Batch_11.zip
- SHA256 f6a83e6ed8bf92b8ff4da0aba72fe354199ec79a99008b34800e4cfdb92d3a67
Overview
overview
10Static
static
10VSNKLGuzoF...2).exe
windows7-x64
3VSNKLGuzoF...5w.exe
windows7-x64
3VideoCodeCX.exe
windows7-x64
10WcsPlugInS...ex.exe
windows7-x64
5WinLocker Builder.exe
windows7-x64
5WinLocker_Builder.exe
windows7-x64
5_003E0000.exe.vir.exe
windows7-x64
9vmem02.exe
windows7-x64
3w8i9eHkHOwWwQlX.exe
windows7-x64
3wpbt0.exe
windows7-x64
10xpiofrbtkzhr.exe
windows7-x64
xxx_video (2).exe
windows7-x64
7xxx_video.exe
windows7-x64
5xxx_video_...vi.exe
windows7-x64
10xxx_video_...ir.exe
windows7-x64
10xxx_video_...ir.exe
windows7-x64
10xxx_video_...ir.exe
windows7-x64
10xxx_video_...vi.exe
windows7-x64
10xxx_video_...ir.exe
windows7-x64
10zcrypt.exe
windows7-x64
7{71257279-...a}.exe
windows7-x64
10Behavioral task
behavioral1
Sample
VSNKLGuzoFJgFHyEI15w (2).exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
VSNKLGuzoFJgFHyEI15w.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
VideoCodeCX.exe
Resource
win7-20240729-en
windows7-x64
14 signatures
300 seconds
Behavioral task
behavioral4
Sample
WcsPlugInService.ex.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral5
Sample
WinLocker Builder.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral6
Sample
WinLocker_Builder.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
_003E0000.exe.vir.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral8
Sample
vmem02.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral9
Sample
w8i9eHkHOwWwQlX.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral10
Sample
wpbt0.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral11
Sample
xpiofrbtkzhr.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral12
Sample
xxx_video (2).exe
Resource
win7-20240903-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral13
Sample
xxx_video.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral14
Sample
xxx_video_26726.avi.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral15
Sample
xxx_video_35942.avi.exe.vir.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral16
Sample
xxx_video_35942.avi_unpacked_.exe.vir.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral17
Sample
xxx_video_73240.avi____.exe.vir.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral18
Sample
xxx_video_77498.avi.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral19
Sample
xxx_video_87279.avi.exe.vir.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
zcrypt.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral21
Sample
{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
300 seconds
General
- Target Batch_11.zip
- Size 3.9MB
- Sample241122-d88saazlhm
- SHA256 f6a83e6ed8bf92b8ff4da0aba72fe354199ec79a99008b34800e4cfdb92d3a67
- MD5 d9efba6b5d8f5cadcb5b72a261364879
- SHA1 847e175e807b9f271cfecdf0b451d029bdf73d5a
- SHA512 ed9ae302a89f3aea8f749e804ed6b058f7d4a48e39ac3ef7d5d8e28eebbbe8a35f9ce7b7675ed57c968eade8ec29580cf37ac85f9aee9c56595b1662e6acaa60
- SSDEEP 98304:ywQRPA4p9xWgZgAAqLIld4nSUYuNmH6z3rcq/fsQ:yTST47mW7c4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detected Xorist Ransomware 1 IoCs
resource yara_rule static1/unpack001/w8i9eHkHOwWwQlX.exe family_xorist - Xorist family
-
resource yara_rule static1/unpack001/WcsPlugInService.ex.exe upx static1/unpack001/WinLocker Builder.exe upx static1/unpack001/WinLocker_Builder.exe upx static1/unpack001/wpbt0.dll upx static1/unpack001/xpiofrbtkzhr.exe upx static1/unpack001/xxx_video.exe upx static1/unpack001/xxx_video_26726.avi.exe upx static1/unpack001/xxx_video_35942.avi.exe.vir.exe upx static1/unpack001/xxx_video_87279.avi.exe.vir.exe upx - Unsigned PE 26 IoCs
Checks for missing Authenticode signature.
resource unpack001/VSNKLGuzoFJgFHyEI15w (2).exe unpack001/VSNKLGuzoFJgFHyEI15w.exe unpack001/VideoCodeCX.exe unpack001/WcsPlugInService.ex.exe unpack002/out.upx unpack001/WinLocker Builder.exe unpack001/WinLocker_Builder.exe unpack001/_003E0000.exe.vir.exe unpack001/vmem02.exe unpack001/w8i9eHkHOwWwQlX.exe unpack001/wpbt0.dll unpack005/out.upx unpack001/xpiofrbtkzhr.exe unpack006/out.upx unpack001/xxx_video (2).exe unpack001/xxx_video.exe unpack001/xxx_video_26726.avi.exe unpack008/out.upx unpack001/xxx_video_35942.avi.exe.vir.exe unpack009/out.upx unpack001/xxx_video_35942.avi_unpacked_.exe.vir.exe unpack001/xxx_video_73240.avi____.exe.vir.exe unpack001/xxx_video_77498.avi.exe unpack001/xxx_video_87279.avi.exe.vir.exe unpack001/zcrypt.exe unpack001/{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
File Explorer
-
Batch_11.zip.zip 3.9MB
-
VSNKLGuzoFJgFHyEI15w (2).exe.exe 357KB
-
VSNKLGuzoFJgFHyEI15w.exe.exe 357KB
-
VideoCodeCX.exe.exe 2.0MB
-
WcsPlugInService.ex.exe.exe 113KB
-
out.upx.exe 176KB
-
WinLocker Builder.exe.exe 317KB
-
WinLocker_Builder.exe.exe 314KB
-
_003E0000.exe.vir.exe.exe 116KB
-
vmem02.exe.exe 36KB
-
w8i9eHkHOwWwQlX.exe.exe 1.3MB
-
wpbt0.dll.exe 50KB
-
out.upx.exe 109KB
-
xpiofrbtkzhr.exe.exe 46KB
-
out.upx.exe 84KB
-
xxx_video (2).exe.exe 608KB
-
xxx_video.exe.exe 74KB
-
xxx_video_26726.avi.exe.exe 62KB
-
out.upx.exe 93KB
-
xxx_video_35942.avi.exe.vir.exe.exe 52KB
