Batch_6.zip
- SHA256 c41899315b2f3dad512ed1f58746e59fdb2f9717badcf7b2c861c1248d945991
Overview
overview
10Static
static
6D02D012970...94.exe
windows7-x64
1DBm0yQwt.exe.ViR.exe
windows7-x64
10ca6ec46ee9...52.apk
windows7-x64
3calc.exe
windows7-x64
7ccc71c83c8...B3.exe
windows7-x64
7ccc71c83c8...68.exe
windows7-x64
7cd2d085998...-0.dll
windows7-x64
8cdffb7e75b...ss.exe
windows7-x64
3cf7382c25a...c9.exe
windows7-x64
6cgi19-alpt...e_.exe
windows7-x64
7chrst.exe
windows7-x64
3ci05l2a.exe
windows7-x64
cl.exe
windows7-x64
7clean.exe
windows7-x64
3coinvault.exe
windows7-x64
9com_loader.exe
windows7-x64
3csrss.ex_.exe
windows7-x64
6d.exe
windows7-x64
3d0a5cfec8e...B3.exe
windows7-x64
7d0a5cfec8e...A6.exe
windows7-x64
7d2164cdbc9...FB.exe
windows7-x64
3d2164cdbc9...08.exe
windows7-x64
7d4439055d2..._1.dll
windows7-x64
3d54d2a216e...96.exe
windows7-x64
7d5f29750a8...c5.apk
windows7-x64
3d6c32b0146...4d.zip
windows7-x64
9d889734783...48.exe
windows7-x64
daaa72f48b...2d.exe
windows7-x64
9ddbf1840bf...e2.exe
windows7-x64
10de882c049b..._3.dll
windows7-x64
3decrypt.exe
windows7-x64
3decrypted.ex_.exe
windows7-x64
6Behavioral task
behavioral1
Sample
D02D012970AA164CAD15C757D7E52994.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
DBm0yQwt.exe.ViR.exe
Resource
win7-20240903-en
windows7-x64
21 signatures
300 seconds
Behavioral task
behavioral3
Sample
ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.apk
Resource
win7-20240729-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral4
Sample
calc.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral5
Sample
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_Dumped_TDS=4F9911B3.exe
Resource
win7-20241023-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_TDS=4FAD9768.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral7
Sample
cd2d085998a289134ffaf27fbdcbc8cb_api-ms-win-system-dispex-l1-1-0.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral8
Sample
cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36_not_packed_maybe_useless.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral9
Sample
cf7382c25a8bf0d904d51063ceb29fb70f630bc9.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral10
Sample
cgi19-alptsevs-h555.exe_.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
300 seconds
Behavioral task
behavioral11
Sample
chrst.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral12
Sample
ci05l2a.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
cl.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
300 seconds
Behavioral task
behavioral14
Sample
clean.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral15
Sample
coinvault.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral16
Sample
com_loader.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral17
Sample
csrss.ex_.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral18
Sample
d.exe
Resource
win7-20240729-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral19
Sample
d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_Dumped_TDS=4F9911B3.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral20
Sample
d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_TDS=4FA478A6.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral21
Sample
d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_Dumped_TDS=4FB252FB.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral22
Sample
d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_TDS=4FB30D08.exe
Resource
win7-20241023-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral23
Sample
d4439055d2d63e52ffc23c6d24d89194_86e510605f1ee068bdc1ae306312652a__1.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral24
Sample
d54d2a216e637bcd36e5217cfba98896.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral25
Sample
d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5.apk
Resource
win7-20240903-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral26
Sample
d6c32b0146f219bdcb5cf524ea9e0047d9b9bd0fd7c395d5b11cbc4c3298824d.zip
Resource
win7-20240903-en
windows7-x64
18 signatures
300 seconds
Behavioral task
behavioral27
Sample
d889734783273b7158deeae6cf804a6be99c3a5353d94225a4dbe92caf3a3d48.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
daaa72f48bea498c5ac7ce9bc315e585ff11dad04d1eeb0d1b0ce33a28bedf2d.exe
Resource
win7-20240729-en
windows7-x64
15 signatures
300 seconds
Behavioral task
behavioral29
Sample
ddbf1840bf626da19d8f3467fe9e20e2.exe
Resource
win7-20241010-en
windows7-x64
20 signatures
300 seconds
Behavioral task
behavioral30
Sample
de882c049be133a950b6917562bb2313_583a76e23c1998307d702709dadbe103__3.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral31
Sample
decrypt.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral32
Sample
decrypted.ex_.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
General
- Target Batch_6.zip
- Size 8.6MB
- Sample241122-dwswastmds
- SHA256 c41899315b2f3dad512ed1f58746e59fdb2f9717badcf7b2c861c1248d945991
- MD5 efd2b474bb13fdb3b8a3159a64a22896
- SHA1 48515da815cafb4d990efdd7b67baf86ac949813
- SHA512 05195802d912ff48aac8035a8a061a3d8dc5b312ed936a147a742ad65ab75f982e3b443ebb001dd145086644006bfc361f83fb40799f60e51dd6eb053139f190
- SSDEEP 196608:PYpWTGAAWAquK9u/2fpA4kuu0xCDCFvyRyi1GGywTpGRE:PYpWTGAAqub/2y4kudiCFviy88GGi
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Requests dangerous framework permissions 6 IoCs
description ioc Required to be able to access the camera device. android.permission.CAMERA Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE -
resource yara_rule static1/unpack001/calc.exe upx - Unsigned PE 29 IoCs
Checks for missing Authenticode signature.
resource unpack001/D02D012970AA164CAD15C757D7E52994.exe unpack001/DBm0yQwt.exe.ViR.exe unpack001/calc.exe unpack002/out.upx unpack001/ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_Dumped_TDS=4F9911B3.exe unpack001/ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_TDS=4FAD9768.exe unpack001/cd2d085998a289134ffaf27fbdcbc8cb_api-ms-win-system-dispex-l1-1-0.dll unpack001/cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36_not_packed_maybe_useless.exe unpack001/cf7382c25a8bf0d904d51063ceb29fb70f630bc9.exe unpack001/cgi19-alptsevs-h555.exe_.exe unpack001/chrst.exe unpack001/cl.exe unpack001/clean.exe unpack001/coinvault.exe unpack001/com_loader.exe unpack001/csrss.ex_.exe unpack001/d.exe unpack001/d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_Dumped_TDS=4F9911B3.exe unpack001/d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_TDS=4FA478A6.exe unpack001/d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_Dumped_TDS=4FB252FB.exe unpack001/d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_TDS=4FB30D08.exe unpack001/d4439055d2d63e52ffc23c6d24d89194_86e510605f1ee068bdc1ae306312652a__1.dll unpack001/d54d2a216e637bcd36e5217cfba98896.exe unpack003/Transazione.Pdf______________________________________________________________.exe unpack001/daaa72f48bea498c5ac7ce9bc315e585ff11dad04d1eeb0d1b0ce33a28bedf2d.exe unpack001/ddbf1840bf626da19d8f3467fe9e20e2.exe unpack001/de882c049be133a950b6917562bb2313_583a76e23c1998307d702709dadbe103__3.dll unpack001/decrypt.exe unpack001/decrypted.ex_.exe
File Explorer
-
Batch_6.zip.zip 8.6MB
-
D02D012970AA164CAD15C757D7E52994.exe.exe 214KB
-
DBm0yQwt.exe.ViR.exe.exe 216KB
