Batch_8.zip
- SHA256 fd84148426c6188c0bdec2e66d1f4fda9392342adb0c225d64aaacce24ce8653
Overview
overview
10Static
static
10FD4DC9B2BF...4B.exe
windows7-x64
1FD4DC9B2BF...4B.exe
windows10-2004-x64
1Flyper.exe
windows7-x64
1Flyper.exe
windows10-2004-x64
1Flyper2.exe
windows7-x64
1Flyper2.exe
windows10-2004-x64
1Flyper3.exe
windows7-x64
1Flyper3.exe
windows10-2004-x64
1Free YouTu...er.exe
windows7-x64
3Free YouTu...er.exe
windows10-2004-x64
3FreeYoutub...16.exe
windows7-x64
7FreeYoutub...16.exe
windows10-2004-x64
7file (1).exe
windows7-x64
10file (1).exe
windows10-2004-x64
10file (2).exe
windows7-x64
6file (2).exe
windows10-2004-x64
10file (3).exe
windows7-x64
10file (3).exe
windows10-2004-x64
10file (4).exe
windows7-x64
10file (4).exe
windows10-2004-x64
10file (6).exe
windows7-x64
10file (6).exe
windows10-2004-x64
10file (7).exe
windows7-x64
1file (7).exe
windows10-2004-x64
3file.exe
windows7-x64
5file.exe
windows10-2004-x64
5file_ (1).exe
windows7-x64
7file_ (1).exe
windows10-2004-x64
7file_ (2).exe
windows7-x64
7file_ (2).exe
windows10-2004-x64
7file_ (3).exe
windows7-x64
7file_ (3).exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
FD4DC9B2BFF8D75A704E8FE33C63DA4B.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
FD4DC9B2BFF8D75A704E8FE33C63DA4B.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Flyper.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Flyper.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Flyper2.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Flyper2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Flyper3.exe
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Flyper3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Free YouTube Downloader.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
Free YouTube Downloader.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
FreeYoutubeDownloader11012016.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
FreeYoutubeDownloader11012016.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
file (1).exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral14
Sample
file (1).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral15
Sample
file (2).exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
file (2).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral17
Sample
file (3).exe
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral18
Sample
file (3).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral19
Sample
file (4).exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral20
Sample
file (4).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral21
Sample
file (6).exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral22
Sample
file (6).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral23
Sample
file (7).exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
file (7).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
file.exe
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
file.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral27
Sample
file_ (1).exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
file_ (1).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
file_ (2).exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
file_ (2).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral31
Sample
file_ (3).exe
Resource
win7-20241023-en
windows7-x64
4 signatures
150 seconds
General
- Target Batch_8.zip
- Size 5.3MB
- Sample241122-d95f9atpax
- SHA256 fd84148426c6188c0bdec2e66d1f4fda9392342adb0c225d64aaacce24ce8653
- MD5 a08902a38452cd5ce655ba54040c5833
- SHA1 b94c8f6b0be6f2e8f003c9cfde9d8857d752cb2b
- SHA512 990a022b6ae18b72daca14bc1c0eee95f1e89e366fc62b9b4824e4cd63f261837a56461439fce9b5a6a6aaec03912595d36f1dadeea5661a4cb6a050d40fb12a
- SSDEEP 98304:F6DMk1Jj0MM/64iXHiO1/ghHDwkLP1tfd4HLMXaWPNEa82i2noWmELP7lQw4oJ7:FWHnM/6l5QDbPrV4HORnoGCw4oJ7
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detected Xorist Ransomware 1 IoCs
resource yara_rule static1/unpack004/out.upx family_xorist - Xorist family
-
resource yara_rule static1/unpack001/file_ (7).exe upx static1/unpack001/flash_player.original.exe upx static1/unpack001/informations.exe upx - Unsigned PE 34 IoCs
Checks for missing Authenticode signature.
resource unpack001/FD4DC9B2BFF8D75A704E8FE33C63DA4B.exe unpack001/Flyper.exe unpack001/Flyper2.exe unpack001/Flyper3.exe unpack001/Free YouTube Downloader.exe unpack001/FreeYoutubeDownloader11012016.exe unpack001/file (1).exe unpack001/file (2).exe unpack001/file (3).exe unpack001/file (4).exe unpack001/file (6).exe unpack001/file (7).exe unpack001/file.exe unpack001/file_ (1).exe unpack001/file_ (2).exe unpack001/file_ (3).exe unpack001/file_ (4).exe unpack001/file_ (5).exe unpack001/file_ (6).exe unpack001/file_ (7).exe unpack002/out.upx unpack001/file_.exe unpack001/file_9.exe unpack001/firefox32.exe unpack001/flash_player.original.exe unpack003/out.upx unpack001/flash_player.unpacked.exe unpack001/freegaza_israeli_killers.exe unpack001/fresh_a22bb95ee8cfccc94ba183c071bad3a951b353e98fcf0d6cfa9268aaf9c53d53.exe unpack001/helper[1].exe_.exe unpack001/info[1].exe unpack001/informations.exe unpack004/out.upx unpack001/installer.exe
File Explorer
-
Batch_8.zip.zip 5.3MB
-
FD4DC9B2BFF8D75A704E8FE33C63DA4B.exe.exe 214KB
-
Flyper.exe.exe 214KB
-
Flyper2.exe.exe 214KB
-
Flyper3.exe.exe 214KB
-
Free YouTube Downloader.exe.exe 153KB
-
FreeYoutubeDownloader11012016.exe.exe 376KB
-
file (1).exe.exe 136KB
-
file (2).exe.exe 100KB
-
file (3).exe.exe 146KB
-
file (4).exe.exe 97KB
-
file (6).exe.exe 157KB
-
file (7).exe.exe .ps1 414KB
-
file.exe.exe 256KB
-
file_ (1).exe.exe 288KB
-
file_ (2).exe.exe 164KB
-
file_ (3).exe.exe 287KB
-
file_ (4).exe.exe 135KB
-
file_ (5).exe.exe 285KB
-
file_ (6).exe.exe 134KB
-
file_ (7).exe.exe 165KB
-
out.upx.exe 584KB
-
file_.exe.exe 288KB
-
file_9.exe.exe 107KB
-
firefox32.exe.exe 62KB
-
flash_player.original.exe.exe 530KB
-
out.upx.exe 566KB
-
flash_player.unpacked.exe.exe 1.4MB
-
freegaza_israeli_killers.exe.exe 345KB
-
fresh_a22bb95ee8cfccc94ba183c071bad3a951b353e98fcf0d6cfa9268aaf9c53d53.exe.exe 32KB
-
helper[1].exe_.exe.exe 504KB
-
holycrypt-v0.3.exe152KB
-
info[1].exe.exe 129KB
-
informations.exe.exe 506KB
-
out.upx.exe 1.3MB
-
installer.exe.exe 396KB
FD4DC9B2BFF8D75A704E8FE33C63DA4B.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9ed8b4e2db6d4feb162a0b1109ba4ca92065bd7d1256b6d234e9840dd36ef581
- MD5 fd4dc9b2bff8d75a704e8fe33c63da4b
- SHA1 d45d764fad516464ae784ed61a71e234b10dba42
- SHA512 732a7e209e493e18ae421bc28415389433d1827e4334c40671d354067d280a18a686cc83d9538bd331f66011b8149570b40664061485cfab7b592b7f9e82bdcb
- SSDEEP 3072:F51M+lmsolAIrRuw+mqv9j1MWLQllg6CM+lmsolAIrRuw+mqv9j1MWLQlL:Fg+lDAAaD+lDAAmL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\Paco\Desktop\inInvoice\hIDDeN-teAr\obj\Debug\inInvoice.pdb
mscoree
_CorExeMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Flyper.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 74aa7b73b46d7bd7bc53cb44add9ec8172f2de7831d045e33db06e2d6b916edf
- MD5 7b75b33bcf4ecf013b93f84ed98b3fb5
- SHA1 7be5f5dcf6b9519c0f8c8071503b7f5dd66b6386
- SHA512 96e1253358db1f724b381f9e1e416cc35bf44d94505e8b86508676f997b44be65d3c33c22df9c004652a34170e48805f9b7ba6f2703dd287e8c770cb426c5114
- SSDEEP 3072:5W1M+lmsolAIrRuw+mqv9j1MWLQFPBCM+lmsolAIrRuw+mqv9j1MWLQlL:5J+lDAAIv+lDAAmL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\Paco\Desktop\inInvoice\hIDDeN-teAr\obj\Debug\inInvoice.pdb
mscoree
_CorExeMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Flyper2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 eba685abd63d2c7378f788aa5ca8e4f95f4b82b51347cb8818090ef54e8f7d29
- MD5 d02d012970aa164cad15c757d7e52994
- SHA1 25eef16797a7cf4168938f9d372332d65356b6f7
- SHA512 640545996e924b5f759ba69f970686e67defc9142a195fb6774dd275e22961fd9b21328b119d42b4032f1cf4eb6363ccce64bf6f423d2bf3ddc1d8d5b1f524ee
- SSDEEP 3072:BM+lmsolAIrRuw+mqv9j1MWLQ6xZ4qM+lmsolAIrRuw+mqv9j1MWLQlL:6+lDAArx2+lDAAmL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121486
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\Paco\Desktop\Invoice\HiDdEn-TeAr\obj\Debug\invoice.pdb
mscoree
_CorExeMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Flyper3.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9ed8b4e2db6d4feb162a0b1109ba4ca92065bd7d1256b6d234e9840dd36ef581
- MD5 fd4dc9b2bff8d75a704e8fe33c63da4b
- SHA1 d45d764fad516464ae784ed61a71e234b10dba42
- SHA512 732a7e209e493e18ae421bc28415389433d1827e4334c40671d354067d280a18a686cc83d9538bd331f66011b8149570b40664061485cfab7b592b7f9e82bdcb
- SSDEEP 3072:F51M+lmsolAIrRuw+mqv9j1MWLQllg6CM+lmsolAIrRuw+mqv9j1MWLQlL:Fg+lDAAaD+lDAAmL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\Paco\Desktop\inInvoice\hIDDeN-teAr\obj\Debug\inInvoice.pdb
mscoree
_CorExeMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Free YouTube Downloader.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7
- MD5 f33a4e991a11baf336a2324f700d874d
- SHA1 9da1891a164f2fc0a88d0de1ba397585b455b0f4
- SHA512 edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20
- SSDEEP 3072:PkFkkk2kyWxkFkkk2kyWD4zC270lkFkkk2kyW:PkFkkk2kyWxkFkkk2kyWDwOkFkkk2kyW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
119070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\Amon You\Amon Youtube\Timer\Free YouTube Downloader\Free YouTube Downloader\obj\Debug\Free YouTube Downloader.pdb
mscoree
_CorExeMain
Name
.text
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FreeYoutubeDownloader11012016.exe
- SHA256 1e307799a25403c465d634854a10ee9329aef33a06ec41538264f8ec6695b8c7
- MD5 8731c5b9c6b632517b757219113dd853
- SHA1 732c867995bcf67eb6f0e21f3c76e5428ceb8a71
- SHA512 25350e182d17d5d568287ef9bf173823d4fc4e3d90aff13d2108ee99fd9ccdf5c8b13bff5353ced1b61a91942b0ebdc42ec770bc9fe9f9102d877d2fa5760aff
- SSDEEP 6144:m/QiQXk4oL8+Ee0CYDTAsdR9H8RMDgxqvUUl49EcATvx04/o7+ze4S62T3hG47no:eQi94oL8+iDNdRNUkg0UUl42cATvxsZe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
42488
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
file (1).exe
- IMPHASH e55e9c98504c76e7d2a793dd040a1784
- SHA256 2902a063774a2092d85dfca18650b87fdc087a337add8012e67ea7cdd5debcc2
- MD5 0b37809ae839d24f5a54c3a16f5b4f35
- SHA1 d3091cee95575a53ce93b886469924f2603efbdc
- SHA512 0a9267efc5c0fc25d812f52ff95bd20bae31a12e78fe1ecf07a6d5a993f2a71a66180ae826b3097982b78c221a7f8313c45403042e54a7247a50e7c3ce984895
- SSDEEP 3072:4PTKQFRiVdubWibOQNi3MWL4FksNYFfPK:4PFRwAbpi3MDEK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8447
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrStrIW
StrCatW
psapi
EnumProcesses
EnumProcessModules
GetModuleBaseNameW
kernel32
lstrlenW
CopyFileW
CloseHandle
WriteFile
CreateFileW
WideCharToMultiByte
Sleep
GetCommandLineW
CreateProcessW
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetTickCount
GetEnvironmentVariableW
OpenProcess
SetSystemTime
GetSystemTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
WaitForSingleObject
CreateThread
IsDebuggerPresent
user32
CreateWindowExW
GetSystemMetrics
RegisterClassExW
DefWindowProcW
SetLayeredWindowAttributes
SetWindowPos
SetWindowLongW
GetWindowLongW
EndPaint
BeginPaint
EndDialog
GetDlgItemInt
CallNextHookEx
GetAsyncKeyState
ShowWindow
UpdateWindow
SetForegroundWindow
SetWindowsHookExW
DialogBoxParamW
AdjustWindowRect
AllowSetForegroundWindow
CascadeWindows
BringWindowToTop
ArrangeIconicWindows
AnyPopup
AnimateWindow
MessageBoxW
GetAncestor
BeginDeferWindowPos
gdi32
TextOutW
SetTextColor
SetBkColor
Rectangle
CreateSolidBrush
CreatePen
SelectObject
CreateFontA
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=6, id=149, productName=VS2008 build 21022, version=21022,
count=12, id=131, productName=VS2008 build 21022, version=21022,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=67, id=1, productName=Unmarked objects,
count=9, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
file (2).exe
- IMPHASH 17ef22527356e10d0bcbb740b6521d40
- SHA256 cd7843ba1ae94328aeecfe27eff4fc3e449f297116760a37ebb72a13525e0638
- MD5 947740d3bc01db29b14d1752e20775c7
- SHA1 408847d6c160f4ad377a1844f88bba43ca470f82
- SHA512 dde21adca681cb489ac12412d41ba6ad9bd997f5ccc4f0307630373ea6c68d67596105c38446958ff0d5276159fa9e45d8e566b79f1c41ede2b7c010bab3b1c0
- SSDEEP 3072:UvE3ZxbErzsP2igyL5iolnJ3F+sNYFfP:UE0rzsPLQmNE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4163
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
MulDiv
InterlockedCompareExchange
ExitProcess
SetLastError
GetProcAddress
GetExitCodeProcess
LoadLibraryA
VirtualProtect
CompareStringA
Name
.text
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=5, id=50, version=4667,
count=20, id=106, version=8117,
count=6, id=217, version=1012,
count=15, id=218, version=4321,
count=25, id=201, version=7486,
count=8, id=204, version=2101,
count=5, id=18, version=6710,
count=27, id=239, version=9358,
count=3, id=76, version=3588,
count=17, id=116, version=4203,
count=7, id=100, version=5717,
count=29, id=214, version=5335,
file (3).exe
- IMPHASH c4a0d13517b757a950f8e129974cca4e
- SHA256 9ce3b4f8b78146df14692b934919b6449227ec79e0e51e446d9f07aabad3415e
- MD5 f26c45393af03e80a40ea06aafb01c63
- SHA1 7c7e2f2e97269fce1777e00fd9a02f378cdc2e60
- SHA512 a445023be352a5055e4e681cb075bad0a3b401c21b30a2aad83c898421b8afd76937bd92326e22119556b390fb1bfb78afd649b98a552e643ee640ad1d62d755
- SSDEEP 3072:c0f+6XYD/v+IE1ntwfEqZKfW03DKk9eOxdN/7uzNooX2MsNYFfPu:L7C/Wz1ntwfEq4fHwOZ6FXoE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4251
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcatW
GetStringTypeA
InitializeCriticalSection
lstrcmpW
GetSystemDefaultLangID
LockResource
lstrlenA
LocalReAlloc
GetProcAddress
lstrlenW
VirtualProtect
UnmapViewOfFile
GetLocaleInfoW
SetCurrentDirectoryA
GetModuleHandleA
DeleteFileW
HeapCreate
TlsSetValue
RaiseException
GetCurrentThreadId
WaitForSingleObject
CreateFileW
GetVersion
GetCurrentProcessId
FindClose
GetFileSize
ExitProcess
CreateFileA
LocalLock
LoadLibraryA
lstrcpyW
MultiByteToWideChar
GetProcessHeap
DisableThreadLibraryCalls
TerminateProcess
CreateEventA
GetFileType
Sleep
GlobalAlloc
VirtualFree
GetSystemDirectoryW
MapViewOfFile
GlobalFree
EnterCriticalSection
LocalUnlock
HeapSize
TlsAlloc
LocalFree
GetVersionExA
GetSystemInfo
SetFileAttributesW
GetEnvironmentStrings
ReadFile
GetModuleFileNameW
MulDiv
GetFileAttributesW
GetACP
GetLastError
GlobalUnlock
GetLocaleInfoA
VirtualQuery
VirtualAlloc
GetTimeFormatW
LocalSize
TlsFree
IsProcessorFeaturePresent
lstrcatA
LocalAlloc
SetUnhandledExceptionFilter
SizeofResource
SetStdHandle
FoldStringW
SetThreadPriority
CloseHandle
GetFileInformationByHandle
GetLocalTime
GetUserDefaultLCID
FindFirstFileA
GetSystemTimeAsFileTime
DuplicateHandle
SetLastError
GetEnvironmentStringsW
SetConsoleCtrlHandler
SetEndOfFile
WideCharToMultiByte
GetCurrentProcess
QueryPerformanceCounter
GetUserDefaultUILanguage
WriteFile
OpenMutexA
CompareStringW
FindFirstFileW
InterlockedDecrement
IsBadReadPtr
CreateFileMappingW
GetOEMCP
FormatMessageW
GetSystemDirectoryA
UnhandledExceptionFilter
GetStartupInfoA
GetTickCount
GetTempFileNameA
OutputDebugStringA
GetCommandLineA
lstrcmpiW
GetCommandLineW
SetEvent
GetDateFormatW
GetSystemTime
lstrcpynW
SetFilePointer
LoadResource
IsValidCodePage
GlobalLock
msvcrt
_errno
_adjust_fdiv
__set_app_type
localtime
_lock
_unlock
_XcptFilter
_cexit
_snwprintf
__setusermatherr
__p__commode
wcstoul
_wtol
??1type_info@@UAE@XZ
wcsncmp
iswspace
__p__fmode
_acmdln
exit
_callnewh
__getmainargs
_controlfp
wcsncpy
_c_exit
iswctype
time
_exit
_initterm
user32
MessageBoxW
MessageBeep
GetMenu
CharNextW
DrawTextExW
GetWindowTextW
GetDlgItemTextW
ScreenToClient
CharLowerW
TrackPopupMenu
ReleaseDC
CloseClipboard
TranslateAcceleratorW
EndDialog
DispatchMessageW
InvalidateRect
GetParent
IsWindowVisible
CharUpperW
LoadCursorW
SetWindowPlacement
CallWindowProcW
PeekMessageW
GetSubMenu
IntersectRect
DefWindowProcW
GetDlgItem
RegisterWindowMessageW
DeleteMenu
SetCursor
PostMessageW
DrawEdge
SendDlgItemMessageW
SetFocus
EnableWindow
CheckDlgButton
GetSysColor
SetWinEventHook
GetWindowLongW
IsDialogMessageW
ShowWindow
SendMessageW
GetFocus
MoveWindow
CreateDialogParamW
GetForegroundWindow
GetSystemMenu
OpenClipboard
IsIconic
SetParent
PostQuitMessage
PeekMessageA
SetActiveWindow
GetWindowThreadProcessId
LoadImageW
IsClipboardFormatAvailable
SetDlgItemTextW
EnumWindows
SendMessageA
GetKeyboardLayout
UpdateWindow
DialogBoxParamW
SetWindowLongW
UnhookWinEvent
wsprintfW
EnableMenuItem
InflateRect
GetSystemMetrics
LoadStringW
GetMessageW
SystemParametersInfoA
GetCursorPos
TranslateMessage
CheckMenuItem
GetDlgCtrlID
GetMenuState
SetScrollPos
GetClientRect
WinHelpW
SetWindowTextW
GetDesktopWindow
ReleaseCapture
DestroyWindow
GetWindowPlacement
ChildWindowFromPoint
LoadAcceleratorsW
CreateWindowExW
LoadIconW
RegisterWindowMessageA
UnhookWindowsHookEx
GetDC
RegisterClassExW
gdi32
SetMapMode
TextOutW
SetWindowExtEx
StartPage
EndPage
CreateDCW
GetTextExtentPoint32W
SetAbortProc
GetTextMetricsW
GetTextFaceW
SetViewportExtEx
EnumFontsW
DeleteObject
StartDocW
GetObjectW
SetBkMode
CreateFontIndirectW
GetDeviceCaps
LPtoDP
AbortDoc
EndDoc
SelectObject
GetStockObject
DeleteDC
advapi32
RegCloseKey
RegSetValueExW
RegOpenKeyExA
IsTextUnicode
RegQueryValueExA
RegCreateKeyW
RegQueryValueExW
shell32
DragFinish
DragAcceptFiles
ShellAboutW
DragQueryFileW
comdlg32
FindTextW
GetFileTitleW
PrintDlgExW
GetSaveFileNameW
ReplaceTextW
PageSetupDlgW
ChooseFontW
GetOpenFileNameW
CommDlgExtendedError
winspool.drv
OpenPrinterW
GetPrinterDriverW
ClosePrinter
comctl32
CreateStatusWindowW
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
214B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=9, id=12, version=8715,
count=10, id=3, version=50119,
count=4, id=6, version=5795,
count=7, id=12, version=50276,
count=24, id=12, version=47158,
count=17, id=9, version=42079,
count=18, id=15, version=33161,
count=12, id=7, version=52198,
count=7, version=1022,
file (4).exe
- IMPHASH 8dde48a10230b283ddab8b7d229d871d
- SHA256 ca1d9b37d93106cab5f20fde3e6943ac0ae4761589cf31e2554fbabfaf80bfd5
- MD5 241421356dd99063199983faaaec1d8b
- SHA1 2f65f6007347bdeb6bce09f7b727ed3db30c86a8
- SHA512 59757412acc955bbf6a0695fac8b1b7ac231ae9bee71a42307cc4ec793c09f4d52a7358b0a8b40fa0658fbc688743034eedcf16da36f8bd2643cc48deb2c73ee
- SSDEEP 1536:WUVdfhkoWcPdBW4TVu5nHhJKqMkwN7Y0S8iXU0CsNdyukfP+:WUVTVg5BWkfqUEsNYFfP+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6781
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrStrIW
StrCpyW
StrRStrIW
StrCatW
kernel32
GetLocalTime
ExpandEnvironmentStringsW
CreateThread
GetCommandLineW
GetModuleHandleW
GetProcAddress
LoadLibraryW
lstrlenW
TerminateThread
GetExitCodeThread
GetTickCount
FindClose
DeleteFileW
ReadFile
VirtualAlloc
GetFileSize
FindNextFileW
GetLastError
FindFirstFileW
FreeLibrary
LoadLibraryExW
GetPrivateProfileStringW
MultiByteToWideChar
GetVersion
Process32NextW
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
GetSystemTime
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryA
HeapReAlloc
VirtualFree
GetModuleFileNameA
GetStdHandle
InitializeCriticalSectionAndSpinCount
CreateFileW
WriteFile
CloseHandle
CopyFileW
CreateProcessW
WaitForSingleObject
Sleep
SetSystemTime
GetLocaleInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsSetValue
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
ExitProcess
user32
GetAsyncKeyState
CallNextHookEx
GetDlgItemInt
GetWindowLongW
SetWindowLongW
SetWindowPos
SetLayeredWindowAttributes
DefWindowProcW
EndPaint
GetSystemMetrics
CreateWindowExW
ShowWindow
UpdateWindow
SetForegroundWindow
SetWindowsHookExW
DialogBoxParamW
EndDialog
MessageBoxW
BeginPaint
GetDC
ReleaseDC
RegisterClassExW
gdi32
SetBkColor
CreateDIBitmap
CreateDIBSection
CreateFontA
CreateCompatibleDC
SelectObject
CreatePen
CreateSolidBrush
Rectangle
SetTextColor
TextOutW
BitBlt
shell32
ShellExecuteW
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=16, id=18, version=8444,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=141, id=1, productName=Unmarked objects,
count=74, id=131, productName=VS2008 build 21022, version=21022,
count=35, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
file (6).exe
- IMPHASH 7c7a13676a5931fc5638b234ba8c8833
- SHA256 f77ef2ace574ee9a7d758ef00f7df14c940381625b12a4b65e5e292d1ef34b1c
- MD5 438580ccbffdc97ad5b9f09a213c3e8f
- SHA1 0437c2003974a979ecc4170544f2f863c7dafd12
- SHA512 a8214216662cc7323b3ab0aec016647581ff2ca68edeab9bf340c7befb088f501d7d592f901eea48211681bcf5f90fc74293b940152f32e1be6555f55dd4dbd8
- SSDEEP 3072:0t6Gtx/jjOtP8JV4Y1aaH67pnMK/MdyGwsNYFfP:0thut0JV3fOMdE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ResetEvent
SetEvent
TlsGetValue
GetProcAddress
ExitProcess
IsValidLocale
LoadLibraryA
VirtualProtect
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
46KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
182B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=6, version=4357,
count=17, id=249, version=2676,
count=11, id=246, version=5320,
count=22, id=105, version=9739,
count=18, id=167, version=5616,
file (7).exe
- IMPHASH 0a93557af273d834d10d3cfe6a2203be
- SHA256 b5c2e240ebc4323421fea99a02507a79ea9fba5b29ee9b6cc3e808d288de8c02
- MD5 5c6416f819bfbca2f1862691a03f68be
- SHA1 b26cb187e3ea74fbb76bbea4096aa9315ac4e405
- SHA512 9288510c7541aace8bd669f2ed8e186760a1d224874234a1d797fd7f64462313308828785e43edd010d332f589f8ba93124fe55879638655d18673d56c0d0b26
- SSDEEP 12288:IOkIEyW/jLPWXR8Kwxs/bJYorMvQGuArOQb1K1Gc4nS:AyWPWq/xAxMbrOQJ9c4n
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
54177
Major OS version
16089
Entry point
5110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegEnumValueW
AddAccessAllowedAce
kernel32
VirtualFree
GetModuleHandleA
GetCurrentThreadId
VirtualAlloc
ExitProcess
GetModuleFileNameA
GetCurrentProcess
LocalFree
GetLastError
GetProcessHeap
LoadLibraryA
GetModuleHandleA
gdi32
SetBkMode
DeleteObject
SetBkColor
BitBlt
CreateSolidBrush
ExtTextOutW
DeleteDC
user32
LoadStringW
DestroyWindow
DestroyWindow
ShowWindow
CreateWindowExW
ShowWindow
SendMessageW
GetDC
PostMessageW
LoadStringW
GetMessageW
DefWindowProcW
GetSystemMetrics
LoadIconW
ReleaseDC
GetDC
shell32
DragAcceptFiles
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
388KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=95, version=2179,
count=6, id=25, version=9210,
count=2, id=93, version=2067,
count=27, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=151, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=56, id=39, version=8491,
count=1, id=96, version=2179,
count=27, id=93, version=2179,
count=706, id=1, productName=Unmarked objects,
count=183, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
file.exe
- IMPHASH 658e34a5cdd932120b247a39f4a0d8fe
- SHA256 6b9611c64a82acc1bcb4ee26b372e6b1717e4acb790139d5e296bfc3c440ec24
- MD5 56fe9f129308ccb3a1babe9169f2414c
- SHA1 74809983aa3e0562d69ba5ea5da09b75cd5d1d1e
- SHA512 ac0d0a3610a3bdeaeea0b087c9dc9b86a61971b98c91bca6efa22989debccbc4b8fce1b202a978e10d06d0c38fc93e97a8b68986416b8488bc70101eb01003eb
- SSDEEP 3072:YetaGBy9OYojUkNHEk+qza+ik8X9ETCx5z00kEQMwti2rmSy0PMy50UCnLFUgKaX:l9GLkJEk+guZXD5mI2rm3U6FJKaIOJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
MethCallEngine
ord593
ord594
ord526
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord608
ord717
ProcCallEngine
ord537
ord644
ord578
ord100
ord617
Name
.text
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.swoi
Size
216KB
Virtual Size
4KB
Characteristics
generic
count=1, id=13, version=8169,
file_ (1).exe
- IMPHASH b919d3bd2c21ead468f9689aee227772
- SHA256 66c7984e9f8af6d058d696c4f38efe2d527d02bfba83a3ec2db204ce9c70aa29
- MD5 6ffa35b0a2acd5565ade6d3e1af64a94
- SHA1 7cd6bd698f1629a5ef913012c4b0ddad41f9a332
- SHA512 916d4591806e95a5967c0dc495988b30202f14395efc85586e7c1294c22352a93a8ed8d3df7ebcf44809830a44f211f365196adced4da863479024a86a762f72
- SSDEEP 6144:eSMxSiMnm1e22/p56dNI07bMLox7xRoVkUSlS6mldw40jELBAF:eSwys32/ydNI07bmcxAkHSTZdAF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
244084
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapAlloc
GetProcessHeap
ExitProcess
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
GetProcAddress
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
advapi32
GetUserNameW
Name
.text
Size
258KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=76, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=75, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
file_ (2).exe
- IMPHASH 7c2f291b0c2a88838416c2a4529596ac
- SHA256 9f3c0bbe50b6be0afbb518a02cbdadd2b8b70041b08c26e526126ef383e1b9ac
- MD5 fb7f7126227b912f6cecb6f6350e845b
- SHA1 1ca974c516cff5f349a60b5079dd19da12f530ab
- SHA512 86998f55b2bb03dcb3afd2a2a73e323e9e7f48592acb9b2f5620508ab981a849d9a9774b5379b73ea618347996a1f8b6d9f8dcf52ab7e95bef8b6f435f47b56b
- SSDEEP 3072:44LgKLXiA+3uShifxS/OQSYGHGQwtkTYpj7ToyJIP+ZWs+YqCC/RYnsf:44LgKL+ixAOQZGmLtk27To1uWs+dCC0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
14002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCommandLineW
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
user32
EnumWindows
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=76, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=74, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
file_ (3).exe
- IMPHASH 291b67f55e10062a97475591840be4f7
- SHA256 3f319c6679417445c6c1179eb0424b4446a6798acf61efc38c64de780ca64357
- MD5 9b64fa84f1b815d909f4d4134ef2f077
- SHA1 65da225d8393095f657f75eb16928408d2235048
- SHA512 b2b2fdfb03da6901f8cb01eb11a7ef1d8bc2757c1202fc14dcad492b7552ec3cdb81fcabc39632d3c1d4ec9ad130c38583f6995f8107816895e87620de875996
- SSDEEP 6144:4F3LPSBCHorc1Z6LBkL2WhSbm2gfRtYwxpTxh+fwZZmqUEL79h:4F3WBrcRL2WJRtewnfP9h
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
242932
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
GetSystemDirectoryA
FindFirstFileA
FindNextFileA
HeapAlloc
GetStartupInfoW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
GetProcAddress
WriteFile
GetStdHandle
GetModuleFileNameA
SetUnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
Name
.text
Size
257KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=76, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=76, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
file_ (4).exe
- SHA256 99d596702cc87904fa030fec5f21f6f078c3b04b58b19ac7528f14834cfe943c
- MD5 693f73c11611c6e8cbc1421e228739e2
- SHA1 4ea96e0a92b563112dd05783e41b416cc410fd10
- SHA512 e255bf838fd0c6cf3ec4e4d77cd1fc875654687a2ae2f3c6846f3b11544bbc0d1a2eca67129bcb89715077a55930f33cba5b99195b91911869e86ebcf30e450c
- SSDEEP 3072:/sfKhCVx2XoxJOIrknnyWdWTBR6t1VQLpaPyzF:3hhEJ3rkyCwct/QLsA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
92732
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=78, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=81, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
file_ (5).exe
- IMPHASH 5aba334a0a2e5ab7e5463385dd6bf7d6
- SHA256 39bec7d640fa31372e63fda5b8c5fb5399a28ede453cc8d08adc6a0936dc4762
- MD5 036cc0b626fc8b6b9d8136258f7de2ab
- SHA1 ec3c316686653affdd9e919481887ed8b11b083f
- SHA512 3d9a30977cceb1f8bf9cd9eed754058314f54a1b8758bdfe29b3350346faff7e8e9deeb9f182e71c2dd1fc3aa3f9690601adf3a6f229586876d09962d2848d59
- SSDEEP 6144:weETxpj4y/11v8n1w4P8C/CVfA5SVPN+B6REIyUFGEHapLbA3:q/jJ1vAkC/CCSZC6hyUFGxHA3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
240308
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
Sleep
GetSystemTime
CreateThread
WaitForMultipleObjects
HeapAlloc
GetStartupInfoW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
GetProcAddress
WriteFile
GetStdHandle
GetModuleFileNameA
SetUnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
Name
.text
Size
254KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=132, productName=VS2008 build 21022, version=21022,
count=16, id=149, productName=VS2008 build 21022, version=21022,
count=76, id=131, productName=VS2008 build 21022, version=21022,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=76, id=1, productName=Unmarked objects,
count=2, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
file_ (6).exe
- SHA256 0a5b1277f0c36dba889f2bc43ff8f3eac24ddc343354f7110acfdbcebee9001a
- MD5 046a93df3f0690ab42cf3fb46e2c8078
- SHA1 8b408e00c7f36ceb54c8d6148415bf1373dec3c3
- SHA512 a61821e9fb1c517f9fdb66c24892c4cf2e1166eade93a5924646435123c585271c4efa9120797b73d84e592daaa4e4a3f5018ad8f4f8efa967a49b8644205cd9
- SSDEEP 3072:JJCBy+OCiT4adPHT7CGfvnMAnqLYFryKF:f+OCw4IHNvMAnqLYZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91244
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=78, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=81, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
file_ (7).exe
- SHA256 fb4acc579180273a55a597ab20ec77a7280acb5e2ffe970160dd72b8c1694769
- MD5 0d46f0bb1c0e4bc3ca1fa9f2a9b13b07
- SHA1 67f295dff78f43fe28fb5a9cf8e667bc2b1a1100
- SHA512 ea9ee344015ed93f3fc2fe316e0df1922639f51e90aaf5be65e94a82a3177b00448ebfb7045bb57035b561688e7f05fa93ad74bba2b31029ffd1994cc74dc698
- SSDEEP 3072:RSdK59VNPWqUWnSHmm42G4pbjJ+fRxXfQbNIaykBatKyN1e0W:RSCNPlvSGm42GwjUf7XfQB/Mtpe0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
618064
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
452KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
148KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=37, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=20, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=93, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=132, productName=VS2008 build 21022, version=21022,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=96, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
out.upx
- SHA256 2657f64425ac5e440cf866a94f4dd56666e850a8e8b21cc3ea524a2644aa07c1
- MD5 f08c6702609c06211a5774b231565db9
- SHA1 b7ad2d882f3c925fa1b280b7d5bbca25473fcd17
- SHA512 58c09a4cdb1c1b65aee9bdf5fb137be6a00a5729373874b7d94e7f68cfba5deaf252a80fc8323735ac37b1945d1755560e455c86d179fdaeb8a06d49254278ea
- SSDEEP 6144:fX4hLB7nm/X1QwzFa+XigCPycda4U88f6/ywAi9ug:ghV7upzFa2igCP12BrwtEg
- MD5 SHA1 SHA512 SSDEEP
-
Detected Xorist Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
17539
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
503KB
Virtual Size
506KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=20, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=93, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=132, productName=VS2008 build 21022, version=21022,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=96, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
file_.exe
- IMPHASH bb870a197496189576107320f6635042
- SHA256 b658a9d05f48b37b025a538d5ebcc437d4c11f90d97a815246503ae13cb2300f
- MD5 aee521e7f474c58f4290c7a6a80b6b1d
- SHA1 fdc2068d7d03c80392a878283a55ed80367fa84d
- SHA512 4bd61a8ef822820220c428dcaa69417fd6c7d7b644a845e9dbfe9a033a246125ef028cb4d71842519e3276153aaa9b692a156dc1d0aac397907d6c09f13453c0
- SSDEEP 6144:CqllonqeU7qjgrKYpSGycawn8Ty2YhJ4L5KCPBJUsOmkfkHGWaeiWLh2:xlMq3qkKYEY8Ty/E5zp3HtaePF2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
243956
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
GetProcessHeap
HeapAlloc
GetSystemTime
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
GetProcAddress
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
Name
.text
Size
258KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=76, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=75, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
file_9.exe
- IMPHASH 7395342c585d7b3da53f08d48e2b858d
- SHA256 df4b719bc0b675b6a9466e8fd57e42ff55994e22507aa82aa08fd574935c83e4
- MD5 05fa70fac7d39757fa615c459fe1ab6e
- SHA1 5ab4fba43997a3df4afa36e05012440d6d0253fa
- SHA512 165b74dfb464f3b16cd97cc6c70e8f792543f30cd8c895fd695205531ff96fb630aac22b3f9f2398ed2aa0544b2ab827c8e7e8a018ee1eba021fbcc36e77cd31
- SSDEEP 3072:UosBt1tpuky65s9MAfzbD8pTsmT+G42Wec5:UosB7tUOAvAuHfe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
23696
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
GetErrorInfo
LoadTypeLib
SysFreeString
SetErrorInfo
rpcrt4
CStdStubBuffer_QueryInterface
CStdStubBuffer_Connect
NdrDllCanUnloadNow
RpcServerInqBindings
NdrDllUnregisterProxy
RpcServerUnregisterIf
CStdStubBuffer_Disconnect
RpcStringBindingComposeW
CStdStubBuffer_IsIIDSupported
RpcStringBindingParseW
RpcBindingToStringBindingW
NdrCStdStubBuffer2_Release
RpcServerRegisterIfEx
RpcRevertToSelf
RpcStringFreeA
version
VerQueryValueW
VerFindFileW
GetFileVersionInfoSizeW
GetFileVersionInfoA
VerLanguageNameA
GetFileVersionInfoW
GetFileVersionInfoSizeA
shell32
SHBrowseForFolderA
SHChangeNotify
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListA
DragQueryFileA
CommandLineToArgvW
ShellExecuteA
SHGetMalloc
SHGetFileInfoW
SHGetSpecialFolderPathW
SHGetFolderPathW
DragQueryFileW
SHBrowseForFolderW
ShellExecuteW
SHFileOperationW
ole32
IIDFromString
MkParseDisplayName
PropVariantCopy
CoRevertToSelf
StringFromGUID2
OleSaveToStream
CreateOleAdviseHolder
CreateItemMoniker
PropVariantClear
CoTaskMemFree
CoGetObjectContext
StringFromCLSID
CreateBindCtx
CoInitialize
CoUninitialize
OleRegEnumVerbs
CoGetClassObject
CoTaskMemAlloc
CoImpersonateClient
CreateDataAdviseHolder
OleRun
CoMarshalInterface
CoInitializeSecurity
StgCreateDocfile
CoCreateFreeThreadedMarshaler
GetRunningObjectTable
StgIsStorageFile
StgOpenStorage
user32
WinHelpW
InvalidateRect
SetWindowTextW
EndPaint
UnhookWindowsHookEx
CallWindowProcA
wsprintfA
GetSystemMetrics
SetRect
TrackPopupMenu
ScreenToClient
GetDesktopWindow
CreateWindowExW
RegisterClipboardFormatW
GetWindowRect
DialogBoxParamA
GetSystemMenu
GetSysColorBrush
LoadStringA
kernel32
Sleep
CreateEventW
RaiseException
GetACP
SetHandleCount
lstrcpyW
VirtualAlloc
GetComputerNameW
GlobalAlloc
FormatMessageW
GetLastError
GetCommandLineW
FindResourceW
GetSystemDirectoryW
GetCurrentProcessId
lstrcpyA
GetFileSize
GetLocaleInfoA
LoadLibraryExA
TlsSetValue
lstrcmpiA
HeapReAlloc
GetCurrentDirectoryW
CompareStringA
GetConsoleMode
InterlockedExchange
GetFileAttributesA
DeleteFileW
lstrlenW
GetStdHandle
GetFileAttributesW
SetFileAttributesA
ExitProcess
TerminateProcess
GetTickCount
FindFirstFileW
shlwapi
PathCreateFromUrlW
PathRemoveExtensionW
StrToIntExW
StrRChrW
PathAppendW
StrCpyNW
StrStrIW
StrChrIW
SHDeleteValueA
PathIsUNCW
SHGetValueW
PathAppendA
StrCatW
StrCmpIW
PathRemoveBlanksW
PathRemoveBackslashW
UrlUnescapeW
SHRegGetBoolUSValueW
StrCmpW
PathRemoveFileSpecW
StrCatBuffW
Name
.code
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdbid
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
1024B
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
firefox32.exe
- IMPHASH 2814ee4bf500fa4a49b9308f453071bd
- SHA256 978ed9b9c86653e8f10feb9e7f93eb32f2dadeec42ccce498403e96b7bb3e3c9
- MD5 866604f3adb9207e29505012215f203f
- SHA1 718b342c3bc42f3e73c4014c2b105c4d467b0ba6
- SHA512 cdcdd94e2a4c550a819a28085fe543ed944da298da1409ed111380fbde89f6976a4c7d040750307579b007b4551aa86182d453408436bd7aef35423c49b60f79
- SSDEEP 768:nJ+norJ8u1A9lYYoEXVY8Vb4AitlW+j6O+5X3BJLkgpPpyI933jNdTfpLPvTMuO3:J1l+UMVUjWd/3ptl3jNdf5v7O3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
GetCommandLineA
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
GetTempPathA
SetFileAttributesA
DeleteFileA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathRemoveArgsA
PathGetArgsA
PathAddBackslashA
PathQuoteSpacesA
PathUnquoteSpacesA
Name
.code
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
flash_player.original.exe
- SHA256 b4baa6e421ce09d13f0d93c528375c28c8ac9c7ad0ad1d0ccbf533b82524dec0
- MD5 641ee9969fdfd9e6efd5211f4e363fb1
- SHA1 248bb709f7a0eeb102c6793d73531d47a8372351
- SHA512 1ff9365ed62c32ede4208dddcc662b76d15831013d9d576614ffa7d73a794b952e78f43e44fd01e516104e3177d4bddbc3fa664543ff38ea2aa9e38e382136e9
- SSDEEP 12288:SMhCBdogPgNJ17IujqSBg3uBLgh62eKmd2jG0ox:xIBdogPgNJSujqSKeHJv2jGV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1989728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
444KB
Virtual Size
444KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
85KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1069, id=111, version=2266,
count=1039, id=122, version=32111,
count=480, id=42, version=1925,
count=1156, id=69, version=13017,
count=1102, id=63, version=62635,
count=114, id=98, version=8576,
count=1078, id=67, version=34599,
count=57, id=104, version=18483,
count=981, id=46, version=4749,
count=834, id=55, version=4370,
count=440, id=60, version=26215,
out.upx
- SHA256 9ccc70ff2a6079af8ca7c4305f99df5b0e865d93aa05d2bee180c2a2cfb22e32
- MD5 2af2814a21dba708a6ad577f2fb788c4
- SHA1 ef0c0b190be7e307cc3360df0931e1ce78685208
- SHA512 e3ed22c860f6e9c2e1532ab5d2513e6ed2da1c03ec6aca700311164e6d9110e760034184594575c810f1757440f2bf581b9241178a09b897acdc6a4301f60226
- SSDEEP 6144:X6m48DP7pTs71akBI+u+Nwx9t42H4QJ7eHtkP1sL6y8aMz/inbFgKPpSIkhR2BKz:X/X1w1FIqeMvQgNkP6L58aiSDPANJox
- MD5 SHA1 SHA512 SSDEEP
-
Detected Xorist Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
237312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.nsakvj
Size
233KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.kayh
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.cjyvag
Size
223KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.dwice
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.olkct
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.oyoutxf
Size
512B
Virtual Size
15B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.nljcdks
Size
105KB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1069, id=111, version=2266,
count=1039, id=122, version=32111,
count=480, id=42, version=1925,
count=1156, id=69, version=13017,
count=1102, id=63, version=62635,
count=114, id=98, version=8576,
count=1078, id=67, version=34599,
count=57, id=104, version=18483,
count=981, id=46, version=4749,
count=834, id=55, version=4370,
count=440, id=60, version=26215,
flash_player.unpacked.exe
- SHA256 7cd7119f0b6e320b48c06658fcc9bcbe4367891b0d415474b66d7e4f258255d1
- MD5 21c73f81e2a00d76fc5ffafda6d658f8
- SHA1 3ef746babb4282449744ee565e5c326b82b0263d
- SHA512 fb8162af3e2edf9b92c394c9fa37fc58c77b7494a60d44829ae8ab91a611040919040c0cfe0e7b5f4dfb0997dbd7dfde20169e29c3b4e64a064ef185dc07d9bc
- SSDEEP 12288:/PjQwAjnhk0+UYfBfZOXEU5fbhXr46LuPZ47lk/6cHHiv7n1:/Pjtqnh01JMHVbCsMocH81
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
526216
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
509KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
15B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
32KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.!rc!
Size
Virtual Size
853KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.mackt
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
853KB
Virtual Size
856KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
freegaza_israeli_killers.exe
- IMPHASH d32519c93924bb24d9874d86c5993ee3
- SHA256 8acccd48ee73b7eccbc3622341ea33f9e07dbcdcd6e07f8b01fb630015a44659
- MD5 685a8933f565793c2bf54770b3286bbe
- SHA1 85f5e2bb703c836c2a29045d6fc15ef81804f938
- SHA512 40a85e1d8f0f80120bd413efece18ed5983ffdea316ddedd760c487da535803ae6b904f97b32c8732cca3bc8f6e6ea4f440849281a0d3c541d26a4489c3383a4
- SSDEEP 6144:gSUomEUi3+sMZ3xEYIrQ3XFp6/ZLk5rmrL0bl+oanFvRB4ulqTyO0A:xUomEFRu3xEPEOBermMetRBXw0A
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
119835
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
comctl32
InitCommonControlsEx
shlwapi
SHAutoComplete
kernel32
ReadFile
FlushFileBuffers
GetFileAttributesW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentDirectoryW
GetFullPathNameW
GetModuleFileNameW
FindResourceW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetLocaleInfoW
GetNumberFormatW
ExpandEnvironmentStringsW
WaitForSingleObject
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
GetTempPathW
MoveFileExW
Sleep
UnmapViewOfFile
MapViewOfFile
GetCommandLineW
CreateFileMappingW
GetTickCount
SetEnvironmentVariableW
OpenFileMappingW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateThread
GetProcessAffinityMask
CreateEventW
CreateSemaphoreW
ReleaseSemaphore
ResetEvent
SetEvent
SetThreadPriority
SystemTimeToFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
WideCharToMultiByte
SetFileTime
GetFileType
IsDBCSLeadByte
GetCPInfo
GlobalAlloc
SetCurrentDirectoryW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
ExitProcess
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualAlloc
VirtualFree
HeapCreate
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
SetEndOfFile
SetFilePointer
WriteFile
GetStdHandle
GetLongPathNameW
GetShortPathNameW
CompareStringW
MoveFileW
CreateFileW
CreateDirectoryW
DeviceIoControl
RemoveDirectoryW
DeleteFileW
CreateHardLinkW
GetCurrentProcess
CloseHandle
SetLastError
GetLastError
CreateFileA
MultiByteToWideChar
GetCommandLineA
RaiseException
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
HeapFree
RtlUnwind
user32
EnableWindow
GetDlgItem
ShowWindow
SetWindowLongW
FindWindowExW
GetParent
MapWindowPoints
CreateWindowExW
UpdateWindow
LoadCursorW
RegisterClassExW
DefWindowProcW
DestroyWindow
CopyRect
IsWindow
OemToCharBuffA
LoadIconW
LoadBitmapW
PostMessageW
SetForegroundWindow
MessageBoxW
WaitForInputIdle
IsWindowVisible
DialogBoxParamW
DestroyIcon
SetFocus
GetClassNameW
SendDlgItemMessageW
EndDialog
GetDlgItemTextW
SetDlgItemTextW
wvsprintfW
SendMessageW
GetDC
ReleaseDC
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW
GetWindowRect
GetClientRect
SetWindowPos
GetWindowTextW
SetWindowTextW
GetSystemMetrics
GetWindow
GetWindowLongW
GetSysColor
gdi32
GetObjectW
DeleteObject
GetDeviceCaps
CreateDIBSection
comdlg32
GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
shell32
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFileInfoW
ShellExecuteExW
SHChangeNotify
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ole32
CLSIDFromString
CoCreateInstance
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
oleaut32
VariantInit
Name
.text
Size
161KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=27, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=143, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=232, id=1, productName=Unmarked objects,
count=104, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
fresh_a22bb95ee8cfccc94ba183c071bad3a951b353e98fcf0d6cfa9268aaf9c53d53.exe
- IMPHASH c1332314755e5ff8ad0c0fd2e676cc1a
- SHA256 a22bb95ee8cfccc94ba183c071bad3a951b353e98fcf0d6cfa9268aaf9c53d53
- MD5 5746843ce1596f53fdaab16289fce8ce
- SHA1 6d34dbf9e248555c228e2c641d4e0597f19dbd72
- SHA512 8569e70305338eea019eed39d70bb793a5e06955a267475f637d724cddd27785e2aeeb5f662edb65a6eb3002687a7fbe59e43ae7d7e3bb4f23860e8392e9cb3e
- SSDEEP 384:vKYlvmvlVpw+oGFVQ+YGQgBy+vzYuS1nTB0w9rmDgjC9G:vKYGlVJYGQRFHmDjo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
strcmp
rand
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
_except_handler3
srand
strrchr
sprintf
memcmp
memcpy
??3@YAXPAX@Z
realloc
memmove
free
??2@YAPAXI@Z
strlen
sscanf
malloc
strcpy
strcat
memset
exit
advapi32
CryptAcquireContextA
AllocateAndInitializeSid
CryptImportKey
CryptEncrypt
CryptGenKey
CryptExportKey
FreeSid
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
shlwapi
StrToIntA
StrStrA
StrStrIA
StrDupA
dnsapi
DnsFree
DnsQuery_A
ws2_32
recv
send
inet_addr
closesocket
htons
gethostbyname
socket
WSAStartup
inet_ntoa
connect
kernel32
ExitProcess
LocalAlloc
LocalFree
GetModuleFileNameA
CreateMutexA
GetLastError
Sleep
CreateFileA
CloseHandle
lstrcatA
GetModuleHandleA
GetProcAddress
GetTickCount
GetTempPathA
FindNextFileA
FindFirstFileA
lstrcpyA
lstrlenA
lstrcmpA
ReadFile
SetFilePointer
MultiByteToWideChar
MoveFileA
WriteFile
CreateDirectoryA
GetTempFileNameA
UnhandledExceptionFilter
WinExec
CreateThread
GetCurrentDirectoryA
GetDriveTypeA
GetFileSizeEx
GetStartupInfoA
lstrcmpiA
GetLogicalDriveStringsA
GetDiskFreeSpaceA
FindClose
user32
wsprintfA
shell32
SHEmptyRecycleBinA
SHGetFolderPathA
ShellExecuteA
ole32
CoCreateGuid
CoInitialize
CoCreateInstance
Name
.text
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
989KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=20, id=123, productName=VS2005 build 50727, version=50727,
count=128, id=1, productName=Unmarked objects,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=4, id=14, version=7299,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
helper[1].exe_.exe
- IMPHASH 553ef6236c6cb4268814330cd1e93c7d
- SHA256 d54e3bd3d6532cd9b1c0e66f8148063ae5889c0a76bc04876f3c32e3b58f1cb9
- MD5 2599225a023f4d4c7e8d7f3361236615
- SHA1 9a265bae87e87f01e1b17f02801f39c87da0c1bc
- SHA512 d237976c619e05caf9dcdb7fae0d14acd5c34e3d3f47767bfcd3ba087cbe3b57b3ae159211a7a882446b8eed5ca956e72f71907a92950c68d142bdc7b136ece3
- SSDEEP 12288:j3nZMhJ+ubNmzoOoTc5Bvt3AsRMoS9VqoQXeVQAoOPpE18zvV:j3nZqfbkzQTMJy9goQOV7P218zvV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
46467
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
comctl32
InitCommonControlsEx
shlwapi
SHAutoComplete
kernel32
DeleteFileW
DeleteFileA
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetTickCount
WideCharToMultiByte
GlobalAlloc
GetVersionExW
GetFullPathNameA
GetFullPathNameW
MultiByteToWideChar
GetModuleFileNameW
FindResourceW
GetModuleHandleW
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
CompareStringA
ExitProcess
GetLocaleInfoW
SetFileAttributesW
DosDateTimeToFileTime
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
WaitForSingleObject
Sleep
GetExitCodeProcess
GetTempPathW
MoveFileExW
UnmapViewOfFile
MapViewOfFile
GetCommandLineW
CreateFileMappingW
SetEnvironmentVariableW
OpenFileMappingW
GetProcAddress
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
CompareStringW
IsDBCSLeadByte
GetCPInfo
SetCurrentDirectoryW
LoadLibraryW
FreeLibrary
SetFileAttributesA
GetFileAttributesW
GetFileAttributesA
WriteFile
GetStdHandle
ReadFile
CreateFileW
GetCurrentDirectoryW
CreateFileA
GetFileType
SetEndOfFile
SetFilePointer
MoveFileW
SetFileTime
GetCurrentProcess
CloseHandle
SetLastError
GetLastError
GetNumberFormatW
user32
wvsprintfA
wvsprintfW
ReleaseDC
GetDC
SendMessageW
SetDlgItemTextW
SetFocus
EndDialog
DestroyIcon
SendDlgItemMessageW
GetDlgItemTextW
GetClassNameW
DialogBoxParamW
IsWindowVisible
WaitForInputIdle
SetForegroundWindow
GetSysColor
PostMessageW
LoadBitmapW
LoadIconW
CharToOemA
OemToCharA
MapWindowPoints
CreateWindowExW
SetWindowTextW
UpdateWindow
LoadCursorW
RegisterClassExW
SetWindowLongW
GetWindowLongW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
CopyRect
IsWindow
CharToOemBuffW
MessageBoxW
ShowWindow
GetDlgItem
EnableWindow
OemToCharBuffA
CharUpperA
CharToOemBuffA
LoadStringW
SetWindowPos
GetWindowTextW
GetSystemMetrics
GetWindow
CharUpperW
GetWindowRect
FindWindowExW
GetParent
GetClientRect
gdi32
GetDeviceCaps
GetObjectW
CreateCompatibleBitmap
SelectObject
StretchBlt
CreateCompatibleDC
DeleteObject
DeleteDC
comdlg32
GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW
advapi32
RegOpenKeyExW
LookupPrivilegeValueW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
SetFileSecurityW
SetFileSecurityA
OpenProcessToken
AdjustTokenPrivileges
shell32
SHChangeNotify
ShellExecuteExW
SHFileOperationW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
ole32
OleUninitialize
OleInitialize
CoCreateInstance
CreateStreamOnHGlobal
CLSIDFromString
oleaut32
VariantInit
Name
.text
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=176, id=1, productName=Unmarked objects,
count=5, id=149, productName=VS2008 build 21022, version=21022,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
holycrypt-v0.3.exe
- SHA256 bd9cb63686cf3fba0e72dee7cfdc90438ce33dba4f95c3b77ee39cb6619852d7
- MD5 1a4816c8585e449953803d7cb17cefc9
- SHA1 685e622ccc7fa34be1e80a3dde4bb559a4bf76f0
- SHA512 cde256816025bfb1222780a73fe575fab1e7464f15d6afc18fd57f3e5ccdfe1c22e76cb01d78799411595efefb3b4b6981a2f5f0bd62b10c79010951809d594f
- SSDEEP 3072:6wxxnbnO7gu6p7sto17AocreRw9zRWp/+d16BaehR3CBR5UBuzRdR8JImOJeEV+:C7SYtAAIRw9zRU+dzev3ZBuRdiJwnV+
- MD5 SHA1 SHA512 SSDEEP
info[1].exe
- IMPHASH 3d8d7beb5fc06d08585103c361dc4565
- SHA256 df7b73c2a36286d3d328128c00136f4c89e9c7263ca281b1af44ec06a43c61d2
- MD5 270b8ce04a9f55809938430a2fe6bb47
- SHA1 2166a3a41a65bacf5d53f62d432a67fb8a0dacbe
- SHA512 3eb31dc1afbc5f012b8fae8ffa51a31a37daf1b5eeb308dd7ccc318fdebf6a3fa14f52132a18d914a527b0d6be32e908728c40253501805815fe5c4af31f8590
- SSDEEP 3072:s8Gahi/GgReBJ3wk2dn9KXtTPRmvnI9QCQyT6ykbI:lGvGTSk2dn9KdTUvI16d
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
77824
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InterlockedExchangeAdd
IsDBCSLeadByteEx
ConvertDefaultLocale
BeginUpdateResourceA
OpenMutexW
SetFileApisToOEM
GetVersion
ReadConsoleOutputA
GetCurrentProcess
EscapeCommFunction
CreateWaitableTimerA
EraseTape
SetLocalTime
GetThreadLocale
GetComputerNameW
GetConsoleCursorInfo
SetThreadContext
GetProcessShutdownParameters
HeapAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ReleaseMutex
GlobalFindAtomA
HeapFree
user32
LoadCursorA
comctl32
ord17
msvcrt
_except_handler3
Name
.text
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.cs
Size
512B
Virtual Size
157B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
374KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=64, version=9210,
count=2, id=25, version=9210,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=29, id=1, productName=Unmarked objects,
count=2, productName=Unmarked objects (old),
count=1, id=174, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
informations.exe
- SHA256 8b1c6d1c4df109ef648f36a31e59e492c9752b0acf0eea26a0a75b2398c5d86c
- MD5 ec2b6ecfc8ca67f9357b6550166a0838
- SHA1 134a0ae85224a12e3b8114900b83c9669524d427
- SHA512 d4803c161590c31dadebc13b1d505ee1cf1fbaee52facacdc5ea38bb16f485377819877b4a7662b255caf95c2f5ac93149f211e35c940660d0398142a00bc424
- SSDEEP 12288:A1V8jxipOdK/nJr+ihc9DRVnXGrqgv6rk551VkG1ZUQ/bQDiW:q8lipOAgoc9L2PM5ybKi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1451717
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
908KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
475KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
31KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 5ac301c979746283554b3ac2dd29855583413ad2dd7bca7eb25d9568b10c25b5
- MD5 ea2d100db79a6678b0394c74ebaa2c5a
- SHA1 4292a1e7aa92dc0c89123ddb7499003503985fa8
- SHA512 665280a3d12b09d0bfbab04d2d52358ffb3439739acb56d1524e293f908f22927b6f003e685d17d41885b902be18052b74fd3593fe27a62143906a61e40e164d
- SSDEEP 24576:Si9WQitvyUilzOUxaOWk01G4fbu/F41jen6KXYzkEEknJS7DFN4L3GmPA705sCvS:b9WDAUozOUxaOyGau6I6WPDvlAAoefk1
- MD5 SHA1 SHA512 SSDEEP
-
Detected Xorist Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8657
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
installer.exe
- SHA256 384df588fa4fb60c4986a1156b21314ce7c66468f9f4c8fac1a6b3a3cde1fe58
- MD5 d1550649c3e2ebe1bf11949fa7a7d5f2
- SHA1 a672c879062b8f1b6a84c12fecfc3b96883d36b8
- SHA512 824914391491b4e3e02cf5dd87a43c2429a75085343b206a71c2b3889ef3efdd92f015356584cee373e6c20ffdaf5d918fa033cc2e8b65a363e161c92d8f1603
- SSDEEP 12288:jANwRo+mv8QD4+0V16nkFkkk2kyWs/S4REn+58zOG:jAT8QE+kHW+S4REn+K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
152680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