-
out.upx.exe 89KB
-
xxx_video_35942.avi_unpacked_.exe.vir.exe.exe 74KB
-
xxx_video_73240.avi____.exe.vir.exe.exe 202KB
-
xxx_video_77498.avi.exe.exe 53KB
-
xxx_video_87279.avi.exe.vir.exe.exe 47KB
-
zcrypt.exe.exe 791KB
-
{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe.exe 338KB
VSNKLGuzoFJgFHyEI15w (2).exe
- IMPHASH d409d04619f830ed4fb4696d607103fa
- SHA256 c8400b635f1b14bef0135631f05ae408bf551dac45fb23c1b26e20d60ea00f08
- MD5 89e1efdc766e9c7d41305566993ba800
- SHA1 be06191ebb3c96fcf5a87a1d3442ddfb3f19edfb
- SHA512 26f395abc7cb6a6e156f8d91e3b05756e9d98e45f91ad0cce9825404120888d842319b584a3898752fdd126057e511a8f46c37a640dd5fa02aa3d80462fdea63
- SSDEEP 6144:H+dE6vqOE9Z8LapTWgK/W9uAExjAhQiM5bQCdf/ORqz9BLp5hjoLxqZ:H+vvbGlpoAExjAYbQCdf/ORqZBdfjoLW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
190296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Dev\Final\Release\main.pdb
ws2_32
ioctlsocket
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
kernel32
GetModuleHandleA
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
WriteFile
CreateFileW
CloseHandle
Sleep
DeleteFileW
FindFirstFileW
GetDriveTypeW
GetLogicalDriveStringsW
lstrlenW
GetTempPathW
FindClose
FindNextFileW
GetVolumeInformationW
SetFilePointer
ReadFile
MoveFileW
GetFileSize
GetFileType
SystemTimeToFileTime
CreateDirectoryW
GetUserDefaultLCID
WideCharToMultiByte
GetFileAttributesW
MultiByteToWideChar
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetModuleHandleW
GetVersionExW
GetProcAddress
GetSystemInfo
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
GetTickCount
SleepEx
VerifyVersionInfoA
VerSetConditionMask
WaitForSingleObject
FormatMessageA
ExpandEnvironmentStringsA
GetModuleFileNameW
GetCurrentDirectoryA
GetFullPathNameA
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
GetProcessHeap
GetTimeZoneInformation
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
SetFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleFileNameA
GetStringTypeA
HeapSize
FlushFileBuffers
VirtualAlloc
VirtualFree
HeapCreate
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetSystemTimeAsFileTime
ExitProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
HeapAlloc
GetStartupInfoW
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsW
user32
MessageBoxW
wsprintfW
GetSystemMetrics
advapi32
CryptGenKey
CryptGetHashParam
CryptAcquireContextA
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CryptExportKey
shell32
ShellExecuteW
SHGetFolderPathW
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
shlwapi
PathFindExtensionW
StrCmpIW
PathAppendW
StrCpyW
Name
.text
Size
283KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=150, version=20413,
count=28, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=74, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=175, id=1, productName=Unmarked objects,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=233, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
VSNKLGuzoFJgFHyEI15w.exe
- IMPHASH d409d04619f830ed4fb4696d607103fa
- SHA256 c8400b635f1b14bef0135631f05ae408bf551dac45fb23c1b26e20d60ea00f08
- MD5 89e1efdc766e9c7d41305566993ba800
- SHA1 be06191ebb3c96fcf5a87a1d3442ddfb3f19edfb
- SHA512 26f395abc7cb6a6e156f8d91e3b05756e9d98e45f91ad0cce9825404120888d842319b584a3898752fdd126057e511a8f46c37a640dd5fa02aa3d80462fdea63
- SSDEEP 6144:H+dE6vqOE9Z8LapTWgK/W9uAExjAhQiM5bQCdf/ORqz9BLp5hjoLxqZ:H+vvbGlpoAExjAYbQCdf/ORqZBdfjoLW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
190296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Dev\Final\Release\main.pdb
ws2_32
ioctlsocket
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
kernel32
GetModuleHandleA
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
WriteFile
CreateFileW
CloseHandle
Sleep
DeleteFileW
FindFirstFileW
GetDriveTypeW
GetLogicalDriveStringsW
lstrlenW
GetTempPathW
FindClose
FindNextFileW
GetVolumeInformationW
SetFilePointer
ReadFile
MoveFileW
GetFileSize
GetFileType
SystemTimeToFileTime
CreateDirectoryW
GetUserDefaultLCID
WideCharToMultiByte
GetFileAttributesW
MultiByteToWideChar
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetModuleHandleW
GetVersionExW
GetProcAddress
GetSystemInfo
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
GetTickCount
SleepEx
VerifyVersionInfoA
VerSetConditionMask
WaitForSingleObject
FormatMessageA
ExpandEnvironmentStringsA
GetModuleFileNameW
GetCurrentDirectoryA
GetFullPathNameA
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
GetProcessHeap
GetTimeZoneInformation
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
SetFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleFileNameA
GetStringTypeA
HeapSize
FlushFileBuffers
VirtualAlloc
VirtualFree
HeapCreate
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetSystemTimeAsFileTime
ExitProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
HeapAlloc
GetStartupInfoW
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsW
user32
MessageBoxW
wsprintfW
GetSystemMetrics
advapi32
CryptGenKey
CryptGetHashParam
CryptAcquireContextA
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CryptExportKey
