MsiZap.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3MsiZap.exe
windows7-x64
3MsiZap.exe
windows10-2004-x64
3adfind.exe
windows7-x64
3adfind.exe
windows10-2004-x64
3croperdate.dll
windows7-x64
3croperdate.dll
windows10-2004-x64
3croperdate.exe
windows7-x64
10croperdate.exe
windows10-2004-x64
10croperdate64.dll
windows7-x64
1croperdate64.dll
windows10-2004-x64
1doc_main_0.docx
windows7-x64
7doc_main_0.docx
windows10-2004-x64
1doc_main_1.docx
windows7-x64
7doc_main_1.docx
windows10-2004-x64
1doc_main_10.docx
windows7-x64
7doc_main_10.docx
windows10-2004-x64
1doc_main_11.docx
windows7-x64
7doc_main_11.docx
windows10-2004-x64
1doc_main_12.docx
windows7-x64
7doc_main_12.docx
windows10-2004-x64
1doc_main_13.docx
windows7-x64
7doc_main_13.docx
windows10-2004-x64
1doc_main_14.docx
windows7-x64
7doc_main_14.docx
windows10-2004-x64
1doc_main_15.docx
windows7-x64
7doc_main_15.docx
windows10-2004-x64
1doc_main_16.docx
windows7-x64
7doc_main_16.docx
windows10-2004-x64
1doc_main_17.docx
windows7-x64
7doc_main_17.docx
windows10-2004-x64
1doc_main_18.docx
windows7-x64
7doc_main_18.docx
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
MsiZap.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
MsiZap.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
adfind.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
adfind.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
croperdate.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
croperdate.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
croperdate.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
croperdate.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
croperdate64.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
croperdate64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
doc_main_0.docx
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
doc_main_0.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
doc_main_1.docx
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
doc_main_1.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
doc_main_10.docx
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
doc_main_10.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
doc_main_11.docx
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
doc_main_11.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
doc_main_12.docx
Resource
win7-20241023-en
Behavioral task
behavioral20
Sample
doc_main_12.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
doc_main_13.docx
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
doc_main_13.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
doc_main_14.docx
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
doc_main_14.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
doc_main_15.docx
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
doc_main_15.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
doc_main_16.docx
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
doc_main_16.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
doc_main_17.docx
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
doc_main_17.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
doc_main_18.docx
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
doc_main_18.docx
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_270248e6a629a7d47374cf2c8a172000ca6790c7ab7e90eac0fdbac902122958
-
Size
5.8MB
-
MD5
9cee3ed351f503d03da28319d1a9acf6
-
SHA1
58806175875390a446c1366512e0680711dee087
-
SHA256
270248e6a629a7d47374cf2c8a172000ca6790c7ab7e90eac0fdbac902122958
-
SHA512
ecdabad137321d2860b9d76c3ceef11b758f6d196c0b55c21735e5d9bbcfe49f63f07c325e18c1a723f6aac09145cb6f7347960c7d842fe331c4f289792550b8
-
SSDEEP
98304:/o7ykqZ9PnFMEbnecNecNecNecDecKeczecXecxecmecgnecdec0eck9ecjMQecr:/1kutnOYnecNecNecNecDecKeczecXe8
Malware Config
Signatures
-
Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/MsiZap.exe unpack001/adfind.exe unpack001/croperdate.dll unpack001/croperdate.exe unpack001/croperdate64.dll unpack001/http.dll unpack001/kas.dll unpack001/kas64.dll unpack001/kaslose.dll unpack001/kaslose.exe unpack001/kaslose64.dll unpack001/kaslose64.exe unpack001/kaslosehttp.exe
Files
-
JaffaCakes118_270248e6a629a7d47374cf2c8a172000ca6790c7ab7e90eac0fdbac902122958.zip
-
MsiZap.exe.exe windows:5 windows x86 arch:x86
71439615f782da28b313eece8b020d7e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
QueryServiceStatus
ControlService
OpenServiceW
OpenSCManagerW
AllocateAndInitializeSid
OpenProcessToken
OpenThreadToken
CopySid
GetTokenInformation
FreeSid
EqualSid
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
RegEnumKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
kernel32
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryW
Sleep
GetCurrentProcess
GetCurrentThread
CloseHandle
lstrlenW
LocalFree
FormatMessageW
lstrcmpiW
OutputDebugStringW
GetSystemDirectoryW
lstrcatW
lstrcpyW
SetFileAttributesW
CreateFileW
DeleteFileW
GetFileAttributesW
RemoveDirectoryW
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
GetDriveTypeW
GetWindowsDirectoryW
GetEnvironmentVariableW
lstrcpynW
GetVersionExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
ExitProcess
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
HeapReAlloc
LoadLibraryA
InitializeCriticalSection
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
InterlockedExchange
VirtualQuery
SetFilePointer
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetStdHandle
VirtualProtect
GetSystemInfo
FlushFileBuffers
ReadFile
shell32
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW
msi
ord8
ord201
ord118
ord160
ord159
ord32
ord92
Sections
.text Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
adfind.exe.exe windows:6 windows x86 arch:x86
bca5675746d13a1f246e2da3c2217492
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
E:\DEV\cpp\vs\AdFind\Release\AdFind.pdb
Imports
crypt32
CertNameToStrA
CertFreeCertificateContext
CryptDecodeObjectEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
advapi32
ConvertStringSidToSidA
ConvertSecurityDescriptorToStringSecurityDescriptorA
LsaLookupSids
ConvertSidToStringSidA
ConvertStringSidToSidW
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
LsaOpenPolicy
GetLengthSid
IsValidSecurityDescriptor
LookupAccountSidA
IsValidSid
wldap32
ord309
ord215
ord139
ord132
ord12
ord178
ord77
ord141
ord207
ord96
ord146
ord223
ord310
ord41
ord218
ord135
ord72
ord304
ord191
ord14
ord147
ord166
ord79
ord36
ord27
ord121
ord13
ord54
ord55
ord205
ord26
ord117
ord119
ord126
ord301
ord93
ord196
ws2_32
ntohs
kernel32
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetProcessHeap
SetFilePointerEx
ReadFile
SetConsoleMode
ReadConsoleInputA
ReadConsoleW
CreateFileW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetCommandLineW
GetCommandLineA
WriteFile
HeapFree
HeapReAlloc
HeapAlloc
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetFileAttributesExA
GetStdHandle
MultiByteToWideChar
FormatMessageW
GetTimeZoneInformation
LocalFileTimeToFileTime
GetLastError
GetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFree
SystemTimeToFileTime
WideCharToMultiByte
GetFileType
CreateDirectoryA
GetSystemTime
GetTickCount
RaiseException
SetEndOfFile
RtlUnwind
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
ole32
StringFromGUID2
CLSIDFromString
Sections
.text Size: 793KB - Virtual size: 793KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
croperdate.dll.dll regsvr32 windows:6 windows x86 arch:x86
404e60e1ae3fa5a8516183e3655abd0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
VirtualFree
VirtualAlloc
Sleep
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetSystemInfo
GetWindowsDirectoryA
GetTickCount
IsDebuggerPresent
OutputDebugStringA
WaitForSingleObject
HeapCreate
HeapFree
SetLastError
WaitForMultipleObjects
ResumeThread
ExitThread
GetLastError
SetEvent
CloseHandle
CreateThread
HeapAlloc
CreateEventA
DecodePointer
HeapReAlloc
HeapSize
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetStartupInfoW
LocalFree
EncodePointer
RaiseException
InterlockedFlushSList
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
CreateFileW
SetStdHandle
SetFilePointerEx
WriteConsoleW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitializeSecurity
oleaut32
SysFreeString
SysAllocString
Exports
Exports
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
StartW
Sections
.text Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
croperdate.exe.exe windows:6 windows x86 arch:x86
3b06bdb2bd9c293b03f5f6895108a59f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
VirtualFree
VirtualAlloc
Sleep
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetSystemInfo
GetWindowsDirectoryA
GetTickCount
IsDebuggerPresent
OutputDebugStringA
WaitForSingleObject
HeapCreate
HeapFree
SetLastError
WaitForMultipleObjects
ResumeThread
ExitThread
GetLastError
SetEvent
CloseHandle
CreateThread
HeapAlloc
CreateEventA
DecodePointer
HeapReAlloc
HeapSize
WriteConsoleW
SetFilePointerEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LocalFree
EncodePointer
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetACP
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
CreateFileW
ole32
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
Sections
.text Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
