Batch_5.zip
- SHA256 51b3773145652b5d559396a08e1282a3a1d92d4df473f774d61791386fca0598
Overview
overview
10Static
static
6AES-NI.exe
windows7-x64
7AES-NI.exe
windows10-2004-x64
7Abrechnung.exe
windows7-x64
8Abrechnung.exe
windows10-2004-x64
8Box (2).exe
windows7-x64
3Box (2).exe
windows10-2004-x64
3Box.exe
windows7-x64
3Box.exe
windows10-2004-x64
3a66dde2298...43.exe
windows7-x64
9a66dde2298...43.exe
windows10-2004-x64
9a7768f4973...e0.exe
windows7-x64
10a7768f4973...e0.exe
windows10-2004-x64
10aa7ff3bc28...1e.exe
windows7-x64
7aa7ff3bc28...1e.exe
windows10-2004-x64
7aace43af8d...99.exe
windows7-x64
8aace43af8d...99.exe
windows10-2004-x64
8ad3cc219a8...ws.dll
windows7-x64
10ad3cc219a8...ws.dll
windows10-2004-x64
10aee03626b8...b1.exe
windows7-x64
6aee03626b8...b1.exe
windows10-2004-x64
6afd3b729cf...2e.exe
windows7-x64
10afd3b729cf...2e.exe
windows10-2004-x64
10b56c4569d6...ss.exe
windows7-x64
3b56c4569d6...ss.exe
windows10-2004-x64
30.84762379...67.exe
windows7-x64
70.84762379...67.exe
windows10-2004-x64
3zsgblrbrum...ke.exe
windows7-x64
7zsgblrbrum...ke.exe
windows10-2004-x64
3b7d9f11c16...b0.exe
windows7-x64
5b7d9f11c16...b0.exe
windows10-2004-x64
5b8f60c64c7...af.exe
windows7-x64
10b8f60c64c7...af.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
AES-NI.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
AES-NI.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
Abrechnung.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
Abrechnung.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
Box (2).exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Box (2).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Box.exe
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Box.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral10
Sample
a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
a7768f4973ad7cf8217212a4d12dbae0.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral12
Sample
a7768f4973ad7cf8217212a4d12dbae0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral13
Sample
aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
aace43af8d0932a7b01c5b8fb71c8199.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
aace43af8d0932a7b01c5b8fb71c8199.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral18
Sample
ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral19
Sample
aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral20
Sample
aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
Resource
win7-20241010-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral22
Sample
afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral23
Sample
b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe
Resource
win7-20241023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
0.8476237917779167.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
0.8476237917779167.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
zsgblrbrumorwxfizuke.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
zsgblrbrumorwxfizuke.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral31
Sample
b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral32
Sample
b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target Batch_5.zip
- Size 10.7MB
- Sample241122-dz7tmazlan
- SHA256 51b3773145652b5d559396a08e1282a3a1d92d4df473f774d61791386fca0598
- MD5 840ef805274a90a6354a0f5d1c6f05f1
- SHA1 856f756302fb8559edac0804324c6fec97382d84
- SHA512 a1dbedebf1dc9007ea6781116d3b92e052d5110b34bcc83e87d7ba8736d1b9353bfaeb88de6b53f11ea661ef60231ae2280a4a7e54c4c3bd06cbe7f1aa864904
- SSDEEP 196608:1iAo5dAtwAQT+rrxa/kHpuI7c/hDU9EPh3VkXI599o9kDD8xCO:1jCAtwAy+rrakDcpDU9uFNgaDQCO
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Requests dangerous framework permissions 7 IoCs
description ioc Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Required to be able to access the camera device. android.permission.CAMERA - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/a7768f4973ad7cf8217212a4d12dbae0.exe upx static1/unpack001/b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe upx - Unsigned PE 32 IoCs
Checks for missing Authenticode signature.
resource unpack001/AES-NI.exe unpack001/Abrechnung.exe unpack001/Box (2).exe unpack001/Box.exe unpack001/a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe unpack001/a7768f4973ad7cf8217212a4d12dbae0.exe unpack002/out.upx unpack001/aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe unpack001/aace43af8d0932a7b01c5b8fb71c8199.exe unpack001/ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.exe unpack001/aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe unpack001/afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe unpack001/b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe unpack003/0.8476237917779167.exe unpack003/zsgblrbrumorwxfizuke.exe unpack001/b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe unpack004/out.upx unpack001/b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe unpack005/Saldo.Pdf______________________________________________________________.exe unpack006/Transazione.Pdf______________________________________________________________.exe unpack001/bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe unpack001/be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe unpack001/be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_TDS=4F90A68A.exe unpack001/be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe unpack001/bfb8f7f6cbe24330a310e5c7cbe99ed4_api-ms-win-system-wer-l1-1-0.dll unpack001/bldjad.ex1.exe unpack001/bldjad.exe unpack001/bldjad2.exe unpack001/c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0.exe unpack001/c36c46f4de045ef332decc006694db6e.exe unpack001/c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704.exe unpack001/c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
File Explorer
-
Batch_5.zip.zip 10.7MB
-
AES-NI.exe.exe 999KB
-
Abrechnung.exe.exe 103KB
-
Box (2).exe.exe 438KB
-
Box.exe.exe 440KB
-
a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe.exe 212KB
-
a7768f4973ad7cf8217212a4d12dbae0.exe.exe 380KB
-
out.upx.exe 634KB
-
aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe.exe 550KB
-
aace43af8d0932a7b01c5b8fb71c8199.exe.exe 2.7MB
-
ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.exe.dll 216KB
-
aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe.exe 218KB
-
afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe.exe 164KB
-
b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe.exe 53KB
-
b7989d9eacb5a8b224fd183f6ba65e4e6bd30a4f0e4e1a299f0d2b63dcb56730_Archive_useless.exe.zip 110KB
-
0.8476237917779167.exe.exe 80KB
-
zsgblrbrumorwxfizuke.exe.exe 80KB
-
b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe.exe 518KB
-
out.upx.exe 1.3MB
-
b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe.exe 33KB
-
bb0e8d9ba927076fbe076960ee7c3b31afa9086583b7358c748d78a55b044a38.exe.zip 284KB
-
Saldo.Pdf______________________________________________________________.exe.exe 446KB
-
bb89efd602f3ddae8dc8c804053c5800c6628dbc7073c46bb3d268261130ba59.exe.zip 282KB
-
Transazione.Pdf______________________________________________________________.exe.exe 443KB
-
bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe.exe 791KB
-
bd2d4d43009623941f49554f5932188154fc9d16d820e00db1281d057468b017.exe.vbs 54KB
-
be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe.exe 116KB
-
be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_TDS=4F90A68A.exe.exe 59KB
-
be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe.exe 9KB
-
bfb8f7f6cbe24330a310e5c7cbe99ed4_api-ms-win-system-wer-l1-1-0.dll.dll 440KB
-
bldjad.ex1.exe.exe 132KB
-
bldjad.exe.exe 132KB
-
bldjad2.exe.exe 179KB
-
c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0.exe.exe 26KB
-
c325092750dd55898c47be7ec8a7622c3bf8d1a79c40b160ef7901c2ef18f5db.exe.apk 1.6MB
-
c36c46f4de045ef332decc006694db6e.exe.exe 137KB
-
c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704.exe.exe 56KB
-
c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe.exe 2.4MB
-
c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe.exe 1.5MB
AES-NI.exe
- SHA256 4142ff4667f5b9986888bdcb2a727db6a767f78fe1d5d4ae3346365a1d70eb76
- MD5 83e824c998f321a9179efc5c2cd0a118
- SHA1 16b84004778505afbcc1032d1325c9bed8679b79
- SHA512 d1c9fdb653d6b028c16a9d82895b7f03b6f96aecc802ab5104d6a762091e71502e407feea3d3d64f19b9f7c2888b1fb2b1dd5f2909b6e29414d4e4a78b56917b
- SSDEEP 24576:xMhc8sFdkS6BEeL8xYSCy3vIyzlueaBLxGLJe3:Ghc8sFB6WeIYSPAyUHxGLJe3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
59520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
755KB
Virtual Size
760KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, productName=Unmarked objects (old),
count=1, id=262, version=23917,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=261, version=24723,
count=2, id=261, productName=VS2017 v15.0 build 25017, version=25017,
count=38, id=265, version=25017,
count=1, id=255, productName=VS2017 v15.0 build 25017, version=25017,
count=1, id=258, productName=VS2017 v15.0 build 25017, version=25017,
Abrechnung.exe
- SHA256 7d9fc496bc0ade736bf75e05564e9c93167362ef18450d75222deef0664f9ed5
- MD5 81ff324d2023d8ecb98a127b87d51450
- SHA1 acd24c80f6a02f7fe7a388a6779ea49be64674bc
- SHA512 38b17683e835e7259a6972d0f920f9ac7f5823591962c624aa795c39c3213d0735bacd76c72b7255be1cefeb9c298ffc31266513f088684969e5e18ad4e0a139
- SSDEEP 1536:o7ZrIoIlP/A765noAXMoiCQ/5NSDy+Ud1IE9vpFARgHsjoCje6fLCy:odIp/A0noAcoiCQ/5NS6ERnECnfLCy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
90104
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Box (2).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02
- MD5 1bb4dd43a8aebc8f3b53acd05e31d5b5
- SHA1 54cd1a4a505b301df636903b2293d995d560887e
- SHA512 94c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce
- SSDEEP 3072:rE+rnVvKX8/tmssEDUbPwBIK6xDq3bnBZvG1BpTU41zjhkkxbNWWmZ:ImVa8/tmswUB36G9ZvGZQ49jRF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
454622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\Amon You\Box\Box\obj\Debug\Box.pdb
mscoree
_CorExeMain
Name
.text
Size
436KB
Virtual Size
435KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Box.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 63a6c3864b0a51c790d8d0312137995eb16710178aaaebfe34fa5e57caff9b36
- MD5 698746928e12831d6982b4e260a9da3a
- SHA1 c87945b0f3f19d3fa07f64b5454f588f568a94e7
- SHA512 8680e690337afa911471680aeb0ea6242e7cf68d83043e83b91bd6ffbe0af1af8aac140ecec8958ac6831a4b9f8401ac086e8322d6638144e5501df949594ea0
- SSDEEP 3072:LE+rnVvKX8/tmssEDUbPwBIK6xDq3bnBZvG1BpTU41zjhkkxbNWOc:omVa8/tmswUB36G9ZvGZQ49jR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
456062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\Amon You\Box\Box\obj\Debug\Box.pdb
mscoree
_CorExeMain
Name
.text
Size
437KB
Virtual Size
437KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe
- IMPHASH 950df57a59e3f593262bcaf10cadc60e
- SHA256 a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43
- MD5 c697914b3e3c115391e5a32e6d8d3a98
- SHA1 b61335cc60ff37680e82c7245ec268d206fc21e2
- SHA512 dbdd230a9829eeae3cbb7ba7cead7b378661275ca3a97bef7c4d60a7c8a5a475120bda551c2e2d81e69f9cc4f0dc798f9160d2e94d11f1ed3cc9cdf4752ae35b
- SSDEEP 3072:HTS1pU/dvuuCtCxzxXXQu+pbSCu9P+5qd/o1x3wPWnK:HTeu/Zat6gH9un0ePW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
44506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ntdll
RtlUnwind
NtClose
kernel32
GetProcessTimes
GetCurrentThreadId
GetCurrentProcessId
GetThreadTimes
LoadLibraryA
HeapReAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
InterlockedCompareExchange
HeapDestroy
HeapCreate
HeapSize
MultiByteToWideChar
SetUnhandledExceptionFilter
GetLastError
GetModuleHandleW
GetProcAddress
LocalFree
GetNativeSystemInfo
GetSystemTimeAsFileTime
GetVersionExW
GetThreadContext
SetThreadContext
CreateProcessW
VirtualFreeEx
GetProcessHeap
TerminateProcess
GetModuleFileNameW
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
ResumeThread
CreateThread
CreateMutexW
InitializeCriticalSection
LeaveCriticalSection
OpenMutexW
EnterCriticalSection
DeleteCriticalSection
Sleep
WTSGetActiveConsoleSessionId
QueryPerformanceCounter
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetCurrentThread
GetTickCount
GetCurrentProcess
LCMapStringW
GetStringTypeW
LoadLibraryW
IsProcessorFeaturePresent
SetLastError
TlsFree
DecodePointer
TlsSetValue
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
user32
GetKBCodePage
GetDesktopWindow
GetCapture
GetClipboardOwner
GetShellWindow
GetOpenClipboardWindow
GetFocus
GetActiveWindow
GetForegroundWindow
advapi32
RegCloseKey
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
shell32
ord680
ShellExecuteExW
SHGetFolderPathW
ole32
CoInitializeEx
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=14, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=68, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=4, productName=Unmarked objects (old),
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=138, id=1, productName=Unmarked objects,
count=82, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
a7768f4973ad7cf8217212a4d12dbae0.exe
- SHA256 c8ea293b1ad5343dde79c6e095c134e4100fdaf47c84eac5e3012eae0b0125a2
- MD5 a7768f4973ad7cf8217212a4d12dbae0
- SHA1 143c52e5bf3978c7b1a544ccc9405afd17d77f55
- SHA512 058cc6690f9910ead6441f7128f85cb6669f04a7a949bf0b464b42d7813695cf77f7fff539b742a829464cb1ad41ca0682df120e008095b9739e561f488201d5
- SSDEEP 6144:Uzv+kSZBbdH19ex4T02J4fqz22tvymTiB62iKnWKKmDTcNwjreOwIbN8CCg4mnw8:UzcRD02J4Sq2vHGB67KWKKmDzrCg44w8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
757360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
264KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 0a6447c5c1e463a7b3ef27b608dc3f7e7e9c4baa5ed744dff5b0b92e84bd7a92
- MD5 e145d39ee77f196733f01b64e984c133
- SHA1 e8a5cc961041f6ec574d2d45355a90fbc7822f2e
- SHA512 8fec7d4e589d990d111610bd2bd9ceaa37365056d2b93576c00db4a022a02070ec9d0c9c9f677378e07deb431e69057a06a3e46081c279e714c108b23c111527
- SSDEEP 12288:1kxDoouVA2nxKkh0vdRgQriDJOIZW+yBGQowlNC:fRmJkqoQrilOIQ+yMx
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e
- MD5 e1e589c2c91ca7563f8fb06cf356bbfc
- SHA1 54ac30e96d237ebed232648d8b484579fd7a33d8
- SHA512 8c440d514c0e0b4587834e40ebe0603f1214a771f680c1a49d69a3dcf2cb799ff4f056faf06402a4f7243b927a296374fe024ecfbb754aa550ef25ceebfc0261
- SSDEEP 6144:Nb/thbA20Budh1Bbm20BloOVAIqDAYQ+:ltGcAYp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
467322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\ban cap nhat 26 11 2016\HiddenTear-master\HiddenTear-master\HiddenTear\obj\x86\Debug\HiddenTear.pdb
mscoree
_CorExeMain
Name
.text
Size
448KB
Virtual Size
448KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
aace43af8d0932a7b01c5b8fb71c8199.exe
- IMPHASH 1c2a6fbef41572f4c9ce8acb5a63cde7
- SHA256 3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b
- MD5 aace43af8d0932a7b01c5b8fb71c8199
- SHA1 56422e5cc2abe198198003d2c5bf009c8652a983
- SHA512 c4fdee4e0041a98eba661b41f521ea393e2cf8a2683d7722ba198bbc5d7620600855a773c849b1a24fb0542a6fdaf478b4e66d2ca709663d5665fac1613de2b3
- SSDEEP 49152:HyhKEGeEWYQAsQ36mE4OZYYIqCGA02Ul0UFi28CdNT0BtT:HygEGTRQAsQ36mE4O6rqCb2i28CdNoBN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
303248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
winmm
timeEndPeriod
timeBeginPeriod
ws2_32
WSAGetOverlappedResult
kernel32
WriteFile
WriteConsoleW
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
LoadLibraryA
LoadLibraryW
GetSystemInfo
GetStdHandle
GetQueuedCompletionStatus
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
885KB
Virtual Size
885KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
988KB
Virtual Size
988KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
92KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/4
Size
512B
Virtual Size
274B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/63
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/80
Size
512B
Virtual Size
34B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/99
Size
244KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/112
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/124
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
902B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.symtab
Size
194KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.exe
- IMPHASH 5c2bd224c81b6720b9c891fd4669dac3
- SHA256 ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de
- MD5 70a377690917a98e6ee682f7941eb565
- SHA1 246b1e0d01772a47a5f2032c8642d33d47a11c57
- SHA512 c384afb2230222115bffeeb951e6e204e99c44ff8d27af58b5660aa084405b1da3ad25ee75179b9f5db0f1ca7ceab070457d314b001c53cc0faa71dd7dfe9709
- SSDEEP 3072:eowSng9e1zcHHgttb9a1XchykGt8N3mff:1IehkAttb9aFchy3um
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
DeleteTimerQueueEx
GetCommandLineA
CreateActCtxA
GlobalAddAtomA
GlobalFindAtomW
GetLastError
VirtualProtect
AllocateUserPhysicalPages
AssignProcessToJobObject
CloseHandle
GetConsoleWindow
CreateMutexW
CreateConsoleScreenBuffer
DeactivateActCtx
GetLongPathNameA
CopyFileW
BackupRead
LoadLibraryA
InterlockedExchange
FreeLibrary
GetProcAddress
LocalAlloc
RaiseException
DelayLoadFailureHook
gdi32
GetStockObject
psapi
GetProcessMemoryInfo
GetWsChanges
GetModuleFileNameExA
GetModuleBaseNameW
GetDeviceDriverFileNameA
InitializeProcessForWsWatch
EmptyWorkingSet
EnumPageFilesW
GetModuleFileNameExW
GetModuleInformation
EnumProcessModules
GetDeviceDriverBaseNameA
EnumProcesses
rasapi32
RasHangUpA
RasGetEntryDialParamsA
RasGetEntryDialParamsW
RasEnumDevicesA
RasHangUpW
RasSetSubEntryPropertiesA
RasRenameEntryW
RasEnumDevicesW
RasScriptGetIpAddress
RasValidateEntryNameA
RasFreeEapUserIdentityW
RasGetConnectStatusA
RasGetEapUserIdentityW
RasFreeEapUserIdentityA
RasEnumConnectionsW
RasGetEntryPropertiesA
RasValidateEntryNameW
RasGetCredentialsA
RasGetCountryInfoA
RasAutoDialSharedConnection
RasGetAutodialAddressA
RasEnumAutodialAddressesW
RasSetSubEntryPropertiesW
RasSetAutodialEnableA
RasGetAutodialEnableW
RasAutodialAddressToNetwork
RasSetEntryDialParamsA
RasEditPhonebookEntryA
RasSetEntryPropertiesA
RasDeleteSubEntryA
RasGetAutodialEnableA
RasGetProjectionInfoA
RasGetProjectionInfoW
RasSetEntryPropertiesW
RasGetErrorStringA
RasSetAutodialEnableW
RasGetCredentialsW
RasConnectionNotificationW
RasGetAutodialParamW
RasSetEapUserDataW
RasGetAutodialParamA
RasGetSubEntryHandleA
RasCreatePhonebookEntryA
RasInvokeEapUI
RasIsSharedConnection
msimg32
TransparentBlt
d3dxof
DirectXFileCreate
mstask
_NetrJobGetInfo@12
_SASetNSAccountInformation@12
_SetNetScheduleAccountInformation@12
_GetNetScheduleAccountInformation@12
_NetrJobAdd@12
_NetrJobEnum@20
_SASetAccountInformation@20
tapi32
MMCRemoveProvider
lineUncompleteCall
lineNegotiateAPIVersion
lineSetupConferenceW
lineGatherDigitsW
lineGetLineDevStatusW
lineAgentSpecific
internalPerformance
tapiRequestMediaCallA
tapiGetLocationInfoW
lineGetMessage
lineRegisterRequestRecipient
lineAddProvider
phoneGetDevCaps
lineCreateAgentW
lineGenerateDigits
MMCGetPhoneStatus
lineCreateAgentA
MMCAddProvider
lineSetDevConfig
lineSetAgentMeasurementPeriod
lineSetTollList
lineParkA
lineBlindTransferW
lineHandoff
lineSendUserUserInfo
lineGetQueueInfo
lineGetDevConfigA
lineMakeCall
lineGetRequestA
lineAddToConference
lineSetupTransferW
phoneGetDevCapsW
lineSetCallData
lineConfigDialogEdit
lineGetIcon
lineGetAddressCaps
lineSetCallParams
phoneGetIconA
lineGatherDigits
lineNegotiateExtVersion
TAPIWndProc
lineGetCallStatus
lineGetIconW
linePickupA
lineGetDevCaps
lineGetNumRings
lineForwardW
lineSetMediaMode
phoneGetHookSwitch
lineShutdown
phoneConfigDialog
MMCInitialize
lineProxyMessage
lineMonitorDigits
phoneGetStatusA
lineDial
lineGetAddressCapsA
phoneSetButtonInfo
lineConfigProvider
lineGetAppPriority
lineCreateAgentSessionW
lineSetAgentSessionState
lineGetAddressID
lineGetQueueListW
lineForwardA
lineConfigDialogEditW
LOpenDialAsst
lineSetAgentGroup
phoneGetRing
lineTranslateDialogW
lineTranslateAddressA
lineGetAgentCapsW
lineBlindTransferA
internalRemoveLocation
lineGetLineDevStatus
phoneInitialize
lineGetCountryW
lineForward
lineGenerateTone
MMCSetLineInfo
lineSetTollListW
BrowserDevelope
CareDeny
ClientQueryConsole
ComeNeverA
DynamicHandleTime
FillAffected
FunctionParent
GoalOverviewTarget
IndicateCall
IsResultW
LimitFormattedW
NeedApplicationW
ProcessOperation
ProviderSearchA
PurchaseMethodProtected
ServerStart
SettingProperlyProductW
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
23KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ndata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=110, productName=VS2005 build 50727, version=50727,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=194, id=1, productName=Unmarked objects,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe
- IMPHASH 50a39d8c933b48792bb6a3fa1490d04e
- SHA256 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1
- MD5 35f68acc0c3d5761a61975ec77b49cbc
- SHA1 f6d03e713bc9b47265141d9f9b83ae634d43d204
- SHA512 6a9d131e7c4f310ec77cf3c9c07c75dca279b7ffd6c46b252c559947900f1d754400fc51ce12b8afde86a0fd758e1b68d00a2e5f9144ad019d51bff5c67a4656
- SSDEEP 3072:HfVD9B1hzRAjEdJNCQ4woDZD57Wr3FKajQNR9MiYbuWjqgdcnfKvdHmN5b3SM:/jlVEEbNtoPajxu85cfAG3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
42365
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\StickyKeys\Beijing\Accuracy\GDI.pdb
kernel32
SetStdHandle
GetLocaleInfoA
HeapSize
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
GetStdHandle
TlsGetValue
GetFileType
SetHandleCount
GetModuleFileNameA
WriteFile
LCMapStringA
Sleep
GetModuleHandleW
HeapReAlloc
VirtualAlloc
DeleteCriticalSection
VirtualFree
LCMapStringW
GetStringTypeA
GetStringTypeW
lstrcpyA
AreFileApisANSI
lstrcpyW
FileTimeToLocalFileTime
CloseHandle
GetModuleHandleA
WTSGetActiveConsoleSessionId
DeviceIoControl
LoadLibraryA
GetLocalTime
GetPrivateProfileStringA
GlobalFree
FlushFileBuffers
GlobalUnlock
SetConsoleTitleA
MultiByteToWideChar
CreateFileW
ReadFile
EnumResourceLanguagesA
WriteConsoleW
CreateEventA
GlobalAlloc
GetProcessHeap
LockFile
HeapCreate
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetProcAddress
GetCurrentDirectoryW
ExitProcess
GetLastError
WaitForSingleObject
GlobalLock
GlobalSize
GetCurrentProcess
HeapAlloc
lstrcmpA
GetFileSize
TlsAlloc
CreateFileA
user32
MessageBoxW
GetSystemMetrics
OpenClipboard
PostMessageA
CreatePopupMenu
SetMenu
ShowWindow
GetCursorPos
UpdateWindow
DefWindowProcA
EnableWindow
SetClipboardData
EndDialog
DestroyMenu
LoadCursorA
GetDlgItemTextA
GetDlgItem
EmptyClipboard
ReleaseDC
CreateWindowExA
DrawFrameControl
SetDlgItemTextA
GetDialogBaseUnits
GetClipboardData
GetWindowLongA
InvalidateRect
SetWindowLongA
SetRect
GetKeyboardLayout
GetDC
PtInRect
BeginPaint
SendMessageA
GetWindowTextLengthA
CreateMenu
GetWindow
SetWindowPos
EndPaint
CloseClipboard
GetSystemMenu
GetWindowRect
InsertMenuItemA
RegisterClassExA
PostQuitMessage
SendDlgItemMessageA
TrackPopupMenu
SetCapture
DrawTextW
DeleteMenu
LoadBitmapA
LoadMenuA
LoadIconA
GetWindowInfo
wsprintfA
FindWindowExA
GetClientRect
gdi32
DeleteObject
GetStockObject
TextOutW
MoveToEx
LineTo
CreatePolyPolygonRgn
SetTextColor
DeleteDC
CreateFontIndirectA
GetCurrentObject
CreateHalftonePalette
CreateBitmap
CreateSolidBrush
SelectObject
CreateCompatibleDC
CreateRectRgnIndirect
CreateCompatibleBitmap
Rectangle
RealizePalette
CreateFontW
SelectPalette
CreatePen
GetObjectA
advapi32
AdjustTokenPrivileges
OpenProcessToken
CryptExportKey
CryptReleaseContext
LookupPrivilegeValueA
CryptAcquireContextA
AllocateAndInitializeSid
CryptGetUserKey
CryptGenKey
shell32
SHBrowseForFolderA
ole32
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleGetClipboard
OleCreate
CoInitialize
OleUninitialize
OleInitialize
OleSetContainedObject
StringFromGUID2
CoUninitialize
CoCreateInstance
OleCreateStaticFromData
oleaut32
VariantInit
SysFreeString
SysAllocString
SafeArrayAccessData
SafeArrayUnaccessData
ws2_32
WSAStartup
WSAIoctl
gethostbyname
htons
netapi32
NetWkstaUserEnum
NetWkstaGetInfo
NetWkstaSetInfo
NetApiBufferFree
userenv
GetAllUsersProfileDirectoryA
msacm32
acmFormatEnumA
acmMetrics
winmm
waveOutClose
waveOutPrepareHeader
waveOutMessage
waveOutWrite
waveOutOpen
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
crypt32
CryptDecodeObject
comctl32
ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_BeginDrag
ImageList_DragEnter
ord17
ImageList_Draw
pdh
PdhSetCounterScaleFactor
PdhReadRawLogRecord
PdhSelectDataSourceA
rpcrt4
UuidCreate
imm32
ImmGetOpenStatus
ImmGetContext
ImmReleaseContext
wtsapi32
WTSQueryUserToken
msi
ord101
Name
.text
Size
163KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=47, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=41, id=123, productName=VS2005 build 50727, version=50727,
count=260, id=1, productName=Unmarked objects,
count=1, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
- IMPHASH 9a3d6959e6823cfab73700f601ca3412
- SHA256 afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e
- MD5 08b304d01220f9de63244b4666621bba
- SHA1 b7f9dd8ee3434b35fbb3395f69ff43fd5112a0c6
- SHA512 162cc0fb48615c67ce6e104ca462c41aba79bad0d5409e837b300cffc34a1c9bed63f603eee7091b93edfcd772d8ab1e180fcb3aae6b07fe24413b8505815ae9
- SSDEEP 3072:fHynAdzu0t5GtE13lkAB9z3KJZ3fCI1AjZ7yXgpiqQp:fHKautY3TzaJZarjZeXgpn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
winmm
mmioWrite
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutPrepareHeader
waveOutWrite
waveInUnprepareHeader
waveOutReset
waveOutClose
waveOutOpen
mmioDescend
mmioClose
mmioRead
waveInStop
waveInReset
waveInClose
waveOutUnprepareHeader
waveInOpen
mmioAscend
mfc42
ord4998
ord2379
ord2302
ord567
ord1168
ord1146
ord3574
ord823
ord1948
ord2396
ord3346
ord5300
ord5303
ord4079
ord4699
ord5307
ord5289
ord5715
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord817
ord348
ord565
ord825
ord2726
ord4226
ord537
ord800
ord1105
ord518
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord5302
ord4698
ord5714
ord3738
ord561
ord815
ord2514
ord2621
ord1134
ord641
ord609
ord2256
ord5265
ord4376
ord4853
ord1576
ord4710
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord4234
ord2575
ord6055
ord1776
ord4396
ord5290
ord3402
msvcrt
_except_handler3
_controlfp
_onexit
__dllonexit
_setmbcp
__set_app_type
__CxxFrameHandler
memset
strcpy
sprintf
memcpy
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
kernel32
WaitForSingleObject
GetStartupInfoA
GetModuleHandleA
CreateFileA
GetModuleFileNameA
ResetEvent
Sleep
GetCurrentThreadId
WaitForMultipleObjects
GetLastError
SetEvent
user32
LoadIconA
PostThreadMessageA
PostQuitMessage
EnableWindow
Name
.text
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=97, id=11, version=8966,
count=66, id=19, version=9049,
count=113, id=96, version=3194,
count=158, id=10, version=8447,
count=100, id=28, productName=VS2002 (.NET) build 9466, version=9466,
count=76, id=1, productName=Unmarked objects,
count=154, id=90, productName=VS2003 (.NET) build 3077, version=3077,
count=18, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=136, id=28, version=9178,
b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe
- SHA256 b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54
- MD5 93de5300dabf0711c57cbe31b4c9ef04
- SHA1 4cad182a0cf72c2aff7c1a5b23eb26b352366f63
- SHA512 52c3e7a2721dac4b65d1b0ca78bd594f96f7adc36dcb9a69515665a039d644b4ce130f73f5eddd452911cac7f60c0af19688cdba57339fdec88c0ddfc574cc00
- SSDEEP 768:4chho/bbYYwktIZwTUtv3h12jG6hdYWnXAjpWTbBbIKP077hPdxPaq77tio/rM:PjoDMYwEINR8j/Yu2pqOd77hPQoQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\my projects\bbac\output\Release\bbac.pdb
Name
.text
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.mackt
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=100, id=1, productName=Unmarked objects,
count=25, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
b7989d9eacb5a8b224fd183f6ba65e4e6bd30a4f0e4e1a299f0d2b63dcb56730_Archive_useless.exe
- SHA256 b7989d9eacb5a8b224fd183f6ba65e4e6bd30a4f0e4e1a299f0d2b63dcb56730
- MD5 efb012885a39dd28c11d1c90376162f0
- SHA1 0b2d18503c969a388dcc58293303c86426018e2c
- SHA512 4cf3e37f7a8363f5e64a4e8d3377242857126d9979d1a03dd056bd64af6dfc0e15524fa5d16171a955ac4501c420887021db5046aa0ddec0b965c895f4bfb0bd
- SSDEEP 3072:0XVgiPOH3Uq6NpYwm0XVgiPOH3Uq6NpYwmW:A5OXUqQH5OXUqQp
- MD5 SHA1 SHA512 SSDEEP
0.8476237917779167.exe
- IMPHASH fcae38cb0b0381e590e953306c0423a0
- SHA256 19ec0d0e5143940492a1c79c06eb8f18aa9feb356e41b8b79fdc6a16a3bcd7bf
- MD5 0a2284067bd109885b0597c3a858a88a
- SHA1 7634b3d0ede547c81f93fe570ef3102bf0e0ed14
- SHA512 6405bee390d0c1f38ad434116de512cb67171b66ec6e4efbb43f08577597da51ab37fae899a6f8231fa17fa60654572e5141c2dbcebe520124db61e7393f9eea
- SSDEEP 1536:QF7P2btiVYiZ+TX2tbOH3UqCXOOlIoj6Q849X:U7ktiPCH3UqZAhR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetEnvironmentStringsW
GetPriorityClass
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupGetLineCountA
msvcrt
_adjust_fdiv
memcpy
_exit
_XcptFilter
exit
_onexit
__getmainargs
_initterm
__setusermatherr
_acmdln
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
782B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=25, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
zsgblrbrumorwxfizuke.exe
- IMPHASH fcae38cb0b0381e590e953306c0423a0
- SHA256 19ec0d0e5143940492a1c79c06eb8f18aa9feb356e41b8b79fdc6a16a3bcd7bf
- MD5 0a2284067bd109885b0597c3a858a88a
- SHA1 7634b3d0ede547c81f93fe570ef3102bf0e0ed14
- SHA512 6405bee390d0c1f38ad434116de512cb67171b66ec6e4efbb43f08577597da51ab37fae899a6f8231fa17fa60654572e5141c2dbcebe520124db61e7393f9eea
- SSDEEP 1536:QF7P2btiVYiZ+TX2tbOH3UqCXOOlIoj6Q849X:U7ktiPCH3UqZAhR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetEnvironmentStringsW
GetPriorityClass
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupGetLineCountA
msvcrt
_adjust_fdiv
memcpy
_exit
_XcptFilter
exit
_onexit
__getmainargs
_initterm
__setusermatherr
_acmdln
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
782B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=25, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe
- SHA256 b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0
- MD5 4523ccfd191dcceeae8e884f82f5c7ad
- SHA1 00107a6bdc9886e69425b7b0b761dcc8324946d3
- SHA512 79df12b1abb0d2ddab35e898aa01baaf7ea737fa37331c926b07d0ca478aa9c1c3d14795241e11d7dcff06ec3c5de93b2819cfbc0fd6db5bf6e752c52cfad5a5
- SSDEEP 12288:uPenEoSpi011oQSnRxhmVacKcMxS8JWwEHD1T6hX5IGC2C:SJomi0GnbPcKcNcWwEj1T6hqm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1412016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
972KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
403KB
Virtual Size
404KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
114KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 1087ab1fa2ea21c324fbe6a3c9113f796973926bf2cdeb964815320191b82177
- MD5 5c2cbd8e64cc93ef07b6a12395d87ef5
- SHA1 b9df71ad8f1781c123c8c7f5fc101c7fe7d1f38e
- SHA512 7f880956ef5145380a0f3b80ac5315d8e2f83de4f736093eb4dbcf3ef57cd012be8fe4a7a6f69561bfd2016e4f0a2727069e6c9942c10039a2583fe3f6a2358e
- SSDEEP 24576:k8hosOYJGNynKam+PM0XgdSBkS45MvX30cA4LMiq2mt2Fm:7rTBmAnOSl08QCm
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1048140
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
.text
Size
1014KB
Virtual Size
1014KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
1024B
Virtual Size
934B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
60B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
169KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
- SHA256 c0fcf3ac6b125e985c6574ed7ef1a7929f3be8f6487b68e4d58a48a3b1517b5d
- MD5 d9789bfbc54d5cb6d52c385fd8f5d288
- SHA1 b8f60c64c70f03c263bf9e9261aa157a73864aaf
- SHA512 21e81d64136897e86362304666cb0a8510ae2280c432c8b768875d5459b527e2cdafe9a61107433d3ff7ccf8092f3bbc226f9366623c1d39f76445fc490dc4c8
- SSDEEP 768:IPXirrjYZp0Tf6yFz5Om5jPwxgjAqJTKV/Z:I/iTYHQCm5DpjhJTKVR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
104480
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
text
Size
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
data
Size
22KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=2, id=9, version=8783,
count=1, id=13, version=9782,
bb0e8d9ba927076fbe076960ee7c3b31afa9086583b7358c748d78a55b044a38.exe
- SHA256 bb0e8d9ba927076fbe076960ee7c3b31afa9086583b7358c748d78a55b044a38
- MD5 0066c7dc5bb2e34e0ff6782b7a2ac821
- SHA1 9a24a0c7079c569b5740152205f87ad2213a67ed
- SHA512 804cb06a56cc48ae92f3b41a381e6ad06e5d38e93e8921903e32a7f4b06ae4d2705517f0536b86402b203db10a9134c7097cfbc42c0306c24d716b0a11dad5f6
- SSDEEP 6144:icQu7L20QOPNMNYKEdf7Q0chT7WbK1xb5b:d20Q1YKMfE06jb
- MD5 SHA1 SHA512 SSDEEP
Saldo.Pdf______________________________________________________________.exe
- IMPHASH 380e5390f65e340268c2e7706d44415e
- SHA256 89e71eb0a6403725d2f95cb9e6506b8b139a6948a61dc1c5cfedf18648241ec4
- MD5 93cbe4ed3d46abe732a124a41e7147a2
- SHA1 94a24be60d90479ce27f7787a86678472aabdc6e
- SHA512 8f46af90d8a2d78da003a8a395fd7f74cc235595238ee3a3e4d87fee2aa4c8abf6ece403bb3726122d3825437f5d079ea1f8d6b275153bb76b3b0d75c243ef09
- SSDEEP 6144:XOOxeLzWoeNqagVRUvOWcTwlOcTeP8uENXIEQSdO8c/AVxYflxiW:txeHWoA/Wr0lfQ8BfLkIVxYfrd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
13960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleW
GetTickCount
GetModuleFileNameW
IsDebuggerPresent
GetCPInfo
VirtualQuery
CreateFileA
CloseHandle
HeapSize
WriteConsoleW
GetConsoleOutputCP
GetModuleHandleA
GetCommandLineW
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteConsoleA
RaiseException
user32
GetWindowRect
IsZoomed
GetForegroundWindow
GetWindowLongW
GetDesktopWindow
GetCursor
advapi32
GetUserNameA
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
366KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=28, id=132, productName=VS2008 build 21022, version=21022,
count=26, id=149, productName=VS2008 build 21022, version=21022,
count=116, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=106, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
bb89efd602f3ddae8dc8c804053c5800c6628dbc7073c46bb3d268261130ba59.exe
- SHA256 bb89efd602f3ddae8dc8c804053c5800c6628dbc7073c46bb3d268261130ba59
- MD5 16a0eda7553c6011fbee64cc017e35a7
- SHA1 de3c25f2b3577cc192cb33454616d22718d501dc
- SHA512 122e28741ab6e1092053a27f192ac6e47e7236e78eb56693fbfd9359ffd6097e5bd21a56528ae76a624dec76f10780397e698e1bbf3c3f74ab46d1ea1308894c
- SSDEEP 6144:/Y4mV5gq4DBKkxa2RNJYw8coEdNqAniTw1sbLp7ByJ7NFPjsnH5+qPZOMbM+juh:/mVmb9Kkxa21Yw8QiJdAJTqNbM+u
- MD5 SHA1 SHA512 SSDEEP
Transazione.Pdf______________________________________________________________.exe
- IMPHASH 380e5390f65e340268c2e7706d44415e
- SHA256 4c953b87b35c7764a32cbcde63ea1fb2f1563883f28ef209718604c48ba497e3
- MD5 e982953f4b15ad41dbccb13a09970214
- SHA1 152b6ec0bda40347968c560f370e8f2089cb0436
- SHA512 60d9dc59ad324523ecc5f6933aada9a13cb5e9c67ba0b0e60007d784e17194da2e7308050ce1084c377a965a58bd846fd065c4589c5bc169666915fb557e6124
- SSDEEP 6144:IzexeLzWAewqagVdgv0mzsWZwGoMaRxgbQGsaYVbW6kbqbsL1GeD69wwBKZ9+:vxeHWAdQg/zjwGoMG/Vybqb01GeD0wT+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
13960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleW
GetTickCount
GetModuleFileNameW
IsDebuggerPresent
GetCPInfo
VirtualQuery
CreateFileA
CloseHandle
HeapSize
WriteConsoleW
GetConsoleOutputCP
GetModuleHandleA
GetCommandLineW
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteConsoleA
RaiseException
user32
GetWindowRect
IsZoomed
GetForegroundWindow
GetWindowLongW
GetDesktopWindow
GetCursor
advapi32
GetUserNameA
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=28, id=132, productName=VS2008 build 21022, version=21022,
count=26, id=149, productName=VS2008 build 21022, version=21022,
count=116, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=106, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe
- IMPHASH 7c6791cb1b3ac992063bd8ecc38e1226
- SHA256 bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f
- MD5 d1e75b274211a78d9c5d38c8ff2e1778
- SHA1 d14954a7b9e0c778909fe8dcad99ad4120365b2e
- SHA512 1ec3fbb0bf17d4ad6397ba2e58daa210745f10f88f6722971464a6eeb7573f49be6d65e70a497002d6d00745317f11442bdeaf999b91127b123c11dfe9b088c2
- SSDEEP 24576:l2RNuxIAdOx6mNoGSyGMjc6XaMAy9xg5tMZ/Z3RPpEYrTQAU:rIG+lbGuntxktM15RPpEYrTQAU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
387203
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Asus\Desktop\MyEncrypter2Mod3Window\Release\MyEncrypter2.pdb
kernel32
SetFileAttributesA
GetLogicalDriveStringsA
GetProcAddress
GetFileSize
ExitProcess
WinExec
lstrcmpiA
CreateProcessA
GetTempFileNameA
GetComputerNameA
GetLastError
CloseHandle
LocalFree
GetTickCount
GetStdHandle
GetFileType
GetCurrentThreadId
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
FreeLibrary
GlobalMemoryStatus
FlushConsoleInputBuffer
FlushFileBuffers
GetACP
MultiByteToWideChar
SetEndOfFile
HeapSize
WriteConsoleW
DeleteFileA
LoadLibraryA
CreateFileA
GetFileAttributesA
OpenMutexA
CopyFileA
CompareStringA
Sleep
GetTempPathA
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateMutexA
FindClose
SetFilePointer
ExpandEnvironmentStringsA
FindNextFileA
GetDriveTypeA
ExpandEnvironmentStringsW
WriteFile
GetCurrentProcess
ReadFile
FindFirstFileA
GetModuleFileNameA
FindFirstFileExA
GetCommandLineW
GetCommandLineA
SetEnvironmentVariableA
HeapFree
HeapReAlloc
HeapAlloc
SetConsoleMode
ReadConsoleInputA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetProcessHeap
CreateFileW
SetStdHandle
ReadConsoleW
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
RaiseException
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
SetConsoleCtrlHandler
GetConsoleCP
user32
MessageBoxA
GetUserObjectInformationW
SystemParametersInfoA
GetProcessWindowStation
advapi32
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegCloseKey
RegOpenKeyA
RegGetValueA
RegCreateKeyExA
GetUserNameA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
SystemFunction036
shell32
SHGetFolderPathA
ole32
CoInitialize
CoCreateInstance
oleaut32
VariantClear
shlwapi
PathFindExtensionA
PathFileExistsA
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntry
Name
.text
Size
512KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
222KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=241, version=40116,
count=169, id=243, version=40116,
count=28, id=242, version=40116,
count=25, id=259, version=23013,
count=62, id=261, version=23013,
count=65, id=260, version=23013,
count=2, id=206, version=65501,
count=2, id=208, version=65501,
count=27, id=203, version=65501,
count=193, id=1, productName=Unmarked objects,
count=332, id=260, productName=VS2015 [14.0] build 23026, version=23026,
count=2, id=265, version=23026,
count=2, id=259, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
bd2d4d43009623941f49554f5932188154fc9d16d820e00db1281d057468b017.exe
- SHA256 bd2d4d43009623941f49554f5932188154fc9d16d820e00db1281d057468b017
- MD5 f0be874585b7ed666de5edb88ccb1107
- SHA1 9121c2e1e96cf87e5f9bab3a2dbd4b578bc5b438
- SHA512 f8941d32af25ba6f9f6907efd64265bff8e4884003c65410acd8f6dbb4e5c46f308e9bf0be5e7738f16bbb6dffe8adb2c61b4576ec754a7e5026741eb998d7fd
- SSDEEP 768:UYQW5/spNck0lUzPrU23Wsq91si1QGb6LNyF2kbWsiPfNa133CiMRKeFyZc:UYQW57kCUzbFqvyyFhl2gpyVcrc
- MD5 SHA1 SHA512 SSDEEP
be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe
- SHA256 160e7c9806857f1dfae4191a338c4e9341f1f589b6ed72f4cf6e10db483e3af6
- MD5 50e3871f540b228941b8ef76ef0d543e
- SHA1 ba51fc4ecff55d7c504db666d970490118153afc
- SHA512 16acd834a04b43eed8954d74a884032ae73439ffaefaf51f043fa19a7af7a71cdcf19a752d67194f6b15df1272947bd5522895a266e971a3e241d34aea79bf7f
- SSDEEP 1536:df/SovFSSZtDgN+DpDkDEFtCw0YF8965L+vpCYC:J/zv0SZtDgN+Dp+Er0YF896WpTC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
42514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
436B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mackt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=29, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=75, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=28, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_TDS=4F90A68A.exe
- IMPHASH 4ea786321f19dc7a418dcab762bce2f6
- SHA256 be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d
- MD5 db4161aec038c9c18a03636304083a0e
- SHA1 096f0dfd110366a56cc5cb4b940311b13687663a
- SHA512 4330d31c2c014cba3981f881a5209c17e9321e634436dc83ee8765c2461376f54c971d85d3bdd4c70fa33f5c015d5d41e788cf087a9c3c8f737a172dec918147
- SSDEEP 1536:tK25W2YiTR9vZWsU2c0yChDadK3352M849X:thaiF9vZQ2XNpau52MhR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9498
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetStdHandle
GetEnvironmentStringsW
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
setupapi
SetupGetLineCountA
msvcrt
_adjust_fdiv
memcpy
_exit
_XcptFilter
_onexit
_acmdln
__getmainargs
_initterm
__setusermatherr
exit
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
806B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
45KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=19, version=9049,
count=26, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe
- IMPHASH 522d0f97ab4a6d25aca0ac31ddb4ccd6
- SHA256 be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f
- MD5 0c526b77abfe8d54363e3d14aa28acfe
- SHA1 3239434398da123454635d8fdb0bedc9f40d831a
- SHA512 6c201b45e2041d3f96b05e0275c7e1164ea481b704b49767d2decba19e1587fc93ae54078c89fcb6d937de345697fe7196e49cf8245a53b8f519fa63970b40e4
- SSDEEP 192:DKsF20IA6HAypQRr202tR+6raWP4xqLtSQlH:5Uj1gxV202Xyy4xqpSQZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6912
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrStrW
kernel32
SetFilePointer
FreeResource
lstrlenA
GetDriveTypeW
FindResourceW
LoadResource
CreateProcessW
GetLogicalDriveStringsW
GetModuleHandleW
VirtualFree
SetFileTime
WriteFile
OpenProcess
Sleep
CopyFileW
SizeofResource
GetFileAttributesW
TerminateProcess
ReadFile
GetModuleFileNameW
CreateFileW
FindFirstFileW
lstrcmpW
MultiByteToWideChar
lstrlenW
GetProcAddress
VirtualAlloc
MoveFileW
FindClose
Process32FirstW
GetFileType
LockResource
Process32NextW
lstrcmpiW
FindNextFileW
CreateToolhelp32Snapshot
GetFileTime
CloseHandle
DeleteFileW
SetFileAttributesW
GetVolumeInformationW
CreateThread
ExpandEnvironmentStringsW
GetFileSize
GetCommandLineW
ExitProcess
GetSystemDefaultLangID
ExitThread
user32
GetWindowLongW
LoadIconW
RegisterClassExW
LoadAcceleratorsW
TranslateMessage
wsprintfW
LoadCursorW
ShowWindow
TranslateAcceleratorW
GetSystemMetrics
UpdateWindow
SetWindowTextW
DefWindowProcW
DispatchMessageW
GetMessageW
CreateWindowExW
advapi32
RegCreateKeyW
RegCloseKey
RegSetValueExW
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=71, id=1, productName=Unmarked objects,
count=1, id=137, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
bfb8f7f6cbe24330a310e5c7cbe99ed4_api-ms-win-system-wer-l1-1-0.dll
- IMPHASH 68bc8900cc12958cd840ed89d028d812
- SHA256 a4e9c151a50595b59e787dd3b361ac53d02dd7f212d6b22639dc01776c886d05
- MD5 bfb8f7f6cbe24330a310e5c7cbe99ed4
- SHA1 cfb97a66c90bff92b5d72eb9e81b2e9d8013b66d
- SHA512 f8a4c341b50a37b15c8a11979d8b0ce82c33fb4fd6a9749b4c561db84627e850f8fc23778f78d085b218ea40cdecf05864e68b73f5cc606d7ef30a0454c09550
- SSDEEP 6144:muStbEUJp4qjMO3QZW+PeT9JiPZCL/qrS9spyM:dStbJaE+NCLEnp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4196
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cluster0.pdb
kernel32
GetDiskFreeSpaceW
CreateSemaphoreA
GetDriveTypeW
ReplaceFileW
EnumCalendarInfoW
VerLanguageNameW
CreateProcessA
FreeLibrary
GetFileType
GetModuleFileNameA
GetBinaryTypeW
GetVolumeInformationA
gdi32
GetTextCharset
CLSIDScalableBuffer
CanStrip
CommPFXExtensionCtl
DialogDecrementFill
EqualHungABCWidths
NotifyCSpnStream
OutputUninitializeControls
PauseShellChildAttribute
SelectUnmakeMode
Name
.text
Size
116KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
902B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vqCp0w
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.eh_fram
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=1, productName=Unmarked objects,
count=9, id=2, version=7274,
count=13, id=19, version=9049,
count=1, id=6, version=2134,
count=9, productName=Unmarked objects (old),
bldjad.ex1.exe
- IMPHASH 9afeb1a7e64e34e152035103d5794b26
- SHA256 3fb245ab1427cb59a359fb2e910a3a8e7e4535114cf61469001d740305e97200
- MD5 b1c88e7ed0edb803ead0c0eeeef53935
- SHA1 ddc529d37589d68e9013327e57d3cb15ddd6b406
- SHA512 129ade5293e0c5f0d5a1ad0dfde0e6e0f5eac5f3031f9d57d855a368e034dda932fca4f6d7020d111e463a37fd3da3ffc3405ec750e3a0dea5113a26ce316cd0
- SSDEEP 1536:/udS9WayNWqE9pDV6PSPP7dl5vUOENrlSN+jvNYvecy1q2sJ6Ysktv8FkXAk3RCG:/R9jyMqMVmcdlONoNklYvhvGklRWAx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8560
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetVersion
GetCurrentThread
VirtualAlloc
LocalFree
LoadLibraryA
LocalAlloc
GetProcAddress
GetSystemInfo
GetModuleHandleA
GetVersionExA
GetLastError
GetThreadLocale
GetFileType
CloseHandle
user32
EndPaint
GetFocus
GetKeyState
DispatchMessageA
TranslateMessage
BeginPaint
GetMessageA
CharNextA
advapi32
RegOpenKeyA
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=23, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
bldjad.exe
- IMPHASH 9afeb1a7e64e34e152035103d5794b26
- SHA256 3fb245ab1427cb59a359fb2e910a3a8e7e4535114cf61469001d740305e97200
- MD5 b1c88e7ed0edb803ead0c0eeeef53935
- SHA1 ddc529d37589d68e9013327e57d3cb15ddd6b406
- SHA512 129ade5293e0c5f0d5a1ad0dfde0e6e0f5eac5f3031f9d57d855a368e034dda932fca4f6d7020d111e463a37fd3da3ffc3405ec750e3a0dea5113a26ce316cd0
- SSDEEP 1536:/udS9WayNWqE9pDV6PSPP7dl5vUOENrlSN+jvNYvecy1q2sJ6Ysktv8FkXAk3RCG:/R9jyMqMVmcdlONoNklYvhvGklRWAx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8560
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetVersion
GetCurrentThread
VirtualAlloc
LocalFree
LoadLibraryA
LocalAlloc
GetProcAddress
GetSystemInfo
GetModuleHandleA
GetVersionExA
GetLastError
GetThreadLocale
GetFileType
CloseHandle
user32
EndPaint
GetFocus
GetKeyState
DispatchMessageA
TranslateMessage
BeginPaint
GetMessageA
CharNextA
advapi32
RegOpenKeyA
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=23, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
bldjad2.exe
- IMPHASH 09d0478591d4f788cb3e5ea416c25237
- SHA256 97e1dd8169a82282ab889ab8b21b78eb64af975d66b136a19252b9b44352cb58
- MD5 305811f060ff21aad8d8cd872c1e89e2
- SHA1 32cba371f3021aabb76791992b7109e52fee2325
- SHA512 ace79c93e2137410e02c29280df566d52a9b74d0759f6b5e25930834377c1cb7401fe963df896b60a55c9c67955c5e3ec232aedd87f91f9b5b7d7c76d4575644
- SSDEEP 3072:7oaXHWASj9Fxb9ziS9z7ACPUiwFVb3fSpVD2s+706aeUTQjNSwUbJMwQuUEXszln:0aHejjldiSJtU9Zqf2s+7jaeUoNSwUJI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4272
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Name
.text
Size
171KB
Virtual Size
332KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=13, version=9782,
c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0
- MD5 01a18db18af5cd780eab9bbadd881e8c
- SHA1 36728334c4d1bb927310e0f1268b3890f2bd2457
- SHA512 ea81c1340b8ddbd9a6e796ddb5b18e55c575ac974dcf66ad40ff188f85ae630fe68fa58c2bddd0aef859b5e3ea31b01ed2ee025c49d06e7a6053bb469de0dffe
- SSDEEP 384:fyHccS+efqM7e5at0CdiSw+L0mNBrJKJ0wmQVrIUzf0tWqPWNnokwkwAetW:KHJkqM7eERYSw6ZTwHFIUAsqm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\virus\OneDrive\dokumente\visual studio 2015\Projects\Petya+\Petya+\obj\Debug\Petya+.pdb
mscoree
_CorExeMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
c325092750dd55898c47be7ec8a7622c3bf8d1a79c40b160ef7901c2ef18f5db.exe
- SHA256 c325092750dd55898c47be7ec8a7622c3bf8d1a79c40b160ef7901c2ef18f5db
- MD5 82990aad8c1a1894d7b7fd56e78c3a6b
- SHA1 8874204f4247232a98cca34e2387a3bd2a47d4ae
- SHA512 afe8d2d40e09863e17a725e42ccca1368cc2737c1234f3b6219399a5c4cab765486efe34a92561cc126aad7e0cf51f5cb77fe64d0105b84342f2f345b80ecfa9
- SSDEEP 49152:j2L+FHeMX+8S31Ife70qkBxRXAmnTa+Gq:hXKIfVqWXAcabq
- MD5 SHA1 SHA512 SSDEEP
com.lemmslen.ntdyiea
com.lemmslen.ntdyiea.irsorg
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.READ_PHONE_STATE
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
android.permission.GET_TASKS
android.permission.GET_ACCOUNTS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.WRITE_SETTINGS
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.READ_CONTACTS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.DISABLE_KEYGUARD
com.android.browser.permission.READ_HISTORY_BOOKMARKS
com.sec.android.app.sbrowser.operatorbookmarks.permission.READ_HISTORY_BOOKMARKS
android.permission.RESTART_PACKAGES
android.permission.CAMERA
com.lemmslen.ntdyiea.irsorg
android.intent.action.MAIN
com.lemmslen.ntdyiea.obseribe
android.intent.action.VIEW
com.eevraci.eidtssna.escersl
com.ctiaoui.biellano.dvsslnia
com.lemmslen.ntdyiea.snvdpb
android.system.operate
com.ctiaoui.biellano.erreedi
android.system.registat
com.ctiaoui.biellano.nheero
com.eevraci.eidtssna.atitrnss
com.eevraci.eidtssna.erenmvsu
android.net.conn.CONNECTIVITY_CHANGE
android.system.cache
com.eevraci.eidtssna.encsuler
android.intent.action.REBOOT
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.REBOOT
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.ctiaoui.biellano.olttie
android.app.action.ACTION_DEVICE_ADMIN_DISABLE_REQUESTED
android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.DEVICE_ADMIN_DISABLED
com.eevraci.eidtssna.iitroeef
c36c46f4de045ef332decc006694db6e.exe
- IMPHASH 7756f274b323bce82e17a0d440c839b4
- SHA256 4869d9a1cc95998879b95c141f1ea30518d3ea0a0dab9fe5172f80332e1b2df8
- MD5 c36c46f4de045ef332decc006694db6e
- SHA1 35e869facb8d72500cbf4f92bd89a64d2964899c
- SHA512 54ab54348f193dfb8ca39af215f5fea39c85bd9c4869a5f29cefbf76440056eefaeb016b4f49fb4a1b2ef6c6ad839d07101ef48b59ac7fb44737cece66dad1d7
- SSDEEP 1536:0krzRCHw9oa1KNvn4sBHoD/puuNNsFyVRYdvdE4zxNXGH8t/+rDCF:VrzwQ6akR4YIxNrRYdv6qxNXXEqF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4432
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LocalAlloc
GetModuleHandleA
_lclose
_lread
_lopen
GlobalAlloc
GetSystemTime
GetModuleFileNameA
Sleep
CreateThread
GetProcAddress
LoadLibraryA
Name
.text
Size
4KB
Virtual Size
637B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
4KB
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=93, version=2067,
count=3, id=93, version=2179,
count=13, id=1, productName=Unmarked objects,
count=2, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704.exe
- IMPHASH 41bf9e02ed4c4c0b039d7e7568f47ebf
- SHA256 c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704
- MD5 c386730bdddbb25dc6eeda9702c1effe
- SHA1 2caa8dbd49b3bc07b4e2d6a4f30ae8c1ab3e07f7
- SHA512 e3fd8e8ed88b4eb8453e46407fa467d022c866f399a472f29951793008363f47fae7c9fb0a34bc79582fac3eb4a3e7c10a4509a4bbcc69f42f7c992f9d205957
- SSDEEP 768:G/RZ9izj7h7723SVtXlD0NZewuqE7oOGX5/XtMpCrXZZW4wFxsqdxRp+rwFv:E9UV723SVQNZeP7oOGFtMpjsqDRlN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
lstrlenA
GetStdHandle
LocalAlloc
CreateMutexA
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
GetLastError
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetStartupInfoA
shlwapi
PathAddExtensionA
setupapi
SetupDefaultQueueCallbackA
msvcrt
__setusermatherr
_controlfp
_onexit
memmove
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__dllonexit
Name
.text
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=19, version=9049,
count=33, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3
- MD5 3a37931a0c7f2c8ec5c38b04380c69e1
- SHA1 61ac0d9783a744dfc02f4b6dd880c82e24a274b0
- SHA512 9be09704ae50a657793ddee577e69967483858aa42c92eb3403c79a195c2d11a6f84f274cb6c5e8e357b9e8627ae347d9a11a39d1549a15690765dcf1f3579da
- SSDEEP 49152:Ga8FL30rOQwir2OUXnfgwHrTi4UtqaAR1hbpTye21OR+jFlpuEKD:GaSL3KvSRnfX6qa61FdaOR6lpm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2315854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
- IMPHASH e0577a224cd97b15da521a3e570183e9
- SHA256 c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd
- MD5 00e3b69b18bfad7980c1621256ee10fa
- SHA1 b6cf6789c3b19ca82d12655274df7f9c302da794
- SHA512 30cab0ba2a1e7a8d8c2da100c1eb7e06cb36012a7f67cceee1c3388d718c29d7a3f5543a3c41e7d07aaadde14bee873f4c9b29301460d7f473e2549830576ff9
- SSDEEP 24576:8B8LCHrjTWTHTkRDene4Xgez7d7A8AA6os3xyloB183SlrwCLk:y8OHz8zkRDeeigcfBDo0ocCLk
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
78:ba:bb:85:f1:26:fb:8a:e1:fe:8e:0d:ff:ad:ba:18:c7:05:3c:2f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Adobe Systems
Chains
Jan 17, 2015
Subject
CN=Adobe Systems
Serial Number
2c:a0:28:d1:a4:de:0e:b7:43:13:5e:de:cf:74:d7:af
Issuer
CN=Adobe Systems
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 24, 2014 - Dec 31, 2039
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
1
Major OS version
5
Entry point
17450
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FindResourceA
LoadResource
Sleep
GetProcAddress
LockResource
GetModuleHandleA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
HeapSetInformation
GetLastError
HeapFree
HeapAlloc
GetModuleHandleW
ExitProcess
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
SetUnhandledExceptionFilter
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
ReadFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CloseHandle
LoadLibraryW
GetLocaleInfoW
GetStringTypeW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
GetProcessHeap
Name
.text
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
428KB
Virtual Size
427KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=158, productName=VS2010 build 30319, version=30319,
count=55, id=171, productName=VS2010 build 30319, version=30319,
count=156, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=85, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,