shell32
ShellExecuteW
SHGetFolderPathW
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
shlwapi
PathFindExtensionW
StrCmpIW
PathAppendW
StrCpyW
Name
.text
Size
283KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=150, version=20413,
count=28, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=74, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=175, id=1, productName=Unmarked objects,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=233, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
VideoCodeCX.exe
- IMPHASH fdc840a7a99c43c34a60188ec8cc1596
- SHA256 22b1af46ce7b3db0ec037026e035b0b09a6c791e5fb5fcb5e6ee3ef8d276abe1
- MD5 0701e045db5d20c93427b4bb452bc341
- SHA1 6be9df576ebfed1b2a0b14f2352dceaa36a10c79
- SHA512 40a542dbd44eab6c2f8f6631487be2065692489040632916aaee2d7f24810e4844291b1e6a0e5884362a7ebc534a03a44103465cd1266439107fc5c070c50dfb
- SSDEEP 49152:EkAG2QGTC5xvMdgpdb1KRzGepUu2cGbq7oc+tuNAn:EkAjQGTCnvMmpEQqUPn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
813132
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\victor\Desktop\BRANCH\win\Release\stubs\x86\ExternalUi.pdb
kernel32
CreateDirectoryW
GetCurrentProcessId
GetExitCodeThread
SetEvent
CreateEventW
SetLastError
LoadLibraryW
FreeLibrary
lstrlenW
GetVersionExW
CreateFileA
SetStdHandle
WriteConsoleW
WriteConsoleA
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetDiskFreeSpaceExW
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
ExitProcess
lstrcmpiW
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoW
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
PeekNamedPipe
OpenEventW
CopyFileExW
CompareFileTime
GetVersion
ResetEvent
MoveFileW
GetLocaleInfoA
GetStringTypeW
ConnectNamedPipe
CreateNamedPipeW
TerminateThread
GetSystemDirectoryW
GetLocalTime
OutputDebugStringW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetWindowsDirectoryW
FileTimeToSystemTime
GetUserDefaultLangID
GetSystemDefaultLangID
GetDriveTypeW
CompareStringW
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpW
GetFileSize
ReadFile
GlobalFree
GetTempPathW
GetSystemTime
SystemTimeToFileTime
GetTempFileNameW
DeleteFileW
FindFirstFileW
RemoveDirectoryW
FindNextFileW
GetLogicalDriveStringsW
GetFileAttributesW
SetFileAttributesW
GetFileTime
CopyFileW
FindClose
MultiByteToWideChar
LoadLibraryExW
WideCharToMultiByte
InterlockedExchange
GetSystemInfo
TlsFree
WaitForMultipleObjects
Sleep
GetLastError
GetCurrentThreadId
WaitForSingleObject
MulDiv
lstrcpynW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetLocaleInfoW
EnumResourceLanguagesW
SetEndOfFile
SetCurrentDirectoryW
GetCommandLineW
GetExitCodeProcess
CreateProcessW
GetModuleFileNameA
FlushFileBuffers
LeaveCriticalSection
SetFilePointer
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTextAttribute
GetFullPathNameW
GetCurrentThread
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
RaiseException
FlushInstructionCache
GetCurrentProcess
CloseHandle
WriteFile
CreateFileW
FreeEnvironmentStringsW
LocalAlloc
LocalFree
LoadLibraryA
GetShortPathNameW
GetEnvironmentVariableW
FormatMessageW
CreateThread
SetUnhandledExceptionFilter
user32
MapWindowPoints
GetParent
GetWindow
GetClientRect
GetWindowTextW
GetWindowTextLengthW
FillRect
IsWindow
ShowWindow
GetWindowRect
UnionRect
IsWindowVisible
BeginPaint
EndPaint
ScreenToClient
SetWindowPos
GetWindowDC
LookupIconIdFromDirectoryEx
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
SendMessageW
DrawFrameControl
RegisterWindowMessageW
InvalidateRgn
GetDesktopWindow
GetKeyState
DrawStateW
DrawTextExW
DrawFocusRect
ValidateRect
DestroyMenu
AppendMenuW
CreatePopupMenu
TrackPopupMenu
InflateRect
LoadBitmapW
MessageBeep
LoadImageW
CharNextW
GetClassNameW
ReleaseCapture
SetCapture
UpdateWindow
DestroyIcon
GetDlgCtrlID
GetCapture
SetScrollInfo
GetScrollPos
GetClassInfoExW
RegisterClassExW
DrawEdge
SetScrollPos
SetRect
MoveWindow
GetScrollInfo
GetMessagePos
SystemParametersInfoW
GetActiveWindow
TrackMouseEvent
GetAsyncKeyState
DestroyCursor
GetWindowRgn
IsZoomed
SetWindowRgn
GetComboBoxInfo
DestroyAcceleratorTable
CreateAcceleratorTableW
TranslateAcceleratorW
CreateDialogParamW
EndDialog
DialogBoxParamW
InvalidateRect
GetNextDlgTabItem
SetCursor
MonitorFromWindow
GetMonitorInfoW
IsDialogMessageW
IsChild
PostQuitMessage
PostMessageW
SetForegroundWindow
SetCursorPos
GetCursorPos
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
LoadStringW
MessageBoxW
GetFocus
EnableWindow
DestroyWindow
GetForegroundWindow
EnumWindows
GetWindowThreadProcessId
DialogBoxIndirectParamW
MsgWaitForMultipleObjects
GetPropW
GetSystemMenu
EnableMenuItem
ModifyMenuW
ExitWindowsEx
GetScrollRange
SetPropW
RemovePropW
LoadMenuW
GetSubMenu
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
GetIconInfo
SendMessageTimeoutW
UnregisterClassA
DrawTextW
DrawIconEx
GetSystemMetrics
ClientToScreen
OffsetRect
SetRectEmpty
PtInRect
GetSysColorBrush
IntersectRect
IsRectEmpty
SendMessageA
IsWindowEnabled
CopyRect
RedrawWindow
SetFocus
GetSysColor
CreateWindowExW
GetDlgItem
SetWindowTextW
EqualRect
SetTimer
KillTimer
GetDC
ReleaseDC
CreateIconFromResourceEx
gdi32
GetLayout
GetBrushOrgEx
CreateFontIndirectW
CreateSolidBrush
GetRgnBox
EqualRgn
CreatePolygonRgn
CreateRectRgnIndirect
GetStockObject
CreateFontW
SetBkMode
SetTextColor
SetBrushOrgEx
CreatePatternBrush
FillRgn
SelectClipRgn
GetBitmapBits
CreateRectRgn
GetObjectW
GetDeviceCaps
Rectangle
ExcludeClipRect
CreatePen
ExtTextOutW
SetBkColor
BitBlt
SetViewportOrgEx
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC
CreateDIBSection
CreateBitmapIndirect
CombineRgn
advapi32
RegOpenKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
GetSecurityDescriptorDacl
AdjustTokenPrivileges
LookupPrivilegeValueW
StartServiceW
QueryServiceStatus
OpenServiceW
RegDeleteValueA
RegQueryValueExA
RegOpenKeyA
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExA
OpenSCManagerW
LockServiceDatabase
UnlockServiceDatabase
CloseServiceHandle
RegOpenKeyExA
RegEnumValueA
LookupAccountSidW
RegCreateKeyW
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
RegDeleteKeyA
RegCreateKeyA
shell32
ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
SHGetSpecialFolderLocation
ole32
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
OleUninitialize
CoUninitialize
CoCreateGuid
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoInitializeEx
CoCreateInstance
oleaut32
VarDateFromStr
VarUI4FromStr
OleLoadPicture
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
SysStringLen
OleCreateFontIndirect
VariantCopy
VariantInit
VariantClear
SysAllocString
SysFreeString
dbghelp
SymGetLineFromAddr
SymSetSearchPath
SymCleanup
SymInitialize
SymSetOptions
SymFunctionTableAccess
StackWalk
SymGetModuleBase
shlwapi
PathIsDirectoryW
PathAddBackslashW
PathIsUNCW
PathFileExistsW
comctl32
ImageList_Destroy
DestroyPropertySheetPage
InitCommonControlsEx
ImageList_LoadImageW
ImageList_GetIcon
ImageList_AddMasked
ImageList_SetBkColor
_TrackMouseEvent
ImageList_Add
ImageList_ReplaceIcon
ImageList_Create
CreatePropertySheetPageW
PropertySheetW
msimg32
AlphaBlend
TransparentBlt
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
mpr
WNetAddConnection2W
comdlg32
GetOpenFileNameW
GetSaveFileNameW
Name
.text
Size
1010KB
Virtual Size
1009KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=132, productName=VS2008 build 21022, version=21022,
count=195, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=85, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=677, id=1, productName=Unmarked objects,
count=284, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
WcsPlugInService.ex.exe
- SHA256 8f0c20eab317c9416ad6dd602013528dca8ee1467b111019fe6704ff8da6a241
- MD5 f9a974c8ed6793c226101c10af7542db
- SHA1 5719e5b45721af9ac9652332f2001d984e1d9a45
- SHA512 1f00ca5c9fdb1ca8fe6d9b9728da6b3aac57b72e17e528ec37e77cdf6ae1cd52384b0ae8256e2f74f88ba87c9e90c575a0a8ebf729f894590fe71d5e6ce608d3
- SSDEEP 3072:pxuZMpyk7A79E6rdAXpRCxv/sqJ5SjTOaiZl7ObWlx+T:pYf79JAXKxHs0S3OaiZ1Oiv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
222560
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
106KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=20, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=112, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=48, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=164, id=1, productName=Unmarked objects,
count=1, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 e5abca903daa3982a9d15717bc3e94d95e1033c22a907f63c34f9e26621b8aa6
- MD5 4704e20af978ed6a64c802a129d8f9d0
- SHA1 cb9993d55c02dc20fc97ef85520984e4e55994f7
- SHA512 6c977dc84613aad3f74ca72d2ab474209a91759711e307a767c5b551296690d3930d211898a258d948b7f7fbbdcc61deac567269b7d3e9067b482e6de04ab056
- SSDEEP 3072:MDkgBkiyb0YUUMtR/TUWLNvplwPLwLw/1+eDOB9WmA1/ynID00fT:yXWkYUUMtxTUwLwZ1+eiWx/Os
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10632
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
70KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=112, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=48, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=164, id=1, productName=Unmarked objects,
count=1, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
WinLocker Builder.exe
- SHA256 3def8e9db50996046391a345099f3f7b023f8e0e26356702f73743e25d5716f8
- MD5 10bc8a66ffe85a5eb04d5dd463204318
- SHA1 e0df54485e4fba5af4ff0a61c022f794a5ba25d1
- SHA512 3d833e8083cb4e781b7572eedc89d4c94ea91a04a77f0e7727ff8bb4d16bb8887c19b6a2470e90a2cf714bdf72d26679075f7c7f4127e1c504182955808b99e8
- SSDEEP 6144:eUKmfbTAYbMLaOphVx4bu9xJjF1031CP82ooSaYq:eUvfHfMLaOpXKbOjj/sNLoSbq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1042688
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
760KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
257KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
WinLocker_Builder.exe
- SHA256 cfa91ed5fa38bc5e369b4bf4d59030be432d47b8e2f7e58b9f25c3c034654cc1
- MD5 d010491f999105e40f8550bd9daa4fa7
- SHA1 75f413c324f4b61a524c5330f17cd44019663544
- SHA512 a01eec4d45c9e27a4e138941851eacaa2c865d27c7d83ce94225a98dd3f80cd4576b5e9738a5d3637084443691a8bb72812c63daddbf098c0d69de92c928c669
- SSDEEP 6144:eH7QBEVURAirobeZq26b0FmS3utXig+vQeWXKjkQwLEaoS/V:BBEuR42q26AFmSetX+Qt6LuToS/V