croperdate64.dll.dll regsvr32 windows:6 windows x64 arch:x64
a21f516b5754f8d581a9d694744c3eb1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
VirtualAlloc
Sleep
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetSystemInfo
GetWindowsDirectoryA
GetTickCount
IsDebuggerPresent
OutputDebugStringA
WaitForSingleObject
HeapCreate
HeapFree
SetLastError
WaitForMultipleObjects
ResumeThread
ExitThread
GetLastError
SetEvent
CloseHandle
CreateThread
HeapAlloc
CreateEventA
HeapReAlloc
HeapSize
WriteConsoleW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetStartupInfoW
LocalFree
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
CreateFileW
SetStdHandle
SetFilePointerEx
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitializeSecurity
oleaut32
SysFreeString
SysAllocString
Exports
Exports
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
StartW
Sections
.text Size: 281KB - Virtual size: 281KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
doc_main_0.docx.docx office2007
-
doc_main_1.docx.docx office2007
-
doc_main_10.docx.docx office2007
-
doc_main_11.docx.docx office2007
-
doc_main_12.docx.docx office2007
-
doc_main_13.docx.docx office2007
-
doc_main_14.docx.docx office2007
-
doc_main_15.docx.docx office2007
-
doc_main_16.docx.docx office2007
-
doc_main_17.docx.docx office2007
-
doc_main_18.docx.docx office2007
-
doc_main_19.docx.docx office2007
-
doc_main_2.docx.docx office2007
-
doc_main_20.docx.docx office2007
-
doc_main_21.docx.docx office2007
-
doc_main_22.docx.docx office2007
-
doc_main_23.docx.docx office2007
-
doc_main_24.docx.docx office2007
-
doc_main_25.docx.docx office2007
-
doc_main_26.docx.docx office2007
-
doc_main_28.docx.docx office2007
-
doc_main_29.docx.docx office2007
-
doc_main_3.docx.docx office2007
-
doc_main_30.docx.docx office2007
-
doc_main_31.docx.docx office2007
-
doc_main_32.docx.docx office2007
-
doc_main_4.docx.docx office2007
-
doc_main_5.docx.docx office2007
-
doc_main_6.docx.docx office2007
-
doc_main_7.docx.docx office2007
-
doc_main_8.docx.docx office2007
-
doc_main_9.docx.docx office2007
-
e.bat
-
e2.bat
-
e3.bat
-
e4.bat
-
e5.bat
-
e6.bat
-
eset.bat
-
fed1.bat
-
fed2.bat
-
fed3.bat
-
http.dll.dll regsvr32 windows:6 windows x86 arch:x86
404e60e1ae3fa5a8516183e3655abd0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
VirtualFree
VirtualAlloc
Sleep
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetSystemInfo
GetWindowsDirectoryA
GetTickCount
IsDebuggerPresent
OutputDebugStringA
WaitForSingleObject
HeapCreate
HeapFree
SetLastError
WaitForMultipleObjects
ResumeThread
ExitThread
GetLastError
SetEvent
CloseHandle
CreateThread
HeapAlloc
CreateEventA
DecodePointer
HeapReAlloc
HeapSize
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetStartupInfoW
LocalFree
EncodePointer
RaiseException
InterlockedFlushSList
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
CreateFileW
SetStdHandle
SetFilePointerEx
WriteConsoleW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitializeSecurity
oleaut32
SysFreeString
SysAllocString
Exports
Exports
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
StartW
Sections
.text Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
kas.dll.dll regsvr32 windows:6 windows x86 arch:x86
f7a59d112469e74fcec83c0c24f033f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FindFirstFileA
FindNextFileA
CreateFileA
GetProcessHeap
GetProcAddress
ExitProcess
CloseHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
InterlockedFlushSList
RaiseException
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
FindClose
FindFirstFileExA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
Exports
Exports
DllRegisterServer
Sections
.text Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
kas64.dll.dll regsvr32 windows:6 windows x64 arch:x64
2869cb885758b15d003acb119f131468
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetEnvironmentStringsW
GetLastError
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
HeapAlloc
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
ReadProcessMemory
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_beginthread
_errno
_initterm
_lock
_unlock
abort
calloc
fputc
free
fwrite
localeconv
malloc
memcpy
memset
realloc
strerror
strlen
strncmp
vfprintf
wcslen
Exports
Exports
DllRegisterServer
_cgo_dummy_export
Sections
.text Size: 472KB - Virtual size: 472KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 476KB - Virtual size: 475KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 293KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 111B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
