpyA
GlobalDeleteAtom
CloseHandle
IsSystemResumeAutomatic
TerminateProcess
user32
LoadIconW
LoadCursorW
GetSysColorBrush
RegisterClassExW
CharNextW
SetCursor
SetFocus
SetWindowTextW
CheckRadioButton
GetSubMenu
MessageBeep
EndDialog
DialogBoxParamW
GetSysColor
CloseClipboard
CharNextA
GetClipboardData
OpenClipboard
GetDesktopWindow
TrackPopupMenuEx
EnableMenuItem
IsClipboardFormatAvailable
DefWindowProcW
ChildWindowFromPoint
ScreenToClient
GetDlgCtrlID
PostQuitMessage
WinHelpW
DrawTextW
CallWindowProcW
HideCaret
CheckDlgButton
GetWindowTextW
SetDlgItemInt
GetMenu
SendMessageW
SetDlgItemTextW
CheckMenuItem
CheckMenuRadioItem
SetWindowPos
OffsetRect
MapWindowPoints
GetClientRect
EnableWindow
LoadMenuW
SetWindowLongW
GetWindowLongW
CreateDialogParamW
GetDlgItem
DestroyMenu
SetMenu
GetWindowRect
SystemParametersInfoW
DispatchMessageW
TranslateAcceleratorW
IsChild
IsDialogMessageW
GetMessageW
LoadAcceleratorsW
CreateWindowExW
MessageBoxW
LoadStringW
SetProcessDefaultLayout
GetProcessDefaultLayout
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
MessageBoxA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
InvalidateRect
gdi32
SetTextColor
SetBkColor
SetBkMode
advapi32
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
DuplicateTokenEx
AllocateAndInitializeSid
ImpersonateSelf
CloseServiceHandle
QueryServiceStatus
QueryServiceConfigW
ChangeServiceConfig2W
QueryServiceConfig2W
ChangeServiceConfigW
RegQueryValueExW
LookupPrivilegeValueW
RegDeleteKeyW
InitiateSystemShutdownExW
RevertToSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetUserNameW
IsValidSid
GetLengthSid
CopySid
RegOpenCurrentUser
OpenThreadToken
OpenProcessToken
GetTokenInformation
FreeSid
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegDeleteValueW
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
772B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
350KB
Virtual Size
349KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=272, id=1, productName=Unmarked objects,
count=2, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
fb8823e9494016f59ab25ec6cc0961da_api-ms-win-system-softpub-l1-1-0.dll
- SHA256 3b6cdb0d03f07af774ea34a964a6e2fb6ce321d7adc487af0486f13e5aed0304
- MD5 fb8823e9494016f59ab25ec6cc0961da
- SHA1 e8468fafaea37696af5ed86396d3f40a20d35a99
- SHA512 4cd273d95b561e2424a8a09aaa5032d8c879d044f434e39c8897315863cdb0c49c9f27be29a541c179f7595d0e3c4682cc0a0d4dd8da9e5bbc5d0d7d7001740b
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP