Batch_4.zip
- SHA256 471f3fb1a953fab38be3081eb835574694bc72b94f239edc400d1ce3d7a8ecb0
Overview
overview
10Static
static
10757e3242f6...b4.exe
windows7-x64
976fe72e0ec...ss.exe
windows7-x64
778d4cf8df6...B3.exe
windows7-x64
778d4cf8df6...59.exe
windows7-x64
778db508226...69.exe
windows7-x64
97965f6adf3...ss.exe
windows7-x64
77B75B33BCF...B5.exe
windows7-x64
17E3903944E...72.exe
windows7-x64
77dd9312307...ca.dll
windows7-x64
37e4c9a7e39...1f.exe
windows7-x64
980eb72d781...B3.exe
windows7-x64
780eb72d781...9A.exe
windows7-x64
7845263c869...c8.exe
windows7-x64
98524224187...8f.exe
windows7-x64
686be3831f5...39.exe
windows7-x64
68791931bac...DA.exe
windows7-x64
78791931bac...69.exe
windows7-x64
787a4f3f9f6...88.exe
windows7-x64
789fb6d7ff2...f6.exe
windows7-x64
98c59148535...21.exe
windows7-x64
98d372fcf8a...e0.exe
windows7-x64
7900.exe
windows7-x64
9911d5905cb...b9.exe
windows7-x64
791d24e0657...eb.zip
windows7-x64
992ac6be4d9...5b.exe
windows7-x64
97512f4617...7c.exe
windows7-x64
1098aadc95c5...e7.exe
windows7-x64
109943256.exe
windows7-x64
109B9517FA15...DF.exe
windows7-x64
79b7eaffe4d...c8.exe
windows7-x64
10a322da0be4...44.exe
windows7-x64
10a42252e674...34.exe
windows7-x64
9Behavioral task
behavioral1
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral5
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral6
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral7
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win7-20241010-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral8
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral9
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral10
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral11
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral12
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral13
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral14
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win7-20240729-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral15
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral16
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
300 seconds
Behavioral task
behavioral17
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_TDS=4F84A969.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
300 seconds
Behavioral task
behavioral18
Sample
87a4f3f9f6dc263378f2f01db5f2c988.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral19
Sample
89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral20
Sample
8c591485357e45a09dad3116496e6f686fa11f445a6bea5ef3cd5ed1ac078821.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral21
Sample
8d372fcf8a97223ebb86cdfe707d3035dfbfd4501c5688cfa82a9a4889e637e0.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral22
Sample
900.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
300 seconds
Behavioral task
behavioral23
Sample
911d5905cbe1dd462f171b7167cd15b9.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral24
Sample
91d24e06572099ba0aa5c20be6b1021fa48e864913fe3676ed05323e6b68fceb.zip
Resource
win7-20240903-en
windows7-x64
18 signatures
300 seconds
Behavioral task
behavioral25
Sample
92ac6be4d9215b237d624177ca0543844d0dc8d071660ae4a4cf7c93cc11505b.exe
Resource
win7-20241023-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral26
Sample
97512f4617019c907cd0f88193039e7c.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral27
Sample
98aadc95c589e064a542802bbf0ef01ef00595c34d195f1a1e6443909846d2e7.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral28
Sample
9943256.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
300 seconds
Behavioral task
behavioral29
Sample
9B9517FA1515F47A502FE56536236A20BE5BBADF.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral30
Sample
9b7eaffe4dffcbd06445d0b32785cdc8.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
300 seconds
Behavioral task
behavioral31
Sample
a322da0be4f0be8d85eab815ca708c8452b63f24d0e2d2d6d896a9f9331a6244.exe
Resource
win7-20241023-en
windows7-x64
22 signatures
300 seconds
Behavioral task
behavioral32
Sample
a42252e674a09a0b689e71c88f59969f538a473da647cc4eb5457a5d5e03a234.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
300 seconds
General
- Target Batch_4.zip
- Size 8.6MB
- Sample241122-dkdx1ayrbr
- SHA256 471f3fb1a953fab38be3081eb835574694bc72b94f239edc400d1ce3d7a8ecb0
- MD5 3179e3edf25f87e78f2fd054faf6ae60
- SHA1 7648fb854c73c9a191b935278bcefd58cc5ad3fc
- SHA512 b7d25a1a9008d363058192cd353fdd58c504db313bbcd9bf1090688c8af735f696c8a0551b3023f948de66f9f33c20c5cee18bde680afe7b2e2b60074f8abab7
- SSDEEP 196608:ttxPNvdJy9CNBi63RgR+itIShWmG9E6rHm5F2T97o:Vh7iCNveR+ipWmNEBo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/a322da0be4f0be8d85eab815ca708c8452b63f24d0e2d2d6d896a9f9331a6244.exe family_blackmoon - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe autoit_exe -
resource yara_rule static1/unpack001/97512f4617019c907cd0f88193039e7c.exe upx static1/unpack001/98aadc95c589e064a542802bbf0ef01ef00595c34d195f1a1e6443909846d2e7.exe upx - Unsigned PE 37 IoCs
Checks for missing Authenticode signature.
resource unpack001/757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe unpack001/76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe unpack001/78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe unpack001/78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe unpack001/78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe unpack001/7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe unpack001/7B75B33BCF4ECF013B93F84ED98B3FB5.exe unpack001/7E3903944EAB7B61B495572BAA60FB72.EXE unpack001/7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.exe unpack001/7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe unpack001/80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe unpack001/80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe unpack001/845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe unpack001/85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe unpack001/86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe unpack001/8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe unpack001/8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_TDS=4F84A969.exe unpack001/87a4f3f9f6dc263378f2f01db5f2c988.exe unpack001/89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe unpack001/8c591485357e45a09dad3116496e6f686fa11f445a6bea5ef3cd5ed1ac078821.exe unpack001/8d372fcf8a97223ebb86cdfe707d3035dfbfd4501c5688cfa82a9a4889e637e0.exe unpack001/900.exe unpack001/911d5905cbe1dd462f171b7167cd15b9.exe unpack003/Saldo.Pdf______________________________________________________________.exe unpack001/92ac6be4d9215b237d624177ca0543844d0dc8d071660ae4a4cf7c93cc11505b.exe unpack001/97512f4617019c907cd0f88193039e7c.exe unpack004/out.upx unpack001/98aadc95c589e064a542802bbf0ef01ef00595c34d195f1a1e6443909846d2e7.exe unpack005/out.upx unpack001/9943256.exe unpack001/9B9517FA1515F47A502FE56536236A20BE5BBADF.exe unpack006/$PLUGINSDIR/System.dll unpack006/$PLUGINSDIR/nsDialogs.dll unpack006/unneighbourliness.dll unpack001/9b7eaffe4dffcbd06445d0b32785cdc8.exe unpack001/a322da0be4f0be8d85eab815ca708c8452b63f24d0e2d2d6d896a9f9331a6244.exe unpack001/a42252e674a09a0b689e71c88f59969f538a473da647cc4eb5457a5d5e03a234.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/9B9517FA1515F47A502FE56536236A20BE5BBADF.exe nsis_installer_1 static1/unpack001/9B9517FA1515F47A502FE56536236A20BE5BBADF.exe nsis_installer_2
File Explorer
-
Batch_4.zip.zip 8.6MB
-
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe.exe 18KB
-
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe.exe 89KB
-
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe.exe 116KB
-
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe.exe 72KB
-
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe.exe 865KB
-
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe.exe 54KB
-
7B75B33BCF4ECF013B93F84ED98B3FB5.exe.exe 214KB
-
7E3903944EAB7B61B495572BAA60FB72.EXE.exe 228KB
-
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.exe.dll 602KB
-
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe.exe 161KB
-
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe.exe 116KB
-
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe.exe 68KB
-
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe.exe 246KB
-
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe.exe 56KB
-
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe.exe 37KB
-
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe.exe 116KB
-
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_TDS=4F84A969.exe.exe 72KB
-
87a4f3f9f6dc263378f2f01db5f2c988.exe.exe 630KB
-
89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe.exe 276KB
-
8c591485357e45a09dad3116496e6f686fa11f445a6bea5ef3cd5ed1ac078821.exe.exe 246KB
-
8d372fcf8a97223ebb86cdfe707d3035dfbfd4501c5688cfa82a9a4889e637e0.exe.exe 4.9MB
-
900.exe.exe 12KB
-
911d5905cbe1dd462f171b7167cd15b9.exe.exe 138KB
-
91d24e06572099ba0aa5c20be6b1021fa48e864913fe3676ed05323e6b68fceb.exe.zip 282KB
-
Saldo.Pdf______________________________________________________________.exe.exe 443KB
-
92ac6be4d9215b237d624177ca0543844d0dc8d071660ae4a4cf7c93cc11505b.exe.exe 315KB
-
97512f4617019c907cd0f88193039e7c.exe.exe 666KB
-
out.upx.exe 1.5MB
-
98aadc95c589e064a542802bbf0ef01ef00595c34d195f1a1e6443909846d2e7.exe.exe 151KB
-
out.upx.exe 256KB
-
9943256.exe.exe 134KB
-
9B9517FA1515F47A502FE56536236A20BE5BBADF.exe.exe 119KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
NumenHeartwoodSchefflera2KB
-
SceneButtonInset_Alpha2.png.png 3KB
-
draft.watermark.image.xml967B
-
unneighbourliness.dll.dll 14KB
-
video-card.png49KB
-
9b7eaffe4dffcbd06445d0b32785cdc8.exe.exe 39KB
-
a322da0be4f0be8d85eab815ca708c8452b63f24d0e2d2d6d896a9f9331a6244.exe.exe 322KB
-
a42252e674a09a0b689e71c88f59969f538a473da647cc4eb5457a5d5e03a234.exe.exe 246KB
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4
- MD5 d8e99fcae9a469c2081e7ff01675c361
- SHA1 ef7c4358717ec9d04b9adc8e40b1eb928885ebf0
- SHA512 cd75242646dde33b7c792e9bf9fe976ce7f2dd1b02c5c97a4cf2f9f80cfae1bd44463fc2b0f9e002d17087358fafa298ca0d4dc4aff17405df95f13099c79b02
- SSDEEP 384:rd7gYWDhghSmeSQjkCg3St1bVz1LTwbZxssimS8dHDT:6lg/eLjkCwQQFx8SHX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23566
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
- IMPHASH 0e19eece28bfc9b0d635ed4ec3d29752
- SHA256 76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2
- MD5 0af473977e2b58a3630dc2bd59245127
- SHA1 6b1086070e0918c428b4f6688fe2760c9ab9dfea
- SHA512 d2f001ed413538368597585483c6745ab1bec058e227ada41937b75435f9456135b876e0ce40249389448b9769a37c3c06233c0d648cfaf9f613e42ad0b92450
- SSDEEP 1536:ef/SovFSSZtDgN+DpDkDEFtC+YF8965L+v:I/zv0SZtDgN+Dp+ErYF896W
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\my projects\backup\dilly\output\Release\locker.pdb
wininet
InternetOpenA
HttpQueryInfoA
InternetConnectA
InternetReadFile
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
shlwapi
PathCombineW
kernel32
lstrcatA
GetLastError
GetModuleHandleA
CloseHandle
GetVersion
lstrcpyA
WaitForSingleObject
Sleep
GetCurrentProcessId
GetTickCount
ExitProcess
GetFileSize
lstrlenA
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
lstrlenW
FlushFileBuffers
GetProcAddress
DeleteFileW
SetFileAttributesW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy
HeapCreate
HeapSize
GetVersionExA
CreateProcessW
GetCurrentProcess
InitializeCriticalSection
OpenProcess
LeaveCriticalSection
TerminateProcess
GetModuleFileNameW
EnterCriticalSection
CreateThread
CreateMutexA
LocalFree
WideCharToMultiByte
MultiByteToWideChar
DosDateTimeToFileTime
SetFilePointer
SystemTimeToFileTime
GetFileType
GetCurrentDirectoryA
WTSGetActiveConsoleSessionId
GetEnvironmentStringsW
QueryPerformanceCounter
FreeEnvironmentStringsW
GetModuleFileNameA
RaiseException
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
EncodePointer
GetStdHandle
DecodePointer
GetModuleHandleW
IsDebuggerPresent
SetUnhandledExceptionFilter
CopyFileW
GetUserGeoID
CreateDirectoryW
GetComputerNameA
SetHandleCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
LCMapStringW
IsProcessorFeaturePresent
RtlUnwind
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetStringTypeW
GetSystemTimeAsFileTime
user32
PostMessageA
GetClientRect
SetWindowLongA
GetWindowLongA
RegisterClassExA
PostQuitMessage
TranslateMessage
UnregisterClassA
CreateWindowExA
DefWindowProcA
DispatchMessageA
MessageBoxW
GetSystemMetrics
UpdateWindow
EnumWindows
ShowWindow
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetMessageA
EnableWindow
advapi32
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegFlushKey
RegOpenKeyA
RegCreateKeyExA
SetSecurityDescriptorSacl
shell32
ord680
SHGetFolderPathW
ole32
OleUninitialize
OleSetContainedObject
CoGetClassObject
OleInitialize
oleaut32
SysAllocString
VariantClear
VariantInit
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
- SHA256 5f60eed8e27867c843387fe7fece3af688586a40c8d3dd2c27647b23cc200fdc
- MD5 5a580ab3f5b3806da853459e9ef7b368
- SHA1 df93c0f0dd694ab49646b539418b67d83eafccb5
- SHA512 91ecd8f00f4cd6c7d199eb365cb7cfa414bcab41b144fe7a5f43529e560201a81284cdb3a3d18d252e2eb4429a67f2db5718eacc8bf1eeb072958c0a4be20a3b
- SSDEEP 1536:tf/YvFSSZtDgN+DrDkDEFtCwbfF89lGL+vpCYC:Z/Yv0SZtDgN+Dr+ErbfF89llpTC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mackt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
- IMPHASH 8df8842017f9ad4c4915158983df9eb6
- SHA256 78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b
- MD5 f0b567179d42d5d4f27d6d9a7fcf183f
- SHA1 fb91a4f85ad3576110cdb476b0eb94c2e14a4e1b
- SHA512 ca5afd8671f79d1ee55d51aa75330daac87e4cb116b5b8f60d5be2ed1f21a1e0cbd9e4c613a3c20850bfd0bba78358e4289258f010b6d3c8c169b7a80998c64c
- SSDEEP 768:Xf+vj1VHjoFW+gh2vHa0uTbPKYlNnYVbUnWfTMuRqj2O4sO2ieFZ0F:G71NoFhDHaT/CukbUWdfO4LFeP0F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9274
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetPriorityClass
GetEnvironmentStringsW
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupGetLineCountA
msvcrt
_adjust_fdiv
memcpy
_exit
_XcptFilter
exit
_onexit
__getmainargs
_initterm
__setusermatherr
_acmdln
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
878B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=25, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
- IMPHASH eb97e4fc5518ac300a92a11673825e0b
- SHA256 78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669
- MD5 dbf3707a9cd090853a11dda9cfa78ff0
- SHA1 5af5403d8e003812a34c7b085d878680d7130ad5
- SHA512 68b1627ed20e6980c32c44df3560fc3eeed37db2c47caaf8db86461c594a5d040a7404be777374af512fe05fcdc2f15a6014a914b1445c2e23adb741db68c7e0
- SSDEEP 12288:SCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga+Q9bN9jQl:SCdxte/80jYLT3U1jfsWa+QpN9jQl
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
163658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSACleanup
socket
inet_ntoa
setsockopt
ntohs
recvfrom
ioctlsocket
htons
WSAStartup
__WSAFDIsSet
select
accept
listen
bind
closesocket
WSAGetLastError
recv
sendto
send
inet_addr
gethostbyname
gethostname
connect
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetQueryDataAvailable
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetConnectW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
SetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
DeleteFileW
FindNextFileW
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
LoadLibraryW
VirtualAlloc
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentThread
CloseHandle
GetFullPathNameW
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
FindClose
SetEnvironmentVariableA
user32
AdjustWindowRectEx
CopyImage
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
SetRect
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
MonitorFromRect
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
PeekMessageW
UnregisterHotKey
CheckMenuRadioItem
CharLowerBuffW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
LoadImageW
GetClassNameW
gdi32
StrokePath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
GetDeviceCaps
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
DeleteDC
GetPixel
CreateDCW
GetStockObject
GetTextFaceW
CreateFontW
SetTextColor
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
StrokeAndFillPath
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
RegCreateKeyExW
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
AddAce
SetSecurityDescriptorDacl
GetUserNameW
InitiateSystemShutdownExW
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoSetProxyBlanket
CoCreateInstanceEx
CoInitializeSecurity
oleaut32
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
RegisterTypeLi
CreateStdDispatch
DispCallFunc
VariantChangeType
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
VariantCopy
VariantClear
OleLoadPicture
QueryPathOfRegTypeLi
RegisterTypeLibForUser
UnRegisterTypeLibForUser
UnRegisterTypeLi
CreateDispTypeInfo
SysAllocString
VariantInit
Name
.text
Size
567KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
184KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
- IMPHASH 2d0ebb2aeecc9aedb18485a6a2a54c83
- SHA256 7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f
- MD5 e0c70373ea59baa4422771dde804a21c
- SHA1 d9708f709a0e7ad070ee34b4065437e400e5bdd9
- SHA512 c9a6b94d091a48d1a294953226fca00089dbf266f81fa60481f9ca468f7c3e9a2460bdd384b070dd6ae8bb778fb0737e196a1870e6f550645b9192f78e9763fa
- SSDEEP 768:zchho/bbYYwktIZwTUtv3h12jG6hdYWnXAjpWTbBbIKP077hPIxPaq77ti:wjoDMYwEINR8j/Yu2pqOd77hPl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\my projects\bbac\output\Release\bbac.pdb
wininet
InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetQueryOptionA
InternetConnectA
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
shlwapi
PathCombineW
wvnsprintfA
kernel32
MultiByteToWideChar
CreateThread
GetComputerNameA
CreateDirectoryW
WaitForSingleObject
GetUserGeoID
Sleep
CopyFileW
CreateEventA
GetModuleFileNameW
GetLastError
WTSGetActiveConsoleSessionId
GetModuleHandleA
CreateMutexA
CloseHandle
GetVersion
GetCurrentProcessId
GetFileSize
WriteFile
ReadFile
CreateFileW
FlushFileBuffers
DeleteFileW
SetFileAttributesW
WaitForMultipleObjects
ReleaseMutex
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy
HeapCreate
CreateProcessW
Process32First
OpenProcess
CreateToolhelp32Snapshot
Process32Next
TerminateProcess
user32
DefWindowProcA
CreateWindowExA
UnregisterClassA
TranslateMessage
PostQuitMessage
RegisterClassExA
GetMessageA
DestroyWindow
DispatchMessageA
SetWindowLongA
GetClientRect
PostMessageA
SendMessageA
IsWindowVisible
EnableWindow
GetWindowThreadProcessId
ShowWindow
GetSystemMetrics
UpdateWindow
EnumWindows
GetWindowLongA
advapi32
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegFlushKey
RegCloseKey
RegSetValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegOpenKeyExW
shell32
SHGetFolderPathW
ole32
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
oleaut32
VariantClear
VariantInit
SysAllocString
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=100, id=1, productName=Unmarked objects,
count=25, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 74aa7b73b46d7bd7bc53cb44add9ec8172f2de7831d045e33db06e2d6b916edf
- MD5 7b75b33bcf4ecf013b93f84ed98b3fb5
- SHA1 7be5f5dcf6b9519c0f8c8071503b7f5dd66b6386
- SHA512 96e1253358db1f724b381f9e1e416cc35bf44d94505e8b86508676f997b44be65d3c33c22df9c004652a34170e48805f9b7ba6f2703dd287e8c770cb426c5114
- SSDEEP 3072:5W1M+lmsolAIrRuw+mqv9j1MWLQFPBCM+lmsolAIrRuw+mqv9j1MWLQlL:5J+lDAAIv+lDAAmL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\Paco\Desktop\inInvoice\hIDDeN-teAr\obj\Debug\inInvoice.pdb
mscoree
_CorExeMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
7E3903944EAB7B61B495572BAA60FB72.EXE
- IMPHASH 774803ad6272a6f757a61b9cc3ae489c
- SHA256 06e921abf28c4b260c59d61d84a74c3a5dc12ac99a34110ca5480ce61689385c
- MD5 7e3903944eab7b61b495572baa60fb72
- SHA1 116930517baab6bdb0829990a43af54d155f5332
- SHA512 0e29eaea245dd0068d44ff016c5da65396e5ad94aa79fcbe3cb187666b7b21890b22e2a13ac57e4bcfcf39436a7c5fa53a5470a8fae6de7215f297b82ea62ad5
- SSDEEP 3072:RKR+u1vFeb+pknH46ZjbVxltW8wylYJiocMor+ROYJPR+9RbA8D79qiNFwEQ7:R4Z19dknH4yFhtocMO+kYlI9tdJmr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
48142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateFileA
SetFileAttributesA
GetFileAttributesA
IsBadReadPtr
GetSystemDirectoryA
GetTickCount
FreeLibrary
LoadLibraryExA
GetCurrentProcess
Process32First
CreateToolhelp32Snapshot
MoveFileA
SetCurrentDirectoryA
SizeofResource
LockResource
LoadResource
FindResourceA
FindClose
FindNextFileA
GetFileSize
OpenFileMappingA
WinExec
SetFileTime
GetFileTime
ExitProcess
GetModuleFileNameA
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryA
LocalFileTimeToFileTime
CreateDirectoryA
WriteFile
SetEndOfFile
LoadLibraryA
SetUnhandledExceptionFilter
CreateFileMappingA
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetLastError
IsBadCodePtr
lstrlenA
OpenProcess
lstrlenW
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
ReleaseMutex
FindFirstFileA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
GetVolumeInformationA
GetDiskFreeSpaceA
lstrcmpA
lstrcpyA
HeapAlloc
HeapFree
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetStdHandle
FlushFileBuffers
user32
wsprintfA
wsprintfW
advapi32
CryptAcquireContextA
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDeriveKey
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
ole32
OleUninitialize
OleInitialize
Name
.text
Size
68KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=19, id=14, version=7299,
count=64, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=11, id=93, version=2179,
count=115, id=1, productName=Unmarked objects,
count=20, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.exe
- IMPHASH b09cd7cb9ae5a48bd10d5b61d744b752
- SHA256 7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca
- MD5 ae38213715e758e3c296715f1ec25aea
- SHA1 bf0d7b7d8ab11536e25235f7c18901c9be65fae1
- SHA512 fd0bbeaff08301f6e26c878ef59d7be964533075f1b1c6f93f3a03bee048f4587f44fef96cffe709f5f0511b81edeb4d64878be7b6852f5a14aa3318c9ed15e7
- SSDEEP 12288:6oHEHblpWz0jPLhEfgP6WMDoEuY7jVWv:6vZPLWffWMDo+7Jc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
45591
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32.pdb
gdi32
GetClipRgn
ExtSelectClipRgn
GetHFONT
GetMapMode
SetGraphicsMode
GetClipBox
CreateRectRgn
CreateRectRgnIndirect
SetLayout
GetBoundsRect
ExcludeClipRect
PlayEnhMetaFile
GdiGetBitmapBitsSize
CreatePen
Ellipse
CreateEllipticRgn
GdiFixUpHandle
GetTextCharacterExtra
SetTextCharacterExtra
GetCurrentObject
GetViewportOrgEx
SetViewportOrgEx
PolyPatBlt
CreateBrushIndirect
SetBoundsRect
CopyEnhMetaFileW
CopyMetaFileW
GetPaletteEntries
CreatePalette
SetPaletteEntries
bInitSystemAndFontsDirectoriesW
bMakePathNameW
cGetTTFFromFOT
GetPixel
ExtTextOutA
GetTextCharsetInfo
QueryFontAssocStatus
GetCharWidthInfo
GetCharWidthA
GetTextFaceW
GetCharABCWidthsA
GetCharABCWidthsW
SetBrushOrgEx
CreateFontIndirectW
EnumFontsW
GetTextFaceAliasW
GetTextMetricsW
GetTextColor
GetBkMode
GetViewportExtEx
GetWindowExtEx
GdiGetCharDimensions
GdiGetCodePage
GetTextCharset
GdiPrinterThunk
GdiAddFontResourceW
TranslateCharsetInfo
SaveDC
OffsetWindowOrgEx
RestoreDC
ExtTextOutW
GetObjectType
GetDIBits
CreateDIBSection
SetStretchBltMode
SelectPalette
RealizePalette
SetDIBits
CreateDCW
CreateDIBitmap
CreateCompatibleBitmap
SetBitmapBits
DeleteDC
GdiValidateHandle
GdiDllInitialize
CreateSolidBrush
GetStockObject
CreateCompatibleDC
GdiConvertBitmapV5
GdiCreateLocalEnhMetaFile
GdiCreateLocalMetaFilePict
GetRgnBox
CombineRgn
OffsetRgn
MirrorRgn
EnableEUDC
GdiConvertToDevmodeW
GetTextExtentPointA
GetTextExtentPointW
CreateBitmap
SetLayoutWidth
PatBlt
TextOutA
TextOutW
BitBlt
GdiConvertAndCheckDC
StretchBlt
SetRectRgn
GdiReleaseDC
GdiConvertEnhMetaFile
GdiConvertMetaFilePict
DeleteEnhMetaFile
DeleteMetaFile
DeleteObject
GetDIBColorTable
GetDeviceCaps
StretchDIBits
GetLayout
SetBkColor
SetTextColor
GetObjectW
GetBkColor
SetBkMode
SelectObject
IntersectClipRect
GetTextAlign
SetTextAlign
GdiProcessSetup
kernel32
LocalSize
SizeofResource
LoadResource
FindResourceExW
FindResourceExA
GetModuleHandleW
DisableThreadLibraryCalls
GetCurrentThreadId
IsDBCSLeadByteEx
SearchPathW
ExpandEnvironmentStringsW
LoadLibraryExW
GlobalAddAtomW
GetSystemDirectoryW
GetComputerNameW
GetCurrentProcess
GetCurrentThread
ExitThread
GetExitCodeThread
CreateThread
HeapReAlloc
GlobalHandle
FoldStringW
Sleep
GetStringTypeW
GetStringTypeA
GetCPInfo
HeapSize
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
ReadFile
SetFileTime
GetFileTime
GetSystemWindowsDirectoryW
CopyFileW
MoveFileW
DeleteFileW
CreateProcessW
AddAtomA
AddAtomW
GetAtomNameW
GetAtomNameA
IsValidLocale
ConvertDefaultLocale
CompareStringW
GetCurrentDirectoryW
SetCurrentDirectoryW
lstrlenW
GetLogicalDrives
FindClose
FindNextFileW
FindFirstFileW
GetThreadLocale
ProcessIdToSessionId
GetCurrentProcessId
InterlockedCompareExchange
IsDBCSLeadByte
LCMapStringW
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
lstrlenA
GlobalFindAtomA
GetModuleFileNameA
GetModuleHandleA
GlobalAddAtomA
DelayLoadFailureHook
LoadLibraryA
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocalUnlock
LocalLock
LocalReAlloc
GetACP
GetOEMCP
InterlockedIncrement
InterlockedDecrement
SetLastError
GlobalFindAtomW
GlobalAlloc
MultiByteToWideChar
GlobalReAlloc
GetLastError
GetProcAddress
LoadLibraryW
FreeLibrary
lstrcpynW
CreateFileW
WritePrivateProfileStringW
lstrcmpiW
SetEvent
WaitForMultipleObjectsEx
WideCharToMultiByte
GlobalFlags
GetLocaleInfoW
GlobalFree
GetModuleFileNameW
GlobalGetAtomNameW
GlobalGetAtomNameA
InterlockedExchange
DeleteAtom
LocalAlloc
GlobalDeleteAtom
LocalFree
GlobalSize
GlobalLock
GlobalUnlock
GetUserDefaultLCID
HeapAlloc
HeapFree
lstrcpyW
lstrcatW
GetPrivateProfileStringW
RegisterWaitForInputIdle
ntdll
NtQueryVirtualMemory
RtlUnwind
RtlNtStatusToDosError
NlsAnsiCodePage
RtlAllocateHeap
qsort
RtlMultiByteToUnicodeSize
LdrFlushAlternateResourceModules
RtlPcToFileHeader
wcsrchr
NtRaiseHardError
RtlIsNameLegalDOS8Dot3
strrchr
sscanf
NtQueryKey
NtEnumerateValueKey
RtlRunEncodeUnicodeString
RtlRunDecodeUnicodeString
_wcsicmp
CsrAllocateCaptureBuffer
CsrCaptureMessageBuffer
CsrFreeCaptureBuffer
NtOpenThreadToken
NtOpenProcessToken
NtQueryInformationToken
CsrClientCallServer
memmove
NtCallbackReturn
RtlUnicodeToMultiByteSize
RtlActivateActivationContextUnsafeFast
RtlDeactivateActivationContextUnsafeFast
RtlInitializeCriticalSection
NtQuerySystemInformation
swprintf
RtlDeleteCriticalSection
RtlImageNtHeader
CsrClientConnectToServer
NtYieldExecution
NtCreateKey
NtSetValueKey
NtDeleteValueKey
RtlQueryInformationActiveActivationContext
RtlReleaseActivationContext
RtlFreeHeap
wcsncpy
wcscmp
wcstoul
wcscat
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
NtOpenDirectoryObject
_chkstk
wcscpy
wcsncat
NtSetSecurityObject
NtQuerySecurityObject
NtQueryInformationProcess
wcstol
wcslen
RtlFindActivationContextSectionString
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteN
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlOpenCurrentUser
NtEnumerateKey
NtOpenKey
NtClose
NtQueryValueKey
RtlInitUnicodeString
RtlUnicodeStringToInteger
ActivateKeyboardLayout
AdjustWindowRect
AdjustWindowRectEx
AlignRects
AllowForegroundActivation
AllowSetForegroundWindow
AnimateWindow
AnyPopup
AppendMenuA
AppendMenuW
ArrangeIconicWindows
AttachThreadInput
BeginDeferWindowPos
BeginPaint
BlockInput
BringWindowToTop
BroadcastSystemMessage
BroadcastSystemMessageA
BroadcastSystemMessageExA
BroadcastSystemMessageExW
BroadcastSystemMessageW
BuildReasonArray
CalcMenuBar
CallMsgFilter
CallMsgFilterA
CallMsgFilterW
CallNextHookEx
CallWindowProcA
CallWindowProcW
CascadeChildWindows
CascadeWindows
ChangeClipboardChain
ChangeDisplaySettingsA
ChangeDisplaySettingsExA
ChangeDisplaySettingsExW
ChangeDisplaySettingsW
ChangeMenuA
ChangeMenuW
CharLowerA
CharLowerBuffA
CharLowerBuffW
CharLowerW
CharNextA
CharNextExA
CharNextW
CharPrevA
CharPrevExA
CharPrevW
CharToOemA
CharToOemBuffA
CharToOemBuffW
CharToOemW
CharUpperA
CharUpperBuffA
CharUpperBuffW
CharUpperW
CheckDlgButton
CheckMenuItem
CheckMenuRadioItem
CheckRadioButton
ChildWindowFromPoint
ChildWindowFromPointEx
CliImmSetHotKey
ClientThreadSetup
ClientToScreen
ClipCursor
CloseClipboard
CloseDesktop
CloseWindow
CloseWindowStation
CopyAcceleratorTableA
CopyAcceleratorTableW
CopyIcon
CopyImage
CopyRect
CountClipboardFormats
CreateAcceleratorTableA
CreateAcceleratorTableW
CreateCaret
CreateCursor
CreateDesktopA
CreateDesktopW
CreateDialogIndirectParamA
CreateDialogIndirectParamAorW
CreateDialogIndirectParamW
CreateDialogParamA
CreateDialogParamW
CreateIcon
CreateIconFromResource
CreateIconFromResourceEx
CreateIconIndirect
CreateMDIWindowA
CreateMDIWindowW
CreateMenu
CreatePopupMenu
CreateSystemThreads
CreateWindowExA
CreateWindowExW
CreateWindowStationA
CreateWindowStationW
CsrBroadcastSystemMessageExW
CtxInitUser32
DdeAbandonTransaction
DdeAccessData
DdeAddData
DdeClientTransaction
DdeCmpStringHandles
DdeConnect
DdeConnectList
DdeCreateDataHandle
DdeCreateStringHandleA
DdeCreateStringHandleW
DdeDisconnect
DdeDisconnectList
DdeEnableCallback
DdeFreeDataHandle
DdeFreeStringHandle
DdeGetData
DdeGetLastError
DdeGetQualityOfService
DdeImpersonateClient
DdeInitializeA
DdeInitializeW
DdeKeepStringHandle
DdeNameService
DdePostAdvise
DdeQueryConvInfo
DdeQueryNextServer
DdeQueryStringA
DdeQueryStringW
DdeReconnect
DdeSetQualityOfService
DdeSetUserHandle
DdeUnaccessData
DdeUninitialize
DefDlgProcA
DefDlgProcW
DefFrameProcA
DefFrameProcW
DefMDIChildProcA
DefMDIChildProcW
DefRawInputProc
DefWindowProcA
DefWindowProcW
DeferWindowPos
DeleteMenu
DeregisterShellHookWindow
DestroyAcceleratorTable
DestroyCaret
DestroyCursor
DestroyIcon
DestroyMenu
DestroyReasons
DestroyWindow
DeviceEventWorker
DialogBoxIndirectParamA
DialogBoxIndirectParamAorW
DialogBoxIndirectParamW
DialogBoxParamA
DialogBoxParamW
DisableProcessWindowsGhosting
DispatchMessageA
DispatchMessageW
DisplayExitWindowsWarnings
DlgDirListA
DlgDirListComboBoxA
DlgDirListComboBoxW
DlgDirListW
DlgDirSelectComboBoxExA
DlgDirSelectComboBoxExW
DlgDirSelectExA
DlgDirSelectExW
DragDetect
DragObject
DrawAnimatedRects
DrawCaption
DrawCaptionTempA
DrawCaptionTempW
DrawEdge
DrawFocusRect
DrawFrame
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawMenuBarTemp
DrawStateA
DrawStateW
DrawTextA
DrawTextExA
DrawTextExW
DrawTextW
EditWndProc
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndDeferWindowPos
EndDialog
EndMenu
EndPaint
EndTask
EnterReaderModeHelper
EnumChildWindows
EnumClipboardFormats
EnumDesktopWindows
EnumDesktopsA
EnumDesktopsW
EnumDisplayDevicesA
EnumDisplayDevicesW
EnumDisplayMonitors
EnumDisplaySettingsA
EnumDisplaySettingsExA
EnumDisplaySettingsExW
EnumDisplaySettingsW
EnumPropsA
EnumPropsExA
EnumPropsExW
EnumPropsW
EnumThreadWindows
EnumWindowStationsA
EnumWindowStationsW
EnumWindows
EqualRect
ExcludeUpdateRgn
ExitWindowsEx
FillRect
FindWindowA
FindWindowExA
FindWindowExW
FindWindowW
FlashWindow
FlashWindowEx
FrameRect
FreeDDElParam
GetActiveWindow
GetAltTabInfo
GetAltTabInfoA
GetAltTabInfoW
GetAncestor
GetAppCompatFlags
GetAppCompatFlags2
GetAsyncKeyState
GetCapture
GetCaretBlinkTime
GetCaretPos
GetClassInfoA
GetClassInfoExA
GetClassInfoExW
GetClassInfoW
GetClassLongA
GetClassLongW
GetClassNameA
GetClassNameW
GetClassWord
GetClientRect
GetClipCursor
GetClipboardData
GetClipboardFormatNameA
GetClipboardFormatNameW
GetClipboardOwner
GetClipboardSequenceNumber
GetClipboardViewer
GetComboBoxInfo
GetCursor
GetCursorFrameInfo
GetCursorInfo
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetDialogBaseUnits
GetDlgCtrlID
GetDlgItem
GetDlgItemInt
GetDlgItemTextA
GetDlgItemTextW
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetGUIThreadInfo
GetGuiResources
GetIconInfo
GetInputDesktop
GetInputState
GetInternalWindowPos
GetKBCodePage
GetKeyNameTextA
GetKeyNameTextW
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameA
GetKeyboardLayoutNameW
GetKeyboardState
GetKeyboardType
GetLastActivePopup
GetLastInputInfo
GetLayeredWindowAttributes
GetListBoxInfo
GetMenu
GetMenuBarInfo
GetMenuCheckMarkDimensions
GetMenuContextHelpId
GetMenuDefaultItem
GetMenuInfo
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMenuItemInfoW
GetMenuItemRect
GetMenuState
GetMenuStringA
GetMenuStringW
GetMessageA
GetMessageExtraInfo
GetMessagePos
GetMessageTime
GetMessageW
GetMonitorInfoA
GetMonitorInfoW
GetMouseMovePointsEx
GetNextDlgGroupItem
GetNextDlgTabItem
GetOpenClipboardWindow
GetParent
GetPriorityClipboardFormat
GetProcessDefaultLayout
GetProcessWindowStation
GetProgmanWindow
GetPropA
GetPropW
GetQueueStatus
GetRawInputBuffer
GetRawInputData
GetRawInputDeviceInfoA
GetRawInputDeviceInfoW
GetRawInputDeviceList
GetReasonTitleFromReasonCode
GetRegisteredRawInputDevices
GetScrollBarInfo
GetScrollInfo
GetScrollPos
GetScrollRange
GetShellWindow
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetTabbedTextExtentA
GetTabbedTextExtentW
GetTaskmanWindow
GetThreadDesktop
GetTitleBarInfo
GetTopWindow
GetUpdateRect
GetUpdateRgn
GetUserObjectInformationA
GetUserObjectInformationW
GetUserObjectSecurity
GetWinStationInfo
GetWindow
GetWindowContextHelpId
GetWindowDC
GetWindowInfo
GetWindowLongA
GetWindowLongW
GetWindowModuleFileName
GetWindowModuleFileNameA
GetWindowModuleFileNameW
GetWindowPlacement
GetWindowRect
GetWindowRgn
GetWindowRgnBox
GetWindowTextA
GetWindowTextLengthA
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
GetWindowWord
GrayStringA
GrayStringW
HideCaret
HiliteMenuItem
IMPGetIMEA
IMPGetIMEW
IMPQueryIMEA
IMPQueryIMEW
IMPSetIMEA
IMPSetIMEW
ImpersonateDdeClientWindow
InSendMessage
InSendMessageEx
InflateRect
InitializeLpkHooks
InitializeWin32EntryTable
InsertMenuA
InsertMenuItemA
InsertMenuItemW
InsertMenuW
InternalGetWindowText
IntersectRect
InvalidateRect
InvalidateRgn
InvertRect
IsCharAlphaA
IsCharAlphaNumericA
IsCharAlphaNumericW
IsCharAlphaW
IsCharLowerA
IsCharLowerW
IsCharUpperA
IsCharUpperW
IsChild
IsClipboardFormatAvailable
IsDialogMessage
IsDialogMessageA
IsDialogMessageW
IsDlgButtonChecked
IsGUIThread
IsHungAppWindow
IsIconic
IsMenu
IsRectEmpty
IsServerSideWindow
IsWinEventHookInstalled
IsWindow
IsWindowEnabled
IsWindowInDestroy
IsWindowUnicode
IsWindowVisible
IsZoomed
KillSystemTimer
KillTimer
LoadAcceleratorsA
LoadAcceleratorsW
LoadBitmapA
LoadBitmapW
LoadCursorA
LoadCursorFromFileA
LoadCursorFromFileW
LoadCursorW
LoadIconA
LoadIconW
LoadImageA
LoadImageW
LoadKeyboardLayoutA
LoadKeyboardLayoutEx
LoadKeyboardLayoutW
LoadLocalFonts
LoadMenuA
LoadMenuIndirectA
LoadMenuIndirectW
LoadMenuW
LoadRemoteFonts
LoadStringA
LoadStringW
LockSetForegroundWindow
LockWindowStation
LockWindowUpdate
LockWorkStation
LookupIconIdFromDirectory
LookupIconIdFromDirectoryEx
MBToWCSEx
MB_GetString
MapDialogRect
MapVirtualKeyA
MapVirtualKeyExA
MapVirtualKeyExW
MapVirtualKeyW
MapWindowPoints
MenuItemFromPoint
MenuWindowProcA
MenuWindowProcW
MessageBeep
MessageBoxA
MessageBoxExA
MessageBoxExW
MessageBoxIndirectA
MessageBoxIndirectW
MessageBoxTimeoutA
MessageBoxTimeoutW
MessageBoxW
ModifyMenuA
ModifyMenuW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MoveWindow
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
NotifyWinEvent
OemKeyScan
OemToCharA
OemToCharBuffA
OemToCharBuffW
OemToCharW
OffsetRect
OpenClipboard
OpenDesktopA
OpenDesktopW
OpenIcon
OpenInputDesktop
OpenWindowStationA
OpenWindowStationW
PackDDElParam
PaintDesktop
PaintMenuBar
PeekMessageA
PeekMessageW
PostMessageA
PostMessageW
PostQuitMessage
PostThreadMessageA
PostThreadMessageW
PrintWindow
PrivateExtractIconExA
PrivateExtractIconExW
PrivateExtractIconsA
PrivateExtractIconsW
PrivateSetDbgTag
PrivateSetRipFlags
PtInRect
QuerySendMessage
QueryUserCounters
RealChildWindowFromPoint
RealGetWindowClass
RealGetWindowClassA
RealGetWindowClassW
ReasonCodeNeedsBugID
ReasonCodeNeedsComment
RecordShutdownReason
RedrawWindow
RegisterClassA
RegisterClassExA
RegisterClassExW
RegisterClassW
RegisterClipboardFormatA
RegisterClipboardFormatW
RegisterDeviceNotificationA
RegisterDeviceNotificationW
RegisterHotKey
RegisterLogonProcess
RegisterMessagePumpHook
RegisterRawInputDevices
RegisterServicesProcess
RegisterShellHookWindow
RegisterSystemThread
RegisterTasklist
RegisterUserApiHook
RegisterWindowMessageA
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropA
RemovePropW
ReplyMessage
ResolveDesktopForWOW
ReuseDDElParam
ScreenToClient
ScrollChildren
ScrollDC
ScrollWindow
ScrollWindowEx
SendDlgItemMessageA
SendDlgItemMessageW
SendIMEMessageExA
SendIMEMessageExW
SendInput
SendMessageA
SendMessageCallbackA
SendMessageCallbackW
SendMessageTimeoutA
SendMessageTimeoutW
SendMessageW
SendNotifyMessageA
SendNotifyMessageW
SetActiveWindow
SetCapture
SetCaretBlinkTime
SetCaretPos
SetClassLongA
SetClassLongW
SetClassWord
SetClipboardData
SetClipboardViewer
SetConsoleReserveKeys
SetCursor
SetCursorContents
SetCursorPos
SetDebugErrorLevel
SetDeskWallpaper
SetDlgItemInt
SetDlgItemTextA
SetDlgItemTextW
SetDoubleClickTime
SetFocus
SetForegroundWindow
SetInternalWindowPos
SetKeyboardState
SetLastErrorEx
SetLayeredWindowAttributes
SetLogonNotifyWindow
SetMenu
SetMenuContextHelpId
SetMenuDefaultItem
SetMenuInfo
SetMenuItemBitmaps
SetMenuItemInfoA
SetMenuItemInfoW
SetMessageExtraInfo
SetMessageQueue
SetParent
SetProcessDefaultLayout
SetProcessWindowStation
SetProgmanWindow
SetPropA
SetPropW
SetRect
SetRectEmpty
SetScrollInfo
SetScrollPos
SetScrollRange
SetShellWindow
SetShellWindowEx
SetSysColors
SetSysColorsTemp
SetSystemCursor
SetSystemMenu
SetSystemTimer
SetTaskmanWindow
SetThreadDesktop
SetTimer
SetUserObjectInformationA
SetUserObjectInformationW
SetUserObjectSecurity
SetWinEventHook
SetWindowContextHelpId
SetWindowLongA
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowStationUser
SetWindowTextA
SetWindowTextW
SetWindowWord
SetWindowsHookA
SetWindowsHookExA
SetWindowsHookExW
SetWindowsHookW
ShowCaret
ShowCursor
ShowOwnedPopups
ShowScrollBar
ShowStartGlass
ShowWindow
ShowWindowAsync
SoftModalMessageBox
SubtractRect
SwapMouseButton
SwitchDesktop
SwitchToThisWindow
SystemParametersInfoA
SystemParametersInfoW
TabbedTextOutA
TabbedTextOutW
TileChildWindows
TileWindows
ToAscii
ToAsciiEx
ToUnicode
ToUnicodeEx
TrackMouseEvent
TrackPopupMenu
TrackPopupMenuEx
TranslateAccelerator
TranslateAcceleratorA
TranslateAcceleratorW
TranslateMDISysAccel
TranslateMessage
TranslateMessageEx
UnhookWinEvent
UnhookWindowsHook
UnhookWindowsHookEx
UnionRect
UnloadKeyboardLayout
UnlockWindowStation
UnpackDDElParam
UnregisterClassA
UnregisterClassW
UnregisterDeviceNotification
UnregisterHotKey
UnregisterMessagePumpHook
UnregisterUserApiHook
UpdateLayeredWindow
UpdatePerUserSystemParameters
UpdateWindow
User32InitializeImmEntryTable
UserClientDllInitialize
UserHandleGrantAccess
UserLpkPSMTextOut
UserLpkTabbedTextOut
UserRealizePalette
UserRegisterWowHandlers
VRipOutput
VTagOutput
ValidateRect
ValidateRgn
VkKeyScanA
VkKeyScanExA
VkKeyScanExW
VkKeyScanW
WCSToMBEx
WINNLSEnableIME
WINNLSGetEnableStatus
WINNLSGetIMEHotkey
WaitForInputIdle
WaitMessage
Win32PoolAllocationStats
WinHelpA
WinHelpW
WindowFromDC
WindowFromPoint
keybd_event
mouse_event
wsprintfA
wsprintfW
wvsprintfA
wvsprintfW
Name
.text
Size
381KB
Virtual Size
380KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
205KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=331, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=92, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=8, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=119, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
- IMPHASH 8237df68e65f199149a53c58781e1f1a
- SHA256 7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f
- MD5 517d709b1b99fa87ddfe61950a93cf5c
- SHA1 2b6da3641ad3c13be272c7e66c938afd5879d65f
- SHA512 e23c60821e71704ab77ed8031b025b6ec9065479b766ca9fce2d4e93f1e4e66f7ed821d161890dfd87306408917c82514aaf96506cfc335e2c0bd1166fd1809f
- SSDEEP 3072:+dhOdhhyAbz6XdKWf4xEE1ODDl9oz4ilUEPllLBDlWz:+dhw1CZJEQXl9o05EDLBlWz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8274
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
SetForegroundWindow
CreateMenu
GetSystemMenu
GetDoubleClickTime
GetForegroundWindow
GetQueueStatus
GetClipboardOwner
FindWindowA
MessageBoxIndirectA
WinHelpA
UpdateWindow
DefWindowProcA
InvalidateRect
SetWindowPos
EndPaint
GetWindowTextA
GetWindowTextLengthA
GetClientRect
BeginPaint
SetWindowTextA
PeekMessageA
MsgWaitForMultipleObjects
IsWindow
CreateCaret
ShowCaret
HideCaret
DestroyCaret
TranslateMessage
EnableMenuItem
kernel32
GetSystemDirectoryA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcessId
QueryPerformanceCounter
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
CreateThread
CreateEventA
SetEvent
CloseHandle
WaitForMultipleObjects
WaitForSingleObject
GetFileType
GetSystemTime
GetStdHandle
RaiseException
RtlUnwind
SetEndOfFile
UnhandledExceptionFilter
WriteFile
GetLocaleInfoA
GetStartupInfoA
GetThreadLocale
lstrcpynA
lstrlenA
WideCharToMultiByte
VirtualQuery
GetCurrentThreadId
LocalAlloc
LocalFree
VirtualAlloc
VirtualFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
SetFileTime
SetFilePointer
SetFileAttributesA
SetErrorMode
SetCurrentDirectoryA
SearchPathA
RemoveDirectoryA
ReadFile
MultiByteToWideChar
MulDiv
MoveFileA
LoadLibraryExA
LoadLibraryA
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVersion
GetTickCount
GetTempPathA
GetTempFileNameA
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeProcess
GetDiskFreeSpaceA
GetCurrentProcess
GetCommandLineA
FreeLibrary
FindNextFileA
FindFirstFileA
FindClose
ExpandEnvironmentStringsA
ExitProcess
DeleteFileA
CreateProcessA
CreateFileA
CreateDirectoryA
CopyFileA
CompareFileTime
GetThreadContext
GetCalendarInfoA
SetConsoleCursorInfo
OpenMutexA
CallNamedPipeA
GetComputerNameExW
LocalUnlock
VirtualProtect
GetModuleHandleW
GetSystemInfo
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
GetVersionExA
OutputDebugStringA
GetTimeZoneInformation
HeapReAlloc
HeapDestroy
HeapCreate
TerminateProcess
SetUnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=19, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=72, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=164, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
- SHA256 5f60eed8e27867c843387fe7fece3af688586a40c8d3dd2c27647b23cc200fdc
- MD5 5a580ab3f5b3806da853459e9ef7b368
- SHA1 df93c0f0dd694ab49646b539418b67d83eafccb5
- SHA512 91ecd8f00f4cd6c7d199eb365cb7cfa414bcab41b144fe7a5f43529e560201a81284cdb3a3d18d252e2eb4429a67f2db5718eacc8bf1eeb072958c0a4be20a3b
- SSDEEP 1536:tf/YvFSSZtDgN+DrDkDEFtCwbfF89lGL+vpCYC:Z/Yv0SZtDgN+Dr+ErbfF89llpTC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mackt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
- IMPHASH c0603d2421d9908fc21039f32a3a1140
- SHA256 80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2
- MD5 b1024afccaf9847146e611beab995356
- SHA1 310a31da48325cea02182158efe0daa2ac6b451d
- SHA512 164d5b81008251a454e0cc18ebbaaa3c1ce9f3dd24d45650359db5e4b30f00bd889f88333b2290e86667aa00296dea57f7b016d85f79ba12ea38eb6bd1342244
- SSDEEP 1536:h3C4HGFE94jwEG/eO5VEx70AwAWkH+/z13+QDmsrxwSX:hNoESj8p5OeFAWp7p+Qbxr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrlenA
GlobalAlloc
GetStdHandle
LocalAlloc
CreateMutexA
GetEnvironmentStringsW
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupGetLineCountA
msvcrt
_adjust_fdiv
memcpy
_exit
_onexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=29, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
- SHA256 845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8
- MD5 7f61ab7160ccea4f69fed025fbbfdb30
- SHA1 88d06d4124bca680bf28dde09cc1c3995002eef3
- SHA512 8ff46db7d1bfddef6bab676c1439207a7b755280720bf83406d95a700eac364ef667978a7e538cc3d6e2836487b38ddc34df288100b510e32d16f013ffd07d98
- SSDEEP 6144:clmE5hV/XRG4FmeAs32AcNhunE+AWTWk6+wv:2/XRG4FdAs32AeOWk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
239452
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
231KB
Virtual Size
231KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f
- MD5 a865cae4f9a553fa100932e8786b80be
- SHA1 1c691b07fa9c59c1eb6a993723887a9ac08b301c
- SHA512 df149155fc97c72f9401826f614dfb16edbf982b64c6fb3d7302526cd9c4ee8368dcfdc666c1c1fe2a522115176042f135723e9390ed4755fb35b4ebddc263e2
- SSDEEP 768:9Wf9/O9lXRyz4M9XyTm/O94NOYXkGQ40d4Wg/i+Pet+F/O9LiAU3UF3333efYZCz:9EmRyz4gOmxNOYXF+yzTPSwjH33wk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\Null\Documents\Visual Studio 2012\Projects\FBILock\FBILock\obj\Debug\FBILock.pdb
mscoree
_CorExeMain
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439
- MD5 406588f62853601a4f0381ad537b51ca
- SHA1 a4a5602c1446a61c653a7bf8ad89558b4761ce71
- SHA512 28e019a091c309bb732fa0f3782c763a333ae95e7cfed86424950dac658297e862d707de1328fe50dc8ac2372832c93e6e131db79bf9c9fa91ae58da1fba0bfc
- SSDEEP 768:hLNLdNY8E+pRqAyQ3ipHbEMsm/IqJRDftP5IM05kHZnJ6zZQufB9wZOKh2h1:Ij+pRqAyQ3ipHbEMsm/IqJR3IP54JhA9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Ferial\Desktop\DO NOT OPEN THE FUCKIN RANSOMWAREa\DO NOT OPEN THE FUCKIN RANSOMWARE\obj\x86\Release\DO NOT OPEN THE FUCKIN RANSOMWARE.pdb
mscoree
_CorExeMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
199B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
- SHA256 d03d3d4eab25c38eef57493c7494d3a1ffd0147e1fcb2730a97d9b826e15e799
- MD5 3444e41067c52192e3ee1e5f57ddd393
- SHA1 cccd89e09c2391f7e6bb8cb972c364bc27cad61d
- SHA512 81a6729a11b5626fc49bbcdc2988a2a1de0fe9b1805d5ac9271666a12b81a40f4ce932b51014a21f262fd677773a010894deae3b7bc13ab85d142647662b281e
- SSDEEP 1536:MnUfv0+ZXqm3S+DQNn1Bp/GpL7F6iCINF8nqZULCYk:Mn6v0+ZX5S+DQ11Bx67FZNF8nqWLTk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
43458
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
_dll_entry@16
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mackt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=180, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_TDS=4F84A969.exe
- IMPHASH b6e2eb432a22f6199b27693a6154ef9a
- SHA256 8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f
- MD5 311f6db6e5a4476b03cf973671e8afed
- SHA1 5831825c55e55e9c4127d0ed72d38df060a00eee
- SHA512 5d9824902cea653ac84667889b22017b444a1d878ee990fd6f3a5dabb1c288afa1268a6bb795f8b6ef4f856c4a114bca10d1db11643329e5805d8d659792a431
- SSDEEP 1536:xiOtoD7Ja3UAZfd5ycu6vGRbelxbJ3uJ4GjAaH:gJa3UAlPyclv4belP3k9AM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9812
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetStdHandle
CreateMutexA
CreateEventA
CreateSemaphoreA
GetVersionExA
GetLastError
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
shlwapi
UrlCombineA
setupapi
SetupGetFieldCount
msvcrt
__setusermatherr
_onexit
__dllonexit
memcpy
_controlfp
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
_exit
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
Name
.text
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
930B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=19, version=9049,
count=30, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
87a4f3f9f6dc263378f2f01db5f2c988.exe
- SHA256 5d196e6481f38fa6657d74288fc51b91e273b62ec00100737d0d0cc8f1e8379b
- MD5 87a4f3f9f6dc263378f2f01db5f2c988
- SHA1 dab86879e6e423582fedab0cc00c95882d3c3417
- SHA512 b2d98312e827c14702befe05c4262718a2e321a7200f1c08ddaa2517157b4fef960ba9508cec43654c77bec060c998d71f7be8e0b84633531e1cb5cd10b903e6
- SSDEEP 12288:AzBsMGrB6kzTKOeW9dY82G+JTlJR8E4TeOb57BIAwP/wyBmrdTOVf8I6jTBwF2dO:ifGIkzGOeW9dYG0pFf0wP/wyBmrdTOVN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
485572
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
.text
Size
464KB
Virtual Size
464KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
52B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6
- MD5 0c997c93bf7aac43e8bc22a9ea2fd9f8
- SHA1 1c1e46e49c769c48104ee40506c67f738c6978f9
- SHA512 da27770d969800978e3a21a4ff9d887f1cfca8ee33c81cbbd9c61aa5640e1f6535a6189b45f9c498d8e75628714226ff91658ff53855332036124459b34ebffa
- SSDEEP 6144:1nsJCTa8fC8OrAk2o90sBDuSeJ5zOSP+N4s7:1nWCTa8fC8W/0sBWJ5zvp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
277390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
264KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8c591485357e45a09dad3116496e6f686fa11f445a6bea5ef3cd5ed1ac078821.exe
- SHA256 8c591485357e45a09dad3116496e6f686fa11f445a6bea5ef3cd5ed1ac078821
- MD5 04742f7774cda5b58d7e5c1ba5a4e941
- SHA1 a8e35ff71e0561268f8c3082bcaa2f314a272005
- SHA512 726974f82334c474b363d2232f21db2e04730965147e01f9ac5b8f06a44c873e78e2ee7982147c85dffb1eec40fdb445b18b67d4e25303f1dfc672f63f0b9562
- SSDEEP 1536:xQqUQQ5fNlzCKxOxwoBg5KE+Y5NpWEibmbkWuEZ8DIPsfie8Sf1wKygNiJK:6NBbOKnoIKE+YpWFCoWk6a1wKyPK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
239452
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
231KB
Virtual Size
231KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
8d372fcf8a97223ebb86cdfe707d3035dfbfd4501c5688cfa82a9a4889e637e0.exe
- IMPHASH b5b7cc24098123f0fc0d26869fe821b7
- SHA256 8d372fcf8a97223ebb86cdfe707d3035dfbfd4501c5688cfa82a9a4889e637e0
- MD5 4313fd0a3d2cbedd4570230931833fe1
- SHA1 8280f59248747c6901079ac6e52814606ab8cdc4
- SHA512 1fd81fb997cbc2973b66a2f95b848dc5813b44513d21189b73a708e9d26b583bebe6bb429c89ecb7dd687262fa4a35abb791f56db3dc884e281b4d056b05887e
- SSDEEP 98304:/VKIRQd+TZAJPEoRgWkJgsgv4n/C2QHij4WeoM14s7Oc3b7e6l/R4ze9H:NKo4iAJcoSLi4/C2QHTRh6o/Gy9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
48640
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetVersionExA
GetProcAddress
LoadLibraryA
GetLastError
ExpandEnvironmentStringsA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetShortPathNameW
GetTempPathW
Sleep
LoadLibraryExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetCommandLineW
GetStartupInfoW
WriteConsoleA
SetConsoleTextAttribute
GetStdHandle
GetModuleFileNameW
HeapSize
RtlUnwindEx
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
CreateDirectoryA
GetCurrentProcessId
DeleteFileA
RemoveDirectoryA
FindNextFileA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DecodePointer
EncodePointer
SetConsoleCtrlHandler
GetModuleHandleW
ExitProcess
HeapReAlloc
GetDriveTypeW
GetFullPathNameA
GetFileAttributesA
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CloseHandle
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
GetCurrentDirectoryW
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
WriteFile
SetHandleCount
DeleteCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
ReadFile
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
LoadLibraryW
CreateFileW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetEndOfFile
GetProcessHeap
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
GetStringTypeW
CompareStringW
ws2_32
ntohl
Name
.text
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=171, productName=VS2010 build 30319, version=30319,
count=12, id=158, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=120, id=1, productName=Unmarked objects,
count=186, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
900.exe
- IMPHASH 9fc19485806c08804a01a75c909dbd0f
- SHA256 2424a7ce5e885bf460aeb8968ceab48057813430973c5a2e27d846553e79402c
- MD5 5a43d2db5c8cc3b8ec273aa470ccc931
- SHA1 dfcc68945b9daf7e9f49be4837a6934560ec635f
- SHA512 ffae7fe714667cb44d200f87c36a6f60735926d03ce86dd5756b7e91ab1bd04e7b98dccd1dc0b3f652ea50f5d4c74ffa1f66245052b61e00fd0e8273681a99d3
- SSDEEP 192:LvJ8ZxTFrv7bg1d4/QkODGAoyjwlkp7qQT6yNQ+pJYMq6fdw4RI2P:d8zt+UFxy9p7qk3DfC4RI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12176
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
wnsprintfW
StrStrW
StrStrIW
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
kernel32
GetLogicalDrives
FindFirstFileW
FindNextFileW
lstrlenW
WriteFile
TerminateProcess
GetUserDefaultLangID
GetProcessHeap
WaitForMultipleObjects
FindClose
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
GetLastError
HeapAlloc
CloseHandle
CreateThread
SetFilePointerEx
ExitProcess
CreateProcessW
lstrcpyW
lstrcmpiW
lstrcmpW
MoveFileW
HeapFree
lstrlenA
ReadFile
GetModuleFileNameW
Process32NextW
user32
GetKeyboardLayoutList
advapi32
GetSidSubAuthority
OpenProcessToken
GetSidSubAuthorityCount
CryptEncrypt
CryptReleaseContext
GetTokenInformation
CryptDestroyKey
CryptAcquireContextW
CryptGenRandom
CryptImportKey
CryptExportKey
CryptGenKey
shell32
ShellExecuteW
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
412B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=257, version=26213,
count=49, id=1, productName=Unmarked objects,
count=3, id=265, version=26128,
count=1, id=258, productName=VS2017 v15.6.0 build 26128, version=26128,
911d5905cbe1dd462f171b7167cd15b9.exe
- SHA256 8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051
- MD5 911d5905cbe1dd462f171b7167cd15b9
- SHA1 bca38ab2f4b461e25e4686cfe523d3b0ed2d1cd0
- SHA512 c60c274360040b2385fcfbc1f9cbc85cd48c9872d0cadcfbe0343efb16e5401af1b74159ecd29d5adeb519c2818bde022fd21b20c12e4dfb274351733d38b7d1
- SSDEEP 1536:IhcFu21x8xUoDq88z/1h5jOla6H7uTnkwwZI0qXAREZ+QOS4D0rtJ/lxABC:7DnoDjbin/w1O3D5J/lxABC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
104224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=260, version=25019,
count=1, id=261, version=24723,
count=1, id=259, version=24723,
count=17, productName=Unmarked objects (old),
count=1, id=261, version=25019,
count=38, id=265, version=25019,
count=1, id=258, version=25019,
91d24e06572099ba0aa5c20be6b1021fa48e864913fe3676ed05323e6b68fceb.exe
- SHA256 91d24e06572099ba0aa5c20be6b1021fa48e864913fe3676ed05323e6b68fceb
- MD5 f79b517d733de07ee82e5ac8cd9ee192
- SHA1 050b21190591004cbee3a06019dcb34e766afe47
- SHA512 799e55b3a1e04c7c87c7fe6fcb807600975510a7f05fa57f83a9301731a378c1323486343ba880a575aef59faa6e1d1ccc9cea90173b7626228b24ff9d4e685c
- SSDEEP 6144:QY4mV5gq4DBKkxa2RNJYw8coEdNqAniTw1sbLp7ByJ7NFPjsnH5+qPZOMbM+juE:OmVmb9Kkxa21Yw8QiJdAJTqNbM+/
- MD5 SHA1 SHA512 SSDEEP
Saldo.Pdf______________________________________________________________.exe
- IMPHASH 380e5390f65e340268c2e7706d44415e
- SHA256 4c953b87b35c7764a32cbcde63ea1fb2f1563883f28ef209718604c48ba497e3
- MD5 e982953f4b15ad41dbccb13a09970214
- SHA1 152b6ec0bda40347968c560f370e8f2089cb0436
- SHA512 60d9dc59ad324523ecc5f6933aada9a13cb5e9c67ba0b0e60007d784e17194da2e7308050ce1084c377a965a58bd846fd065c4589c5bc169666915fb557e6124
- SSDEEP 6144:IzexeLzWAewqagVdgv0mzsWZwGoMaRxgbQGsaYVbW6kbqbsL1GeD69wwBKZ9+:vxeHWAdQg/zjwGoMG/Vybqb01GeD0wT+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
13960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleW
GetTickCount
GetModuleFileNameW
IsDebuggerPresent
GetCPInfo
VirtualQuery
CreateFileA
CloseHandle
HeapSize
WriteConsoleW
GetConsoleOutputCP
GetModuleHandleA
GetCommandLineW
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteConsoleA
RaiseException
user32
GetWindowRect
IsZoomed
GetForegroundWindow
GetWindowLongW
GetDesktopWindow
GetCursor
advapi32
GetUserNameA
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=28, id=132, productName=VS2008 build 21022, version=21022,
count=26, id=149, productName=VS2008 build 21022, version=21022,
count=116, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=106, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
92ac6be4d9215b237d624177ca0543844d0dc8d071660ae4a4cf7c93cc11505b.exe
- IMPHASH 008aca28b7c001acc5e0ab32fabaad84
- SHA256 92ac6be4d9215b237d624177ca0543844d0dc8d071660ae4a4cf7c93cc11505b
- MD5 8434eea972e516a35f4ac59a7f868453
- SHA1 39eff0a248b7f23ee728396968e9279b241d2378
- SHA512 308160a34f7074f9a8178ce8ba37f155ba096c7448bc5cd0e9861788e158d2eacdbb329f716bc1b6935db9b26c0bcb9aca23966c73e4114c8ea92e6f53d77348
- SSDEEP 6144:BswDdb2MemnBVlz0SoVbO4A6OA4Trl28TyT6llY1/I8cWJWlfTXve:BswRSslz0P1OdFXJlJ8buXve
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
68453
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
J:\Win32Project9\Release\Win32Project9.pdb
kernel32
GetCurrentProcess
ExitThread
SetEndOfFile
CreateFileW
HeapSize
WriteConsoleW
ReadConsoleW
SetStdHandle
FindFirstFileExW
FindClose
GetProcAddress
GetCommandLineW
GetCommandLineA
GetProcessHeap
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WinExec
CreateProcessA
GetStartupInfoA
GetModuleFileNameW
CopyFileA
GetFileAttributesA
GetModuleFileNameA
FindNextFileW
GetLocalTime
FindFirstFileW
CreateThread
GetModuleHandleW
Sleep
GetLogicalDrives
VerifyVersionInfoW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileAttributesExW
GetExitCodeProcess
WaitForSingleObject
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetLastError
FreeLibrary
LoadLibraryExW
RaiseException
RtlUnwind
MoveFileExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetACP
HeapAlloc
HeapReAlloc
HeapFree
VerSetConditionMask
user32
ShowWindow
SendMessageW
FindWindowW
DrawTextA
CallNextHookEx
GetAsyncKeyState
DefWindowProcW
PostQuitMessage
DestroyWindow
KillTimer
InvalidateRect
SetTimer
EndPaint
SetWindowsHookExW
DrawTextW
BeginPaint
GetSystemMetrics
ShowCursor
DispatchMessageW
TranslateMessage
GetMessageW
SetForegroundWindow
SetWindowLongW
SetWindowPos
CreateWindowExW
RegisterClassExW
LoadCursorW
gdi32
MoveToEx
CreatePen
DeleteObject
SetTextColor
SetBkMode
SelectObject
CreateFontIndirectW
CreateSolidBrush
LineTo
advapi32
SystemFunction036
GetUserNameA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetUserNameW
shell32
ord680
wininet
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
netapi32
NetUserGetInfo
Name
.text
Size
174KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
122KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=160, id=243, version=40116,
count=27, id=242, version=40116,
count=22, id=259, version=23013,
count=60, id=261, version=23013,
count=66, id=260, version=23013,
count=15, id=203, version=65501,
count=158, id=1, productName=Unmarked objects,
count=2, id=265, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
97512f4617019c907cd0f88193039e7c.exe
- SHA256 438888ef36bad1079af79daf152db443b4472c5715a7b3da0ba24cc757c53499
- MD5 97512f4617019c907cd0f88193039e7c
- SHA1 24cfa261ee30f697e7d1e2215eee1c21eebf4579
- SHA512 cfbb8dd91434f917d507cb919aa7e6b16b7b2056d56185f6ad5b6149e05629325cdb3df907f58bb3f634b17a9989bf5b6d6b81f5396a3a556431742ed742ac4a
- SSDEEP 12288:bB/72HFAQBMiZB7fJJ2qDHKK/K5FJL+xQhrwjeI:bBKqFiT7fJJ2qbKK6F5+xQhrEJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1618128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
912KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
665KB
Virtual Size
668KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 4061360b63e3f18d077d72d92a3bf09f666af5d97169ee19a800bdc953fbecec
- MD5 5da07e31effd46c25e765f2334c6b91e
- SHA1 2bc62344405bca56b0b7133e37dd14e928b18f66
- SHA512 6c815d6fb6c0a3b545454edac96b60e85c7fdf9b772b4bdbba0fc292afa1cc97072314e14b4a951b45046536603bf634aab4a089e332fb8c99bacda97733dcac
- SSDEEP 24576:ZX8MrUquMnj5Zw6UjNfpmR6Q9zz0DQuGvmq4e+57PRWUazgFGykkkbpu2kOkg7iT:UejHzRj9v0DQuGvmq4bn7g7kkbwPOkfT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5112
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
916KB
Virtual Size
915KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
554KB
Virtual Size
553KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
98aadc95c589e064a542802bbf0ef01ef00595c34d195f1a1e6443909846d2e7.exe
- SHA256 98aadc95c589e064a542802bbf0ef01ef00595c34d195f1a1e6443909846d2e7
- MD5 993135dacbff2607839ee5a76ca06c61
- SHA1 c1a9a8cdad293887214605ca0e47f3ddfa4e1a52
- SHA512 69472dc86d5d3c44742b209fb0a57ab3afd8f93d0c5adfdcd48c2e4828828309101fcb9500813044712b1bc3e85e6a2ad3e5dde5f3818fb8772f0ff5d0b873ea
- SSDEEP 3072:aMAr2Q8LH/r1GgDwheOj9Pm4uX2QZJiU8ypfoAWe:aMAaQ0D1VDwheuhJmJiU8y90
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
300080
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
149KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 e523e6a0cd2722074ac16b17dfedea41463b437d8cc48c2ae6c63280a0a055b1
- MD5 c82ac177c9414e6aac1c7fc47ca01412
- SHA1 e87430581bb40b44afea2298d34bfda8d0c10d34
- SHA512 6898c48347b656ee7ddbe173d2d5ef8b6aac5e17317e5993d61ba43518a3fe6e027b30d40a8b2fc6c6ccde1bc12370bbfee0787c50d289c2c17935af6e2a34d2
- SSDEEP 3072:oNSP4ahNXOWRTVyOjWjwWDdriwEt71r00LtW1ULiqnSLT8Zl:vPbPOWTVCiws71rrRW1GiqaT8Zl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
247676
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
240KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
9943256.exe
- IMPHASH 0d2a3dff6d08ba82ac9b7da6dc4764b3
- SHA256 4725414537a3605ee6cdd226d189419cc5d3a7df1b092b526b61b8c5e2a59386
- MD5 25e54dfbce20546da0e8cd8152ee2b8e
- SHA1 3f0b80ef090c0b14821309b6110839cbd2312afe
- SHA512 215f4d5d35153622f159970e0097cde6e00d387f5636a1c28d3de6c0f5f84b61dfcaf4d390464eb888738786a0028d7d6f6ce13a29e07116ad032027428215a2
- SSDEEP 3072:r+qf9FUiVdubWibOQNi3MWL4FksNYFfPK:r+iLUwAbpi3MDEK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8317
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrStrIW
StrCatW
psapi
EnumProcesses
EnumProcessModules
GetModuleBaseNameW
kernel32
lstrlenW
CopyFileW
CloseHandle
WriteFile
CreateFileW
WideCharToMultiByte
Sleep
GetCommandLineW
CreateProcessW
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetTickCount
GetEnvironmentVariableW
OpenProcess
SetSystemTime
GetSystemTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
WaitForSingleObject
CreateThread
IsDebuggerPresent
user32
CreateWindowExW
GetSystemMetrics
RegisterClassExW
DefWindowProcW
SetLayeredWindowAttributes
SetWindowPos
SetWindowLongW
GetWindowLongW
EndPaint
BeginPaint
EndDialog
GetDlgItemInt
CallNextHookEx
GetAsyncKeyState
ShowWindow
UpdateWindow
SetForegroundWindow
SetWindowsHookExW
DialogBoxParamW
BeginDeferWindowPos
AdjustWindowRect
ArrangeIconicWindows
AllowSetForegroundWindow
AnimateWindow
BringWindowToTop
AnyPopup
CascadeWindows
MessageBoxW
CloseWindow
gdi32
TextOutW
SetTextColor
SetBkColor
Rectangle
CreateSolidBrush
CreatePen
SelectObject
CreateFontA
Name
.text
Size
22KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=6, id=149, productName=VS2008 build 21022, version=21022,
count=12, id=131, productName=VS2008 build 21022, version=21022,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=67, id=1, productName=Unmarked objects,
count=9, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
9B9517FA1515F47A502FE56536236A20BE5BBADF.exe
- IMPHASH 59a4a44a250c4cf4f2d9de2b3fe5d95f
- SHA256 e58e7b91af952f56d32d3cb11e82d366f256f40d2e4c846f3aa8cda886bfb49f
- MD5 b80a2daca4b5000fae089e655f2fa4b0
- SHA1 9b9517fa1515f47a502fe56536236a20be5bbadf
- SHA512 9e5a24fd11bf542608ca8762ad735de749cfcfdc2bd750ca3f7de20dbc19a2ccda0cc88544261314c8dfa77c5ad2fd6e97af51ceee344794fba1efa49d32964f
- SSDEEP 3072:VAsj8MBX8s0oXJE455Vdcws635oUIFNTNC1f3U:VAsBZW+VdK6iUcIfU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12823
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
CloseHandle
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
GetTempPathA
GetWindowsDirectoryA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
- MD5 883eff06ac96966270731e4e22817e11
- SHA1 523c87c98236cbc04430e87ec19b977595092ac8
- SHA512 60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
- SSDEEP 96:UPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+l:UPtkuWJX7zB3kGwfy0nyUVsxCjOMb1u
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9999
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
610B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 38e7b5c3ee58b43a91f9679e94aabd09
- SHA256 c5bf321a3a2aace7b42014cf78a3d0fb3eec03b2c8ff00ad72445f56657377af
- MD5 36bdf3e282ee81ea2f9a400604a55ff6
- SHA1 032c7337754bd9bddb71db20feaddad7837e0a29
- SHA512 58a99987fb63e392632f855f97f945bfd9de941788905636807a925b711db290370965875f1074478ce40ec4cd6f9e671a661e14c14a17ddceb08df692fe9c5d
- SSDEEP 96:3ip41CMj95rKhkfL5RkEdKkcxM2DjDf3GEEE9v5E9av+Yx4FndY7ndS27gA:3iujesS4HREEK5MYxwdqn420
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc
user32
DestroyWindow
CallWindowProcA
SetCursor
GetPropA
CharPrevA
MapWindowPoints
DrawFocusRect
GetWindowLongA
GetClientRect
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
LoadCursorA
RemovePropA
DrawTextA
gdi32
SetTextColor
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=55, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
NumenHeartwoodSchefflera
- SHA256 8386a96ed774e87b797a5da03d43301ae1517dba4763781885a3e205862fbfc0
- MD5 402314fe6d3e8e0cd078c8bd4db540ce
- SHA1 7f70d315e118999349e51e9dc9469b177482f61a
- SHA512 6dd20314c553a81d446431f86b30cfd323f0f09c729dc555653bbb30451c2c1e0690699ddba9119e2ca47bf47a2951c445552584dab86d123499b28723786cd1
- MD5 SHA1 SHA512
SceneButtonInset_Alpha2.png
- SHA256 e652f0c04257af76513146fc02b0cc6ab12b70889443a8cfea3a6bff2e3dbd6f
- MD5 4085bbfe2ed5c1f902654748d32bea36
- SHA1 06f67dba3f0632075c353618fa2712cb5f877c93
- SHA512 583d70e1b473f3f1a76d984e0c0514e317509c532a10ba626547d7e3956cb0e31155697c87cf55430e1f67a48b703471c713d6da23bb2979f59377bba2cabf82
- MD5 SHA1 SHA512
draft.watermark.image.xml
- SHA256 b33347a75bba19d1832ac914dae86097b9485ff3d64c33741522c7f28c349c39
- MD5 81a14090a89ea84f314bb42c45978088
- SHA1 6eed3a6053cb148bda8bc91997fc72217d53b24a
- SHA512 00b77fd31a1cdb04adb57db4dbe15e2640f0ba411667378fed197ecc49d2af86e23b37cfb99b1006fca177ddd7362cf5cce0c5ec8646d63c10dbb4a22b846525
- MD5 SHA1 SHA512
unneighbourliness.dll
- IMPHASH 0e2a4e49270105abc999a944432cb3a3
- SHA256 3b4d00c530873bacd106d2654f2339b6bcdfc942cdb3008ea37c042eece500b2
- MD5 8d76fcd24e4af8e65e25c0d8ed00a5ba
- SHA1 77c7da80febb1a88aaa7ece24cdd151d72951740
- SHA512 0906564e3dadbd6f399bc303612ea85a8e58be96a4b8e421a10027bbb2fd24fb32da8d99697e1e1a45b2bdf1710b295b6e72b1e657fa37a32d3f0e973c5ee1c7
- SSDEEP 384:WSzjUYvjLgtaUj1MYHEtgz83iHv6CWypP:W4UI4tHj1MYagz83iP6bAP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
CheckDlgButton
DefDlgProcA
Azine
_EnumMastery
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
223B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
673B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
video-card.png
- SHA256 8ae6ae68ee7d7c72834f3077157618a2c6472bf7e2c658d4d7edb21dbec67270
- MD5 2d1f4c3d96765a8a44bf988287b39200
- SHA1 fd392100fe82565577df126c8241f86a282cf8d6
- SHA512 7b0a16db1287230996f608dc717e2ac91a2a9850762453192b7ac5d101e15ef3c45b44da41cbc1243423834b491cf2c62139a2fe876a1d67cba6f3b79b0bfe69
- SSDEEP 1536:HDWOfcE2XWsp9A/Up9Sz8LiCu91lE6Dfugoz:HDWFTn8o9Szuu9Loz
- MD5 SHA1 SHA512 SSDEEP
9b7eaffe4dffcbd06445d0b32785cdc8.exe
- SHA256 4137f8c196fdd99a5cd64c518ed27c466953e37b78887954ea192b5595a0a076
- MD5 9b7eaffe4dffcbd06445d0b32785cdc8
- SHA1 af992e2e6c045137b8220c60f534f80da968dd38
- SHA512 3639fc1b3ccd57b6a61acecfce8030a7c2c634deb44b75345b5c69eb5cad03a8aecae781b950c254e35f4db248b5e9113fd06412f14ca7a90596985a282e123f
- SSDEEP 768:BPXsWRbrIA8vxG/VZ0xcv+n9DfUEGC4ZC:B/s+HUxSZOcvI9DsE4ZC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
143904
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
text
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
data
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=14, id=9, version=8783,
count=1, id=13, version=9782,
a322da0be4f0be8d85eab815ca708c8452b63f24d0e2d2d6d896a9f9331a6244.exe
- IMPHASH b13814a376b70a4e0bb7a2b2a5007ed6
- SHA256 a322da0be4f0be8d85eab815ca708c8452b63f24d0e2d2d6d896a9f9331a6244
- MD5 4a6bcd14aee9be6ccd5fd4939f8350ef
- SHA1 10a7e4377fdbab12ee66151d3c5af9096bc47b59
- SHA512 336c05288cae08c966659b5ca528994ccdb0be55cc2197ee810067242995a3448321a9c1b2355a16c5f4cbdcc4131f2707839e055dec4df2bd8dbb6c5090b7f2
- SSDEEP 6144:lf0H8b57WZ87m4eEictcjk76F3OpRsmC:lf/b57WZ8K1ZcenF3OpRs
- MD5 SHA1 SHA512 SSDEEP
-
Detect Blackmoon payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
50339
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LCMapStringW
CreateEventA
GetTempPathA
LoadLibraryW
GetStringTypeW
GetConsoleCP
GetConsoleMode
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcessId
SetStdHandle
WriteConsoleW
CreateFileW
OpenProcess
GetCurrentProcess
SetProcessWorkingSetSize
CreateThread
CreateWaitableTimerA
SetWaitableTimer
lstrcpyn
GetWindowsDirectoryA
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
MoveFileA
WriteFile
CreateFileA
GetFileSize
ReadFile
FindClose
FindFirstFileA
FindNextFileA
GetTickCount
SetFileAttributesA
GetModuleFileNameA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CloseHandle
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
MultiByteToWideChar
GlobalFree
RtlMoveMemory
GlobalSize
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapCreate
IsProcessorFeaturePresent
OpenEventA
lstrlenA
GetSystemDirectoryA
GetLastError
WideCharToMultiByte
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
GlobalLock
LocalAlloc
LocalFree
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalUnlock
GlobalHandle
TlsFree
LeaveCriticalSection
GlobalReAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
lstrcpynA
GlobalFlags
InterlockedDecrement
WritePrivateProfileStringA
lstrcatA
lstrcpyA
InterlockedIncrement
SetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetVersion
GetProcessVersion
SetErrorMode
SetFilePointer
FlushFileBuffers
GetCPInfo
GetOEMCP
EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
RtlUnwind
GetModuleHandleW
RaiseException
HeapQueryInformation
HeapSize
GetACP
IsValidCodePage
Sleep
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
user32
IsWindowVisible
GetWindowTextA
GetClassNameA
ShowWindow
SetForegroundWindow
SetWindowPos
MsgWaitForMultipleObjects
DestroyMenu
GetWindowThreadProcessId
GetDlgItem
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
SystemParametersInfoA
EnableWindow
GetParent
IsWindowEnabled
GetForegroundWindow
GetActiveWindow
PostQuitMessage
PostMessageA
SendMessageA
SetCursor
GetWindowLongA
GetLastActivePopup
SetWindowsHookExA
GetCursorPos
ValidateRect
CallNextHookEx
GetKeyState
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
PtInRect
GetWindowRect
GetDlgCtrlID
GetWindow
ClientToScreen
SetWindowTextA
UnhookWindowsHookEx
GetMenuItemCount
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
UnregisterClassA
SetWindowLongA
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
advapi32
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ole32
GetHGlobalFromStream
CreateStreamOnHGlobal
gdiplus
GdiplusStartup
GdipDisposeImage
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdipSaveImageToStream
gdi32
DeleteDC
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
SelectObject
RestoreDC
SaveDC
DeleteObject
CreateBitmap
GetStockObject
GetObjectA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
comctl32
ord17
Name
.text
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
84KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=152, version=20115,
count=48, id=171, productName=VS2010 build 30319, version=30319,
count=25, id=158, productName=VS2010 build 30319, version=30319,
count=132, id=170, productName=VS2010 build 30319, version=30319,
count=15, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=14, id=19, version=8034,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=402, id=1, productName=Unmarked objects,
count=93, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=8, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=154, productName=VS2010 Beta 1 [10.0] build 20506, version=20506,
count=1, id=157, productName=VS2010 build 30319, version=30319,
a42252e674a09a0b689e71c88f59969f538a473da647cc4eb5457a5d5e03a234.exe
- SHA256 a42252e674a09a0b689e71c88f59969f538a473da647cc4eb5457a5d5e03a234
- MD5 7ec4fb3737e96c0aef2f98d20013dc5a
- SHA1 4e8a042292c4ef20556d4aedf5b3ea0a29d2fbe7
- SHA512 849ab6bfd9f61a10d29b727e0bfcc7804653764e2d4a9a01515a48b6ff52e37fd1954715d8decb7bde819bf490563924c3d8e51dcaf8218c40852ffdf9d65eb8
- SSDEEP 3072:6NBbOKnoIKE+Ypjf+MGtmhoWk6a1wKyPK:clmE5jfwWk6+wv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
239452
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
231KB
Virtual Size
231KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