kaslose.dll.dll regsvr32 windows:6 windows x86 arch:x86
404e60e1ae3fa5a8516183e3655abd0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
VirtualFree
VirtualAlloc
Sleep
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetSystemInfo
GetWindowsDirectoryA
GetTickCount
IsDebuggerPresent
OutputDebugStringA
WaitForSingleObject
HeapCreate
HeapFree
SetLastError
WaitForMultipleObjects
ResumeThread
ExitThread
GetLastError
SetEvent
CloseHandle
CreateThread
HeapAlloc
CreateEventA
DecodePointer
HeapReAlloc
HeapSize
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetStartupInfoW
LocalFree
EncodePointer
RaiseException
InterlockedFlushSList
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
CreateFileW
SetStdHandle
SetFilePointerEx
WriteConsoleW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitializeSecurity
oleaut32
SysFreeString
SysAllocString
Exports
Exports
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
StartW
Sections
.text Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
kaslose.exe.exe windows:6 windows x86 arch:x86
3b06bdb2bd9c293b03f5f6895108a59f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
VirtualFree
VirtualAlloc
Sleep
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetSystemInfo
GetWindowsDirectoryA
GetTickCount
IsDebuggerPresent
OutputDebugStringA
WaitForSingleObject
HeapCreate
HeapFree
SetLastError
WaitForMultipleObjects
ResumeThread
ExitThread
GetLastError
SetEvent
CloseHandle
CreateThread
HeapAlloc
CreateEventA
DecodePointer
HeapReAlloc
HeapSize
WriteConsoleW
SetFilePointerEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LocalFree
EncodePointer
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetACP
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
CreateFileW
ole32
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
Sections
.text Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
kaslose64.dll.dll regsvr32 windows:6 windows x64 arch:x64
a21f516b5754f8d581a9d694744c3eb1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
VirtualAlloc
Sleep
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetSystemInfo
GetWindowsDirectoryA
GetTickCount
IsDebuggerPresent
OutputDebugStringA
WaitForSingleObject
HeapCreate
HeapFree
SetLastError
WaitForMultipleObjects
ResumeThread
ExitThread
GetLastError
SetEvent
CloseHandle
CreateThread
HeapAlloc
CreateEventA
HeapReAlloc
HeapSize
WriteConsoleW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetStartupInfoW
LocalFree
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
CreateFileW
SetStdHandle
SetFilePointerEx
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitializeSecurity
oleaut32
SysFreeString
SysAllocString
Exports
Exports
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
StartW
Sections
.text Size: 281KB - Virtual size: 281KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
kaslose64.exe.exe windows:6 windows x64 arch:x64
961ddf9e7e58d7f5a12b18942e3a8a2b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
VirtualAlloc
Sleep
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetSystemInfo
GetWindowsDirectoryA
GetTickCount
IsDebuggerPresent
OutputDebugStringA
WaitForSingleObject
HeapCreate
HeapFree
SetLastError
WaitForMultipleObjects
ResumeThread
ExitThread
GetLastError
SetEvent
CloseHandle
CreateThread
HeapAlloc
CreateEventA
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlCaptureContext
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
LocalFree
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
oleaut32
SysAllocString
SysFreeString
msvcp140
_Xtime_get_ticks
?_Random_device@std@@YAIXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
vcruntime140
memcpy
memmove
__std_terminate
memset
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
memcmp
__C_specific_handler
api-ms-win-crt-string-l1-1-0
strcat_s
strcpy_s
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf
_set_fmode
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_c_exit
_crt_atexit
terminate
exit
_cexit
_invalid_parameter_noinfo_noreturn
_exit
_seh_filter_exe
_initterm_e
_register_onexit_function
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
_initterm
_set_app_type
api-ms-win-crt-time-l1-1-0
_time32
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 218KB - Virtual size: 217KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
kaslosehttp.exe.exe windows:6 windows x86 arch:x86
3b06bdb2bd9c293b03f5f6895108a59f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
VirtualFree
VirtualAlloc
Sleep
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetSystemInfo
GetWindowsDirectoryA
GetTickCount
IsDebuggerPresent
OutputDebugStringA
WaitForSingleObject
HeapCreate
HeapFree
SetLastError
WaitForMultipleObjects
ResumeThread
ExitThread
GetLastError
SetEvent
CloseHandle
CreateThread
HeapAlloc
CreateEventA
DecodePointer
HeapReAlloc
HeapSize
WriteConsoleW
SetFilePointerEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LocalFree
EncodePointer
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetACP
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
CreateFileW
ole32
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
Sections
.text Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
kasper.bat
-
kasperV2.bat
-
kes.bat
-
powershellon.bat
-
pse.exe.exe windows:5 windows x86 arch:x86
c1e59519b5e5d84af07afa6f5a8625f1
Code Sign
33:00:00:00:98:04:58:cb:7f:23:09:b0:9e:00:00:00:00:00:98Certificate
IssuerCN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before30/03/2016, 19:21Not After30/06/2017, 19:21SubjectCN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7AFA-E41C-E142,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate
IssuerCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before04/06/2015, 17:42Not After04/09/2016, 17:42SubjectCN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:33:26:1a:00:00:00:00:00:31Certificate
IssuerCN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6dNot Before31/08/2010, 22:19Not After31/08/2020, 22:29SubjectCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:16:68:34:00:00:00:00:00:1cCertificate
IssuerCN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6dNot Before03/04/2007, 12:53Not After03/04/2021, 13:03SubjectCN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64Certificate
IssuerCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before28/10/2015, 20:31Not After28/01/2017, 20:31SubjectCN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:0e:90:d2:00:00:00:00:00:03Certificate
IssuerCN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before08/07/2011, 20:59Not After08/07/2026, 21:09SubjectCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0c:4f:c5:97:fa:40:70:59:c9:4b:35:34:f4:9b:c0:90:a1:1c:cb:4e:4e:6d:96:9a:f2:67:e1:4d:69:35:9f:71Signer
Actual PE Digest0c:4f:c5:97:fa:40:70:59:c9:4b:35:34:f4:9b:c0:90:a1:1c:cb:4e:4e:6d:96:9a:f2:67:e1:4d:69:35:9f:71Digest Algorithmsha256PE Digest Matchestrueb4:77:bc:a0:7b:c3:2e:88:63:11:99:73:bc:91:f6:a5:5f:10:40:5fSigner
Actual PE Digestb4:77:bc:a0:7b:c3:2e:88:63:11:99:73:bc:91:f6:a5:5f:10:40:5fDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
netapi32
NetServerEnum
NetApiBufferFree
ws2_32
gethostname
WSAStartup
inet_ntoa
gethostbyname
mpr
WNetCancelConnection2W
WNetAddConnection2W
kernel32
GetExitCodeProcess
ResumeThread
WaitForMultipleObjects
GetFileTime
DuplicateHandle
DisconnectNamedPipe
SetNamedPipeHandleState
TransactNamedPipe
CreateEventW
GetCurrentProcessId
GetFullPathNameW
SetFileAttributesW
GetFileAttributesW
CopyFileW
WaitNamedPipeW
SetConsoleCtrlHandler
SetConsoleTitleW
ReadConsoleW
GetVersion
SetProcessAffinityMask
ReadFile
GetConsoleScreenBufferInfo
MultiByteToWideChar
GetComputerNameW
DeleteFileW
CreateFileW
GetSystemDirectoryW
FindResourceW
LoadLibraryExW
FormatMessageA
GetTickCount
CloseHandle
WriteFile
SizeofResource
LoadResource
Sleep
WaitForSingleObject
SetEndOfFile
SetEvent
SetLastError
GetLastError
GetCurrentProcess
FreeLibrary
LockResource
SetPriorityClass
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
LoadLibraryW
GetStdHandle
GetFileType
LocalFree
LocalAlloc
GetProcAddress
FreeEnvironmentStringsW
LCMapStringW
OutputDebugStringW
HeapSize
HeapReAlloc
SetFilePointerEx
WriteConsoleW
GetEnvironmentVariableW
RaiseException
LoadLibraryExA
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
CreateThread
GetCurrentThreadId
ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
RtlUnwind
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
comdlg32
PrintDlgW
advapi32
LsaClose
CreateProcessAsUserW
CryptHashData
CryptCreateHash
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptExportKey
CryptDestroyKey
CryptDeriveKey
CryptGenKey
CryptReleaseContext
CryptAcquireContextW
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
OpenProcessToken
LsaEnumerateAccountRights
LsaOpenPolicy
LsaFreeMemory
SetSecurityInfo
GetSecurityInfo
LookupPrivilegeValueW
AddAccessAllowedAce
GetAce
AddAce
InitializeAcl
GetLengthSid
FreeSid
AllocateAndInitializeSid
SetTokenInformation
GetTokenInformation
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegCreateKeyW
RegCloseKey
Sections
.text Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
rdp.bat
-
sima.bat
-
sintel.bat
-
sophos.bat
-
sophv1.bat
-
sophv2.bat
-
star.bat
-
stsophospc.bat
-
test.bat
-
trend.bat
-
trend8.bat