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1034880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
756KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
254KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
_003E0000.exe.vir.exe
- SHA256 878304de96556ed340f190a9d8b5650dc71512eed4210676560fc41e7ac4857c
- MD5 f57d188c4667fab46208396af20badd2
- SHA1 367ea268c494d17672ef371adebef0f505c1a804
- SHA512 157615951ccf90c69aaa4e4e1e1f664ffcb6c5817371143ac5bc2dfac04185e57981d50194ad4a1784c29f16211b6a18e9fa085721d05e29ba63377e40dc41a2
- SSDEEP 3072:SsB0ura/QOVLLkeyYP1RNDZyuubclhZUnr:Sef7wkey21flyu8+i
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
100384
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=223, version=20806,
count=33, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
vmem02.exe
- IMPHASH a208ed6b0434bcbf2b456ccd3a72195d
- SHA256 16e42d3e4af4d7de0bc9adfc317a68fffa41feb406e82d870bff657a86ab448e
- MD5 ceca6f5828b79d4da88523c4c30d890d
- SHA1 3a9197e2105200b5756e3428e7ca4f5dd2b6df23
- SHA512 5448036fc6a88d1e6797cb194007327d7f263c8254c0a6463025fc4da1d08fb637ae033aa7da6e6c7f5dfd95aed029ce03c3e0df362f71a0becefe20f58957b2
- SSDEEP 768:FtGLOTlOw4qwau28gJV6eRf130SngnM1RLNen+l3:wO5x7waQPeRt3BngMHU+J
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
4576
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
GetModuleHandleW
user32
CreateWindowExW
DefWindowProcW
DispatchMessageW
GetMessageW
GetSystemMetrics
KillTimer
LoadCursorW
LoadIconW
MoveWindow
PostQuitMessage
RegisterClassW
SetTimer
TranslateMessage
Name
.text
Size
961B
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
w8i9eHkHOwWwQlX.exe
- SHA256 7910428acb8eb014340219f413e4fcaab9bd31f9664e644fe91dacda9e65470d
- MD5 6ec6069728a91a04407283bc6bf208b7
- SHA1 5407241081ab23a29acafe11187bc118abdc15b0
- SHA512 bb809949f9305d4eed3becd28a254dc0eda7eea925a10548e6e560826ac22c51508a1ef9c9443e3690f98693b9775d238781392c16a0ca27301b5a1880913487
- SSDEEP 24576:q9WQitvyUilzOUxaOWk01G4fbu/F41jen6KXYzkEEknJS7DFN4L3GmPA705sCvsF:q9WDAUozOUxaOyGau6I6WPDvlAAoefk1
- MD5 SHA1 SHA512 SSDEEP
-
Detected Xorist Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8657
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
wpbt0.dll
- SHA256 9282cdf4c83b4ca8015b0e450ac68c5bb7effe4503d3d34efa2ad496d37d2d26
- MD5 df9188698b078a38b399a8b6f61f9c34
- SHA1 b221335078e9e368f07b102fccab2c83c4f90a5f
- SHA512 97242771d5c9f864d6f929c141085c718da9642777778228e3a2b072c2137467c6b80fc8c0d439cc5aac0e434a5e6cef13b22b537ab52812de9ed3d98eb6e37b
- SSDEEP 768:it81vCu5ZnWpQgUMq9+12GDuRUP6Ez9Ctwgg/wI2oRPfFSTYJa2U:iqOpQCq9+1VDuSVIhJGe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
147408
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
48KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 6872bb9510e1b46ed3dbc290a295b8ca30d681b34f5994a48ce3370e35534a58
- MD5 97e87019aba30ac679f5a4ce3a23953a
- SHA1 f2bc9c1819c37a79b3bb069088c6af4c9a20c5f6
- SHA512 f880400cd2a38a1204873b2ef7359e8d64d40ae4ffb6bb1c878bea6856c10a5e203414e94e5674735f0e06fc0c27e881e4cd7bd8a2f50c6b8b4ea9271b09d0db
- SSDEEP 3072:7GwOWQP1ofFYoNA5HbScuQq0tf5KmK5Y8nPRBTssu7r6dmHXJ9:JQdol2bScuQq0tfIvPc/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94796
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
xpiofrbtkzhr.exe
- SHA256 6a298fd7189f63d29fb4c4cc342844a98c10945f8e0700363b0d078111568528
- MD5 25a11c9dd8d3eb6ecf8544e95d866a98
- SHA1 b462e8f5a05dba7328885af7646f9229d09656fb
- SHA512 2483c4b7dad5bf273c955c70716dcb61a7f61ea1047de6f03ab867e549a3791a1c93291ef9d81e6308eecffb3a05f963b45f8b539ab31f84c5520844cb8a8992
- SSDEEP 768:1ySfi5TqmFi4tuXnKtgYr/TOsex9PEMBex6BHmRGBNc1uobW80vOA4N:dK5TbUayYLTOh9PEMEx+O150vOPN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
114048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=158, productName=VS2010 build 30319, version=30319,
count=7, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=27, id=1, productName=Unmarked objects,
count=3, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
out.upx
- SHA256 3966547e319817cf4dbd43c30d63d88ee09385fc54b064981c2e5ea3a209cc66
- MD5 710b85161e7c2eaec9e5bded9c4a7854
- SHA1 dc6009b28840c33c09d8e63db502939ffdb4e072
- SHA512 4b17b52b1ba172e49e778de1f852f58763f6e06614984c4361f1a5a84ee517126f534a4e2f5cfb3394c7619b5c798937da1924a762b62424f39f7ad0530f1409
- SSDEEP 1536:e2TSNLSL7EqNd1A9O75xPIFcQaxXoNzgueHhkKLcjKsMFYM6dN:e2TSo3h7ecBmxghHxLcjKsHN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4848
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
610B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=158, productName=VS2010 build 30319, version=30319,
count=7, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=27, id=1, productName=Unmarked objects,
count=3, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
xxx_video (2).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d51d08aef8661780261241ddb5bb2617b1fafa1ac1cdcad77e825c16faf48c79
- MD5 2bcae695288cd75a2d71c0dbb69359fd
- SHA1 6a0476b62c069d42a2d8290b7d467d8a136312e7
- SHA512 a28d5299addd39b0905745889cc478549c295ba9a19d49b1b0fe723840c298d0793203627ea5852e91ed2efc6684d2cf7362ff2958e52eb30c859cab497b0e96
- SSDEEP 12288:ao7VLRpB3hC/K+wAN0PdyT9ElIdq5uMumzu5FEiXqv3RZF8N4E:9P5zZI43
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
617566
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
596KB
Virtual Size
595KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
xxx_video.exe
- SHA256 2a9e5ded530da46678845fc5f3be1f83819b6a255765174eb4ae06ba4abb5b53
- MD5 ed6cec1486bd9af8a567604112f786bf
- SHA1 147b9b965701a42fb6e8088da0abf4eb3b987d1c
- SHA512 e8e1ae480b129a9bff0d98c65d212973be9892f4fa103a78bbb275f3d3be7c68e871888dcb73bcdd35c3958f9d7b889671b9d8aadbdc4623c4b4a81ba182805b
- SSDEEP 1536:Y4adWLt4aPI7ZPItWEK01i+jmcIJID+U5pnouy8NM:C8LGaPI7ZPItFK0zxIC9noutNM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
261936
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
55KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=14, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=67, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=75, id=1, productName=Unmarked objects,
count=5, id=93, version=2179,
count=22, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
xxx_video_26726.avi.exe
- SHA256 76520b94f15467309d3ca3d8022bb156e8daa811223774b7a74127881ab50fc0
- MD5 91096e06bc95a718d0b67661764a92b3
- SHA1 a05df3707c71b2cedfb94bb81c6c1af3311be235
- SHA512 67dd71681bbde5dd5c2972f57930b856c68d90b5cf2f0edbbdfcdf2b6fb5898ff2ecfe58be6aa4aa8b0aa88bacee6a58043fa8733b5b911f2c478f30347e715d
- SSDEEP 1536:zX9X3D0CmuUFQArTc+OMnlf5JSVeK69mEgey5O:79n7Urc+dnlB4VzLTw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
7
Entry point
115488
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
49KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1060, id=116, version=31576,
count=785, id=4, version=19661,
count=876, id=91, version=9893,
count=598, id=124, version=53774,
count=566, id=75, version=15322,
count=1113, id=31, version=23671,
count=1056, id=124, version=16386,
count=86, id=122, version=46249,
count=768, id=62, version=56742,
count=737, id=1, version=32014,
count=565, id=2, version=35095,
out.upx
- SHA256 67e0a218ed94c7ce5eeeae989e9f4a65815640971d15d88ffd91b9a5b90a547a
- MD5 fca24f3dc7837a9d266c311c7643eba3
- SHA1 f3b4b7a72752e16ddf9be7ebb7c561cc186ccad0
- SHA512 16bf07c426082fcae129f60dccc15f9176e2dda32c64caa1239784e49ffe1a4c6349ad6266d216448eb0f124209d3c921f5b593a0e1ddafc5adf4c5e671e226d
- SSDEEP 1536:zWT8r0YMhopUwOaDN37DU88eE5RfZCYID+Ed5O:yT8gYMhSDF7DUK0Fyw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
7
Entry point
6839
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
71KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
349B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
13B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1060, id=116, version=31576,
count=785, id=4, version=19661,
count=876, id=91, version=9893,
count=598, id=124, version=53774,
count=566, id=75, version=15322,
count=1113, id=31, version=23671,
count=1056, id=124, version=16386,
count=86, id=122, version=46249,
count=768, id=62, version=56742,
count=737, id=1, version=32014,
count=565, id=2, version=35095,
xxx_video_35942.avi.exe.vir.exe
- SHA256 0a5506d1867dbb76b428b099b2ae6a3ec0c85ec8dc855b66ae822fcc77ba0f12
- MD5 cc279bf22bc5f3348034cc732db279df
- SHA1 1df6eceb7417fdca34ec2e351752e62b9e308bf0
- SHA512 c76c05b996b13815be43c640773b73e1aaaf34b642502098e0ed736e4dc98ee071a89a4d524a7440a3b2a3fd2d571d0396658070268d1e2e04a5a4e4555c6875
- SSDEEP 1536:VxpWSs6Ugax7sR5T3qgWXHYccHbs3CJP0YLI:V7WSs7Fx7sR5joHYcmYk8c
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
9
Entry point
190880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
51KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=273, id=42, version=40096,
count=195, id=118, version=62392,
count=765, id=87, version=22915,
count=751, id=29, version=6139,
count=60, id=25, version=24371,
count=196, id=63, version=20887,
count=202, id=53, version=48395,
out.upx
- SHA256 d5efdb3135029fd738415f23b59ad83311011bbcfe20f1fce78de668f79a508a
- MD5 6ea822d6e7d3b8844c20dab2ba57e994
- SHA1 4e3c28ad95c52f71ca4a95ccad6082fe4233c130
- SHA512 ec38b5615811e93bf465d12d958b0b1b85c6bd322576a7116e6fad9efdc13edb9dc7dfbb2a73d93b8005cacb62afe24a0e03730499b5b29333a76804ea3255f7
- SSDEEP 768:4klahnHp6nOPJNyvUFjYSAiouyWSpH+IEPyVOep7+1ZOMuHzys5+notJCVcSUnp+:TmjY6y9HwyVRpS1Z0zys5qH6pQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
9
Entry point
7840
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.slcsyy
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.xpsfowa
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.jyngd
Size
6KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gwpkkwo
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ogsqa
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=273, id=42, version=40096,
count=195, id=118, version=62392,
count=765, id=87, version=22915,
count=751, id=29, version=6139,
count=60, id=25, version=24371,
count=196, id=63, version=20887,
count=202, id=53, version=48395,
xxx_video_35942.avi_unpacked_.exe.vir.exe
- SHA256 2c7a6f717702e2789aa4813bbeef2890edfcb216c0af83ac399015853c057c80
- MD5 af5c2e270346cdb9206ab7c09074a13f
- SHA1 b20c204a948da5f41b1cc8c047ca4c410b67f60d
- SHA512 dffa29aa1a627455a1d04e86238dbbc52f881281c66f3d278f176794a32ce3a5920a101fff8ae85322d962021a8fb6a1c1ac96a2a2fd382f407cb3ce6ae58310
- SSDEEP 768:V7B7vOri/ija+1IqhZ9o9nn6vRhwXzqaRMicwVSeRSNRGfbxuuNtpzWLhp4oQsSJ:V7B7vyDo9nadaRuwweBzxJWLv6smf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
0
Entry point
%!f(<nil>)
Magic Number
Subsystem
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
44KB
Virtual Size
7KB
Characteristics
Name
Size
184KB
Virtual Size
5B
Characteristics
Name
����
Size
Virtual Size
Characteristics
generic
xxx_video_73240.avi____.exe.vir.exe
- SHA256 4a47be4e443a8d327b607cf606994666dfcd688ae02a50b9c7c0ea2b0e0c9b41
- MD5 ec1515255dd45a0fa15a23fe5f07a23e
- SHA1 e61bf707f6eaa7009504c65f2d498de72818f738
- SHA512 23c8b170549c5d1340938a152bcf4ab0cdcddbe6d446be3bdcbb9c211127d60013fbe00019208151c784e6f522ae5770e546f4dec88cf285a891a3938648b526
- SSDEEP 768:vs8Rt5Kv/2CxxurzvCW6QtKarJ0R9ShWbSt+Y41P+MBefyap3eKFW3e:vf4vgzKWxkaiR9Shp+Y0mMBeqapVFW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
0
Entry point
%!f(<nil>)
Magic Number
Subsystem
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
32KB
Virtual Size
7KB
Characteristics
Name
Size
208KB
Virtual Size
4B
Characteristics
Name
����
Size
Virtual Size
Characteristics
generic
xxx_video_77498.avi.exe
- SHA256 8041d6917560303a9562dfe705a8c57c57425f11f61ffe9e91907e19cfe8619e
- MD5 1980cdff48796a156a69bbc5b71b8bc6
- SHA1 feec2e4f363839525ffea205a33d7a1c0241a5f8
- SHA512 01b297498995e0ecc4c2f3bde81a3fd6abe93924cd930712a97f2932e5f18693a545ec7ab76c768a740b3e4e11ffb010fc49455127649438656d015fa6bb17d6
- SSDEEP 768:W9881n/iH9YJVNv0ryM8CZarJ305Q0nUxtLnZ0XX5FcfH7Gt61:czCYJVNvPM3Zap05Qb3ZoFcfbb1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
39448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
628B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
xxx_video_87279.avi.exe.vir.exe
- SHA256 d29dac501b57a07abdc2f7da0550fffa9ed321d228b50235eb76ccb248f0d4e9
- MD5 a5fe0efa78b0b70bfe86b62f55cf8ba6
- SHA1 39a3c0aa0795d2d81cba8e998735b2df77eadea5
- SHA512 b01378c32c893ea5a7c0c892515fd93ef005b867df86ab0896bb15b7b06b71d1e1acad009c330a8e943378f579615370b6c3966d46c83d883773cff9970233a1
- SSDEEP 768:Vtr+TB0qJUvzy7idWzLql4Ha71YpJaskLnkKDakY2S1MDiuk:v+8v2gWnCcaJEUKR2Ov
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
9
Entry point
157904
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
43KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=222, id=46, version=6571,
count=526, id=78, version=1028,
count=804, id=105, version=40281,
count=356, id=113, version=10610,
count=512, id=85, version=45626,
count=506, id=99, version=26820,
zcrypt.exe
- IMPHASH 7c6791cb1b3ac992063bd8ecc38e1226
- SHA256 bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f
- MD5 d1e75b274211a78d9c5d38c8ff2e1778
- SHA1 d14954a7b9e0c778909fe8dcad99ad4120365b2e
- SHA512 1ec3fbb0bf17d4ad6397ba2e58daa210745f10f88f6722971464a6eeb7573f49be6d65e70a497002d6d00745317f11442bdeaf999b91127b123c11dfe9b088c2
- SSDEEP 24576:l2RNuxIAdOx6mNoGSyGMjc6XaMAy9xg5tMZ/Z3RPpEYrTQAU:rIG+lbGuntxktM15RPpEYrTQAU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
387203
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Asus\Desktop\MyEncrypter2Mod3Window\Release\MyEncrypter2.pdb
kernel32
SetFileAttributesA
GetLogicalDriveStringsA
GetProcAddress
GetFileSize
ExitProcess
WinExec
lstrcmpiA
CreateProcessA
GetTempFileNameA
GetComputerNameA
GetLastError
CloseHandle
LocalFree
GetTickCount
GetStdHandle
GetFileType
GetCurrentThreadId
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
FreeLibrary
GlobalMemoryStatus
FlushConsoleInputBuffer
FlushFileBuffers
GetACP
MultiByteToWideChar
SetEndOfFile
HeapSize
WriteConsoleW
DeleteFileA
LoadLibraryA
CreateFileA
GetFileAttributesA
OpenMutexA
CopyFileA
CompareStringA
Sleep
GetTempPathA
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateMutexA
FindClose
SetFilePointer
ExpandEnvironmentStringsA
FindNextFileA
GetDriveTypeA
ExpandEnvironmentStringsW
WriteFile
GetCurrentProcess
ReadFile
FindFirstFileA
GetModuleFileNameA
FindFirstFileExA
GetCommandLineW
GetCommandLineA
SetEnvironmentVariableA
HeapFree
HeapReAlloc
HeapAlloc
SetConsoleMode
ReadConsoleInputA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetProcessHeap
CreateFileW
SetStdHandle
ReadConsoleW
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
RaiseException
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
SetConsoleCtrlHandler
GetConsoleCP
user32
MessageBoxA
GetUserObjectInformationW
SystemParametersInfoA
GetProcessWindowStation
advapi32
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegCloseKey
RegOpenKeyA
RegGetValueA
RegCreateKeyExA
GetUserNameA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
SystemFunction036
shell32
SHGetFolderPathA
ole32
CoInitialize
CoCreateInstance
oleaut32
VariantClear
shlwapi
PathFindExtensionA
PathFileExistsA
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntry
Name
.text
Size
512KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
222KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=241, version=40116,
count=169, id=243, version=40116,
count=28, id=242, version=40116,
count=25, id=259, version=23013,
count=62, id=261, version=23013,
count=65, id=260, version=23013,
count=2, id=206, version=65501,
count=2, id=208, version=65501,
count=27, id=203, version=65501,
count=193, id=1, productName=Unmarked objects,
count=332, id=260, productName=VS2015 [14.0] build 23026, version=23026,
count=2, id=265, version=23026,
count=2, id=259, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
- IMPHASH 7e8ad4139efc6cbcf31df3bc4b291dd8
- SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
- MD5 04fb36199787f2e3e2135611a38321eb
- SHA1 65559245709fe98052eb284577f1fd61c01ad20d
- SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
- SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
_except_handler3
memcpy
memmove
_vsnprintf
_vsnwprintf
_purecall
memset
kernel32
LoadLibraryW
FreeLibrary
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
lstrcmpA
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
CreateMutexW
ReleaseMutex
FindResourceExW
LoadResource
SizeofResource
LockResource
CreateProcessW
SetFilePointerEx
FindNextFileW
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTime
GetDateFormatW
GetTimeFormatW
GetCurrentThreadId
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
GetEnvironmentVariableW
CopyFileExW
GetUserDefaultUILanguage
DeleteCriticalSection
FindClose
FindFirstFileW
DeleteFileW
GetFileTime
SetLastError
GetFileSizeEx
FlushFileBuffers
ReadFile
WriteFile
SetFileTime
ResumeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
SetFileAttributesW
CreateFileW
GetFileAttributesW
Sleep
GetTickCount
MoveFileExW
ExpandEnvironmentStringsW
GetVolumeInformationW
GetDiskFreeSpaceExW
WaitForMultipleObjects
ResetEvent
GetTempPathW
GetLogicalDrives
GetDriveTypeW
LocalFree
CloseHandle
CreateEventW
GetLastError
GetHandleInformation
SetThreadPriority
GetModuleFileNameW
GetCurrentThread
GetModuleHandleW
SetEvent
GetComputerNameW
WaitForSingleObject
SetErrorMode
GetCommandLineW
ExitProcess
CreateThread
user32
MessageBoxIndirectW
InSendMessage
ClientToScreen
GetWindowLongW
GetClassNameW
GetCaretPos
TrackPopupMenu
AppendMenuW
GetCursorPos
CreatePopupMenu
SetMenuDefaultItem
DestroyMenu
LoadIconW
CloseClipboard
EmptyClipboard
OpenClipboard
SetClipboardData
SystemParametersInfoW
ScrollWindowEx
GetSystemMetrics
UpdateWindow
SetScrollInfo
MessageBoxW
EndPaint
ScreenToClient
GetWindowRect
DrawTextW
GetParent
GetClientRect
IsDialogMessageW
DestroyWindow
BeginPaint
DrawFocusRect
IntersectRect
GetDlgItem
SendMessageW
GetDlgCtrlID
SetWindowTextW
MoveWindow
GetDC
ReleaseDC
CharLowerW
PostQuitMessage
MsgWaitForMultipleObjects
TranslateMessage
PeekMessageW
DispatchMessageW
SetTimer
PostMessageW
SetFocus
RegisterClassExW
FlashWindowEx
InvalidateRect
GetWindowTextW
MonitorFromWindow
SetWindowPos
ShowWindow
GetForegroundWindow
AdjustWindowRectEx
IsWindowVisible
GetMonitorInfoW
DefWindowProcW
DialogBoxParamW
SetWindowLongW
EndDialog
CreateDialogParamW
MonitorFromPoint
UnregisterClassW
SetForegroundWindow
GetKeyState
ReplyMessage
GetScrollInfo
CreateWindowExW
advapi32
CryptAcquireContextW
RegSetValueExW
RegEnumKeyExW
RegFlushKey
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptGetHashParam
CryptCreateHash
CryptDestroyHash
CryptHashData
RegCreateKeyExW
RegCloseKey
CryptExportKey
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW
shell32
SHGetFileInfoW
SHGetFolderPathW
ShellExecuteExW
CommandLineToArgvW
uxtheme
SetWindowTheme
gdi32
GetDeviceCaps
CreateSolidBrush
GetObjectW
CreateCompatibleDC
SelectObject
DeleteObject
SetBkMode
SetBkColor
DeleteDC
SetTextColor
GetObjectA
CreateFontIndirectW
comctl32
InitCommonControlsEx
ord413
ord410
shlwapi
StrCmpW
StrCmpNW
StrCmpIW
PathMatchSpecW
PathRemoveBackslashW
PathAddBackslashW
ord12
PathFindFileNameW
PathRemoveFileSpecW
PathUnquoteSpacesW
StrChrW
PathQuoteSpacesW
msimg32
AlphaBlend
winhttp
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpWriteData
WinHttpOpenRequest
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpOpen
gdiplus
GdipAlloc
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdipCloneImage
GdiplusStartup
GdipDeleteBrush
GdipCreateBitmapFromStream
GdipCreateFontFromLogfontA
GdipSetStringFormatLineAlign
GdipDeleteFont
GdipDeleteGraphics
GdipDrawImageRectI
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipDrawString
GdipCreateFromHDC
GdipSetStringFormatHotkeyPrefix
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateFontFromDC
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdipFree
GdipCloneBrush
ole32
CoInitializeEx
CoUninitialize
CoTaskMemFree
StringFromGUID2
crypt32
CryptImportPublicKeyInfo
CryptStringToBinaryA
CryptDecodeObjectEx
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
248KB
Virtual Size
247KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=316, id=1, productName=Unmarked objects,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=211, version=60610,
count=1, id=201, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD3 build 60610, version=60610,