-
ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.exe.apk 1.5MB
-
calc.exe.exe 161KB
-
out.upx.exe 193KB
-
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_Dumped_TDS=4F9911B3.exe.exe 112KB
-
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_TDS=4FAD9768.exe.exe 68KB
-
cd2d085998a289134ffaf27fbdcbc8cb_api-ms-win-system-dispex-l1-1-0.dll.dll 440KB
-
cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36_not_packed_maybe_useless.exe.exe 53KB
-
cf7382c25a8bf0d904d51063ceb29fb70f630bc9.exe.exe 501KB
-
cgi19-alptsevs-h555.exe_.exe.exe 569KB
-
chrst.exe.exe 130KB
-
ci05l2a.exe179KB
-
cl.exe.exe 236KB
-
clean.exe.exe 114KB
-
coinvault.exe.exe 544KB
-
com_loader.exe.exe 64KB
-
csrss.ex_.exe.exe 892KB
-
d.exe.exe 130KB
-
d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_Dumped_TDS=4F9911B3.exe.exe 116KB
-
d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_TDS=4FA478A6.exe.exe 68KB
-
d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_Dumped_TDS=4FB252FB.exe.exe 53KB
-
d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_TDS=4FB30D08.exe.exe 56KB
-
d4439055d2d63e52ffc23c6d24d89194_86e510605f1ee068bdc1ae306312652a__1.dll.dll 160KB
-
d54d2a216e637bcd36e5217cfba98896.exe.exe 285KB
-
d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5.exe.apk 1.7MB
-
d6c32b0146f219bdcb5cf524ea9e0047d9b9bd0fd7c395d5b11cbc4c3298824d.exe.zip 284KB
-
Transazione.Pdf______________________________________________________________.exe.exe 446KB
-
d889734783273b7158deeae6cf804a6be99c3a5353d94225a4dbe92caf3a3d48.exe.elf 419KB
-
daaa72f48bea498c5ac7ce9bc315e585ff11dad04d1eeb0d1b0ce33a28bedf2d.exe.exe 823KB
-
ddbf1840bf626da19d8f3467fe9e20e2.exe.exe 173KB
-
de882c049be133a950b6917562bb2313_583a76e23c1998307d702709dadbe103__3.dll.dll 659KB
-
decrypt.exe.exe 75KB
-
decrypted.ex_.exe.exe 507KB
D02D012970AA164CAD15C757D7E52994.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 eba685abd63d2c7378f788aa5ca8e4f95f4b82b51347cb8818090ef54e8f7d29
- MD5 d02d012970aa164cad15c757d7e52994
- SHA1 25eef16797a7cf4168938f9d372332d65356b6f7
- SHA512 640545996e924b5f759ba69f970686e67defc9142a195fb6774dd275e22961fd9b21328b119d42b4032f1cf4eb6363ccce64bf6f423d2bf3ddc1d8d5b1f524ee
- SSDEEP 3072:BM+lmsolAIrRuw+mqv9j1MWLQ6xZ4qM+lmsolAIrRuw+mqv9j1MWLQlL:6+lDAArx2+lDAAmL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121486
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\Paco\Desktop\Invoice\HiDdEn-TeAr\obj\Debug\invoice.pdb
mscoree
_CorExeMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
DBm0yQwt.exe.ViR.exe
- IMPHASH 41650cfcdcf1a88f0c9ad2f113ce9650
- SHA256 ac3f6f87217e1d4fbcd56289b4c77b1adea3dbbaf4131a84b7b2508d6fadcfaf
- MD5 3cb2c3ce48ac870ab0be9afb7233295f
- SHA1 b87ac51e95b85e64bb3fecbbb8f9d2acb5b53895
- SHA512 e41c6ad1f5522dda96e19fdf4b79ebd8b7bc13507c5ed5afc1155e37b1dabf16f11f66b1101124035d3d92a942bcd60122e3751069ebd7da1a36e498845b6900
- SSDEEP 3072:UPPdPl/PuW/Yqoeog665R6OKEjzG6hgckhmnl/5aUWTo+Kuv+nAo:UHTnVHv82ZJFgJ+/Hxn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
15888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileA
CloseHandle
UnhandledExceptionFilter
FindResourceA
GetModuleHandleA
LockResource
LoadLibraryA
GetProcAddress
GetLastError
GetStdHandle
MulDiv
HeapCreate
SizeofResource
InterlockedDecrement
HeapAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeleteCriticalSection
GetFileType
SetHandleCount
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapFree
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineA
GetStartupInfoA
RaiseException
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
IsValidCodePage
GetOEMCP
GetACP
LoadResource
SetStdHandle
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
GetCurrentProcess
TerminateProcess
GetModuleFileNameA
WriteFile
ExitProcess
Sleep
GetModuleHandleW
SetUnhandledExceptionFilter
user32
SendMessageW
GetSystemMetrics
ScrollWindowEx
SetLayeredWindowAttributes
SetWindowPos
GetSysColor
GetDlgItem
ReleaseDC
GetWindowLongA
InvalidateRect
SetWindowLongA
CopyIcon
SetMessageQueue
SetScrollInfo
LoadCursorA
SetCursor
GetWindowRect
SendDlgItemMessageA
FillRect
MsgWaitForMultipleObjects
GetFocus
GetParent
DrawIcon
GetClientRect
DrawTextExW
SendMessageA
SetRectEmpty
wsprintfW
GetIconInfo
GetUpdateRect
GetDC
OffsetRect
GetCursorInfo
GetWindowTextA
gdi32
SetWindowOrgEx
BitBlt
GetWindowOrgEx
PatBlt
GetTextMetricsW
SetViewportOrgEx
SetTextColor
CreateFontA
GetDeviceCaps
SetBrushOrgEx
CreateBitmap
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
EnumFontFamiliesA
CreatePatternBrush
GdiGradientFill
SetTextAlign
CreateSolidBrush
CreateDIBSection
advapi32
RegCreateKeyA
RegSetValueExA
shell32
SHBrowseForFolderA
SHCreateShellItem
ole32
CoFreeUnusedLibraries
CoInitialize
StringFromCLSID
CoUninitialize
CoGetMalloc
CoCreateInstance
oleaut32
SysFreeString
RevokeActiveObject
VariantClear
wininet
InternetCrackUrlA
ws2_32
WSAGetQOSByName
WSAGetOverlappedResult
winscard
SCardGetProviderIdW
shlwapi
UrlGetPartA
comctl32
ImageList_DrawIndirect
rpcrt4
RpcBindingFromStringBindingA
RpcStringFreeA
RpcStringBindingComposeA
RpcBindingFree
secur32
GetUserNameExA
opengl32
glEndList
powrprof
GetPwrCapabilities
urlmon
CoInternetParseUrl
rpcns4
RpcNsBindingImportBeginA
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
663KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=117, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=132, productName=VS2008 build 21022, version=21022,
count=47, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=37, id=123, productName=VS2005 build 50727, version=50727,
count=189, id=1, productName=Unmarked objects,
count=1, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.exe
- SHA256 ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52
- MD5 4b4d8abbca536c987fca430af62c9bc8
- SHA1 4055b08de4d70cd512e1f10d186d887a2c38c86e
- SHA512 1feb88f28eeda10e670761cda1d61039fc51f76e38aaf731cf11d7f4621b5f45ac2816037fbaf5a40ad53f14e221f24dbefc34023329a6b753fb90c35a515736
- SSDEEP 24576:C6+MSDnehBCO+whjuFtxY5CMbkQfLenj3eesz07m5zvRquduX85ng7ScD:C6PQe3X+C6Mb1Den5i0MzvRgX85g7ScD
- MD5 SHA1 SHA512 SSDEEP
com.android.porntube
.Loader
android.permission.DISABLE_KEYGUARD
com.android.browser.permission.READ_HISTORY_BOOKMARKS
com.sec.android.app.sbrowser.operatorbookmarks.permission.READ_HISTORY_BOOKMARKS
android.permission.RESTART_PACKAGES
android.permission.CAMERA
android.permission.GET_TASKS
android.permission.GET_ACCOUNTS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.WRITE_SETTINGS
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.READ_CONTACTS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.READ_PHONE_STATE
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
.Loader
android.intent.action.MAIN
com.sklasse.utils.takePh
.player
android.intent.action.VIEW
com.plugins.core.attrapt
com.plugins.core.helper
com.plugins.core.setzero
android.system.registat
.sklasse
android.system.operate
com.sklasse.utils.qq
com.sklasse.utils.astart
android.intent.action.REBOOT
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.REBOOT
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.sklasse.utils.brr
com.sklasse.utils.cached_reps
android.net.conn.CONNECTIVITY_CHANGE
android.system.cache
com.plugins.core.setsize
android.app.action.ACTION_DEVICE_ADMIN_DISABLE_REQUESTED
android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.DEVICE_ADMIN_DISABLED
calc.exe
- SHA256 ef00fed6e97e926bdb3b968030795ef5dd34e8e40dec2b7cf802de97feed6321
- MD5 df543c8c85a47c41886f644f4ecf66ff
- SHA1 460154b09e361829c46efcbd64848bfd1db43f53
- SHA512 2a43d36b8db163de66c48d3e1db318d4ffc4aa52f2bb5e3b5074cd597cedd18be5f01b07d1afe7cb53af54c54d4e3e32e0bd0c27d2f8698459c1214b5ebfc17d
- SSDEEP 3072:g4eqa10YgyW9nnrS8zut754EmUQqWKcm+cqAdZuRqoDb1Ndgjx9MApVfqF8CHJq:A5WFrbzSeE6qWK+yHuR/DfCt9vpAFrp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
10
Entry point
218304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
158KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=208, id=126, version=35753,
count=704, id=49, version=43268,
count=575, id=15, version=8599,
count=379, id=81, version=39511,
count=686, id=97, version=8508,
count=901, id=80, version=43789,
count=717, id=71, version=45448,
out.upx
- SHA256 b37eaab2fcdb8ce80a9583da199508888739ceb16531672109acf0207a7a4d96
- MD5 9086cd7901c3855cccc1e9fded040933
- SHA1 4d1c06a460a1374a1bf7dd7ea64d1d98c3790ea0
- SHA512 3b1be640f2a30a046b904373b856a26a752f08864fe402ebdea85f6efe8c1435fcdb525b82fc6293ad27ca1f020e0b3d16722eae0775e52630465d6bd10e92bd
- SSDEEP 3072:sfq84P0gr75Po+ZRKD7g1Y/OtztjqZqFEQoHqrX9JOA5sCwvaXZ:cmrloE57dqZ4EQZLOA5eo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
10
Entry point
78769
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=208, id=126, version=35753,
count=704, id=49, version=43268,
count=575, id=15, version=8599,
count=379, id=81, version=39511,
count=686, id=97, version=8508,
count=901, id=80, version=43789,
count=717, id=71, version=45448,
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_Dumped_TDS=4F9911B3.exe
- IMPHASH 0e19eece28bfc9b0d635ed4ec3d29752
- SHA256 ffdc8e2813a270f45ebd2540e0b0d8730443b6ab444c2d8ac4d1b4dbbd1e7854
- MD5 c1fa82712918b9907168593ce4497295
- SHA1 dbd20b8fb720fa9735c9b4edce20f819f26f3f15
- SHA512 3ddc30baca3c92566e68d2148912fdd72d470404793edd7448464ec9c5a092e336e0176ea4f55dedabc6f95bd7ad974507324177cb191d26a1f208dfb9b1db4c
- SSDEEP 1536:mf/YvFSSZtDgN+DrDkDEFtCofF89lGL+v:Q/Yv0SZtDgN+Dr+EpfF89ll
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wininet
InternetOpenA
HttpQueryInfoA
InternetConnectA
InternetReadFile
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
shlwapi
PathCombineW
kernel32
lstrcatA
GetLastError
GetModuleHandleA
CloseHandle
GetVersion
lstrcpyA
WaitForSingleObject
Sleep
GetCurrentProcessId
GetTickCount
ExitProcess
GetFileSize
lstrlenA
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
lstrlenW
FlushFileBuffers
GetProcAddress
DeleteFileW
SetFileAttributesW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy
HeapCreate
HeapSize
GetVersionExA
CreateProcessW
GetCurrentProcess
InitializeCriticalSection
OpenProcess
LeaveCriticalSection
TerminateProcess
GetModuleFileNameW
EnterCriticalSection
CreateThread
CreateMutexA
LocalFree
WideCharToMultiByte
MultiByteToWideChar
DosDateTimeToFileTime
SetFilePointer
SystemTimeToFileTime
GetFileType
GetCurrentDirectoryA
WTSGetActiveConsoleSessionId
GetEnvironmentStringsW
QueryPerformanceCounter
FreeEnvironmentStringsW
GetModuleFileNameA
RaiseException
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
EncodePointer
GetStdHandle
DecodePointer
GetModuleHandleW
IsDebuggerPresent
SetUnhandledExceptionFilter
CopyFileW
GetUserGeoID
CreateDirectoryW
GetComputerNameA
SetHandleCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
LCMapStringW
IsProcessorFeaturePresent
RtlUnwind
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetStringTypeW
GetSystemTimeAsFileTime
user32
PostMessageA
GetClientRect
SetWindowLongA
GetWindowLongA
RegisterClassExA
PostQuitMessage
TranslateMessage
UnregisterClassA
CreateWindowExA
DefWindowProcA
DispatchMessageA
MessageBoxW
GetSystemMetrics
UpdateWindow
EnumWindows
ShowWindow
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetMessageA
EnableWindow
advapi32
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegFlushKey
RegOpenKeyA
RegCreateKeyExA
SetSecurityDescriptorSacl
shell32
ord680
SHGetFolderPathW
ole32
OleUninitialize
OleSetContainedObject
CoGetClassObject
OleInitialize
oleaut32
SysAllocString
VariantClear
VariantInit
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_TDS=4FAD9768.exe
- IMPHASH a81730656ca1c2ccf1449f66476dc87b
- SHA256 ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2
- MD5 2fbed8e1453f1cf9c9ac43d642df00fc
- SHA1 22aa6eeb79e95ff26f0775804152041aeb6df46b
- SHA512 88043ca993f9fc81ae9a8da8579274796fde3f8bded78e11419fa06cf41466d671b0c50169645f19fa9e683c0b014d24366b31552f561267f03d0f2214578687
- SSDEEP 1536:HFxpZTK0l7htEAoWt4EsLGtPx00oipJlzL6oMNbzKl+OJL8LeG:HjpZTKk1te/rLGtPC0NFLnY4R1G
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LocalAlloc
GetEnvironmentStringsW
GetStdHandle
CreateMutexA
lstrlenA
GlobalAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupGetLineCountA
msvcrt
_adjust_fdiv
memcpy
_exit
_onexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=29, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
cd2d085998a289134ffaf27fbdcbc8cb_api-ms-win-system-dispex-l1-1-0.dll
- IMPHASH 01d60c50f07df84cdeeb313752cc4354
- SHA256 0b12584302a5a72f467a08046814593ea505fa397785f1012ab973dd961a6c0e
- MD5 cd2d085998a289134ffaf27fbdcbc8cb
- SHA1 e22678fe4bd0b209b14d5ed061ae61bb52e79df1
- SHA512 69c3ea1ff6c140ac4b21051bf0c0f3049750c31c0a1622ffa145daa1285b24678cd02d6bc89f85ecc5416b99ee99f42763a2d4e1d214c1d9d9e4acee834adc93
- SSDEEP 6144:LDOrPcXOQeRKIawC7duJDaD0A9B5+9MRALsfwT4HZQO2f8etm:LqDQiF/Ad+9YzHZeZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4201
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cluster0.pdb
kernel32
LoadResource
SetConsoleOutputCP
OutputDebugStringW
lstrcpynA
GetConsoleFontSize
EnumResourceTypesW
PrepareTape
ConvertDefaultLocale
MoveFileWithProgressA
IsSystemResumeAutomatic
CLSIDScalableBuffer
CanStrip
CommPFXExtensionCtl
DialogDecrementFill
EqualHungABCWidths
NotifyCSpnStream
OutputUninitializeControls
PauseShellChildAttribute
SelectUnmakeMode
Name
.text
Size
116KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
719B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vqCp0w
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.eh_fram
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=1, productName=Unmarked objects,
count=9, id=2, version=7274,
count=13, id=19, version=9049,
count=1, id=6, version=2134,
count=9, productName=Unmarked objects (old),
cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36_not_packed_maybe_useless.exe
- SHA256 cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36
- MD5 16f3a592d1a19d9873134f8e9c6ebbcc
- SHA1 4e1a7a09e393c0d387e4846b4a48bfe273effe43
- SHA512 2b80c9ee5ba51132ab19059bef46d6db6228bea1d250905795f27ffabfffc20ad785aba42129a1d95b6432ea5a4cab226bf23cc7c2f658f7dc40770af93d492c
- SSDEEP 768:uxX2MKhRw7+am7nx3h1OPG0H+l65Fuj0AjmWTbsbIK9QnjVPCxPao1X7tiJ+r/:uFKIqamtRMPJQoh2mqxTnjVPpJG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
41888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\my projects\bbac\output\Release\bbac.pdb
Name
.text
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.mackt
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=96, id=1, productName=Unmarked objects,
count=25, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
cf7382c25a8bf0d904d51063ceb29fb70f630bc9.exe
- IMPHASH e9e3923fa6b5c81cfcfc4413e09333bb
- SHA256 c95fde4a188dbc361f9eff80e9ba9d082ef40f7a16809b5ef4886903f8fc8698
- MD5 8cef8cf2a22f58a16b12b5b0b05552ba
- SHA1 cf7382c25a8bf0d904d51063ceb29fb70f630bc9
- SHA512 86031b49267669987ee4cbe0e267d953c17032428c4ccaac318c3737c2b9a4c0203fa162f8c83a7f1616b73450118e6e5c0a474008130e1681443b3a51171591
- SSDEEP 12288:clxTE2jm56ven1viU+NoAHKor2Bzqbb+0eT9aEZuo:cE2qvGHKorIaK0eMjo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncpy
memcpy
fopen
fseek
fclose
memmove
_CIsqrt
_CIlog
floor
ceil
_CIexp
fabs
malloc
free
strlen
kernel32
GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
Sleep
FreeLibrary
HeapAlloc
HeapFree
CloseHandle
InitializeCriticalSection
ReadFile
GetLastError
LoadLibraryA
GetProcAddress
HeapReAlloc
TlsAlloc
GetVersionExA
GetLogicalDriveStringsA
user32
DestroyIcon
FillRect
gdi32
GetObjectType
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
CreateDIBSection
SelectObject
BitBlt
CreateBitmap
SetPixel
GetStockObject
wsock32
closesocket
WSACleanup
WSAStartup
winmm
mciSendCommandA
Name
.code
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ta
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
src
Size
480KB
Virtual Size
479KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
cgi19-alptsevs-h555.exe_.exe
- IMPHASH 553ef6236c6cb4268814330cd1e93c7d
- SHA256 388cc8da15d0fbee9bb9fb87715c8f2967b1584a12e30b4ea1ebbc27ff3b557b
- MD5 e9b9c39dd91c7fac1ee0b92e018a21bd
- SHA1 1ddcf37b32f90f864b51adba3f4bd3a0f5ea935f
- SHA512 dee5a5da3fe70e5d15f48ba9e8d9204a2de641b91e22a8e3ddb7dfaa1aafd6d943bb21188985bb8d40836fc6e24ee2df9a9d988f5ea8048d30517cd6bf7e3add
- SSDEEP 12288:j3nZMhJ+ubNmz0C4nkspjhPMy7NxkIXGUikyjk0y0xjYfYK4zjibVWidV3BtGN:j3nZqfbkz94h9P1+sbi3j2Bwjifv3BAN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
46467
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
comctl32
InitCommonControlsEx
shlwapi
SHAutoComplete
kernel32
DeleteFileW
DeleteFileA
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetTickCount
WideCharToMultiByte
GlobalAlloc
GetVersionExW
GetFullPathNameA
GetFullPathNameW
MultiByteToWideChar
GetModuleFileNameW
FindResourceW
GetModuleHandleW
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
CompareStringA
ExitProcess
GetLocaleInfoW
SetFileAttributesW
DosDateTimeToFileTime
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
WaitForSingleObject
Sleep
GetExitCodeProcess
GetTempPathW
MoveFileExW
UnmapViewOfFile
MapViewOfFile
GetCommandLineW
CreateFileMappingW
SetEnvironmentVariableW
OpenFileMappingW
GetProcAddress
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
CompareStringW
IsDBCSLeadByte
GetCPInfo
SetCurrentDirectoryW
LoadLibraryW
FreeLibrary
SetFileAttributesA
GetFileAttributesW
GetFileAttributesA
WriteFile
GetStdHandle
ReadFile
CreateFileW
GetCurrentDirectoryW
CreateFileA
GetFileType
SetEndOfFile
SetFilePointer
MoveFileW
SetFileTime
GetCurrentProcess
CloseHandle
SetLastError
GetLastError
GetNumberFormatW
user32
wvsprintfA
wvsprintfW
ReleaseDC
GetDC
SendMessageW
SetDlgItemTextW
SetFocus
EndDialog
DestroyIcon
SendDlgItemMessageW
GetDlgItemTextW
GetClassNameW
DialogBoxParamW
IsWindowVisible
WaitForInputIdle
SetForegroundWindow
GetSysColor
PostMessageW
LoadBitmapW
LoadIconW
CharToOemA
OemToCharA
MapWindowPoints
CreateWindowExW
SetWindowTextW
UpdateWindow
LoadCursorW
RegisterClassExW
SetWindowLongW
GetWindowLongW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
CopyRect
IsWindow
CharToOemBuffW
MessageBoxW
ShowWindow
GetDlgItem
EnableWindow
OemToCharBuffA
CharUpperA
CharToOemBuffA
LoadStringW
SetWindowPos
GetWindowTextW
GetSystemMetrics
GetWindow
CharUpperW
GetWindowRect
FindWindowExW
GetParent
GetClientRect
gdi32
GetDeviceCaps
GetObjectW
CreateCompatibleBitmap
SelectObject
StretchBlt
CreateCompatibleDC
DeleteObject
DeleteDC
comdlg32
GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW
advapi32
RegOpenKeyExW
LookupPrivilegeValueW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
SetFileSecurityW
SetFileSecurityA
OpenProcessToken
AdjustTokenPrivileges
shell32
SHChangeNotify
ShellExecuteExW
SHFileOperationW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
ole32
OleUninitialize
OleInitialize
CoCreateInstance
CreateStreamOnHGlobal
CLSIDFromString
oleaut32
VariantInit
Name
.text
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=176, id=1, productName=Unmarked objects,
count=5, id=149, productName=VS2008 build 21022, version=21022,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
chrst.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a02565ec78fa1221433e720bd57b044938345b8c65a73143bd9ff73529767526
- MD5 c657daf595b5d535ccc757ad837eebe8
- SHA1 894e953e86e54a830a14fac94e57569d184a9c09
- SHA512 21a26bc146dd2a915c17b268b13edc565e9a582d11c1714d89741f4156a880dfe35415d4920a6326d164519f4b28b6371ef9c7bfdb5e19080448bd77b4a20a4b
- SSDEEP 3072:YpcslRnXfFdRIVLdkVz1ZIGWSt8t81U3Uxi1mVB9kx:4XfNSLdkryGd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
135822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Computer\Documents\Visual Studio 2010\Projects\MyV\MyV\obj\x86\Release\chrst.pdb
mscoree
_CorExeMain
Name
.text
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
142B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ci05l2a.exe
- SHA256 94bf77695e893c6c9cd0b69e1081eb00a617ec384c980c127681d010f8aceb71
- MD5 27b4d4c481f97f0a90c420fb106be2a1
- SHA1 35c8fd7176b2f50caf6af597b07d18074a6c8619
- SHA512 8e6d23ec233308c32dfe4373900132b021856082584c94ddc01c31b74c859cdf73cb3b2816fd51a693848b35d248bcdc76212a3b323ccc045dcfc8df59bb31c5
- SSDEEP 3072:Kz23EV9nbulU4sYjoEgwNLu4T4gG1ZJC8VMKsMJ9Bi1YrJ+YPkiKL/vZ6d:o3aJoEgiLuEEJjMaNI1iI6d
- MD5 SHA1 SHA512 SSDEEP
cl.exe
- IMPHASH 31706a369ec92804872975ce580c66c6
- SHA256 b082e82311a6e8416b1823122959ea368316a936aa6ca667c032d300f76effaf
- MD5 748ec019c171f22b8384195742967c51
- SHA1 e3fefcbd3c432ac85d046a7ab27d2b0114ae658a
- SHA512 a2bbef3dacdac5d5cf65f71f97c663b8731e2f2dbd9d923076e3551b68fce33157b961bd4709bfd6ccb1c5c807c453a8bae209538093dfe4c0662fb7e074ddc3
- SSDEEP 6144:6741oQa1cxp/UWD9xgYxY68hX7Ph0ht7LRhU/a:v1uOp8J2Y68hLPhZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7884
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaVarTstGt
ord690
__vbaNextEachAry
_CIcos
_adj_fptan
__vbaStrI4
ord693
__vbaAryMove
__vbaFreeVar
__vbaLineInputStr
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFpCDblR8
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
ord518
__vbaForEachCollAd
__vbaStrCat
__vbaVarCmpNe
__vbaSetSystemError
ord661
ord662
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
ord667
__vbaAryDestruct
__vbaLateMemSt
__vbaExitProc
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaForEachCollVar
ord520
__vbaBoolVarNull
_CIsin
ord631
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord529
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaPutOwner4
__vbaNextEachCollVar
__vbaObjVar
__vbaPrintObj
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
__vbaStrR8
__vbaRedim
EVENT_SINK_Release
__vbaNew
ord600
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
__vbaStrToUnicode
__vbaPrintFile
__vbaDateStr
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord531
ord716
__vbaFPException
ord532
__vbaInStrVar
ord717
__vbaStrVarVal
__vbaUbound
__vbaGetOwner4
__vbaVarCat
ord536
ord645
_CIlog
__vbaFileOpen
__vbaR8Str
__vbaVar2Vec
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord578
ord100
__vbaVarTstNe
__vbaI4Var
__vbaForEachAry
ord689
__vbaLateMemCall
ord612
__vbaStrToAnsi
__vbaVarDup
__vbaVarLateMemCallLd
ord616
__vbaFpI4
ord617
__vbaLateMemCallLd
_CIatan
__vbaAryCopy
__vbaStrMove
ord619
__vbaR8IntI4
ord650
_allmul
_CItan
__vbaNextEachCollAd
ord546
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581
Name
.text
Size
220KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=12, id=9, version=8041,
count=1, id=13, version=8169,
clean.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c926450324f23575ff6e980b70688caa56f584a84f2b447aea78183828099e50
- MD5 d15cfcd6caabb1cd1ebdc352a6ebb39e
- SHA1 e60f23f716f37a7c91ae459fba65e41b4a60f752
- SHA512 c5e3989e8157520036db2937c68bbb603ad58d16217fabbcb4860a7193d43e27d99062f4edcfcf3ab158ed7f0122df8665dd39aa1de53e81b2399aea6de7db57
- SSDEEP 768:W+ry2sgHBHn+Kcv+aEtm0aOL9/rxM/UUk9B:I7gpiyri/UUYB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
coinvault.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a5333438bed6532770f7d34b72439006625a9b38fd91f7659e390530cda18fd
- MD5 b3a7fc445abfba3429094542049063c2
- SHA1 451d2a60192d5a49c13dd4aed19c15448358969d
- SHA512 711d5a9a0fe539dc9e12092d360b008cc469cd387606e5a76c703e98b7e71863256cea4dbabf41b69b5d6bf0a7cebc01f2acd445c8d0e3a841f8dc46bc532908
- SSDEEP 12288:xtMW53Bkb5nG7KC/MIkf74f6Z0PvB5V/EXF:xtJ53m5G7fP+Mi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
520046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
500KB
Virtual Size
499KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
com_loader.exe
- IMPHASH 5f21313fbe26dcd91c5fd3dfe5d4a4b2
- SHA256 eb72bef17b4f62a3cef6e36385cbdd65cf916f36b28d86b37b2990e2fc9e5330
- MD5 7bb58c27b807d0de43de40178ca30154
- SHA1 d3a69a5aa1f49a55eaed6de0686b45dede103b31
- SHA512 538527ca1c5037f4325ceca26b66ee0ef2d293eb29566b6bffa521593fa52e13450a01ba194ca5f574b2fa2d3335f3ab14ce759bf2d3421f746ffee5617a9d32
- SSDEEP 768:TDYGaFFIR9v3PHchAps29+PP+ZkY1DjSzT2MxeRzL3MJV:HdJIAps29uujJjSH25
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10109
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wtsapi32
WTSSetUserConfigA
WTSVirtualChannelClose
WTSVirtualChannelRead
WTSRegisterSessionNotification
WTSSetSessionInformationA
WTSLogoffSession
WTSEnumerateSessionsA
WTSEnumerateServersA
WTSWaitSystemEvent
WTSSendMessageA
WTSCloseServer
WTSOpenServerA
WTSUnRegisterSessionNotification
WTSVirtualChannelPurgeInput
WTSFreeMemory
WTSEnumerateProcessesA
dbnmpntw
ConnectionVer
ConnectionError
ConnectionClose
user32
LoadStringA
SetFocus
GetCursor
wsprintfA
CreateWindowExA
CharToOemA
DrawTextW
LoadCursorA
FindWindowW
PeekMessageW
PostMessageA
IsDialogMessageA
MessageBoxW
kernel32
FindFirstFileA
SearchPathA
CopyFileA
GetOEMCP
HeapFree
FormatMessageA
lstrcpynW
GetProcessHeap
GetLogicalDriveStringsA
CopyFileExW
DeleteFileA
GetGeoInfoW
CreateDirectoryA
GetCurrentDirectoryW
CreateFileA
ReadFile
SetLastError
GetDateFormatA
GetLocaleInfoW
FileTimeToSystemTime
WaitForSingleObjectEx
GetLastError
MapViewOfFile
LoadLibraryA
InterlockedIncrement
CreateWaitableTimerA
GetDriveTypeW
WriteConsoleW
OpenMutexW
DeviceIoControl
QueryDosDeviceA
GetSystemTime
ReleaseMutex
GetProcAddress
GetStartupInfoA
GetFileSize
cmutil
CmMoveMemory
CmFree
shell32
ExtractIconA
ShellAboutA
DuplicateIcon
SHGetDataFromIDListA
SHChangeNotify
DragQueryPoint
StrChrA
FindExecutableA
DllUnregisterServer
SHGetMalloc
SHGetDesktopFolder
ShellMessageBoxA
DllRegisterServer
Name
.text
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=26, productName=Unmarked objects (old),
count=1, id=18, version=8444,
csrss.ex_.exe
- IMPHASH c64a1d6bfad8c05542b811bf6115ab59
- SHA256 d460e5870a252c2827b88fdfc651a033a5d5875770f21a23b476a36e56ad5a8e
- MD5 d1217c81cca33f5fcc4bed6cd948a36b
- SHA1 b1a299b2e29141618fd8ee1eba33f46dcbaa3f0a
- SHA512 bd63a2a187e5fba3691933b3eef02e86a09efd07d18c68dc1e372f9f848655ef4fffd930c5df6cc1f1ec10f66d424595c22866b74aa4d3688998c6c7013b897b
- SSDEEP 24576:zdRpOBhPImfR23aAHRdY2Eq2htqgQdsmGDs2SZ:5R0BtoqAHnvEvhcVGDs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mfc42
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord641
ord609
ord800
ord2514
ord2621
ord1134
ord5265
ord4376
ord4853
ord4998
ord2512
ord1775
ord4407
ord5280
ord4425
ord3597
ord2575
ord6055
ord4078
ord1776
ord4396
ord5241
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord3402
ord4627
ord3574
ord1146
ord1168
ord860
ord540
ord567
ord324
ord2370
ord2302
ord4234
ord4710
ord6334
ord2379
ord2554
ord4486
ord6375
ord4274
ord6052
ord4673
ord1576
msvcrt
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit
_controlfp
_XcptFilter
_exit
srand
_gcvt
rand
__CxxFrameHandler
_setmbcp
exit
kernel32
GetModuleFileNameA
GetTickCount
GetModuleHandleA
GetStartupInfoA
CreateFileA
user32
SetTimer
KillTimer
ScreenToClient
GetCursorPos
InvalidateRect
EnableWindow
LoadIconA
SendMessageA
Name
.text
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
844KB
Virtual Size
843KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=4, version=9782,
count=129, id=1, productName=Unmarked objects,
count=3, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
d.exe
- SHA256 c2f7af050697d7b0140f4ee1ce6c87225e958e6ff4f18867afd842aecbfe87ad
- MD5 1e592556901445106d9b1e779bbe062d
- SHA1 6999e59bd935faf42a977b25a078ce8adfe08dd2
- SHA512 d6f24ac2034a1d876e910b15c97a324468ab2ca70799fd9fc72ade39daac76d4853ca8d1acba89d48525ce2ec5a7d018a9bf3383c6836633b81c32ef8ae331e2
- SSDEEP 3072:CfAHvg0rsef7WSkYvnW4iq9jAfDkt31bkaQaY76E:KWr97WSBW4iq9jArk31Wf76E
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Tepakuzebupy
Burope
WugineFoqyxo
JoJoqyfewi
GazoConabygefo
Name
CODE
Size
1024B
Virtual Size
964B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
171B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.crt
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
181B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
38B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
120KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_Dumped_TDS=4F9911B3.exe
- SHA256 5f60eed8e27867c843387fe7fece3af688586a40c8d3dd2c27647b23cc200fdc
- MD5 5a580ab3f5b3806da853459e9ef7b368
- SHA1 df93c0f0dd694ab49646b539418b67d83eafccb5
- SHA512 91ecd8f00f4cd6c7d199eb365cb7cfa414bcab41b144fe7a5f43529e560201a81284cdb3a3d18d252e2eb4429a67f2db5718eacc8bf1eeb072958c0a4be20a3b
- SSDEEP 1536:tf/YvFSSZtDgN+DrDkDEFtCwbfF89lGL+vpCYC:Z/Yv0SZtDgN+Dr+ErbfF89llpTC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mackt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_TDS=4FA478A6.exe
- IMPHASH eab51c0600845240b281f3cd3aff39ca
- SHA256 d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523
- MD5 c4c129fa72b3c0a6364635e33ee3d9b7
- SHA1 50f622bc092397885d032a26e872c6983c89a4b1
- SHA512 5c17a3c8c3344254858d1401c0309af8ebb23e51717542493b2bf87184e30a914aab6c057a24882a2f376449d36da72c7b6542af475dbb4698c65ea739b41917
- SSDEEP 768:cYC0MRRsJMuQrfJ6J7IIxDcSr1wif7SvK73qUzBA/mbLWpXcjMqJ8ocoNV3T9:cYLMRGMulJxf7EKbqaAqWp0MqJD3T9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8566
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrlenA
GetCurrentProcessId
LocalAlloc
GlobalAlloc
GetPriorityClass
GetEnvironmentStrings
HeapFree
HeapAlloc
GetProcessHeap
GetEnvironmentStringsW
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupGetLineCountA
msvcrt
_adjust_fdiv
memcpy
_onexit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_exit
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=30, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_Dumped_TDS=4FB252FB.exe
- SHA256 cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36
- MD5 16f3a592d1a19d9873134f8e9c6ebbcc
- SHA1 4e1a7a09e393c0d387e4846b4a48bfe273effe43
- SHA512 2b80c9ee5ba51132ab19059bef46d6db6228bea1d250905795f27ffabfffc20ad785aba42129a1d95b6432ea5a4cab226bf23cc7c2f658f7dc40770af93d492c
- SSDEEP 768:uxX2MKhRw7+am7nx3h1OPG0H+l65Fuj0AjmWTbsbIK9QnjVPCxPao1X7tiJ+r/:uFKIqamtRMPJQoh2mqxTnjVPpJG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
41888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\my projects\bbac\output\Release\bbac.pdb
Name
.text
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.mackt
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=96, id=1, productName=Unmarked objects,
count=25, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_TDS=4FB30D08.exe
- IMPHASH 518151b350ef47dd17b5213c5d748a55
- SHA256 d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4
- MD5 327cea8d93ff1094fe1ba9008e8c5657
- SHA1 97574533c1260e6e3bd3008359e38055aba0d203
- SHA512 7904652fa2c81296be80efec5617dd86059a940ef0ee10c45a9673d6d85cf845afaa188385d4dd7643ff37ad61a25c33c14486448c5eb51b55d9ba59158c6357
- SSDEEP 768:mbLjRB9o7troDVMOXsgRha8ZwByuiiCKR0YFeIupRXnzUpiPqDOyktPxEY:k/L9stroDzRhD6yuDR0lIupRnXTboY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GlobalAlloc
lstrlenA
GetStdHandle
CreateMutexA
LocalAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupDecompressOrCopyFileA
msvcrt
_adjust_fdiv
memcpy
_exit
_onexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=28, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
d4439055d2d63e52ffc23c6d24d89194_86e510605f1ee068bdc1ae306312652a__1.dll
- IMPHASH 86e510605f1ee068bdc1ae306312652a
- SHA256 1036c84a003378907560356642bb065caef961f9dbc5c3b2a4954d5cbe7100df
- MD5 d4439055d2d63e52ffc23c6d24d89194
- SHA1 92a35105a3cf19a183ef9ca9e66cb9063fffecf1
- SHA512 f9d77411522444d7924baf6c0933cb3f4ae856c4e5b73990e81b6e2e4e372b309aececc585df3b3306db037612b1fb09516adc0403c28306f37cf3bb2b9f9499
- SSDEEP 3072:OcT8OeFXkldH+kqGq+WZO1Vdeuo5punOreYt2HxOMrR7:/T1Cklt+kqGq+WI1VdeaEefUM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
69163
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InterlockedIncrement
InterlockedDecrement
GetTickCount
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
FreeLibrary
LoadLibraryA
WaitForSingleObject
TerminateThread
Sleep
CreateThread
GetCurrentProcess
VirtualProtect
GlobalAlloc
GlobalFree
GetCurrentThread
SetThreadPriority
GetComputerNameA
GetThreadContext
HeapReAlloc
SetThreadContext
HeapAlloc
HeapFree
Thread32First
HeapDestroy
HeapCreate
Thread32Next
OpenThread
CreateToolhelp32Snapshot
GetCurrentProcessId
SuspendThread
ResumeThread
VirtualQuery
VirtualFree
VirtualAlloc
GetSystemInfo
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
SetLastError
RaiseException
GetCPInfo
GetACP
GetOEMCP
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetLocaleInfoA
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
GetConsoleCP
GetConsoleMode
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
LocalFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GetFileTime
CreateMutexA
GetLastError
GetWindowsDirectoryA
TlsGetValue
CreateFileA
user32
UpdateWindow
SystemParametersInfoA
ShowWindow
DefWindowProcA
CreateWindowExA
GetWindowLongA
SetWindowLongA
LoadIconA
KillTimer
PostQuitMessage
LoadCursorA
TranslateMessage
DestroyWindow
GetSystemMetrics
GetUserObjectInformationA
GetThreadDesktop
CreateDesktopA
CloseDesktop
SetThreadDesktop
GetClientRect
CopyRect
RegisterClassExA
GetMessageA
SendMessageA
GetWindow
DispatchMessageA
ChildWindowFromPointEx
GetAncestor
PostMessageA
MapWindowPoints
PeekMessageA
GetClassNameA
GetWindowRect
PtInRect
ClientToScreen
ScreenToClient
SetTimer
advapi32
RegOpenKeyExA
RegCloseKey
RegCreateKeyW
RegCreateKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
psapi
GetModuleInformation
ole32
CoGetClassObject
CoUninitialize
OleSetContainedObject
OleUninitialize
CoTaskMemAlloc
CoInitialize
OleInitialize
CoCreateInstance
OleCreate
CoDisconnectObject
oleaut32
SysFreeString
VariantInit
SysAllocString
VariantClear
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
wininet
InternetCrackUrlA
urlmon
UrlMkSetSessionOption
URLOpenPullStreamA
oleacc
AccessibleObjectFromWindow
WindowFromAccessibleObject
ws2_32
inet_addr
inet_ntoa
imm32
ImmDisableIME
Name
.text
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=25, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=185, id=1, productName=Unmarked objects,
count=2, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=25, id=125, productName=VS2005 build 50727, version=50727,
count=47, id=110, productName=VS2005 build 50727, version=50727,
count=118, id=109, productName=VS2005 build 50727, version=50727,
count=33, id=114, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
d54d2a216e637bcd36e5217cfba98896.exe
- SHA256 d620778dbbcf11e3a293aeaaebac7b6a9a02e7d8790ca5ffa59bda1e9b9632f4
- MD5 d54d2a216e637bcd36e5217cfba98896
- SHA1 41e846d00379083a988db6028890233b4d74e8f4
- SHA512 b92fdfd0ec1cbbfc4145465b88efe75223fb4df2df1d77122527175d211db0d572449726dd9ea8579f7cb4c5dc9df467f5980cb7344b7e931e85a34207f500b3
- SSDEEP 6144:XZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6x2UjYe0yIJA94agq/L9j:pANwRo+mv8QD4+0V16x2Y0yIu4agq/Lt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
152680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5.exe
- SHA256 d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5
- MD5 187f7d5ae06b386581f5f177340ca2b7
- SHA1 0f25cefa85a0822a08ad23caca24a622fbf4aef0
- SHA512 682d127bf1ffc42cc475f119a010eeb12460ca2e9a8fbc8a0207e3ee8912ed0c8a0fcea374c83e91f494cba2bc378173f1833b3b4f5913b622279da2c0f62248
- SSDEEP 49152:BATnMeAX+Iexb7peltHmeOCbJOIOUCZKw:BeMtU7pMHVZJOzTB
- MD5 SHA1 SHA512 SSDEEP
com.tartiap.lnnhdatu
com.tartiap.lnnhdatu.dilmoeu
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.DISABLE_KEYGUARD
com.android.browser.permission.READ_HISTORY_BOOKMARKS
com.sec.android.app.sbrowser.operatorbookmarks.permission.READ_HISTORY_BOOKMARKS
android.permission.PROCESS_OUTGOING_CALLS
android.permission.PROCESS_INCOMING_CALLS
android.permission.RESTART_PACKAGES
android.permission.RECEIVE_SMS
android.permission.CAMERA
android.permission.GET_TASKS
android.permission.GET_ACCOUNTS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.WRITE_SETTINGS
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.READ_CONTACTS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.READ_PHONE_STATE
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
com.tartiap.lnnhdatu.dilmoeu
android.intent.action.MAIN
com.tartiap.lnnhdatu.eisosia
android.intent.action.VIEW
com.dafmhc.rtgktino.nhiainrm
com.pmgiya.nestnu.gquulaw
com.tartiap.lnnhdatu.rnasdvs
android.system.operate
com.pmgiya.nestnu.edladeee
android.system.registat
com.pmgiya.nestnu.edicryj
com.dafmhc.rtgktino.snioiao
com.dafmhc.rtgktino.nneaen
android.net.conn.CONNECTIVITY_CHANGE
android.system.cache
com.dafmhc.rtgktino.onlarse
android.intent.action.REBOOT
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.REBOOT
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.pmgiya.nestnu.eigulni
android.app.action.ACTION_DEVICE_ADMIN_DISABLE_REQUESTED
android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.DEVICE_ADMIN_DISABLED
com.dafmhc.rtgktino.nsatpnro
d6c32b0146f219bdcb5cf524ea9e0047d9b9bd0fd7c395d5b11cbc4c3298824d.exe
- SHA256 d6c32b0146f219bdcb5cf524ea9e0047d9b9bd0fd7c395d5b11cbc4c3298824d
- MD5 3751a4a1f68718405518d107a8bcc563
- SHA1 c58fe7477c0a639e64bcf1a49df79dee58961a34
- SHA512 8fa33e5682069baf48c0e85375a4151356e5917d63fbe62642c1dc9f33ce77881a359c2300e2d221bce297fbe7349a66b55cc47ff8502125b2a44c23d59e8dfd
- SSDEEP 6144:ZcQu7L20QOPNMNYKEdf7Q0chT7WbK1xb5a:S20Q1YKMfE06ja
- MD5 SHA1 SHA512 SSDEEP
Transazione.Pdf______________________________________________________________.exe
- IMPHASH 380e5390f65e340268c2e7706d44415e
- SHA256 89e71eb0a6403725d2f95cb9e6506b8b139a6948a61dc1c5cfedf18648241ec4
- MD5 93cbe4ed3d46abe732a124a41e7147a2
- SHA1 94a24be60d90479ce27f7787a86678472aabdc6e
- SHA512 8f46af90d8a2d78da003a8a395fd7f74cc235595238ee3a3e4d87fee2aa4c8abf6ece403bb3726122d3825437f5d079ea1f8d6b275153bb76b3b0d75c243ef09
- SSDEEP 6144:XOOxeLzWoeNqagVRUvOWcTwlOcTeP8uENXIEQSdO8c/AVxYflxiW:txeHWoA/Wr0lfQ8BfLkIVxYfrd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
13960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleW
GetTickCount
GetModuleFileNameW
IsDebuggerPresent
GetCPInfo
VirtualQuery
CreateFileA
CloseHandle
HeapSize
WriteConsoleW
GetConsoleOutputCP
GetModuleHandleA
GetCommandLineW
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteConsoleA
RaiseException
user32
GetWindowRect
IsZoomed
GetForegroundWindow
GetWindowLongW
GetDesktopWindow
GetCursor
advapi32
GetUserNameA
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
366KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=28, id=132, productName=VS2008 build 21022, version=21022,
count=26, id=149, productName=VS2008 build 21022, version=21022,
count=116, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=106, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
d889734783273b7158deeae6cf804a6be99c3a5353d94225a4dbe92caf3a3d48.exe
- SHA256 d889734783273b7158deeae6cf804a6be99c3a5353d94225a4dbe92caf3a3d48
- MD5 71375aa4ad00f0fb209c8f22e0090715
- SHA1 d7b0255d7d98c33a30fe71543ec98d802c2a2dd7
- SHA512 82281ebc86c9cb70f56bf1f6da625397e8d74f504c38f893a82b780b690796b0c107ba15854b0650d71546a45e98cb9b1b85ff50ec8e34dd0d1658babb310c1e
- SSDEEP 6144:hUACNIqeT/ibcxeejQB/VlTpMf5wh4rNJPAyPmzwl+jJJxV0N9XN/:h/CyToGgjEwh+DPAKBgCNhN/
- MD5 SHA1 SHA512 SSDEEP
daaa72f48bea498c5ac7ce9bc315e585ff11dad04d1eeb0d1b0ce33a28bedf2d.exe
- IMPHASH 7511ea923b51c6e2824a2cc82310820e
- SHA256 daaa72f48bea498c5ac7ce9bc315e585ff11dad04d1eeb0d1b0ce33a28bedf2d
- MD5 82cdd59192afa50e4dbe1b16d6254ad7
- SHA1 7392f0d93fd8e604431adedf00b237ebbf6a3881
- SHA512 a5e2e99b3725c4e860caee27ed2a2dcb35a3f3fe3abc06b9412b209e950cd518049e53831ec3c9adf74b0d4815e271dbf0832db70f9a9435ff7a6ad61121cb2a
- SSDEEP 6144:PrjxuKuDjTlGWu5kOqaJ049Od6bKaZ3GS4Ur3jC/ZdXtrOsEJDQqEGQLzXQ4T:ZyDjxGWerJ0eWQ443u/tabE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6384
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ReleaseSemaphore
RtlUnwind
ScrollConsoleScreenBufferW
SetEvent
SetLastError
SetMailslotInfo
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
QueryPerformanceCounter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
lstrcatA
lstrcmpiA
lstrcpyA
lstrcpynA
QueryInformationJobObject
OpenMutexA
OpenFile
MultiByteToWideChar
LockFileEx
LockFile
LocalFree
LocalAlloc
LoadResource
LoadLibraryExA
LeaveCriticalSection
IsValidLanguageGroup
IsDBCSLeadByte
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSection
HeapUnlock
HeapSize
HeapSetInformation
HeapFree
HeapAlloc
GlobalUnWire
GlobalAlloc
GlobalDeleteAtom
GetWriteWatch
GetVersionExW
GetVersionExA
GetUserDefaultUILanguage
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetStringTypeA
GetStartupInfoA
GetProcessHeap
GetPriorityClass
GetModuleFileNameW
GetModuleFileNameA
GetLastError
GetFullPathNameA
GetDiskFreeSpaceA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameW
GetComputerNameA
FreeResource
FreeLibraryAndExitThread
FreeLibrary
FindResourceA
FindFirstFileExW
FatalExit
EraseTape
EnumDateFormatsExW
EnterCriticalSection
DnsHostnameToComputerNameW
DeleteCriticalSection
DebugBreak
CreateThread
CreateSemaphoreA
CreateFileMappingA
CreateEventW
CreateEventA
CloseHandle
CancelDeviceWakeupRequest
BindIoCompletionCallback
BackupWrite
BackupSeek
BackupRead
GetModuleHandleW
GetCommandLineA
GetFileAttributesA
GetDriveTypeA
lstrlenA
GetVersion
LoadLibraryA
GetProcAddress
VirtualAlloc
GetModuleHandleA
GetCommandLineW
lstrlenW
LoadLibraryW
UnhandledExceptionFilter
user32
UpdateLayeredWindow
UnhookWindowsHookEx
UnhookWindowsHook
SwitchDesktop
SetWindowLongA
SetSystemCursor
SetShellWindow
SetMenuItemBitmaps
ReleaseDC
RegisterWindowMessageA
RegisterClassA
RedrawWindow
PostThreadMessageA
PostQuitMessage
PostMessageA
OffsetRect
MsgWaitForMultipleObjects
MessageBoxIndirectA
IsMenu
IsCharAlphaW
InsertMenuA
InSendMessageEx
GetWindowWord
GetWindowTextLengthW
GetWindowModuleFileNameA
GetWindowLongA
GetTabbedTextExtentA
GetSubMenu
GetMonitorInfoW
GetMessagePos
GetMessageA
GetMenu
GetInputState
GetDoubleClickTime
GetClassInfoW
GetCapture
EnumDisplaySettingsW
EnumDisplayDevicesW
DrawFocusRect
DispatchMessageA
DialogBoxParamW
DefWindowProcA
DefDlgProcW
DdeGetData
DdeFreeDataHandle
DdeConnectList
ClientToScreen
ChildWindowFromPoint
CheckRadioButton
CharPrevA
CallNextHookEx
AppendMenuA
GetKeyState
CharNextW
UpdateWindow
GetSysColor
CharLowerW
CharLowerA
LoadIconW
GetDC
IsWindow
GetDlgItem
CharUpperW
CharNextA
DestroyWindow
CharUpperA
GetParent
LoadBitmapW
IsWindowVisible
GetSystemMetrics
CreateWindowExA
gdi32
SetViewportOrgEx
SetICMMode
StretchDIBits
PolyTextOutA
PlayMetaFile
GetTextFaceW
GetTextFaceA
GetOutlineTextMetricsW
GetLayout
GetFontData
GetDIBits
GetColorSpace
GdiSetAttrs
GdiIsMetaFileDC
GdiInitializeLanguagePack
GdiInitSpool
GdiEntry9
GdiEntry7
GdiEntry13
GdiEntry10
GdiConvertEnhMetaFile
GdiAddGlsRecord
ExcludeClipRect
EnumFontFamiliesExA
EnumEnhMetaFile
EngTransparentBlt
EngPaint
EngComputeGlyphSet
CreatePenIndirect
SaveDC
CreateCompatibleDC
AddFontResourceW
SetTextAlign
CreateMetaFileA
SetBkMode
GetEnhMetaFileA
GetEnhMetaFileW
SetTextColor
SelectObject
AbortPath
AddFontMemResourceEx
Arc
StartFormPage
CreateICW
advapi32
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RegSetValueExW
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
OpenProcessToken
MakeSelfRelativeSD
MakeAbsoluteSD
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetLengthSid
GetAclInformation
GetAce
FreeSid
EqualSid
DeleteAce
AllocateAndInitializeSid
AddAce
AddAccessDeniedAce
AddAccessAllowedAce
RegQueryValueExW
SetSecurityDescriptorOwner
ole32
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoSuspendClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoInitializeEx
CoInitialize
CoCreateInstance
CoCreateGuid
msvcrt
_onexit
wcsspn
wcsrchr
wcsncmp
wcscspn
wcschr
towupper
swscanf
strchr
sscanf
realloc
memset
_XcptFilter
__CxxFrameHandler
__dllonexit
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_acmdln
_adjust_fdiv
_amsg_exit
_beginthreadex
_cexit
_controlfp
_exit
_initterm
_ismbblead
_lock
_purecall
_stricmp
_strnicmp
_ultow
_unlock
_vsnprintf
_vsnwprintf
_wcsicmp
_wcsnicmp
_wtoi
exit
free
iswalpha
iswascii
iswcntrl
iswdigit
malloc
memcpy
Name
.text
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gt1
Size
556KB
Virtual Size
555KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gt2
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gt3
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ggg
Size
91KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=50, id=19, version=8078,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=274, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 build 21022, version=21022,
count=5, productName=Unmarked objects (old),
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
ddbf1840bf626da19d8f3467fe9e20e2.exe
- IMPHASH c46fc6dad3ad830f98729fc8700f4924
- SHA256 85113774d887cf194b7bfbcc8b44f0904a49a19b9c4cf304d11a4b73944996a7
- MD5 ddbf1840bf626da19d8f3467fe9e20e2
- SHA1 e56e267b688418c372ce088d09c027338bcede3e
- SHA512 5fa35c8e132ae631a280e5ab3a3fae79e6bd5327e969f52ebd5cd57acd244b72860221c70099f7f824dcb5c63d287f1fac1e31525c090bf10bcc3bb26b5d50a2
- SSDEEP 3072:MtmG0J6qaFw9mIxlCxkwCQ5fdWw8DKCegdMf0x+bwAv7M87T0M5g9S3Y:Smd0qqaAxlN8D9egmFbwAV7T0Mo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10107
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetConsoleCtrlHandler
GetHandleInformation
GetCurrentProcess
SetProcessAffinityMask
VirtualAlloc
GetSystemTimes
GetProcessId
SetComputerNameExW
DuplicateHandle
OpenProcess
GetLastError
TerminateThread
GlobalAlloc
CloseHandle
LoadLibraryW
AddAtomA
GetModuleHandleW
lstrcpyW
SetProcessWorkingSetSize
GetTickCount
GetDriveTypeW
DecodePointer
EncodePointer
WriteConsoleW
GetConsoleCP
FlushFileBuffers
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RaiseException
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
ReadFile
GetConsoleMode
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
SetFilePointerEx
HeapSize
CreateFileW
user32
PostMessageW
CopyImage
SetScrollRange
BeginPaint
ShowScrollBar
Name
.text
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=125, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=259, version=24123,
count=18, id=260, version=24123,
count=38, id=261, version=24123,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=1, productName=Unmarked objects,
count=1, id=24197, version=7130,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=56207, version=52101,
de882c049be133a950b6917562bb2313_583a76e23c1998307d702709dadbe103__3.dll
- IMPHASH 583a76e23c1998307d702709dadbe103
- SHA256 e53610a977b65c01b275e37aefad7884368dfe00b50750e35b6c8c87556a2c06
- MD5 de882c049be133a950b6917562bb2313
- SHA1 93e9e42eba18e83811b4e9858be5cd09b9c50e5d
- SHA512 a5915f0247627f3556acea9743d2bfa7f9b4c6d047f4fa754684bd973f8926fdd50d52572d8c24cf33bc771870b84950c27ee0ba9dc9eec2f2738f4f3374e271
- SSDEEP 12288:amxpNJkdqblBAEBJ05jP5Fspq7EuVvCxcgOmKVEPILAJtARBvq8IqpwNBcLRm8QL:zxrJkdqblBAEBQP5qQbVvCNOmKVE5/A8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
446371
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryExW
ExpandEnvironmentStringsW
FindFirstFileW
FindClose
FindNextFileW
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
InterlockedCompareExchange
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
FlushFileBuffers
GetTempPathW
HeapSize
LockFileEx
GetDiskFreeSpaceW
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
GetThreadContext
SetThreadContext
Thread32First
Thread32Next
OpenThread
VirtualProtect
GetCurrentThreadId
DeleteCriticalSection
ResumeThread
VirtualQuery
VirtualFree
VirtualAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RaiseException
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
GetLocaleInfoW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetCurrentDirectoryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
InterlockedExchange
GetTimeZoneInformation
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetModuleHandleA
CreateToolhelp32Snapshot
Process32Next
EnterCriticalSection
GlobalUnlock
LeaveCriticalSection
InitializeCriticalSection
GlobalLock
Process32First
GetPrivateProfileStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetEnvironmentVariableW
GetVersion
MultiByteToWideChar
WideCharToMultiByte
LocalFree
CreateThread
CloseHandle
GetLastError
TerminateThread
SuspendThread
WaitForSingleObject
user32
IsWindow
OpenClipboard
UnhookWindowsHookEx
SendMessageW
GetWindowThreadProcessId
ToUnicodeEx
OemToCharA
GetMessageA
SetTimer
PostThreadMessageA
EnumChildWindows
SetWindowsHookExA
CloseClipboard
GetKeyState
CallNextHookEx
DispatchMessageA
GetForegroundWindow
GetClassNameW
GetWindowTextW
GetClipboardData
GetKeyboardLayout
GetGUIThreadInfo
TranslateMessage
KillTimer
advapi32
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptDestroyKey
CryptDecrypt
CryptGetHashParam
CryptAcquireContextA
RegOpenKeyExA
CryptCreateHash
RegEnumValueA
RegEnumValueW
CryptDestroyHash
RegCloseKey
CryptHashData
RegQueryValueExW
RegQueryInfoKeyA
RegOpenKeyExW
RegEnumKeyExW
CryptDeriveKey
CryptSetKeyParam
shell32
SHGetFolderPathW
ole32
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
SysFreeString
VariantInit
VariantClear
wininet
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
crypt32
CryptUnprotectData
oleacc
AccessibleObjectFromWindow
Name
.text
Size
541KB
Virtual Size
540KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=218, id=1, productName=Unmarked objects,
count=11, id=126, version=50327,
count=75, id=110, productName=VS2005 build 50727, version=50727,
count=30, id=125, productName=VS2005 build 50727, version=50727,
count=168, id=109, productName=VS2005 build 50727, version=50727,
count=56, id=114, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
decrypt.exe
- SHA256 491333504219247276258b0691a79e4ccfbc4162999f9f372512c337418e757e
- MD5 cde1a96c7d1fc4fd04d4f076b936e9a0
- SHA1 76cab15be34a942de6f878ec11ce5100f10e6855
- SHA512 782d4e602422a67539116d57e82a2362540aa52f28e1e2ce5ab238b3733b60926d9e540888bee9b558c76f7f53b9ba6f98d0dd6d7c5c8dc47354fe07a17da615
- SSDEEP 1536:v5gwm1brk4bXgdDMyR6u7YHwpv7EBFG36CBIvRo28aPduysjCPaAmy:nww9Mg7YHGvKG36
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
73376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1004B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=223, version=20806,
count=15, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
decrypted.ex_.exe
- SHA256 ea407f99a8e150b84bbfb47f1c22e2ef804333fbe4315ada0aab919ae2d2ec7e
- MD5 b374304c7603f7ea36112909fb3b8991
- SHA1 222e85c995558ab0bd14e4a840a3788fe63d380f
- SHA512 42ab474f6bc309bf3d2c2fb636804c293f3fc384304d7dfbdfd4e388cba6dbac0934295030e09c6656b69b1c8a9aac3c3d70e7c2e2c2cdc9eb2c0bfc0ede2700
- SSDEEP 12288:njQfF4Ibclmp6S44rgpEEt5p69QFCkohJW:nsuRlmpl440ttGi8hE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
348948
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
337KB
Virtual Size
336KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
91KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