Unique_Icons_But_Unknown_Malware.rar
- SHA256 abff8ad79e497aeb5787012b0b0b718324e98bff7e703071c9fe75d6e534b6d6
Overview
overview
10Static
static
100486218577...d9.exe
windows7-x64
109bfd15145...11.exe
windows7-x64
9141d93e2d4...aa.exe
windows7-x64
1016c2807567...55.exe
windows7-x64
32f41c73046...95.exe
windows7-x64
103e275093a5...01.exe
windows7-x64
10419a809f42...89.exe
windows7-x64
34b10fd0d5e...58.exe
windows7-x64
104d78c439ed...f7.exe
windows7-x64
74f7713dcf8...63.exe
windows7-x64
7597deecbe6...4d.exe
windows7-x64
76b59edf464...e8.exe
windows7-x64
87def3cd43d...d8.exe
windows7-x64
796ba85326e...8a.exe
windows7-x64
797f1b6afb2...2e.exe
windows7-x64
59906747639...1e.exe
windows7-x64
19e1609ab7f...08.exe
windows7-x64
10b7fc91fc1f...37.exe
windows7-x64
7bf179bbd2c...25.exe
windows7-x64
3cfc68c40f4...4f.exe
windows7-x64
6e6e948a0aa...eb.exe
windows7-x64
1f02fe52119...68.exe
windows7-x64
8$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows7-x64
3secrehosted.exe
windows7-x64
3Behavioral task
behavioral1
Sample
04862185775476ae0b6f7e8a02133cb408d212ca17bbff5c20dcfdcf569b3dd9.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
141d93e2d408738bba4f523f60d6ead702424e7d62c34921c8a34150a31870aa.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
16c2807567b31c30288d92c0649ce78ea87434104bac72db407bb45bf65a4855.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
3e275093a5ad4b2083eda47dfd2e9053cae044f7990a323c6f649093a8d00901.exe
Resource
win7-20240903-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral7
Sample
419a809f42361b2fcff98eb6f201e54ecef532c9b378db06e999f54285032889.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
4b10fd0d5e4370dde456862f810e27b2be1f854356191b9893ab1a65f4af5358.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
4f7713dcf8ad6717ea6eb432774a29317649a512445221dc0a29ed79e48b7663.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral11
Sample
597deecbe673c67d998825bdf4ddeca83f6fbb3bdccec91dabf4f9052713ac4d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
6b59edf464eaaeac4f4b2f43474e573694429f08c448db770618dc574b6171e8.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
96ba85326e2250f4e1cf07f5981bb96ea1383901663a6354899b5da0cd77b98a.exe
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
97f1b6afb24cda22203275fc34bd07ba51170729edba8ee67bdb66a529574a2e.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
9906747639b782d738555a2522acd4a09ca8a3356f7848a4e68f284d888d891e.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
b7fc91fc1fa6a53b1e5d97e21a7abefbde3ca7349d4db0fdbe15ec2702b1b737.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
bf179bbd2ce7ca31e421334efa7d262e30dc16b9bb5cced1b8b18d119adc4425.exe
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
cfc68c40f4631954894898633fd0c5a06c5ce5837eba7d4b56fc3514c01e124f.exe
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe
Resource
win7-20240729-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
secrehosted.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
General
- Target Unique_Icons_But_Unknown_Malware.rar
- Size 55.8MB
- Sample241127-lfrx3atrgr
- SHA256 abff8ad79e497aeb5787012b0b0b718324e98bff7e703071c9fe75d6e534b6d6
- MD5 9482d0b143b8cc0cb39c5caa948b965d
- SHA1 f9e48d067999bbfb827cd94976c7a73b52719ff8
- SHA512 5f00aa543d0073ad1db5b2b6a008d98f6c4e585aea93aff7eb492aa46a7f0c536abff669757063d6d7c7131d1e0dd618391561ec453f09e2196168a27406d1a4
- SSDEEP 786432:4SHD1JF9dWPBvk7bpHaiT0MYV5WsP9tF7BV/KPgLZroAqmJZpC+uGixVM:4UDZ9dvd6HXXn9PKP0lFvC+unLM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule static1/unpack001/9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08.exe family_mafiaware666 - Mafiaware666 family
- Sapphire family
- Sapphire ransomware PDB string 1 IoCs
resource yara_rule static1/unpack001/6b59edf464eaaeac4f4b2f43474e573694429f08c448db770618dc574b6171e8.exe sapphire_ransomware -
resource yara_rule static1/unpack001/bf179bbd2ce7ca31e421334efa7d262e30dc16b9bb5cced1b8b18d119adc4425.exe aspack_v212_v242 -
resource yara_rule static1/unpack001/97f1b6afb24cda22203275fc34bd07ba51170729edba8ee67bdb66a529574a2e.exe upx - Detects Pyinstaller 4 IoCs
resource yara_rule static1/unpack001/4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe pyinstaller static1/unpack001/7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe pyinstaller static1/unpack001/96ba85326e2250f4e1cf07f5981bb96ea1383901663a6354899b5da0cd77b98a.exe pyinstaller static1/unpack001/b7fc91fc1fa6a53b1e5d97e21a7abefbde3ca7349d4db0fdbe15ec2702b1b737.exe pyinstaller - Unsigned PE 23 IoCs
Checks for missing Authenticode signature.
resource unpack001/04862185775476ae0b6f7e8a02133cb408d212ca17bbff5c20dcfdcf569b3dd9.exe unpack001/09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe unpack001/141d93e2d408738bba4f523f60d6ead702424e7d62c34921c8a34150a31870aa.exe unpack001/16c2807567b31c30288d92c0649ce78ea87434104bac72db407bb45bf65a4855.exe unpack001/2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe unpack001/3e275093a5ad4b2083eda47dfd2e9053cae044f7990a323c6f649093a8d00901.exe unpack001/419a809f42361b2fcff98eb6f201e54ecef532c9b378db06e999f54285032889.exe unpack001/4b10fd0d5e4370dde456862f810e27b2be1f854356191b9893ab1a65f4af5358.exe unpack001/4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe unpack001/4f7713dcf8ad6717ea6eb432774a29317649a512445221dc0a29ed79e48b7663.exe unpack001/6b59edf464eaaeac4f4b2f43474e573694429f08c448db770618dc574b6171e8.exe unpack001/7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe unpack001/96ba85326e2250f4e1cf07f5981bb96ea1383901663a6354899b5da0cd77b98a.exe unpack001/97f1b6afb24cda22203275fc34bd07ba51170729edba8ee67bdb66a529574a2e.exe unpack005/out.upx unpack001/9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08.exe unpack001/b7fc91fc1fa6a53b1e5d97e21a7abefbde3ca7349d4db0fdbe15ec2702b1b737.exe unpack001/bf179bbd2ce7ca31e421334efa7d262e30dc16b9bb5cced1b8b18d119adc4425.exe unpack001/e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe unpack001/f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe unpack007/$PLUGINSDIR/nsExec.dll unpack007/$PLUGINSDIR/nsProcess.dll unpack007/secrehosted.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe nsis_installer_1 static1/unpack001/f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe nsis_installer_2
File Explorer
-
Unique_Icons_But_Unknown_Malware.rar.rar 55.8MB
-
04862185775476ae0b6f7e8a02133cb408d212ca17bbff5c20dcfdcf569b3dd9.exe.exe 633KB
-
09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe.exe 765KB
-
141d93e2d408738bba4f523f60d6ead702424e7d62c34921c8a34150a31870aa.exe.exe 694KB
-
16c2807567b31c30288d92c0649ce78ea87434104bac72db407bb45bf65a4855.exe.exe 568KB
-
2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe.exe 1.5MB
-
3e275093a5ad4b2083eda47dfd2e9053cae044f7990a323c6f649093a8d00901.exe.exe 583KB
-
419a809f42361b2fcff98eb6f201e54ecef532c9b378db06e999f54285032889.exe.exe 1.5MB
-
4b10fd0d5e4370dde456862f810e27b2be1f854356191b9893ab1a65f4af5358.exe.exe 624KB
-
4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe.exe 6.5MB
-
NitroGenerator.pyc7KB
-
4f7713dcf8ad6717ea6eb432774a29317649a512445221dc0a29ed79e48b7663.exe.exe 5.7MB
-
597deecbe673c67d998825bdf4ddeca83f6fbb3bdccec91dabf4f9052713ac4d.exe.exe 838KB
-
6b59edf464eaaeac4f4b2f43474e573694429f08c448db770618dc574b6171e8.exe.exe 536KB
-
7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe.exe 6.5MB
-
DiscordNitroGenerator.pyc9KB
-
96ba85326e2250f4e1cf07f5981bb96ea1383901663a6354899b5da0cd77b98a.exe.exe 6.7MB
-
NitroGenerator.pyc8KB
-
97f1b6afb24cda22203275fc34bd07ba51170729edba8ee67bdb66a529574a2e.exe.exe 9.9MB
-
out.upx.exe 12.5MB
-
9906747639b782d738555a2522acd4a09ca8a3356f7848a4e68f284d888d891e.exe.exe 577KB
-
9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08.exe.exe 1.3MB
-
b7fc91fc1fa6a53b1e5d97e21a7abefbde3ca7349d4db0fdbe15ec2702b1b737.exe.exe 6.7MB
-
DC_Grabber.pyc1KB
-
bf179bbd2ce7ca31e421334efa7d262e30dc16b9bb5cced1b8b18d119adc4425.exe.exe 1.7MB
-
cfc68c40f4631954894898633fd0c5a06c5ce5837eba7d4b56fc3514c01e124f.exe.exe 595KB
-
e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe.exe 853KB
-
f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe.exe 6.6MB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
$PLUGINSDIR/nsProcess.dll.dll 4KB
-
parameters.ini220B
-
secrehosted.exe.exe 6.7MB
04862185775476ae0b6f7e8a02133cb408d212ca17bbff5c20dcfdcf569b3dd9.exe
- IMPHASH fafa4a28b560c39ab0fffc511680e6be
- SHA256 04862185775476ae0b6f7e8a02133cb408d212ca17bbff5c20dcfdcf569b3dd9
- MD5 54d2510dce5b4d827388d60df115b148
- SHA1 dbdcfb4e9d929749027e14fa1fa78dae281d4f00
- SHA512 36dd1d765d034b19b2e81eead484fcc562430894f953e0e2e913cf47e917b2b9d102a0c273ec9febe6ab1f654b9d3fcf81c3acc7522fcbc17e92149399c01c6d
- SSDEEP 6144:yP1SPCRMshMX8pU+E0zyvGJm8v9UDHO1lxAk5C1K4kzRNDa0/C+Lf61Znj:IzPpU4J6unxAKFRFfC+LiDj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4700
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\buildslave\unity\build\build\WindowsStandaloneSupport\Variations\win64_nondevelopment_mono\WindowsPlayer_x64_Master_mono.pdb
unityplayer
UnityMain
kernel32
HeapAlloc
RaiseException
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetACP
HeapFree
CloseHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
CreateFileW
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
552KB
Virtual Size
552KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=120, id=243, version=40116,
count=13, id=242, version=40116,
count=7, id=259, version=24123,
count=28, id=261, version=24123,
count=18, id=260, version=24123,
count=3, id=257, version=24218,
count=2, id=239, version=40116,
count=86, id=1, productName=Unmarked objects,
count=2, id=261, version=24218,
count=1, id=256, version=24218,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, version=24218,
09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11
- MD5 500ef53924b722ddb43632b0dd9070c9
- SHA1 daf44813ae7f0792ccb3640cd4c700193daf6cf4
- SHA512 f7ace2a8e018ef576e98221b60ac9e99477b2e5ef7f323147c9f90c3f9a1639cd778eca4558491a2c4217001d52377fa8ec5ac2732ee362221c34c69c7610216
- SSDEEP 12288:Xl26S0vAcB+UwoVSidDHeeIJoCnVRWJvdKLv8S2cZtWkHCmTBQk9TfXX4Jy0Ro0Y:VlS2jgvkTee8VRWJVKLvR2cbWaHTPXqy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
745578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\1314\Downloads\Maya3.3\Maya3.3\Maya3.0\Zm\obj\Release\Fuck学习强国.pdb
mscoree
_CorExeMain
Name
.text
Size
720KB
Virtual Size
720KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
141d93e2d408738bba4f523f60d6ead702424e7d62c34921c8a34150a31870aa.exe
- IMPHASH 2bb37eed0d9f70910d890802982d6521
- SHA256 141d93e2d408738bba4f523f60d6ead702424e7d62c34921c8a34150a31870aa
- MD5 69d1816b669117f2bd58c44c3395d781
- SHA1 4eb14f9bb555143671faef063da7f518a7493d94
- SHA512 ea097012b4e0729e81f725b437c4b3d650b152ede8e7e27df3615941bbbd2c75346d1b51eb9308531343bd6d1bb6b553015a5805c964c61bc7372862a950806f
- SSDEEP 12288:Dmrvzqs6OZxzLogi93gAuEaw5hMlvN79yb5wdhuEvKcpK85DOMJb4zzlj:Daqs6OZxzLogivMl7bvjpK85DOM+zl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
143273
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FindNextFileA
FindFirstFileExA
FindClose
CloseHandle
HeapReAlloc
GetTimeZoneInformation
GetFileType
HeapFree
HeapAlloc
IsValidCodePage
GetUserDefaultLCID
IsValidLocale
GetACP
GetModuleFileNameA
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
RaiseException
RtlUnwind
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
SetFilePointerEx
WriteConsoleW
CreateFileW
WaitForSingleObject
lstrlenA
VirtualAlloc
GetProcessWorkingSetSize
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLocaleName
TerminateProcess
GetCurrentProcess
CreateEventA
GetConsoleWindow
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetProcAddress
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
MultiByteToWideChar
OpenEventA
SetLastError
OutputDebugStringW
DebugBreak
MulDiv
OpenJobObjectA
WideCharToMultiByte
EnumSystemLanguageGroupsA
CreateThread
lstrcpyA
GetCurrentThreadId
FormatMessageW
LocalFree
GetStartupInfoW
GetLastError
TerminateThread
GlobalAlloc
user32
SetScrollPos
OpenDesktopW
GetWindowTextLengthA
RegisterClassExA
UpdateWindow
SetForegroundWindow
DrawIconEx
IsIconic
ReleaseDC
GetCursorPos
DialogBoxIndirectParamW
GetScrollInfo
SetScrollInfo
GetUpdateRect
CheckDlgButton
InvalidateRect
SetWindowContextHelpId
EndPaint
PtInRect
GetMessageA
GetMessagePos
GetWindowRect
LoadCursorA
InflateRect
GetDC
InsertMenuA
LoadStringA
PostMessageA
FillRect
EndDialog
GetSystemMetrics
CreatePopupMenu
DrawIcon
TrackPopupMenu
LoadStringW
wsprintfA
GetClassLongA
OffsetRect
SetTimer
DrawTextA
SetWindowLongA
CopyRect
GetWindowTextA
ChangeDisplaySettingsA
CreateAcceleratorTableA
MapWindowPoints
GetWindowLongA
LoadBitmapA
MessageBoxA
GetSysColor
EnumDisplaySettingsA
GetForegroundWindow
MoveWindow
IsDlgButtonChecked
DefWindowProcA
DestroyMenu
CreateWindowExA
SetFocus
TranslateMessage
BeginPaint
SendMessageA
SetCursor
CreateDialogParamA
SetClassLongA
LoadIconA
SystemParametersInfoA
TrackPopupMenuEx
CheckMenuItem
GetClientRect
GetDlgItem
AppendMenuW
SetRect
ShowWindow
SendMessageW
DefWindowProcW
RegisterClassW
UnregisterClassW
CreateWindowExW
SetWindowPos
GetWindowPlacement
SetWindowPlacement
EnableWindow
SetMenu
AdjustWindowRectEx
GetWindowLongW
SetWindowLongW
MonitorFromWindow
GetMonitorInfoW
LoadCursorW
LoadIconW
SystemParametersInfoW
GetMessageW
DispatchMessageW
PeekMessageW
PostMessageW
PostQuitMessage
GetActiveWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
IsDialogMessageW
ReleaseCapture
CharNextW
DestroyWindow
SetParent
SetWindowTextW
GetWindowTextW
GetClassNameW
GetAncestor
CreateMenu
GetMenuItemInfoW
SetMenuItemInfoW
KillTimer
ValidateRect
IsChild
GetMessageTime
GetDoubleClickTime
GetKeyState
SetCapture
gdi32
BitBlt
SaveDC
CreateFontA
SelectObject
CreateDIBSection
GetTextExtentPoint32A
SetBrushOrgEx
CreatePatternBrush
CreateCompatibleBitmap
GetTextMetricsW
GetTextExtentPoint32W
CreateFontIndirectW
CreateCompatibleDC
CreateDCW
GetStockObject
GetDeviceCaps
GetPixel
DeleteDC
SetTextColor
SetBkMode
LineTo
CreatePen
SelectClipRgn
ExcludeClipRect
MoveToEx
RestoreDC
DeleteObject
CreateSolidBrush
advapi32
RegOpenKeyExA
RegCloseKey
ImpersonateLoggedOnUser
shell32
SHBrowseForFolderA
ole32
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoMarshalInterface
CoInitialize
oleaut32
LoadTypeLi
odbc32
ord41
opengl32
glTexGeni
glClear
glEnable
glVertex3f
glEnd
glTexCoord2f
glLoadIdentity
glTexParameteri
glHint
glDepthFunc
glShadeModel
glClearDepth
glRotatef
glVertex2f
glTexImage2D
glTranslatef
glClearColor
glBegin
comctl32
ord410
_TrackMouseEvent
ord411
CreatePropertySheetPageA
InitCommonControlsEx
DestroyPropertySheetPage
ord413
ord412
gdiplus
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdiplusShutdown
GdipSaveImageToFile
GdipFree
GdiplusStartup
GdipDisposeImage
urlmon
CreateAsyncBindCtx
pdh
PdhCollectQueryData
msvfw32
DrawDibOpen
activeds
ord8
ord7
d2d1
ord1
ord4
ord3
ord2
ord5
dwrite
DWriteCreateFactory
uiAllocControl
uiAreaBeginUserWindowMove
uiAreaBeginUserWindowResize
uiAreaQueueRedrawAll
uiAreaScrollTo
uiAreaSetSize
uiAttributeColor
uiAttributeFamily
uiAttributeFeatures
uiAttributeGetType
uiAttributeItalic
uiAttributeSize
uiAttributeStretch
uiAttributeUnderline
uiAttributeUnderlineColor
uiAttributeWeight
uiAttributedStringAppendUnattributed
uiAttributedStringByteIndexToGrapheme
uiAttributedStringDelete
uiAttributedStringForEachAttribute
uiAttributedStringGraphemeToByteIndex
uiAttributedStringInsertAtUnattributed
uiAttributedStringLen
uiAttributedStringNumGraphemes
uiAttributedStringSetAttribute
uiAttributedStringString
uiBoxAppend
uiBoxDelete
uiBoxPadded
uiBoxSetPadded
uiComboboxAppend
uiComboboxOnSelected
uiComboboxSelected
uiComboboxSetSelected
uiControlDestroy
uiControlDisable
uiControlEnable
uiControlEnabled
uiControlEnabledToUser
uiControlHandle
uiControlHide
uiControlParent
uiControlSetParent
uiControlShow
uiControlToplevel
uiControlVerifySetParent
uiControlVisible
uiDrawClip
uiDrawFill
uiDrawFreePath
uiDrawFreeTextLayout
uiDrawMatrixInvert
uiDrawMatrixInvertible
uiDrawMatrixMultiply
uiDrawMatrixRotate
uiDrawMatrixScale
uiDrawMatrixSetIdentity
uiDrawMatrixSkew
uiDrawMatrixTransformPoint
uiDrawMatrixTransformSize
uiDrawMatrixTranslate
uiDrawNewPath
uiDrawNewTextLayout
uiDrawPathAddRectangle
uiDrawPathArcTo
uiDrawPathBezierTo
uiDrawPathCloseFigure
uiDrawPathEnd
uiDrawPathLineTo
uiDrawPathNewFigure
uiDrawPathNewFigureWithArc
uiDrawRestore
uiDrawSave
uiDrawStroke
uiDrawText
uiDrawTextLayoutExtents
uiDrawTransform
uiFontButtonFont
uiFontButtonOnChanged
uiFormAppend
uiFormDelete
uiFormPadded
uiFormSetPadded
uiFreeAttribute
uiFreeAttributedString
uiFreeControl
uiFreeFontButtonFont
uiFreeImage
uiFreeInitError
uiFreeOpenTypeFeatures
uiFreeText
uiImageAppend
uiInit
uiMain
uiMainStep
uiMainSteps
uiMenuAppendAboutItem
uiMenuAppendCheckItem
uiMenuAppendItem
uiMenuAppendPreferencesItem
uiMenuAppendQuitItem
uiMenuAppendSeparator
uiMenuItemChecked
uiMenuItemDisable
uiMenuItemEnable
uiMenuItemOnClicked
uiMenuItemSetChecked
uiNewArea
uiNewAttributedString
uiNewBackgroundAttribute
uiNewColorAttribute
uiNewCombobox
uiNewFamilyAttribute
uiNewFeaturesAttribute
uiNewFontButton
uiNewForm
uiNewHorizontalBox
uiNewImage
uiNewItalicAttribute
uiNewMenu
uiNewOpenTypeFeatures
uiNewScrollingArea
uiNewSizeAttribute
uiNewStretchAttribute
uiNewUnderlineAttribute
uiNewUnderlineColorAttribute
uiNewVerticalBox
uiNewWeightAttribute
uiNewWindow
uiOnShouldQuit
uiOpenTypeFeaturesAdd
uiOpenTypeFeaturesClone
uiOpenTypeFeaturesForEach
uiOpenTypeFeaturesGet
uiOpenTypeFeaturesRemove
uiQueueMain
uiQuit
uiTimer
uiUninit
uiUserBugCannotSetParentOnToplevel
uiWindowBorderless
uiWindowContentSize
uiWindowFullscreen
uiWindowMargined
uiWindowOnClosing
uiWindowOnContentSizeChanged
uiWindowSetBorderless
uiWindowSetChild
uiWindowSetContentSize
uiWindowSetFullscreen
uiWindowSetMargined
uiWindowSetTitle
uiWindowTitle
uiWindowsAllocControl
uiWindowsControlAssignControlIDZOrder
uiWindowsControlAssignSoleControlIDZOrder
uiWindowsControlChildVisibilityChanged
uiWindowsControlContinueMinimumSizeChanged
uiWindowsControlLayoutRect
uiWindowsControlMinimumSize
uiWindowsControlMinimumSizeChanged
uiWindowsControlNotifyVisibilityChanged
uiWindowsControlSetParentHWND
uiWindowsControlSyncEnableState
uiWindowsControlTooSmall
uiWindowsEnsureAssignControlIDZOrder
uiWindowsEnsureCreateControlHWND
uiWindowsEnsureDestroyWindow
uiWindowsEnsureGetClientRect
uiWindowsEnsureGetWindowRect
uiWindowsEnsureMoveWindowDuringResize
uiWindowsEnsureSetParentHWND
uiWindowsGetSizing
uiWindowsMakeContainer
uiWindowsRegisterReceiveWM_WININICHANGE
uiWindowsRegisterWM_COMMANDHandler
uiWindowsRegisterWM_HSCROLLHandler
uiWindowsRegisterWM_NOTIFYHandler
uiWindowsSetWindowText
uiWindowsShouldStopSyncEnableState
uiWindowsSizingDlgUnitsToPixels
uiWindowsSizingStandardPadding
uiWindowsUnregisterReceiveWM_WININICHANGE
uiWindowsUnregisterWM_COMMANDHandler
uiWindowsUnregisterWM_HSCROLLHandler
uiWindowsUnregisterWM_NOTIFYHandler
uiWindowsWindowText
uiWindowsWindowTextWidth
Name
.text
Size
274KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
273KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=241, version=40116,
count=139, id=243, version=40116,
count=36, id=242, version=40116,
count=24, id=259, version=26706,
count=58, id=261, version=26706,
count=33, id=260, version=26706,
count=37, id=261, version=27035,
count=11, id=260, version=27035,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=310, id=1, productName=Unmarked objects,
count=1, id=265, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,
16c2807567b31c30288d92c0649ce78ea87434104bac72db407bb45bf65a4855.exe
- IMPHASH 12558c4dd0ec18ba63d0e699cc441f33
- SHA256 16c2807567b31c30288d92c0649ce78ea87434104bac72db407bb45bf65a4855
- MD5 90b53ba29d2aa7f436059ef1103c2130
- SHA1 db8a3b842a830e72bb4f067dd88aea76010d0704
- SHA512 fec790d618aa41cdb88fc407c3ddc5d652c103dbc65c9ae94edfd554a6a45d81352bf907e259fcb359eb29c7d4412f884337c3a14cb38516a280d3b554c4eb81
- SSDEEP 12288:zNftIXXgD3gyO7Ibi/yQ0pF+T3r+ZgzGd5:zNfWXXgDWIbikpFy3rId5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4324
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
ord690
ord586
MethCallEngine
ord516
ord519
ord666
ord669
ord591
ord592
ord596
ord598
ord520
EVENT_SINK_AddRef
ord564
ord673
ord674
ord569
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord100
ord616
Name
.text
Size
536KB
Virtual Size
532KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=13, version=9782,
2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95
- MD5 b8f887a092b6bdcb1bd882e35164d1d7
- SHA1 08152f67bf925a7478312d45a67f33116a6097b3
- SHA512 057b60f71a84c51d3112e553164d4a476f9488bd1369cec4405975b8cece83fe29d58342bd02ad17542ca1e38254f05dadca027ecbeb281d3b94ff198517dff7
- SSDEEP 24576:7zwwr/TK4y3+HaxwUsgdYNLhzEnmfp499VYn6nTtEpR59qUN0i6OtH:78wra+ksgdYNLhYmfpaVYn6nTMR59VSi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1300366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
266KB
Virtual Size
265KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
3e275093a5ad4b2083eda47dfd2e9053cae044f7990a323c6f649093a8d00901.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3e275093a5ad4b2083eda47dfd2e9053cae044f7990a323c6f649093a8d00901
- MD5 74d4e0e6dcf5cc7942c35e630036af0c
- SHA1 c7c4bb3907344aed022d181eb73f8fd812e06f88
- SHA512 110bb901dacc153fb484673fd033d2c0f9a3f7cbfd73a46f54c44c1f699796844b68db5a860cbbb5be08c03f4ad9dfcd25feb71fc8a9b37445e137a002e6a8eb
- SSDEEP 12288:5D+7m+CQXYm2o0PTYRPA6PHoVhVtknag6g6n+9iuE5vt+PC3H8H:I7mYRyGA6PIzVtknRJ6notmH8H
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
439998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
422KB
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
419a809f42361b2fcff98eb6f201e54ecef532c9b378db06e999f54285032889.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 419a809f42361b2fcff98eb6f201e54ecef532c9b378db06e999f54285032889
- MD5 cfc9c44d0b4c399d84f24402ddd8394e
- SHA1 c7fbb886991a6ecb68ccd32906361caab21610f5
- SHA512 041834ef114ab6422ad3fdc8754b4dc62c2e6e96f6773cf8e0a9d7cd1da3c691da5a33edd429beee3e4d6a36bf38d9f6897e0ef026ec7e1b28881e13a5597b84
- SSDEEP 12288:MHovgGspGZU+CaVy+AQVlR7Ud91D/rSCBaN6B11wIg/1vBLPHjFlWE7hnFI9q1U:dvt5CagTQVPO1LrfBk6BII83nWElr1U
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1560858
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Murder Miners Source\VoxelTest\VoxelTest\obj\x86\Release\Murder Miners.pdb
mscoree
_CorExeMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4b10fd0d5e4370dde456862f810e27b2be1f854356191b9893ab1a65f4af5358.exe
- IMPHASH fd3d928673975de5eabf64abf0fb4590
- SHA256 4b10fd0d5e4370dde456862f810e27b2be1f854356191b9893ab1a65f4af5358
- MD5 b9ea663ffcfe1152bd6e9a452a4eaf14
- SHA1 e45d164dfab4898baefa313ee53c360a7e850f30
- SHA512 8fb37dc3ad80f46e83785988037a6f1801e4f326f23b1584bb3b3b4e58d7a489b55322e8ba2a8eba4ab627462802aadb83c3f392c6b3f4f32f0741ee675c0c5f
- SSDEEP 6144:hzTCYruA1ohrPv8FG0+DVg5w83gSkdwPU0YnG3Fx+GaJ5674pIbVg73zf7ewvNwq:hzBCAnFfG83qEU0YGTcJ47Fmreu+Du
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
267752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathIsUNCA
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
SHDeleteKeyA
kernel32
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetErrorMode
GetTickCount
RtlUnwind
HeapFree
HeapAlloc
FindNextFileA
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RaiseException
GetSystemTimeAsFileTime
GetCommandLineA
GetProcessHeap
GetStartupInfoA
ExitThread
CreateThread
ExitProcess
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
GetCurrentDirectoryA
GetStdHandle
SetHandleCount
GetFileType
GetACP
Sleep
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetShortPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
WriteFile
DeleteFileA
MoveFileA
SystemTimeToFileTime
FileTimeToSystemTime
GetThreadLocale
GetOEMCP
GetCPInfo
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GlobalFlags
GetDiskFreeSpaceA
GetFullPathNameA
GetTempFileNameA
GetFileTime
SetFileTime
GetFileAttributesA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
InterlockedDecrement
GetModuleFileNameW
SuspendThread
ResumeThread
SetThreadPriority
GlobalFree
GlobalAlloc
FreeResource
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GlobalLock
GlobalUnlock
GetCurrentProcessId
GlobalGetAtomNameA
GlobalAddAtomA
lstrcpynA
SetLastError
GetModuleHandleA
FormatMessageA
LocalFree
GetCurrentThreadId
GetModuleFileNameA
MulDiv
SetEvent
WaitForSingleObject
LoadLibraryW
GetVersionExA
GetStringTypeExA
lstrlenA
lstrcmpiA
CompareStringW
CompareStringA
GetVersion
MultiByteToWideChar
InterlockedExchange
LoadLibraryA
FreeLibrary
GetProcAddress
PulseEvent
GetDriveTypeA
FindFirstChangeNotificationA
FindCloseChangeNotification
FindNextChangeNotification
SetFilePointer
ReadFile
CreateFileA
GetFileSize
CreateEventA
OpenEventA
WaitForMultipleObjects
CloseHandle
GetLastError
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
user32
PostQuitMessage
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
GetSysColorBrush
UnregisterClassA
DestroyIcon
CharNextA
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
RegisterClipboardFormatA
PostThreadMessageA
SetParent
DeleteMenu
IsRectEmpty
GetMenuItemInfoA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
GetMessageA
TranslateMessage
ValidateRect
WindowFromPoint
SetRect
EndPaint
BeginPaint
GetWindowDC
GetMenuStringA
AppendMenuA
InsertMenuA
MoveWindow
IsDialogMessageA
GetDlgItemTextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
CheckMenuItem
SendDlgItemMessageA
IsChild
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
TrackPopupMenu
GetClassInfoExA
RegisterClassA
DeferWindowPos
GetScrollInfo
SetScrollInfo
DefWindowProcA
CallWindowProcA
SystemParametersInfoA
GetWindowPlacement
UnpackDDElParam
ReuseDDElParam
DestroyMenu
GetClassNameA
WinHelpA
SetFocus
GetWindowThreadProcessId
IsWindowEnabled
EqualRect
GetDlgItem
GetKeyState
GetDlgCtrlID
LoadIconA
PeekMessageA
GetCapture
LoadAcceleratorsA
SetActiveWindow
IsWindowVisible
InsertMenuItemA
CreatePopupMenu
GetClassInfoA
IntersectRect
CopyRect
GetLastActivePopup
SetMenu
GetDesktopWindow
GetParent
SendMessageA
PtInRect
SetRectEmpty
InflateRect
OffsetRect
GetWindow
AdjustWindowRectEx
SetWindowPos
TranslateAcceleratorA
TranslateMDISysAccel
GetActiveWindow
DrawMenuBar
CreateWindowExA
GetMenuItemCount
GetMenuItemID
DefMDIChildProcA
DefFrameProcA
GetFocus
DrawEdge
FrameRect
FillRect
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
SetScrollPos
KillTimer
ScreenToClient
BringWindowToTop
LoadMenuA
GetSubMenu
IsIconic
DrawFrameControl
GetWindowRect
GetClientRect
ClientToScreen
ReleaseDC
InvalidateRect
GetDCEx
LockWindowUpdate
RedrawWindow
SetCapture
GetSystemMetrics
GetSysColor
EnableWindow
GetCursorPos
IsWindow
SetCursor
LoadCursorA
ReleaseCapture
MessageBoxA
SetWindowTextA
EnableMenuItem
GetMenu
GetSystemMenu
SetForegroundWindow
SetWindowLongA
GetWindowLongA
LoadBitmapA
UpdateWindow
SetTimer
CharUpperA
ShowWindow
LoadStringA
PostMessageA
MessageBeep
GetDC
gdi32
CreatePen
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
CreateFontA
StretchDIBits
GetTextColor
GetRgnBox
GetStockObject
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
SetViewportOrgEx
ScaleViewportExtEx
SetViewportExtEx
PatBlt
GetCharWidthA
CreateSolidBrush
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipRgn
DeleteObject
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
CreateRectRgn
CreateFontIndirectA
GetTextExtentPoint32A
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetCurrentObject
GetBkColor
CreateCompatibleBitmap
GetDeviceCaps
BitBlt
CreateCompatibleDC
GetObjectA
SelectObject
OffsetViewportOrgEx
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
advapi32
SetFileSecurityA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueA
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
GetFileSecurityA
shell32
ExtractIconA
SHGetFileInfoA
DragQueryFileA
DragFinish
DragAcceptFiles
Shell_NotifyIconA
oledlg
ord8
ole32
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CLSIDFromProgID
oleaut32
SysAllocString
OleCreateFontIndirect
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
Name
.text
Size
356KB
Virtual Size
355KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
100KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
148KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=28, id=125, productName=VS2005 build 50727, version=50727,
count=161, id=109, productName=VS2005 build 50727, version=50727,
count=23, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=576, id=1, productName=Unmarked objects,
count=204, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe
- IMPHASH e1e8417f4591da7741a300229f9e8e8b
- SHA256 4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7
- MD5 14b6f391b8983ee29eae1b12046198fe
- SHA1 7151e86314dc13dbbe1c933e561657a5f0659d8f
- SHA512 f40ff4c506f17e9f387921e7c57bf518cc668a3f2bf57a5e71ddab12e17f1bc179d55dcbd2bbfcd6b4d805064e9af6481c54ceb254d203485e52cae9c5c6d5b9
- SSDEEP 196608:RXYF+gp1DM9onJ5hrZER9xQ3jo4UR7+OjPw:mpNM9c5hlER9xA2RSOj
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
34564
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
SetDllDirectoryW
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetLastError
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
ws2_32
ntohl
Name
.text
Size
131KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=241, version=40116,
count=169, id=243, version=40116,
count=13, id=242, version=40116,
count=7, id=259, version=24123,
count=28, id=261, version=24123,
count=19, id=260, version=24123,
count=7, id=203, version=65501,
count=114, id=1, productName=Unmarked objects,
count=16, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
NitroGenerator.pyc
- SHA256 6ae9d5c68db7fdd3bc223b6a97a06ed7f1a5ff16442b8668c08393fd26e06cc0
- MD5 795556094310a690c1743e2c33e948ac
- SHA1 3708bb4a92758bfe76153478341f811a8c328549
- SHA512 397417d1a058baa8227600563b2fa6e6af7a9edfee440b6a3b667d6ac0afba49ab76d758e2824217540c6f3b365f25a2c8a33a4b1838b5c1eb0ba4a37321f456
- SSDEEP 192:avhZZ6+sRrhICftd/oJ7h8Ro+uT+lBSWB:Ep8rmCffAJ1t+Q+SWB
- MD5 SHA1 SHA512 SSDEEP
4f7713dcf8ad6717ea6eb432774a29317649a512445221dc0a29ed79e48b7663.exe
- SHA256 4f7713dcf8ad6717ea6eb432774a29317649a512445221dc0a29ed79e48b7663
- MD5 ef8e29925a165755db235f31092eb5e6
- SHA1 3bae3a4c18c7d8baf0fca9b0a5e58b7785f33123
- SHA512 5ae5e1fa3bc54431dad5cfb16ea14ac7ac203265197af9ad181d0362dee248cd2e9de18da71a5712e97522c2eb3fa5c24629ebd418b2aadcc32c694237bc2200
- SSDEEP 98304:yVWEpMFhfhIp8WIs6d0xCNj3DeoWhoWEEN2F5qh27OkgnQxdT6/dsjNUoWUP9O:zB1IdIs6dNN2oIoWEn/qhNk0H/dsaI9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
26819956
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
W��ҿ"O8��~�;�qt���A��������R�ފ�x�����g��"�_)>Tr�GbI��b
���i��5�S|[��B�A�"p���St���1m52pu~]+�����?��
��Q���� L�N��-M��e4��Q�~�c����L�Z�B��Ż���l�q F=jZC��u��K�,P�H�ܫ��Qm�������8��$#���PI�(b|��`M��V.úQ!�\K��� i��<Oyv `Z�j$� S������]��ܛ�f�{SI,���>r`��N ������g�N���Y��P����j���ՕOn�y�v����|l`X�.���*,�J�Y�{h�DX��� �O�.�z����Y�#�:�srQrn}.B�ag<
��Z46ɳ
V¦s�x� �5� o��tis�HAfC���7�De��1�@���M����F����4l!�� ���L���
~$�+iz�I��� ��֣�X�i�^�f��;�e���T O�����0d���KP|y�[�����m�a/q|i��ػ�DQ.�OsJ���2q���8:�O�������
��n� o�OƆx,���Qd�NӀӐ��� ��� d� �����h~�u>�Nb���cPk�c�ju
�V���Y�;�����%\4r4�V�f�%$K����Qk���3�:�ړ�%�����v��4�*�����-+�ݘw���6@���'9�U��Y��Q����{A�bd�� &�E��ق��g����
�������g�Y��+U���V����(��)�]c���=
���и ����u*��R^IJ�-��Y���i�,q��������c�d>*qm=� �� הo�\D������Q���kq灚�94S r|��$D���%�����/��F��+��M�> 첻�WŲ�]S˂��q$���(������¢�[ ���*�>�[�)�8� ȿ�5)p&�9pF3�Π�,E�iRhY ��Uǹ�*Z�0�C�<ԤQ<"<g�v�QN!��H�2^O�փ�Nt��}`U�0!��]�畉� '�����,���* +�nJ�u0�#� �h��ׄ4�� ��?
ۮT۹��c���1���s+��q~,�}f�����y��6���$Lr����3��f�gP3J�#��2�d�GY��!A+-�Ո��A�K ������?- �E�9��Y� z��l����ھ����^^4�C��Ry�6�L&SR���|D�i���X��E�"�(���Gï��&6��"���Qtv�"zJ�Z�o�xE�hp�QXV�h0�͜eg�08u�M�'Ub&�l9f�LR� j#����L8�����dM�m]�� -����Ei�α� ����S �:O�
�v����K�!��H�����b����CL&Z�3��C�E
v#�8��Ƙ��k�h�����4�3ԧ�c�D5'.�� \:\`6�(o��Y��f��p����VɅ�t� �SZ�V��5��^%1O?�0Jx-q�As�`"�@
Ԭb�+y�!x�-�Zq���:D��2nR�I��ub�.���(��!z?�Cl�3g���jD (�ui�&p�����ҿyqe���B��=I���X׆o@�V""b��ỏx�*��n,ј����G^L�pf};V7���ᆿ]iekt1 ; &�k����a$�'�R����/��_y8����N����>SL�M> �+]�������XA����Yy�6�E X�`�h��������Z Q���9����𝕬[U��;4Z�,�ftαmmoi��c����#�����~��˜�AP��� �:��\�e�f J���_�F:- x����Ic��`�������a���äzj�I�ҳ���y�$��xef~�1����7 �=E�����γ��a�4V�v�N�g�����|��L>#�.o��9?�E+N����H�*�|� ���Oh����D*w�ۦPb�|�,{��R�Y `_KB��n�d���f�1�n��N��
�� ��A��+���4\�D`_^3%�7+�siW(�-8�� ����E��τ⁏=�����u=ϹT� � }g;z-�2c8��6�#��q��iö�$<���gN�ɼ-�4Q��?A��K�C�G�/�B��,2�?^Һ����eKr����9��i r����-J[y:�V�]�1)�4���|��a�ɚ�G���fˎ .�� 9�6���I�5�xO�o��xY;��0lpV�mQ�'B4�N�CYX��;��.Xk�h0�Ь�{T�� e2�^ ���ء)>�C�.��ڶqAY7�S�
��ݷ|�8��R5ʶ+ g �_F�g�YG���ᇭ�,*�p|���j�'�7䎍�֖�͙�����{�&T�1�zr��� ��P����o���`=��D�H�c �ht� �=̯��B� p q�<��1?f����i�d�/~!�>��>��y��{�$��e�#�n *�{�x� 0e���K�
"����fS��E�j�����b,B���z�v���)��e��:)Y��ߓ*�q�yC��5���v
���]� 7�6!f?y��3�����d
W�\��� �3���.�4�4B��Ԫ�S��Q3�����d���j?Pr��[n���ۜ��QC����*�*�a�֗GY/�P����59�Ǚ���ٶ�q~�d�= ���00�wD
5(�oƎ:�'� �-X�
oU�I:k��������x�Lu���D#���3�*��;x���±� �>�eE R趪��3Yi1y`P��R!7�sj�>k�j�����N�R[��n�0�<����WO��d&�˦�4�}�,�� *������oV:��jJ�r�e���c�d%&�=��L�C����+E ��1[swa܍����\/���gR��K桰�;\�g%_8��k� ������
�=�b;����H�}+�������I�
�$ {��|R��F��^�jq�rK�jW�NrP�z�� �pg�I���&�8딑d�� �hb ���䪬VU&�'NQ��rrP���u,)z�e��(�-]1�_U!��?��<�,�"nC�Ƽ�D�%��T�gz
�
{�pߩ�3z��O�IVx �6�:��*�H�2��(xISޟ�qI���5^7��y^�4�����K�ۜ����\GK � �T�"Y^��F�����)�=�̻�w]^�zg �6[_��ۧ�e�v������zKmf�N�? �=���䞔rꑬ+���2��� � 2�%��>'6����
���W�)�����+ c
Be�n6�&� @TG�YS���Ȓ<�]���w�6ak��Z�V, ��������4>���M�R1t����юfn�f0N�00tM_T���߹�c+UM�o
әWW��>=��3���� ���Er&��F1�K\(�>�¶
nd�l�d�p=�[��@�)B�) "Of�f=S@ �Ȯ��t����j2�P$h���Oe��ՕF�&�n<u�a�\��wdL�`�Kr�}��s
����7�.Ns�ң�[5���j����)���MH�䣹X����(^���ZZ�ܣ= ��v�eqfR�2����B3�:s3��w�$B��uc=�ɥ#PZi�[֝in��Njx*�BOK0-[�χ4�����F%�Z���F��`^#PƖi���Gv+
��1�f����� �Q: 1��A)��>���y��s�OMj� 8J/��tW���2P�ǴL��'ݪOÎ�ϧ8����r�w
-n �*`���'5 �q����9��N��
N�S�1C������+�j�Dq)C8x{�*�Ӧ���z���GS�P�:=}�˨���Q箖>���
Name
Size
138KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
34KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
238KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
189KB
Virtual Size
19.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.glad
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=16, id=259, version=24610,
count=168, id=261, version=24610,
count=23, id=260, version=24610,
count=23, id=259, version=25305,
count=124, id=261, version=25305,
count=37, id=260, version=25305,
count=15, id=257, version=24610,
count=180, id=1, productName=Unmarked objects,
count=2, id=265, version=25547,
count=1, id=255, productName=VS2017 v15.4.5 build 25547, version=25547,
count=1, id=258, productName=VS2017 v15.4.5 build 25547, version=25547,
597deecbe673c67d998825bdf4ddeca83f6fbb3bdccec91dabf4f9052713ac4d.exe
- IMPHASH f1632ad073d9d68162159e63f63f8870
- SHA256 597deecbe673c67d998825bdf4ddeca83f6fbb3bdccec91dabf4f9052713ac4d
- MD5 b4f28f47e2115e7a578761f2d38fd079
- SHA1 7bf97badf3eb26218bb13bfcafc30c956d18b56f
- SHA512 3fdc3bce35d80bd91dbbe816fd05be613cb1d5a2b2a234d0d0c7f862289b3f9ef5413c682f981d66df1ef0347e0b7f342d302aee52fa97d07b585442d2daf637
- SSDEEP 24576:0y4sIMHgxyMCQW0zAqK1vaNOIEDTuy+Bt:KDMHgx/CQW0cqMva8IEDTuyc
- MD5 SHA1 SHA512 SSDEEP
Digest
a9:c6:2c:a9:98:df:7c:5c:35:d7:17:3a:fe:c4:16:a8:4c:a1:c3:23:8f:5b:43:dd:82:78:fb:43:bb:1a:0e:1d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=HAYCAV LIMITED,O=HAYCAV LIMITED,POSTALCODE=EC1V 2PH,STREET=210 City Road,L=LONDON,ST=LONDON,C=GB
Chains
Apr 4, 2019
CN=HAYCAV LIMITED,O=HAYCAV LIMITED,POSTALCODE=EC1V 2PH,STREET=210 City Road,L=LONDON,ST=LONDON,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Digest
90:12:56:43:51:ed:c7:10:04:d7:f2:4c:1e:70:d8:55:78:c8:07:e9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=HAYCAV LIMITED,O=HAYCAV LIMITED,POSTALCODE=EC1V 2PH,STREET=210 City Road,L=LONDON,ST=LONDON,C=GB
Chains
Apr 4, 2019
CN=HAYCAV LIMITED,O=HAYCAV LIMITED,POSTALCODE=EC1V 2PH,STREET=210 City Road,L=LONDON,ST=LONDON,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=HAYCAV LIMITED,O=HAYCAV LIMITED,POSTALCODE=EC1V 2PH,STREET=210 City Road,L=LONDON,ST=LONDON,C=GB
Serial Number
e0:79:1e:36:fe:f9:8f:6c:e2:3b:89:64:ff:65:3e:71
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 1, 2018 - May 8, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=HAYCAV LIMITED,O=HAYCAV LIMITED,POSTALCODE=EC1V 2PH,STREET=210 City Road,L=LONDON,ST=LONDON,C=GB
Serial Number
e0:79:1e:36:fe:f9:8f:6c:e2:3b:89:64:ff:65:3e:71
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 1, 2018 - May 8, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
5
Entry point
37258
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Admit\Release\unbreakable.pdb
kernel32
GetFullPathNameA
FormatMessageW
FormatMessageA
LocalFree
GetTempPathW
LockFileEx
LoadLibraryW
DeleteFileW
GetFileAttributesW
DeleteFileA
GetFileAttributesA
LockFile
UnlockFile
GetFileSize
SetEndOfFile
ReadFile
AreFileApisANSI
GetVersionExA
InitializeCriticalSection
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
InterlockedExchange
FreeLibrary
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetFullPathNameW
GetUserDefaultLCID
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetModuleFileNameW
GetTempPathA
GetTempFileNameA
WideCharToMultiByte
MultiByteToWideChar
GetConsoleTitleA
GetCurrentProcessId
GetTickCount
SetConsoleTitleA
Sleep
VirtualAlloc
GetModuleHandleA
GetProcAddress
lstrlenA
GlobalAlloc
GetModuleFileNameA
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
CreateEventA
WaitForSingleObject
HeapCreate
DeleteCriticalSection
GetLastError
CreateFileA
GetSystemTime
GetFileTime
CloseHandle
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
WriteFile
ExitProcess
VirtualQuery
CreateFileW
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
HeapFree
HeapAlloc
GetStartupInfoW
RtlUnwind
RaiseException
GetLocaleInfoA
FileTimeToSystemTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
user32
EndPaint
SetFocus
GetDlgItem
DialogBoxParamA
GetDialogBaseUnits
DialogBoxIndirectParamA
EnumWindowStationsW
DrawFrameControl
InflateRect
GetSystemMetrics
DefMDIChildProcA
CopyRect
SetWindowLongA
KillTimer
GetCursorInfo
ReleaseDC
GetClientRect
GetDC
FindWindowA
BeginPaint
SetCursor
GetSubMenu
DefWindowProcA
SendMessageA
wsprintfA
EndDialog
SetLayeredWindowAttributes
UpdateWindow
ShowWindow
CreateWindowExW
GetCursorPos
LoadCursorA
GetDesktopWindow
DestroyWindow
IsWindow
GetWindow
GetWindowLongA
DrawTextA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadIconA
RegisterClassExW
PostQuitMessage
GetUpdateRect
GetParent
gdi32
ExcludeClipRect
CreateSolidBrush
CreatePen
SelectObject
Rectangle
LineTo
SetDCPenColor
Ellipse
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
GetTextExtentPoint32A
CreateEllipticRgn
DeleteObject
CreateRectRgn
SetViewportOrgEx
SelectClipRgn
MoveToEx
shell32
SHGetDesktopFolder
ole32
RevokeDragDrop
CoLockObjectExternal
oleaut32
OleLoadPicture
SystemTimeToVariantTime
wininet
FtpSetCurrentDirectoryA
ws2_32
WSAStartup
winmm
timeGetTime
crypt32
CryptFormatObject
shlwapi
StrChrA
PathFileExistsW
comctl32
ord412
ord413
activeds
ord9
pdh
PdhBrowseCountersA
gdiplus
GdipDisposeImage
GdipGetImageWidth
GdipCreateLineBrushI
GdipCreateFromHDC
GdipFillRectangleI
GdipDrawImageRectI
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromFile
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDeleteBrush
GdipGetImagePixelFormat
GdipGetImageHeight
opengl32
glViewport
glOrtho
glLoadIdentity
glMatrixMode
glu32
gluLookAt
uxtheme
CloseThemeData
OpenThemeData
wsnmp32
ord601
ord201
ntdsapi
DsAddSidHistoryA
DsGetRdnW
DsGetDomainControllerInfoA
dwmapi
DwmEnableBlurBehindWindow
Type
Name
.text
Size
355KB
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
395KB
Virtual Size
394KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=45, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=155, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=43, id=123, productName=VS2005 build 50727, version=50727,
count=234, id=1, productName=Unmarked objects,
count=55, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
6b59edf464eaaeac4f4b2f43474e573694429f08c448db770618dc574b6171e8.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6b59edf464eaaeac4f4b2f43474e573694429f08c448db770618dc574b6171e8
- MD5 11f3f3382708bc7235e4d72130bc16e4
- SHA1 165459297e28175a41690fcf5f71642018a438c4
- SHA512 0ccfd5ddbdc2b86d39a4e18bfeb9ef29e5ea4f904aa40f148eb761aa82f8d45a7c6c81fce09dbd8b605a96446b0c8d5eea07496fb52053c6404c5f92e3a3de32
- SSDEEP 12288:kpKKP6WRDw6hPGUIrPiqK6UIrPiqK9h4u0hyZPAF:49PFdw6h+xjJRxjJj8P6
- MD5 SHA1 SHA512 SSDEEP
-
Sapphire ransomware PDB string
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
301906
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Sapphire-Ransomware-master\Sapphire Ransomware\obj\Debug\GachaLife_Update.pdb
mscoree
_CorExeMain
Name
.text
Size
287KB
Virtual Size
286KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
- IMPHASH e1e8417f4591da7741a300229f9e8e8b
- SHA256 7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8
- MD5 145d87e44b5607f5cbe102d1f5afe333
- SHA1 62f3e3e1535a1955853f4c2628cf31d99197bf1d
- SHA512 6edabdff5cb316045f20e4de4334e5e6f7aa2909436b94cd4da6f34929682caec31c6e4bdab1992399e9a97c48c51dd4ea2228c055bf523e9a661c710bdb5b4c
- SSDEEP 196608:LrJnLa9onJ5hrZERVM+ENFJzFcguwW+W7THsC3k:NG9c5hlERVMRFJzFcgupl7TN
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
34564
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
SetDllDirectoryW
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetLastError
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
ws2_32
ntohl
Name
.text
Size
131KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=241, version=40116,
count=169, id=243, version=40116,
count=13, id=242, version=40116,
count=7, id=259, version=24123,
count=28, id=261, version=24123,
count=19, id=260, version=24123,
count=7, id=203, version=65501,
count=114, id=1, productName=Unmarked objects,
count=16, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
DiscordNitroGenerator.pyc
- SHA256 bf63e35442184daaac14bdc3076b5dfc4f4752f0fa070196fd0b0e7ba965b74b
- MD5 e6fb5f4322cbc3da9a50c20886c42e2e
- SHA1 65348e93316e507b56a7ea2b92e628bb44291a81
- SHA512 27649c865636d7dfc2761629def17b61b9460f18b8c49cc8a2345a7ca89cb891bfb9c574407cb504a5fd0799d2f2de6ff685f70330980bcf41e6e03ead614c10
- SSDEEP 192:AxAAgAxRZ6+scrnNBbQf3vVXXfgp7p8RMTIll/X3TtQn3XVIYHe8W:A2AgAD/rNB8f39XYp9BUlgXaee1
- MD5 SHA1 SHA512 SSDEEP
96ba85326e2250f4e1cf07f5981bb96ea1383901663a6354899b5da0cd77b98a.exe
- IMPHASH e1e8417f4591da7741a300229f9e8e8b
- SHA256 96ba85326e2250f4e1cf07f5981bb96ea1383901663a6354899b5da0cd77b98a
- MD5 09ed7ffe72f67fe9d02df3d31ecaf9c2
- SHA1 fd9d56bb3d30986e41c12db7652dc6ade26bafe7
- SHA512 fdc4ded62ee81705cebab17b577ee63f404d230bd6f3fc9f5e08c671ce5bd0b0d643779dc351c2ecfa03394d59055992bcda907d6b2ce0cb1f9e2bf2c92497d9
- SSDEEP 196608:wCHgeIs9onJ5hrZERlyiU8AdZYJERurTbqGnNqbm:is9c5hlERJAdZYygrvqG
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
34564
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
SetDllDirectoryW
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetLastError
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
ws2_32
ntohl
Name
.text
Size
131KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
196KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=241, version=40116,
count=169, id=243, version=40116,
count=13, id=242, version=40116,
count=7, id=259, version=24123,
count=28, id=261, version=24123,
count=19, id=260, version=24123,
count=7, id=203, version=65501,
count=114, id=1, productName=Unmarked objects,
count=16, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
NitroGenerator.pyc
- SHA256 f2a1ec420ce14cf8ddb6e0e68868197cf57ae45839f32427bd32c043fe8a9dca
- MD5 fa5c82dc08f0d1df738ee69d11070b12
- SHA1 ec8458c62cd3c53a8d79fee1154a16a9190453e0
- SHA512 e78c66c80a8211cad2c8c898b97444fe017cf7276f7d4b2732590c66cc90874fd84fc18d0f0f50f8e563c543ef572883f82c0590a155e1a28cda4809b6ec50e2
- SSDEEP 192:heItfRpJoNkZ6+skrond8dfhmSsuoGI7Z89dSCx6lz9BC:hjNr1dfoSsXGI18d761C
- MD5 SHA1 SHA512 SSDEEP
97f1b6afb24cda22203275fc34bd07ba51170729edba8ee67bdb66a529574a2e.exe
- SHA256 97f1b6afb24cda22203275fc34bd07ba51170729edba8ee67bdb66a529574a2e
- MD5 35c38b54ec41899c417ec3fcb06cccf4
- SHA1 3dd53581b2120c467191267f23f021d9d939d899
- SHA512 58010a01088e2817f278ba9c5dd3dc6e05f21c33d1d45797d170b712fdf183eccbd4d6eaee58f73b5eb79fc04b39089fc543cf60be259b62fab1a425ddd3eec4
- SSDEEP 196608:UQBQji8WWzNfmRUJbeq/gEY8OA33+yzzRZa/viMRLpMXBMJTybG:NB06gNfuUB7/gk33+sz7KpRVGGJTWG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13306032
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
9.8MB
Virtual Size
9.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
71KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=5, id=12, version=7291,
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=44, id=19, version=8022,
count=24, id=19, version=8034,
count=672, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=212, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=95, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=94, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=53, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
out.upx
- SHA256 9d80fdfdaa2fc06b8e3278091b9fdf145c090793dd39007c20cdf9c881b599dd
- MD5 55b3e33208986e564d832a96e2a59733
- SHA1 353fd8bdc9dca7ecf157480c2d61076a50e7af7f
- SHA512 dcaf2cdd06033d9e31027b85dc3c15d6d1be4dae4a1b39dc4c20bc14efed8b738060de7716f2902ec605e5a09f50dad6648a9b417d0db35ab09e047143d29b76
- SSDEEP 393216:JDMlRqadteEoDwv3z5VfE/I5M37RiOO3UrrTpQ4zSI+w1J0OrUwBcfTuM/sZ6p1Z:JYlLdteQ7y37RiLUTpCZwDOFHFmi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
408450
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
520KB
Virtual Size
518KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11.8MB
Virtual Size
11.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
88KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=5, id=12, version=7291,
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=44, id=19, version=8022,
count=24, id=19, version=8034,
count=672, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=212, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=95, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=94, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=53, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
9906747639b782d738555a2522acd4a09ca8a3356f7848a4e68f284d888d891e.exe
- IMPHASH d8510bdedf9dc05b902a211ff01636cf
- SHA256 9906747639b782d738555a2522acd4a09ca8a3356f7848a4e68f284d888d891e
- MD5 0a305e53c26f277a2afeb9cf4541f756
- SHA1 be05166cf743ca175fb5a31ffefd384e4793ee76
- SHA512 677eb1db78cdcd19d1048669e9217d635454e0bf23c9577ef569e13a116526847663cba777e5f22f1b0466ea317fe406c5b3a1801ab3063a0892ad68abfca5f5
- SSDEEP 12288:LBEZRnbrET0OeW5fw0q1Ybwv98ic+cy3GBX:LBmEYEVw0qTe8GX
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
73:e3:b9:69:93:da:a1:1a:6d:b9:14:14:30:85:ce:19:12:b9:cf:35:2c:da:ff:dd:fe:03:a8:ba:bd:5d:b9:4c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 26, 2024
Subject
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:9e:05:ca:b1:2e:ac:93:cf:b6:00:00:00:00:02:9e
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2020 - Sep 23, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
280368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
MpCmdRun.pdb
kernel32
DebugBreak
Sleep
CloseHandle
SetErrorMode
FormatMessageW
GetSystemTimeAsFileTime
GetLastError
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LocalFree
GetTickCount
SetLastError
GetCurrentThreadId
GetCommandLineW
GetCurrentProcess
GetExitCodeProcess
DeleteFileW
CreateDirectoryW
GetLocalTime
CopyFileW
CreatePipe
SetHandleInformation
CreateProcessW
WaitForSingleObject
FindFirstFileW
GetSystemTime
FindNextFileW
FindClose
FreeLibrary
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
LoadLibraryExW
GetStdHandle
GetConsoleMode
SetConsoleMode
GetDateFormatW
GetTimeFormatW
CompareFileTime
TerminateProcess
GetProcAddress
GetSystemDefaultUILanguage
MultiByteToWideChar
lstrlenA
GetSystemInfo
LoadLibraryExA
VirtualProtect
GetSystemFirmwareTable
SetFilePointerEx
LoadLibraryW
WriteFile
CreateTimerQueueTimer
GetFileSizeEx
ReadFile
VirtualQuery
HeapSetInformation
GetNativeSystemInfo
GetSystemDirectoryW
GetTempPathW
GetModuleFileNameW
QueryPerformanceFrequency
MoveFileExW
SetFileInformationByHandle
GetProcessHeap
AcquireSRWLockShared
HeapAlloc
ReleaseSRWLockShared
SetThreadpoolTimer
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
HeapFree
GetVersionExW
FileTimeToDosDateTime
WideCharToMultiByte
GetFileInformationByHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetFileAttributesW
SetFileAttributesW
CreateFileW
GetFinalPathNameByHandleW
DeviceIoControl
DeleteTimerQueueTimer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
RaiseException
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
GetSystemPowerStatus
GetComputerNameExW
GetLocaleInfoW
ConvertDefaultLocale
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__stdio_common_vsprintf
_set_fmode
__p__commode
_lseek
_write
_wtempnam
__acrt_iob_func
_read
_wsopen_dispatch
_wfopen
fclose
getchar
fgetws
__stdio_common_vswscanf
__stdio_common_vfwprintf
__stdio_common_vswprintf
__stdio_common_vfprintf
feof
_close
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
_wcsnicmp
_wcsicmp
iswprint
iswspace
wcscmp
isprint
towlower
_wcsupr_s
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstol
_wtoi
_itoa_s
wcstoul
api-ms-win-crt-runtime-l1-1-0
abort
__doserrno
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
_initialize_onexit_table
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_register_onexit_function
_invalid_parameter_noinfo
_errno
_invalid_parameter_noinfo_noreturn
_exit
_crt_atexit
__p___argc
setupapi
SetupDiGetClassRegistryPropertyW
bcrypt
BCryptDestroyHash
BCryptFinishHash
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptHashData
mpclient
MpConfigIteratorOpen
MpConfigIteratorEnum
MpConfigIteratorClose
MpNetworkCapture
MpConfigDelValue
MpQuarantineRequest
MpDynamicSignatureEnumerate
MpManagerStatusQueryEx
MpUpdateStart
MpSampleQuery
MpSampleSubmit
MpDynamicSignatureOpen
MpConveySampleSubmissionResult
MpGetSampleChunk
MpAddDynamicSignatureFile
MpUpdateStartEx
MpCleanStart
MpCleanOpen
MpQueryEngineConfigDword
MpManagerVersionQuery
MpScanStartEx
MpScanControl
MpScanResult
MpThreatEnumerate
MpThreatOpen
MpConfigUninitialize
MpConfigGetValueAlloc
MpUpdatePlatform
MpWDEnable
MpManagerEnable
MpConfigInitialize
MpAllocMemory
MpClientUtilExportFunctions
MpFreeMemory
MpConfigClose
MpConfigSetValue
MpConfigGetValue
MpConfigOpen
MpGetTPStateInfo
MpManagerStatusQuery
MpManagerOpen
MpHandleClose
MpGetTaskSchedulerStrings
MpRemoveDynamicSignatureFile
MpUtilsExportFunctions
ntdll
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlLengthSid
RtlCompareMemory
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
calloc
malloc
_callnewh
_set_new_mode
_calloc_base
_free_base
free
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-math-l1-1-0
ceilf
Name
.text
Size
304KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=260, version=29395,
count=9, id=259, version=29395,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=50, id=261, version=29395,
count=11, id=257, version=29395,
count=471, id=1, productName=Unmarked objects,
count=130, id=265, version=29395,
count=1, id=126, version=50727,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08
- MD5 70117cfb0d652621da77c47c952fb81a
- SHA1 3d841739fd18d02612851c10684631ddcdbc442c
- SHA512 abaa63d29588b5fdd5fdc99b1a9eeeeb5ec32416b24054ea5111d960c483492e8b76fd5652d32d8bf6380a7a803916e3009c90ffae9988bee6c4f09b4b7a71d8
- SSDEEP 24576:nTSTiRsBE12BIVpT2QhYpAILUo/g9QZqpMC3QVbIoTdWR8SfEuGujqZF13z8H81:nT7RseZDT2tSbvQsIbe8YVjPH81
- MD5 SHA1 SHA512 SSDEEP
-
Detect MafiaWare666 ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1360610
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\bokai\Downloads\EncrypterPOC-main\EncrypterPOC-main\WindowsFormsApp1\obj\Release\WindowsFormsApp1.pdb
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
b7fc91fc1fa6a53b1e5d97e21a7abefbde3ca7349d4db0fdbe15ec2702b1b737.exe
- IMPHASH 08c12a4e8a6a5e4388e0bc669ebc661c
- SHA256 b7fc91fc1fa6a53b1e5d97e21a7abefbde3ca7349d4db0fdbe15ec2702b1b737
- MD5 80ed1719d442fc2171378203cf4a18d9
- SHA1 460e8fe2a7cc6ce2ad7fce8efa646309c83b0f2d
- SHA512 a682fe3b247dca16b11329264749ce8f5fe3a9742dde70e19edff5eb72f0399f0502965c1bdea02d80428c989ccffba399146e27899ca79a16e49a44bde5468b
- SSDEEP 196608:Wpl+gp1DM9onJ5hrZER9xQ3jo4UR7+cOKcAYuO:y3pNM9c5hlER9xA2RSccA
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
35000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
MessageBoxW
MessageBoxA
kernel32
HeapReAlloc
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
SetEndOfFile
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
GetDriveTypeW
HeapSize
GetTimeZoneInformation
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
RaiseException
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
ws2_32
ntohl
Name
.text
Size
129KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
262KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=241, version=40116,
count=171, id=243, version=40116,
count=13, id=242, version=40116,
count=7, id=259, version=24123,
count=28, id=261, version=24123,
count=19, id=260, version=24123,
count=9, id=203, version=65501,
count=116, id=1, productName=Unmarked objects,
count=16, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
DC_Grabber.pyc
- SHA256 c77aa191c11ecf402db7c914a85b910de3f1d3a1ecebbca32bdc44cd8e5b1a93
- MD5 4163c7d02c184a7af767be41ab22511a
- SHA1 1e6fb348f49af88cd4f1bc5ab060a67ef877d5e6
- SHA512 07269a2b3070581be4e54c27a9bad57c96921ea2f433ca4b2e017697e5c0de37fef8b4f5c42e32b38dea46f81de0d3ec8a2555c552adeac177eede97d42da1ee
- MD5 SHA1 SHA512
bf179bbd2ce7ca31e421334efa7d262e30dc16b9bb5cced1b8b18d119adc4425.exe
- SHA256 bf179bbd2ce7ca31e421334efa7d262e30dc16b9bb5cced1b8b18d119adc4425
- MD5 3a7ee11b5c67258e478c564b6a54f3d0
- SHA1 fc7448b0e35688c3181b71d41f7f0eb86ad23f09
- SHA512 16e88c8095167279736b71074414a7598e3d7b776239f90fe1d6607886f176bc15eebd7cb7233f474455de4b078351f8691fdc94d47d5cbde0052de8f463036c
- SSDEEP 49152:kHftXHrT6Qdbu/OUlYF+E7UAQndLI8oOHxPKalwx:k/t3f6QdbbUlYkzAQd8WxCaU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
75730945
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
1.3MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
130KB
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
96KB
Virtual Size
66.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.TFPT
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
105KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
cfc68c40f4631954894898633fd0c5a06c5ce5837eba7d4b56fc3514c01e124f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cfc68c40f4631954894898633fd0c5a06c5ce5837eba7d4b56fc3514c01e124f
- MD5 dedb7d290dc95b76d6daf34569d25522
- SHA1 7bc1c4e3ca288a096ef9abb347238e904970a955
- SHA512 bfae90fa15abd4513869f55a8b51501da68222b3475fdb77292130fa6da32c025983d5715e12572a8083f1f758336032483ec7cb9a388875e106105d7c6e2ac2
- SSDEEP 12288:egYqC/dIVYS1QYMHy4Ijd1jF4sjMUUWp+GIMHg:hodIVyYMS4IjTljcO+hM
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
72:5b:68:fd:02:07:ad:e4:d8:d3:6b:22:ad:d7:e0:04:04:74:a6:a8
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jun 15, 2021
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:e2:0d:5b:e0:b5:19:0b:1d:bf:de:9b:ef:38:0d:9a
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - May 7, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
321342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
306KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
281KB
Virtual Size
280KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe
- IMPHASH 8ef0868017063524296ec8b3461ee456
- SHA256 e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb
- MD5 4df094b7a875e5d2e7cb634752cd951d
- SHA1 c088d58529b77f6670891f9ebb7af80da830c9ce
- SHA512 a932b3ca31cf5457d73f9d73429610c24fafd60e69ce849e0e3de7e4ab1ffe464ba40182d903b8f7dd7f80202587be81871d8a5dfec7a4da2d030eb67d63872e
- SSDEEP 12288:Btu7UAD3Qlp2MtIaM2QVA2DrYrgMDvsu/UJHI20KoGIVlGiL:T+V3ap2pDsPvsu/UJHTkF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
313572
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\codecrack\github\einweggerat\out_x64\einweggerat.pdb
dinput8
DirectInput8Create
shlwapi
PathStripPathW
PathRemoveExtensionW
PathAppendW
StrStrIA
PathFindExtensionW
kernel32
LeaveCriticalSection
Sleep
GetCurrentProcess
GetCurrentProcessId
ExitProcess
GetCurrentThreadId
GetSystemTime
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
LoadLibraryExW
LoadLibraryA
LocalAlloc
LocalFree
lstrcmpW
lstrcmpiW
lstrcpynW
lstrlenW
SetDllDirectoryW
VerifyVersionInfoW
CompareStringW
AllocConsole
AttachConsole
InitializeCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
CreateEventW
CreateThread
SetThreadPriority
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileSizeEx
GetConsoleCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
SetLastError
GetUserDefaultLCID
IsValidLocale
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
GetFileType
WriteFile
GetStdHandle
GetModuleHandleExW
VirtualQuery
VirtualProtect
GetSystemInfo
ReadFile
RtlUnwindEx
RtlPcToFileHeader
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringW
GetCPInfo
GetLocaleInfoW
LCMapStringW
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
GetStringTypeW
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
CloseHandle
FindNextFileW
FindFirstFileW
FindClose
CreateFileA
CreateDirectoryW
GetCommandLineA
VerSetConditionMask
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
WideCharToMultiByte
MultiByteToWideChar
lstrcatW
lstrcpyW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionEx
RtlUnwind
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
RaiseException
DecodePointer
LoadLibraryW
GetProcAddress
FreeLibrary
SetStdHandle
FlushFileBuffers
CreateFileW
SetEndOfFile
WriteConsoleW
EnumSystemLocalesW
user32
MapWindowPoints
ScreenToClient
GetCursorPos
SetCursor
GetSysColor
PtInRect
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
GetParent
GetSysColorBrush
DrawFocusRect
FillRect
FrameRect
SetRectEmpty
MessageBeep
OffsetRect
SetParent
UnregisterClassW
GetClassNameW
GetWindow
CheckMenuRadioItem
LoadCursorW
LoadIconW
DestroyIcon
LoadImageW
DrawIconEx
IsDialogMessageW
SystemParametersInfoW
MessageBoxW
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
MoveWindow
BeginPaint
ValidateRect
InvalidateRect
EndPaint
GetWindowLongW
ReleaseDC
GetDC
UpdateWindow
DrawTextW
SetMenuDefaultItem
SetMenuItemInfoW
GetMenuItemInfoW
TrackPopupMenuEx
RemoveMenu
AppendMenuW
GetMenuItemCount
DestroyMenu
CreatePopupMenu
SetMenu
LoadMenuW
GetSystemMetrics
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowEnabled
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetKeyNameTextW
GetKeyState
GetFocus
GetActiveWindow
SetFocus
CharNextW
GetDlgCtrlID
GetNextDlgTabItem
GetDlgItem
EndDialog
DialogBoxParamW
CreateDialogParamW
SetWindowPos
ShowWindow
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageW
GetMessagePos
PeekMessageW
DispatchMessageW
TranslateMessage
DrawFrameControl
TrackMouseEvent
wsprintfW
wsprintfA
LoadStringW
LoadStringA
EnumDisplaySettingsW
SetWindowTextW
gdi32
ChoosePixelFormat
ExtTextOutW
MoveToEx
GetObjectW
GetTextMetricsW
SetTextColor
SetBkMode
SetBkColor
SelectObject
LineTo
GetStockObject
FillRgn
DeleteObject
CreateSolidBrush
CreateRectRgnIndirect
CreatePen
CombineRgn
SetPixelFormat
SwapBuffers
CreateFontIndirectW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegQueryValueExW
RegDeleteKeyW
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
shell32
CommandLineToArgvW
ShellExecuteW
DragAcceptFiles
DragFinish
DragQueryFileW
ole32
CoSetProxyBlanket
CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SysStringByteLen
SysAllocStringByteLen
VariantInit
VarUI4FromStr
VariantChangeType
VariantCopy
VariantClear
comctl32
ImageList_Create
ImageList_ReplaceIcon
InitCommonControlsEx
opengl32
wglDeleteContext
wglGetProcAddress
wglMakeCurrent
wglCreateContext
crypt32
CryptBinaryToStringW
CryptStringToBinaryW
Name
.text
Size
518KB
Virtual Size
518KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
165KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
118KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=259, version=26715,
count=2, id=199, version=41118,
count=90, id=261, version=28117,
count=19, id=260, version=28117,
count=9, id=259, version=28117,
count=23, id=260, version=26715,
count=190, id=261, version=26715,
count=4, id=262, version=26715,
count=27, id=257, version=26715,
count=315, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2019 v16.4.4 build 28316, version=28316,
count=11, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,
count=1, id=255, productName=VS2019 v16.4.4 build 28316, version=28316,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.4.4 build 28316, version=28316,
f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe
- IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
- SHA256 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768
- MD5 466b6ffd9a2098925c8727c60099626f
- SHA1 9b1bef96aa713e21b0946506e2fcb6cede4bfc0b
- SHA512 005b6feed62de8a274ba5f2ef7904a0263e513dee18995a04cc4b5fbb746bc094bfd06f56f4aa8ef5e89793bc958a37d1bdb0c57327dae437f1ecb36b4534307
- SSDEEP 196608:wjB8ZML/cWcIjvuK7qtigyegsZPc+3ZGe74rb8cWEDc:wjB8Z6cOv17qisRXcPWE4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12707
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
GetFileAttributesA
SetFileAttributesA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
GetFullPathNameA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
GlobalUnlock
GetDiskFreeSpaceA
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/nsExec.dll
- IMPHASH 46f8b6973f33717335c0f6d8087de67b
- SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
- MD5 b5a1f9dc73e2944a388a61411bdd8c70
- SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
- SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
- SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleA
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
lstrcpynA
ReadFile
PeekNamedPipe
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
GetProcAddress
GetVersion
DeleteFileA
lstrcmpiA
GetCurrentProcess
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
CreatePipe
GlobalLock
lstrcatA
user32
SendMessageA
OemToCharBuffA
FindWindowExA
CharNextA
wsprintfA
CharPrevA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
458B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsProcess.dll
- IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4255
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
lstrcpynA
GlobalAlloc
_FindProcess
_KillProcess
_Unload
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
646B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
146B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=15, id=1, productName=Unmarked objects,
count=1, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
parameters.ini
- SHA256 fc8636f6c23d345622992fa37650e24efef646987fef2150e42391c03d061589
- MD5 80e46e47466d7b829d70df82858072cc
- SHA1 f48a69048de7184e200cc7023aed44234bdb6c8f
- SHA512 7d9ec20fcfdce3f57cc4535192de96a0dd546c81b380d5aa7e5bac1d91f199168d94384e7b1f3adb06ee33dfe999a7d8eea09c7f6966ea0cac80935fb244e914
- MD5 SHA1 SHA512
secrehosted.exe
- IMPHASH 57e874dfa8e7eebdf2ca356d9c305d3e
- SHA256 0cedeb6633fdc8079cde76d2cc72bf98f0496c0dd644a7f215e59014b3dc5f4b
- MD5 c1b7d5a866e2c21c7bc6222328638cfc
- SHA1 3c09adc17b23ec529951d467481afd495d227cdc
- SHA512 7e47ea282cb82f003c92565ff9dc9d1cfcdbeeecd8668565eaecd4ef99e609083b3a0192bf01e8e13b467b53e266157cb61cc13c77f1ad169cec1cd141a28814
- SSDEEP 196608:3YvW2URVICtO4SS2khNmunJI036/n+WWYBB:qWDkC8kTHKPQYP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
10807191
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
wininet
InternetCloseHandle
winspool.drv
DocumentPropertiesW
comctl32
ImageList_GetImageInfo
shell32
Shell_NotifyIconW
user32
CopyImage
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
version
GetFileVersionInfoSizeW
oleaut32
SafeArrayPutElement
advapi32
CloseServiceHandle
netapi32
NetWkstaGetInfo
msvcrt
isupper
winhttp
WinHttpGetIEProxyConfigForCurrentUser
kernel32
GetVersion
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shfolder
SHGetFolderPathW
wsock32
gethostbyaddr
ole32
IsEqualGUID
gdi32
Pie
wtsapi32
WTSSendMessageW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
96B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vmp0
Size
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
6.6MB
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