Unique_Icons_But_Unknown_Malware_2.rar
- SHA256 fa3f7a4c1502f499a481b56f5e7c185876626e3d00110d84e09652f98b776aff
Overview
overview
10Static
static
100811cf7c27...de.exe
windows7-x64
90dd0b31f05...24.exe
windows7-x64
71ad888606f...e0.exe
windows7-x64
31c77a07e45...95.exe
windows7-x64
1023f1c183af...bc.exe
windows7-x64
1038e891599d...90.exe
windows7-x64
103a13e092e9...db.exe
windows7-x64
43b9dabd99d...82.exe
windows7-x64
358fe9776f3...06.exe
windows7-x64
105ab93bd422...11.exe
windows7-x64
36b06c25fc6...43.exe
windows7-x64
106cc8001c9b...07.exe
windows7-x64
173ca5dd6d4...3f.exe
windows7-x64
107b931d48ea...f0.exe
windows7-x64
107d6892645b...0f.exe
windows7-x64
109036aeb570...7e.exe
windows7-x64
39b6289a8bf...2b.exe
windows7-x64
8acf2b76704...a7.exe
windows7-x64
3af2f191f8d...53.exe
windows7-x64
10cc7045d9fe...ab.dll
windows7-x64
10d1a6bd542d...a8.exe
windows7-x64
10efe947e0a8...69.exe
windows7-x64
10f13edd0b86...9f.exe
windows7-x64
10Behavioral task
behavioral1
Sample
0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral2
Sample
0dd0b31f05bd8036791494372275f393714ac18bae0f8d26a808387a0fcfe224.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
1200 seconds
Behavioral task
behavioral3
Sample
1ad888606f448d0d04c37ba11348b4c7d06f22b1cb3e8c217a21a5674bf29ce0.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral4
Sample
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral5
Sample
23f1c183af6a0322746465beeb83e79c30ba8f497cd52d60e2ed544bb7b39ebc.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral6
Sample
38e891599dad5b84356bad13b154ef7e26bb07aa651809a00369e52a54adc890.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral7
Sample
3a13e092e9c857702ad930dbd32ff7e4819151b0eab88be26d0229d95a74b6db.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
1200 seconds
Behavioral task
behavioral8
Sample
3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral9
Sample
58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806.exe
Resource
win7-20241023-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral10
Sample
5ab93bd4225586706037be1870f84d4bd124b38df01f78de5648e3e0f30b8911.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral11
Sample
6b06c25fc6181adf110e8109550698897836b5c429fe9b013b2e51a3abc05343.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
1200 seconds
Behavioral task
behavioral12
Sample
6cc8001c9b61f55dc390743a9a6adfe2de01efd983f68599b288d39d3bfb7207.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral13
Sample
73ca5dd6d49b4c296ee1304aaac2e5fde01156800b538354fd27366df5b9323f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral14
Sample
7b931d48eafa703a99ca7f104daf9a7343b6f1161d49073b86f5a4700864d3f0.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
1200 seconds
Behavioral task
behavioral15
Sample
7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
1200 seconds
Behavioral task
behavioral16
Sample
9036aeb570b22497c0f937e7edcef624800426011f0193a2b78c7f124e3a4c7e.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral17
Sample
9b6289a8bf3eab91297cc6d01215b06f4d979a81656eb80bc0ae6d3b7e8b112b.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
1200 seconds
Behavioral task
behavioral18
Sample
acf2b767040e546b689b4f1724569fd9992189ba2035654cfbf866b933e5b1a7.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
1200 seconds
Behavioral task
behavioral19
Sample
af2f191f8d2199d74867e9b1b9071e677c91b24d529d17b83ff04d0f03098a53.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral20
Sample
cc7045d9fe77c4aa4cb646d01fb4700008a34f58f49358d0b0b0997d21016aab.dll
Resource
win7-20241023-en
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral21
Sample
d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral22
Sample
efe947e0a8842997d152af946ef0293a972cc11662f3c62a8461bc4a07427669.exe
Resource
win7-20240729-en
windows7-x64
15 signatures
1200 seconds
Behavioral task
behavioral23
Sample
f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f.exe
Resource
win7-20241010-en
windows7-x64
19 signatures
1200 seconds
General
- Target Unique_Icons_But_Unknown_Malware_2.rar
- Size 2.3MB
- Sample241127-le54astrfj
- SHA256 fa3f7a4c1502f499a481b56f5e7c185876626e3d00110d84e09652f98b776aff
- MD5 5d4b7054cd11fb441757a5c52e41759b
- SHA1 08956bd2dff30ecc33f7489ab9c1a8c142812e6c
- SHA512 96fab5476cd758aa76c683810e485ae0adcdcbc9938f33ff71968367ef4664d62a79975cde6e5071427135a5073f11c1f55b36b73f88d86b96dcfd3e0ba13122
- SSDEEP 49152:kdXUkI/XI52rHPNoZ/jV3DcVVcgGTYWLanJ6:aXk/IAzPMxDcVM8WLaJ6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
HacKed
C2
-
cheat12.ddns.net:57
Mutex
-
a412988a99c974058615f1975119a5d1
Attributes
-
reg_key
a412988a99c974058615f1975119a5d1
-
splitter
|'|'|
Extracted
Family
-
blacknet
Botnet
-
HacKed
C2
-
https://xblackeyex.000webhostapp.com/blacknet/
Mutex
-
BN[SNqrYexG-0655563]
Attributes
-
antivm
false
-
elevate_uac
false
-
install_name
svchost.exe
-
splitter
|BN|
-
start_name
17d5d9a29524a220af2c5580f0145c42
-
startup
false
-
usb_spread
false
Extracted
Family
-
pony
C2
-
http://butterchoco.net/admin/bull/gate.php
Signatures
- BlackNET payload 1 IoCs
resource yara_rule static1/unpack001/7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe family_blacknet - Blacknet family
- Chaos Ransomware 1 IoCs
resource yara_rule static1/unpack001/f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f.exe family_chaos - Chaos family
- Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule static1/unpack001/d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe family_mafiaware666 - Eternity family
- Mafiaware666 family
- Njrat family
- Pony family
- Unsigned PE 19 IoCs
Checks for missing Authenticode signature.
resource unpack001/0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe unpack001/0dd0b31f05bd8036791494372275f393714ac18bae0f8d26a808387a0fcfe224.exe unpack001/1ad888606f448d0d04c37ba11348b4c7d06f22b1cb3e8c217a21a5674bf29ce0.exe unpack001/1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe unpack001/23f1c183af6a0322746465beeb83e79c30ba8f497cd52d60e2ed544bb7b39ebc.exe unpack001/38e891599dad5b84356bad13b154ef7e26bb07aa651809a00369e52a54adc890.exe unpack001/3a13e092e9c857702ad930dbd32ff7e4819151b0eab88be26d0229d95a74b6db.exe unpack001/58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806.exe unpack001/6b06c25fc6181adf110e8109550698897836b5c429fe9b013b2e51a3abc05343.exe unpack001/6cc8001c9b61f55dc390743a9a6adfe2de01efd983f68599b288d39d3bfb7207.exe unpack001/7b931d48eafa703a99ca7f104daf9a7343b6f1161d49073b86f5a4700864d3f0.exe unpack001/7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe unpack001/9b6289a8bf3eab91297cc6d01215b06f4d979a81656eb80bc0ae6d3b7e8b112b.exe unpack001/acf2b767040e546b689b4f1724569fd9992189ba2035654cfbf866b933e5b1a7.exe unpack001/af2f191f8d2199d74867e9b1b9071e677c91b24d529d17b83ff04d0f03098a53.exe unpack001/cc7045d9fe77c4aa4cb646d01fb4700008a34f58f49358d0b0b0997d21016aab.exe unpack001/d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe unpack001/efe947e0a8842997d152af946ef0293a972cc11662f3c62a8461bc4a07427669.exe unpack001/f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f.exe
File Explorer
-
Unique_Icons_But_Unknown_Malware_2.rar.rar 2.3MB
-
0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe.exe 258KB
-
0dd0b31f05bd8036791494372275f393714ac18bae0f8d26a808387a0fcfe224.exe.exe 184KB
-
1ad888606f448d0d04c37ba11348b4c7d06f22b1cb3e8c217a21a5674bf29ce0.exe.exe 188KB
-
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe.exe 114KB
-
23f1c183af6a0322746465beeb83e79c30ba8f497cd52d60e2ed544bb7b39ebc.exe.exe 169KB
-
38e891599dad5b84356bad13b154ef7e26bb07aa651809a00369e52a54adc890.exe.exe 265KB
-
3a13e092e9c857702ad930dbd32ff7e4819151b0eab88be26d0229d95a74b6db.exe.exe 184KB
-
3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82.exe.exe 185KB
-
58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806.exe.exe 506KB
-
5ab93bd4225586706037be1870f84d4bd124b38df01f78de5648e3e0f30b8911.exe.exe 189KB
-
6b06c25fc6181adf110e8109550698897836b5c429fe9b013b2e51a3abc05343.exe.exe 156KB
-
6cc8001c9b61f55dc390743a9a6adfe2de01efd983f68599b288d39d3bfb7207.exe.exe 156KB
-
73ca5dd6d49b4c296ee1304aaac2e5fde01156800b538354fd27366df5b9323f.exe.exe 212KB
-
7b931d48eafa703a99ca7f104daf9a7343b6f1161d49073b86f5a4700864d3f0.exe.exe 82KB
-
7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe.exe 247KB
-
9036aeb570b22497c0f937e7edcef624800426011f0193a2b78c7f124e3a4c7e.exe.exe 87KB
-
9b6289a8bf3eab91297cc6d01215b06f4d979a81656eb80bc0ae6d3b7e8b112b.exe.exe 86KB
-
acf2b767040e546b689b4f1724569fd9992189ba2035654cfbf866b933e5b1a7.exe.exe 253KB
-
af2f191f8d2199d74867e9b1b9071e677c91b24d529d17b83ff04d0f03098a53.exe.exe 317KB
-
cc7045d9fe77c4aa4cb646d01fb4700008a34f58f49358d0b0b0997d21016aab.exe.dll 256KB
-
d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe.exe 273KB
-
efe947e0a8842997d152af946ef0293a972cc11662f3c62a8461bc4a07427669.exe.exe 161KB
-
f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f.exe.exe 188KB
0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de
- MD5 54465f04a6075b8e68f272d09b243e81
- SHA1 49bee4626e538e0d7a0e034e36c04e5949ccddfd
- SHA512 e177d2bd9fe7722a582e3c93ed9ccd25d9b0ebe0818b425d040088744aade3ae848f9ade3be28d70651af08484a9245b1db8fd2fb897f03c1d4c0332847dff0c
- SSDEEP 3072:cmTn8N2QAzgfJkP7+TPbPT/vn/Q7rF48D2W6yop7+TPbPT/vn/Q7jF48DbF62Ime:cX7AYkkT47uC2Wno2T472CbFzXV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
157414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\User\Source\data\installer\installer\obj\Release\installer.pdb
mscoree
_CorExeMain
Name
.text
Size
146KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
0dd0b31f05bd8036791494372275f393714ac18bae0f8d26a808387a0fcfe224.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0dd0b31f05bd8036791494372275f393714ac18bae0f8d26a808387a0fcfe224
- MD5 9982685953def8f730e37c9fab083076
- SHA1 0ff503764a952733f5f2c69cc4ebc9add47eb023
- SHA512 4a1dd5124e5655c5b060df8ddbe2e00c97fa047cf05472dfa5e75c2a2c8093f734b9674a62fd81967498b7155533a4415ec37cb334163f4bfe58e75797d7325c
- SSDEEP 3072:LA1wctAHKZRX9k8KvdoItwUeQzpnGlRuu4KXIzPCyZXK0lNOzzzzzYZt1xrWfew:M1ltAHKZRX9YmuVeopnGh4zRZ/FZRdw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
178242
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
1ad888606f448d0d04c37ba11348b4c7d06f22b1cb3e8c217a21a5674bf29ce0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1ad888606f448d0d04c37ba11348b4c7d06f22b1cb3e8c217a21a5674bf29ce0
- MD5 fe3939ed3ab1b6c8e93187e9dedee944
- SHA1 9d6d0fea98e4d6ba614d9c1bdc24d2e83451b228
- SHA512 7bd8efaa55c99728dd968c855b555a5816e17fd3c434f9dbdc3cf5458e3c273c812c4b366508e3e641ca5c1c68643fc5015d62a06b2812deb9bc21b8ce75c7f6
- SSDEEP 3072:GqkghNWHKnYVpJBKvCzZpatl3QxP61p/JULwIjXaNKZRoW5vj/jh42qk:GqXmlpr6nnIj6KZRosLck
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
182350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\PC_CONTENTS\MY_TOOLS\Unpackers\MegaDumper\MegaDumper\obj\x86\Debug\MegaDumper.pdb
mscoree
_CorExeMain
Name
.text
Size
172KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695
- MD5 e534402738b11f52fd1991e2c63f816f
- SHA1 5b166f3f830a9f6a3b2e581321c6541819c31771
- SHA512 b8c8c91c9846e54843098654f6ff52907c58424a8002a67cfe89af1b0905e4ac9c31afa3d407947acff14bc7aa42715f1dba2fb9f11d8e4728cf3823f831858d
- SSDEEP 3072:Rg3cVWuLhZtblN5w1/zE5Id0bpeoXErZju:RdVWsfzO1gY0b7XErZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
104750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
23f1c183af6a0322746465beeb83e79c30ba8f497cd52d60e2ed544bb7b39ebc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 23f1c183af6a0322746465beeb83e79c30ba8f497cd52d60e2ed544bb7b39ebc
- MD5 4f3006a594b5508cd7d86a8e3823aac3
- SHA1 516cb26210726d34709d9a6749909ad025ff6727
- SHA512 24530cdb5fb808e5ff4e2e11a32a5f9ed1706ca66884fd077da60f6b5603cc6d5d1a5c574a3a12bcb2c6e1845c3744e86740dbb6bada90d979ff2d80c530cbd5
- SSDEEP 3072:OO8I0hNYpeUoZnXJduG1SNHGM/H4B99VH5AxuGpMS83Q9LZV:0NY4UoZnXJduG1S40kDZAxuO8K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
38e891599dad5b84356bad13b154ef7e26bb07aa651809a00369e52a54adc890.exe
- IMPHASH 2469bdeec834e1080ec1d36ede2b8455
- SHA256 38e891599dad5b84356bad13b154ef7e26bb07aa651809a00369e52a54adc890
- MD5 048df8f057b4ec78233640a09dd80e9b
- SHA1 de16d030b3f5b067e5663eb1d75d2498c00d6817
- SHA512 d0cd4ce4c9d930866e269d9f44d44f79d24811d47cc700433c3611a287585b72fdc6d0ab38d07a1c3b76533d5ffd7756248d5ef68b7fe5c5218d631521d5e1b8
- SSDEEP 3072:4OUEH7tRFNhHm/4FBVlhmhvXsk/GYtnkAtc3MmJNz7YaoXryNnv0uLT+K/5XK3mL:B7t9hpHlIt/GYiJV7Yaq2nvNLT7/I3m
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15466
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Spell\Travel\complete\Landlone.pdb
kernel32
InitializeCriticalSectionAndSpinCount
DecodePointer
SetEndOfFile
WriteConsoleW
HeapReAlloc
HeapSize
FlushFileBuffers
CreateFileW
GetConsoleCP
GetProcessHeap
GetStringTypeW
SetStdHandle
LCMapStringW
GetExitCodeProcess
lstrcmpiA
FindFirstChangeNotificationA
ResetEvent
DeleteFileA
TlsAlloc
GetCurrentThread
OpenMutexA
GetTempPathA
Sleep
DuplicateHandle
lstrcmpA
CreateMutexA
GetEnvironmentVariableA
PeekNamedPipe
FindNextFileA
VirtualProtect
TlsSetValue
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
EncodePointer
RaiseException
GetLastError
GetModuleFileNameW
SetLastError
RtlUnwind
FindFirstFileA
TlsGetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReadFile
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
CloseHandle
FindClose
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
GetWindowLongA
GetKeyNameTextA
IsDlgButtonChecked
CallNextHookEx
EnumWindows
ReleaseDC
DefWindowProcA
DrawIconEx
DrawEdge
GetClassInfoExA
gdi32
IntersectClipRect
EndPage
RestoreDC
CreateFontIndirectA
Rectangle
LineTo
SetBkMode
StartDocA
ExtTextOutA
comctl32
ImageList_Destroy
ImageList_SetIconSize
ImageList_GetImageCount
ImageList_SetBkColor
ImageList_AddMasked
ImageList_Remove
ole32
CoRegisterClassObject
CoUninitialize
CoInitialize
CoRegisterSurrogate
shlwapi
SHRegCloseUSKey
SHRegWriteUSValueA
StrToIntA
SHRegCreateUSKeyA
PathFindFileNameA
advapi32
SystemFunction036
OpenServiceA
OpenThreadToken
RegOpenKeyExA
InitializeSecurityDescriptor
FreeSid
OpenProcessToken
ControlService
SetSecurityDescriptorDacl
SetEntriesInAclA
CreateServiceW
RegCloseKey
StartServiceCtrlDispatcherA
QueryServiceStatus
RegDeleteKeyA
RegQueryValueExA
AllocateAndInitializeSid
LookupPrivilegeValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenSCManagerA
RegCreateKeyExA
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmNotifyIME
ImmSetCompositionFontA
ImmGetCompositionStringA
Name
.text
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
292B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=241, version=40116,
count=135, id=243, version=40116,
count=24, id=242, version=40116,
count=20, id=259, version=23406,
count=18, id=260, version=23406,
count=37, id=261, version=23406,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=164, id=1, productName=Unmarked objects,
count=1, id=265, version=23506,
count=1, id=255, productName=VS2015 UPD1 build 23506, version=23506,
count=1, id=258, productName=VS2015 UPD1 build 23506, version=23506,
3a13e092e9c857702ad930dbd32ff7e4819151b0eab88be26d0229d95a74b6db.exe
- IMPHASH 1d46cc82ecd324ef15e6b3920d944eb3
- SHA256 3a13e092e9c857702ad930dbd32ff7e4819151b0eab88be26d0229d95a74b6db
- MD5 bddda24ea5eb8c90d4515f455e15ccd2
- SHA1 13643d56b16c171d46f3c5b23795d42714abcfb7
- SHA512 019d388cc938832a40b3b37bdbaeeca3dfa46916566adcd7f6aadaec053b0b9a19765b0ab64a3006a072dfe0c3892dd2efd88416c2ac576fe39bcc4fb670d701
- SSDEEP 3072:93a8ANAzn6PkNQHxT8SZzITXXJeX6trAXy:93jYNUTHJeWAi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
19203
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\源码\i2\i2\vs2017\Release\WindowsProject1.pdb
kernel32
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
Sleep
ExitProcess
VirtualAlloc
VirtualProtect
VirtualFree
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryA
CopyFileW
IsBadReadPtr
UnhandledExceptionFilter
LocalFree
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
ole32
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
msvcp140
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
vcruntime140
_CxxThrowException
_except_handler4_common
memmove
__std_exception_destroy
__std_exception_copy
__std_terminate
memset
__CxxFrameHandler3
memcpy
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_initterm_e
exit
_get_wide_winmain_command_line
_initialize_wide_environment
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_configure_wide_argv
_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_cexit
_initterm
api-ms-win-crt-environment-l1-1-0
_wgetenv
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vfprintf
ungetc
__acrt_iob_func
_get_stream_buffer_pointers
fclose
setvbuf
fwrite
_fseeki64
fflush
fread
fputc
fgetpos
fgetc
fsetpos
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-heap-l1-1-0
free
_callnewh
_set_new_mode
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
70KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=262, version=26213,
count=4, id=257, version=26706,
count=30, id=261, version=26706,
count=12, id=260, version=26706,
count=6, id=259, version=26706,
count=9, id=257, version=26213,
count=157, id=1, productName=Unmarked objects,
count=3, id=261, version=27032,
count=1, id=255, version=27032,
count=1, id=151,
count=1, id=258, version=27032,
3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82.exe
- IMPHASH ec7603dfc11290c5ea59ede1b41eac50
- SHA256 3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82
- MD5 76ef16e94f77454aaffdfa4c700be85f
- SHA1 9b45b3826706337a11e43248095fb2c62e42d14d
- SHA512 4185cf9393877fd6d80ecfb7290c10d40a62fc7013d175e5fc91df56870500ea33b518e4f55b4e7d8a7865d3f7707fb5f49f621d5d944bb1edffda4734f99d53
- SSDEEP 3072:fNCpBPbYsMn1mx6nWGdN6YROBxQo6PfSPgHvUJjX1qINSxT3OIpkApPxn:fNiGC6nWGdN6YO6Pf9vAjX1qINGLdRz
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
55:7e:59:12:c0:ed:63:3a:cb:5b:e7:da:2f:6c:23:99:5e:d6:5d:d2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Chains
Nov 26, 2024
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Serial Number
4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6d
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 7, 2007 - Dec 10, 2008
Minor OS version
0
Major OS version
4
Entry point
75130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
_TrackMouseEvent
ord17
msvfw32
MCIWndCreateW
MCIWndCreateA
winmm
waveOutSetVolume
waveOutGetVolume
PlaySoundA
waveOutGetNumDevs
shlwapi
PathRemoveFileSpecW
kernel32
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
SetLastError
GetOEMCP
GetACP
SetEndOfFile
CreateFileA
FlushFileBuffers
SetStdHandle
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
IsBadCodePtr
IsBadReadPtr
SetFilePointer
GetStringTypeA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetCommandLineW
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
CompareStringA
WaitForSingleObject
CloseHandle
DeviceIoControl
MulDiv
FreeLibrary
Sleep
ReleaseMutex
GetLastError
GetUserDefaultLCID
GetUserDefaultUILanguage
GetSystemDefaultLangID
WriteFile
ReadFile
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
SetEnvironmentVariableA
HeapSize
HeapReAlloc
RtlUnwind
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
RaiseException
ExitProcess
TerminateProcess
GetCurrentProcess
GetVersionExA
HeapAlloc
HeapFree
LCMapStringA
user32
DestroyIcon
GetSystemMetrics
SetFocus
BeginPaint
FillRect
DrawEdge
keybd_event
SetForegroundWindow
UpdateWindow
TranslateMessage
ReleaseDC
GetAsyncKeyState
SetCursor
EndPaint
RedrawWindow
MoveWindow
GetIconInfo
CreateIconIndirect
GetClientRect
InvalidateRect
ShowWindow
PostQuitMessage
DrawIconEx
SetRect
GetDC
GetWindowRect
gdi32
CreateSolidBrush
GetStockObject
PatBlt
CreateCompatibleBitmap
CreateCompatibleDC
SetTextAlign
SetLayout
LineTo
SetBkMode
StretchBlt
BitBlt
SetTextColor
CreatePenIndirect
SelectObject
MoveToEx
Polyline
DeleteObject
DeleteDC
advapi32
RegQueryValueA
RegCloseKey
Name
.text
Size
116KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
538KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=131, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=10, id=93, version=2179,
count=5, id=25, version=9210,
count=133, id=1, productName=Unmarked objects,
count=52, id=105, version=2067,
count=54, id=95, version=2179,
count=27, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806.exe
- IMPHASH 4c3d146415a27e5b2b768097598f2851
- SHA256 58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806
- MD5 65cf08ffaf12e47de8cd37098aac5b33
- SHA1 68f823b5572c628d5f8b5b0665ed7d54d85b443f
- SHA512 81850cc1cb702ea9833b5e1afd3c90b294969ea635b3dc6513c24fb6d88b38e6b7f47d39fc217cc645f70e7528b0eb08a1f9d29089b2792a30bbdbdaa1b0369c
- SSDEEP 12288:ArrVAOlxCOHj4yyVgxhDOpAdvaiv/+24yX5dSwlK:ArZAzRyCaDPvbv/9Xa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33802
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\random\fucking\path\to\fucking\idiotic\nonexisting\file\with\pdb\extension.pdb
kernel32
GetProcAddress
VirtualAlloc
ExitProcess
GetModuleHandleW
WriteFile
OpenProcess
Sleep
CreateFileW
ExitThread
GetLastError
OutputDebugStringA
CloseHandle
CreateThread
SetStdHandle
SetFilePointerEx
GetStringTypeW
ReadConsoleW
EncodePointer
DecodePointer
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapSize
HeapFree
RaiseException
HeapAlloc
SetLastError
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
LoadLibraryExW
HeapReAlloc
LCMapStringW
OutputDebugStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
WriteConsoleW
user32
CreateWindowExA
PostMessageA
MessageBoxA
Name
.text
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
369KB
Virtual Size
376KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=225, version=20806,
count=23, id=223, version=20806,
count=119, id=224, version=20806,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=92, id=1, productName=Unmarked objects,
count=3, id=228, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 build 21005, version=21005,
5ab93bd4225586706037be1870f84d4bd124b38df01f78de5648e3e0f30b8911.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5ab93bd4225586706037be1870f84d4bd124b38df01f78de5648e3e0f30b8911
- MD5 edf55c47be55365e15be64ed8240fbf0
- SHA1 e240ec08e175e7a9739c4f3e3b9797c6f8f27d6a
- SHA512 aaa439ca2bcf0ee832f54942b37960f66262d696e4964244e5c3c47209c173de803de46e567efc9df5d2af34cafcf1049cd5a247c0049b6dfdaf5091b320247a
- SSDEEP 1536:/y29YoWallrxCka5FMXKe0fobM/zrzhzrY:K297rVKFKKe0fobM/dg
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
8c:e3:1b:2b:4e:1a:03:92:e0:3f:49:b9:66:60:f3:db:ba:b7:48:49:e5:cd:e4:9f:d3:ab:8a:9c:0a:48:1d:87
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 26, 2024
PE Signature issue
Digest
8c:e3:1b:2b:4e:1a:03:92:e0:3f:49:b9:66:60:f3:db:ba:b7:48:49:e5:cd:e4:9f:d3:ab:8a:9c:0a:48:1d:87
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:25:48:b2:9d:0e:7f:c5:f4:1f:00:00:00:00:03:25
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8a:07:37:33:cf:20:48:89:3c:00:00:00:00:01:8a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
13182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
6b06c25fc6181adf110e8109550698897836b5c429fe9b013b2e51a3abc05343.exe
- IMPHASH f4c0c0105b7e9220f8a3864a384e3519
- SHA256 6b06c25fc6181adf110e8109550698897836b5c429fe9b013b2e51a3abc05343
- MD5 d6d75850a2ec8570b1e0217dde3b6ac7
- SHA1 a695229c100ede35204da2081fff6769f4d30ecb
- SHA512 2d9d2b6397498e9179b514fa5796f1297f128f658dec5c9635e12c91abcbe10ecd55b31072cec9c90514a120ca41b39e540400895b4aa2ae5ba87baac00b2bc4
- SSDEEP 1536:nhoA+BcD5sIa36HMFlS31U7lTve2Ya2ChJKzOuIzGv:CA+mD5s13/HTvZnEJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5424
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaStrI2
_CIcos
_adj_fptan
__vbaFreeVar
ord588
__vbaFreeVarList
_adj_fdiv_m64
ord513
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
ord660
__vbaHresultCheckObj
ord662
ord557
_adj_fdiv_m32
ord666
__vbaAryDestruct
ord591
__vbaLateMemSt
__vbaObjSet
ord595
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
ord529
__vbaAryConstruct2
__vbaVarTstEq
__vbaObjVar
_adj_fpatan
ord569
ord677
EVENT_SINK_Release
ord679
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord713
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaStrVarVal
ord536
_CIlog
ord646
__vbaNew2
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
ord573
__vbaStrCopy
ord682
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
ord610
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
ord615
__vbaVarLateMemCallLd
ord616
__vbaFpI4
__vbaLateMemCallLd
_CIatan
ord540
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
Name
.text
Size
144KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=5, id=9, version=8783,
count=1, id=13, version=9782,
6cc8001c9b61f55dc390743a9a6adfe2de01efd983f68599b288d39d3bfb7207.exe
- SHA256 6cc8001c9b61f55dc390743a9a6adfe2de01efd983f68599b288d39d3bfb7207
- MD5 693701db23a12f69c6f8a47fde7e8ada
- SHA1 c72997afaf96010c2ba2a53631395fc355ffc252
- SHA512 09471a5757098227780f6c8a9ca61cb4cf7f33c97858855f35332699e85e8c576e63630f98927887c61554cbb2ac94f91013b2c7fb7f5eae64709393eaefa2dd
- SSDEEP 1536:s4plMDQqy8HvtyzXJCUJ1he3mDL0ZiZpBJ1fi/dPUZJ/CeXgiD3W38QsGK7MlZcw:LpmDRXvtMJCU7DzpBhJZMIB7aOQj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\qb\workspace\19992\p4gen\gfx_Development\SourceCUI\GfxDownloadWrapper\obj\x64\Release\GfxDownloadWrapper.pdb
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
73ca5dd6d49b4c296ee1304aaac2e5fde01156800b538354fd27366df5b9323f.exe
- IMPHASH 12c0f256818a0032e7fc8a4fe9b667ee
- SHA256 73ca5dd6d49b4c296ee1304aaac2e5fde01156800b538354fd27366df5b9323f
- MD5 43b55685945d2cecc170b850cf622038
- SHA1 3b301a8a8a38dddd3cfb554b264342f9948102b0
- SHA512 ba08284c9c07150f68fc92be46cdf058caa0b6f9b25135cc2716c286efdbcfd59d79f5bf211260d900ac3fd8fe78b582010ae8985b2f240829c9b94020ae7a65
- SSDEEP 3072:DNDzKKCY4RZzOo8u2IJskwUu25iiik4l9ep6RHpm0/d2IK9EzB2tPNxBWg3facbN:pDGKClZl8P6KVRH83TtVf33bncxfq
- MD5 SHA1 SHA512 SSDEEP
Digest
06:f6:4d:5e:1a:07:2d:d9:0f:b4:49:4c:dd:10:3a:49:83:3e:fa:10
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=MYSINGLESOURCE LTD,O=MYSINGLESOURCE LTD,POSTALCODE=GU34 5B,STREET=21 Kingswood Rise\, Four Marks\, \, United Kingdom\, GU34 5B,L=Alton,ST=Hampshire,C=GB
Chains
Feb 22, 2019
CN=MYSINGLESOURCE LTD,O=MYSINGLESOURCE LTD,POSTALCODE=GU34 5B,STREET=21 Kingswood Rise\, Four Marks\, \, United Kingdom\, GU34 5B,L=Alton,ST=Hampshire,C=GB
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=MYSINGLESOURCE LTD,O=MYSINGLESOURCE LTD,POSTALCODE=GU34 5B,STREET=21 Kingswood Rise\, Four Marks\, \, United Kingdom\, GU34 5B,L=Alton,ST=Hampshire,C=GB
Serial Number
73:e6:ae:dc:8c:44:d8:72:f1:55:d7:41:d1:10:f6:20
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 4, 2019 - Feb 4, 2020
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 1, 2010 - Jan 18, 2038
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
126604
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
comctl32
ord17
shell32
ShellExecuteW
SHBrowseForFolderW
ShellExecuteExW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW
SHGetMalloc
gdi32
CreateCompatibleDC
CreateFontIndirectW
DeleteObject
DeleteDC
GetCurrentObject
StretchBlt
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
GetObjectW
advapi32
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
user32
EnableMenuItem
IsWindow
EnableWindow
MessageBeep
LoadIconW
LoadImageW
SetWindowsHookExW
PtInRect
CallNextHookEx
DefWindowProcW
CallWindowProcW
DrawIconEx
DialogBoxIndirectParamW
GetWindow
ClientToScreen
GetDC
DrawTextW
ShowWindow
SystemParametersInfoW
GetSystemMetrics
SetFocus
UnhookWindowsHookEx
GetWindowLongPtrW
SetWindowLongPtrW
GetClientRect
GetSystemMenu
GetKeyState
MessageBoxA
GetSysColor
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
wsprintfA
GetClassNameA
GetWindowLongW
GetMenu
SetWindowPos
GetWindowDC
ReleaseDC
CopyImage
GetParent
GetWindowRect
ScreenToClient
CreateWindowExW
SetTimer
GetMessageW
CreateWindowExA
KillTimer
DestroyWindow
CharUpperW
DispatchMessageW
EndDialog
wsprintfW
MessageBoxW
wvsprintfW
GetDlgItem
SendMessageW
ole32
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
VariantClear
SysAllocStringLen
OleLoadPicture
SysAllocString
kernel32
GetFileInformationByHandle
WaitForMultipleObjects
VirtualAlloc
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
VirtualFree
SetEndOfFile
SetFileTime
ReadFile
SetFilePointer
GetFileSize
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FormatMessageW
lstrcpyW
LocalFree
IsBadReadPtr
SuspendThread
TerminateThread
GetSystemDirectoryW
GetCurrentThreadId
SetCurrentDirectoryA
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
GetVersionExW
GetModuleFileNameW
GetCurrentProcess
SetProcessWorkingSetSize
SetEnvironmentVariableW
GetDriveTypeW
CreateFileW
LoadLibraryA
SetThreadLocale
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
CompareFileTime
WideCharToMultiByte
GetTempPathW
FindFirstFileW
lstrcmpW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
GetEnvironmentVariableW
lstrcmpiW
GetLocaleInfoW
MultiByteToWideChar
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetSystemDefaultLCID
lstrcmpiA
GlobalAlloc
GlobalFree
MulDiv
FindResourceExA
SizeofResource
LoadResource
LockResource
GetProcAddress
GetModuleHandleW
GetStdHandle
WriteFile
lstrlenA
CreateDirectoryW
GetFileAttributesW
lstrlenW
GetLocalTime
SystemTimeToFileTime
CreateThread
GetExitCodeThread
ExitProcess
lstrcatW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
CloseHandle
WaitForSingleObject
GetExitCodeProcess
GetQueuedCompletionStatus
ResumeThread
SetInformationJobObject
CreateIoCompletionPort
AssignProcessToJobObject
CreateJobObjectW
GetLastError
CreateProcessW
GetStartupInfoW
GetCommandLineW
SetLastError
SetCurrentDirectoryW
GetDiskFreeSpaceExW
SetFileAttributesW
Sleep
GetCurrentProcessId
msvcrt
__CxxFrameHandler
??3@YAXPEAX@Z
memset
_wtol
_purecall
memcmp
??2@YAPEAX_K@Z
_wcsnicmp
memmove
memcpy
strncpy
wcsncpy
wcsncmp
strncmp
?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z
_beginthreadex
wcscmp
_CxxThrowException
wcsstr
free
malloc
__C_specific_handler
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UEAA@XZ
__getmainargs
_XcptFilter
_exit
_ismbblead
_cexit
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
Name
.text
Size
121KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
7b931d48eafa703a99ca7f104daf9a7343b6f1161d49073b86f5a4700864d3f0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7b931d48eafa703a99ca7f104daf9a7343b6f1161d49073b86f5a4700864d3f0
- MD5 71168fd55a8d0cc983b653566d942efc
- SHA1 732906708ad72b0f41bbe8937d2b2014758dd18a
- SHA512 fe374f46eb82c7bed927b48b45896ae3a0d118171e2be248905e2e14306e0c85ae4b34521b1c0af90cb2bb6f7fe45800d289ce36b4921067aeea3e9c2a9a0842
- SSDEEP 768:569iQap3x5Mt/+E6kmzVmh8uVHI5432rufLRoYFIk1eUwHXPmI+mL:o9m5Mt/+EtmzVs8ui+3IyRbykUHfFh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
84062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
G:\ravdhksam\ravdhksam\obj\Debug\ravdhksam.pdb
mscoree
_CorExeMain
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f
- MD5 312e0a90fe8474691950d41e57bfb003
- SHA1 f8185c7943c6e93b75c0cec34daf2eccd7db848b
- SHA512 511b9029002da76cceaa9fc2a47aebfe6a365f3588614094ec8bddaaad80305fe79ba45d9a1cb23ca0c1d1572eb5106073fac033b644df5e867a13db69e39678
- SSDEEP 3072:FYl5q4euWjwNpbF3onQ7twT12Hd+d9nVap5Ty6dz6m:yTqgWcbF/7twTWm64
- MD5 SHA1 SHA512 SSDEEP
-
BlackNET payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
65342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
190KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
9036aeb570b22497c0f937e7edcef624800426011f0193a2b78c7f124e3a4c7e.exe
- IMPHASH ba8df9c8faad61510a4a5d848be97a10
- SHA256 9036aeb570b22497c0f937e7edcef624800426011f0193a2b78c7f124e3a4c7e
- MD5 cd9dca1277ac7597aaff4d93c866692b
- SHA1 2446eb432aee7ea6a387db50623bfa1c7dd9d515
- SHA512 0e826ee27ffb6299071db1c363e48e81b9e5f8278d648048e95ee437ba23d127d63ec0cc67aeb25c74929c51d79ca24ab14d27756a76fd988758bf29f32ba9c7
- SSDEEP 1536:IooxEzyAtoLcNDsWjcdYj5x0Et+supkyxFCELwDXFai2Q:I34FtJsc5N+sarLcf2Q
- MD5 SHA1 SHA512 SSDEEP
Digest
e8:f9:ba:73:64:ba:d9:df:75:c8:b2:0f:c2:93:e8:07:d6:92:d3:c7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=628941,CN=OM SECURE PROTECTION SERVICES LIMITED,O=OM SECURE PROTECTION SERVICES LIMITED,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Chains
Nov 13, 2019
SERIALNUMBER=628941,CN=OM SECURE PROTECTION SERVICES LIMITED,O=OM SECURE PROTECTION SERVICES LIMITED,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
SERIALNUMBER=628941,CN=OM SECURE PROTECTION SERVICES LIMITED,O=OM SECURE PROTECTION SERVICES LIMITED,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Serial Number
09:ad:30:22:5b:bb:6c:63:61:4a:1a:54:88:e0:95:6e
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 14, 2019 - Aug 20, 2020
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
6
Entry point
5938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateProcessA
CloseHandle
CreateFileA
GetFileSize
ReadFile
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapSize
GetStringTypeW
WideCharToMultiByte
HeapReAlloc
RtlUnwind
LoadLibraryW
OutputDebugStringW
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
GetLastError
SetLastError
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
HeapFree
Sleep
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
CreateFileW
user32
EndDialog
PostQuitMessage
EndPaint
BeginPaint
DefWindowProcW
DestroyWindow
DialogBoxParamW
UpdateWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
LoadStringW
ShowWindow
shell32
SHGetFolderPathA
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=207, version=50929,
count=10, id=205, version=50929,
count=86, id=206, version=50929,
count=101, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=2, id=211, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
9b6289a8bf3eab91297cc6d01215b06f4d979a81656eb80bc0ae6d3b7e8b112b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9b6289a8bf3eab91297cc6d01215b06f4d979a81656eb80bc0ae6d3b7e8b112b
- MD5 0fdc37659fc3457c7a5a65cd0a7f60df
- SHA1 80be5349ebe8ab391303cc4b9045ffbf7c8a4ce2
- SHA512 22ffd409d8b802c6fe811d2afeaf29fb2922493a01edc8ec620224d5405e8a8e1bef9fb4784dff791269ee14aca4068324e869b221c48dfce4e4561bd82ba8c4
- SSDEEP 1536:za5jmXUnxNeqxUNzUpBnyduZFnb3IilknvMZGvbDYs6Wi7P+:e5jmXULeHN4pBf33IVvTbEs6Wi7P+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
77390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
acf2b767040e546b689b4f1724569fd9992189ba2035654cfbf866b933e5b1a7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 acf2b767040e546b689b4f1724569fd9992189ba2035654cfbf866b933e5b1a7
- MD5 f5a44dcdc172eda48524f913e8a9b1b6
- SHA1 f57bd06d5d94a470d11daa7f8baa31a59e9cff00
- SHA512 ea74f74fa86dbe0a2a094b0389733655bbf39b902ab215fc52c72b788a5472c0541aa2f8d0f29c26cee0720f086682e01a83c7d21f87634f36d9dd6c16508cbd
- SSDEEP 6144:yvnWcO9CKmdUpn7OSZht+VN0Bd3YGZUyJAb4tYKBg:y/oCKmdUzht+VNUYGdtm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
185278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\VB\HiDDen PerSOn NotePad\HiDDen PerSOn NotePad\obj\x86\Release\HiDDen PerSOn NotePad.pdb
mscoree
_CorExeMain
Name
.text
Size
173KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
af2f191f8d2199d74867e9b1b9071e677c91b24d529d17b83ff04d0f03098a53.exe
- SHA256 af2f191f8d2199d74867e9b1b9071e677c91b24d529d17b83ff04d0f03098a53
- MD5 ba86b03b4a7416194db00e101051273f
- SHA1 951e60b7acbb3c05f8e02bc0148abda7c8e22dca
- SHA512 48233e887d770dc074f6e2a91b04484c275afa548025d240b55de8516d4cc3fb40e083eedcef288e6791acfaadf14ae2d9fe9392185e3d2c4eb8a68446b19d62
- SSDEEP 6144:pbFCWw8bLymcsPKQ/bBltLL8+8jtmMBylDA0sa:XCWw8fyjWLZ/U8MBSb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33764
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=171, productName=VS2010 build 30319, version=30319,
count=37, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=36, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=115, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=277, id=1, productName=Unmarked objects,
count=30, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
cc7045d9fe77c4aa4cb646d01fb4700008a34f58f49358d0b0b0997d21016aab.exe
- SHA256 cc7045d9fe77c4aa4cb646d01fb4700008a34f58f49358d0b0b0997d21016aab
- MD5 fcb53acd5fd1637a2ac1bc69f396e92c
- SHA1 a09432a56375c5a39856d59e402c3f8642edda7b
- SHA512 47bcd8326a65b2a50ee7a9691853c6a6d6a424ad4e0a7760794aa20c137450017793ed9756302666b6b1aed93048d879395a6fde2c95f9b9fc67ca4bd6e38116
- SSDEEP 3072:eb/VDsMK5SdPlKCXbkB9Kv1y5Gun6XKwRDcXEX55d2wNQ+XnwEf4bvuQ5OjrDGZt:WCoMRt6XKUSRACdOj57jY5jM9H8eGN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38399
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DllUnregisterServer
DllRegisterServer
DllGetClassObject
DllCanUnloadNow
Name
.text
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
496B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
121KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8
- MD5 1d96091dc25660ac8989193299659be7
- SHA1 bc95772709ad585d528e43de2af29ed0bb628841
- SHA512 8c47793a478b0aaf12353ee1f1b2883c0a64eba1511889d33a6782e47f0ac8755dc3b594f2a74820f155243f215f015eb216ef62b6500a8fe9cc0d9cbe0baaa2
- SSDEEP 3072:U+vMJOW7ySZS3XbhbbzPZEhIUejpSvA+jJwktRCoWvgDcephDZhAzN0V:6GSAHNbbdsjDIcHWvg4efvA
- MD5 SHA1 SHA512 SSDEEP
-
Detect MafiaWare666 ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
75706
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\1\Downloads\EncrypterPOC-main\EncrypterPOC-main\WindowsFormsApp1\obj\Release\WindowsFormsApp1.pdb
mscoree
_CorExeMain
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
206KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
efe947e0a8842997d152af946ef0293a972cc11662f3c62a8461bc4a07427669.exe
- SHA256 efe947e0a8842997d152af946ef0293a972cc11662f3c62a8461bc4a07427669
- MD5 9e1da7b0d3c74f1d6d77a95557115e51
- SHA1 f3fe719be56d67edc3d44e21edbb4115d062ed0d
- SHA512 ec1be9c4cb3f0e0a439fd43fbc2d7e5e9383dbe6a3a0ead7092bc2b6eb63122d9a285c431847db1b20bfa09aa096c16ea822edab89c6ca7c145c7fc027237c51
- SSDEEP 3072:1MTLZhs0uDI0rAfOXl+y+uql/GOtsrVrqhTqndtndhndKndI:2TLFuD6fOXlql/GLJrqqndtndhndKndI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
69306
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.rrdata
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rmnet
Size
19KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.orpc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.text
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data2
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tsustu
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
rqvmxkb
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CODE
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.brdata
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.extjmp
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
new_imp
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
new_imp
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rmnet
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
new_imp
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f
- MD5 d158894d0bb726520cdd6a7fce485502
- SHA1 2f96ff31e88d76e28892f5e7289d7dab12355a57
- SHA512 31c1c755e0506fccf08c07479e79fbb4b081b84684449e63d53eeaa3036edba741ce6d10f484ff82ec0dcd8a50b121b998211f3c661bc8747512a88688638350
- SSDEEP 3072:sgMAkr98bY+GC+4cGRJfnAi+dZMLwjezS0OtEoifN5l:mr98MQ+4cGRJonZgwGUM
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
167KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