MALZ6.zip
- SHA256 c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099
Password
infected
Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
9UDP.exe
windows7-x64
3UDP.exe
windows10-2004-x64
3a
ubuntu-24.04-amd64
8arm1
debian-9-armhf
4bj.exe
windows7-x64
10bj.exe
windows10-2004-x64
10bjyk.exe
windows7-x64
10bjyk.exe
windows10-2004-x64
10cctv.exe
windows7-x64
7cctv.exe
windows10-2004-x64
10cctv_2.exe
windows7-x64
1cctv_2.exe
windows10-2004-x64
10cn.exe
windows7-x64
7cn.exe
windows10-2004-x64
7cn1.exe
windows7-x64
7cn1.exe
windows10-2004-x64
3dhl.exe
windows7-x64
10dhl.exe
windows10-2004-x64
10java
ubuntu-18.04-amd64
4java (2)
ubuntu-24.04-amd64
1java1
ubuntu-24.04-amd64
7k5.exe
windows7-x64
8k5.exe
windows10-2004-x64
10ly1
debian-9-mips
3mh.exe
windows7-x64
10mh.exe
windows10-2004-x64
10mips
debian-12-mipsel
4pjhxx
ubuntu-24.04-amd64
1rootkit
ubuntu-24.04-amd64
8se.exe
windows7-x64
7Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
UDP.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
UDP.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
a
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
arm1
Resource
debian9-armhf-20240729-en
debian-9-armhf
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
bj.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral8
Sample
bj.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral9
Sample
bjyk.exe
Resource
win7-20241023-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral10
Sample
bjyk.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral11
Sample
cctv.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral12
Sample
cctv.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral13
Sample
cctv_2.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
cctv_2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral15
Sample
cn.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
cn.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
cn1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral18
Sample
cn1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
dhl.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral20
Sample
dhl.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral21
Sample
java
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
java (2)
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
java1
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
k5.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral25
Sample
k5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral26
Sample
ly1
Resource
debian9-mipsbe-20240729-en
debian-9-mips
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
mh.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral28
Sample
mh.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral29
Sample
mips
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
pjhxx
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
rootkit
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
15 signatures
150 seconds
Behavioral task
behavioral32
Sample
se.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
General
- Target MALZ6.zip
- Size 17.8MB
- Sample250102-1ejbvswpcv
- SHA256 c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099
- MD5 5ad5a10e0ae8eeb1bb6817c9d0cd960e
- SHA1 ecb3ffcf79aedfa3c35c2dab0b4f5ca0f872b62c
- SHA512 05b6ee99e6843d928255daded5a699231c25275b726f68be2b67c6bfc59305bc2b2ad5ae6ab11e70ce975a3ad10e7acbb520601728d9e4b255b7891263828cdd
- SSDEEP 393216:P7tKCblX9nuQNeyIvnpDDsIT0vyirPw9yesWcnE1zoQrq8:c6hVeyQpvsIgvyirPiKWcnkUr8
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Gh0st RAT payload 8 IoCs
resource yara_rule static1/unpack001/HkMh_3.exe family_gh0strat static1/unpack001/bj.exe family_gh0strat static1/unpack001/bjyk.exe family_gh0strat static1/unpack001/dhl.exe family_gh0strat static1/unpack001/server.exe family_gh0strat static1/unpack001/smss.exe family_gh0strat static1/unpack001/yk.exe family_gh0strat static1/unpack001/yk1.exe family_gh0strat - Gh0strat family
- MrBlack trojan 2 IoCs
resource yara_rule static1/unpack001/Drkv family_mrblack static1/unpack001/squld family_mrblack - Mrblack family
-
resource yara_rule static1/unpack001/06432 upx static1/unpack001/Killbash.x upx static1/unpack001/mh.exe upx static1/unpack001/rootkit upx - Unsigned PE 27 IoCs
Checks for missing Authenticode signature.
resource unpack002/客户端(Client)_KEY.exe unpack006/10711.exe unpack006/711.exe unpack001/FCK_RSC.dump unpack001/FUCK360.exe unpack001/GetPass.exe unpack001/HkMh.exe unpack001/HkMh_2.exe unpack001/HkMh_3.exe unpack001/ShellCodeDec.bat unpack001/UDP.exe unpack001/bj.exe unpack001/bjyk.exe unpack001/cctv.exe unpack001/cctv_2.exe unpack001/cn.exe unpack001/dhl.exe unpack001/k5.exe unpack001/mh.exe unpack001/se.exe unpack001/server.exe unpack001/smss.exe unpack001/taskmgr.exe unpack001/win.exe unpack001/xm.exe unpack001/yk.exe unpack001/yk1.exe
File Explorer
-
MALZ6.zip.zip 17.8MB
-
(Client)_KEY.rar.rar 1.1MB
-
SConfig.ini182B
-
客户端(Client)_KEY.exe.exe 1.2MB
-
06432.elf 384KB
-
1.exe.html 2KB
-
518_2.exe.exe 68KB
-
520.exe.exe 29KB
-
711_2.rar.rar 1.1MB
-
10711.exe.exe 677KB
-
711.exe.exe 560KB
-
TSmm.elf 1.5MB
-
Drkv.elf 1.2MB
-
FCK_RSC.dump.dll 8KB
-
FUCK360.exe.exe 250KB
-
GetPass.exe.exe 52KB
-
HkMh.exe.exe 332KB
-
HkMh_2.exe.exe 226KB
-
HkMh_3.exe.exe 176KB
-
Killbash.x.elf 338KB
-
Server.rar.rar 4.3MB
-
ShellCodeDec.bat.exe 74KB
-
TSmm.elf 31KB
-
Trustr.elf 1.5MB
-
UDP.exe.exe 31KB
-
a.elf 1.3MB
-
arm1.elf 977KB
-
bj.exe.exe 378KB
-
bjyk.exe.exe 378KB
-
blah.rar.rar 44KB
-
cctv.exe.exe 221KB
-
cctv_2.exe.exe 48KB
-
cn.exe.exe 520KB
-
cn1.exe196KB
-
cook358B
-
dhl.exe.exe 378KB
-
dot.rar.rar 51KB
-
java.elf 1.5MB
-
java (2).elf 41KB
-
java1.elf 1.5MB
-
k5.exe.exe 76KB
-
ly1.elf 745KB
-
mh.exe.exe 92KB
-
mips.elf 1.1MB
-
pjhxx.elf 544KB
-
rootkit.elf 357KB
-
s_3.txt5.0MB
-
se.exe.exe 96KB
-
server.exe.exe 378KB
-
smss.exe.exe 260KB
-
sqlrer.elf 1.5MB
-
squld.elf 1.1MB
-
ssh.sh.sh 747B
-
taskmgr.exe.exe 288KB
-
win.exe.exe 133KB
-
wm.html .js 8KB
-
wrt1.elf 1.1MB
-
xm.exe.exe 38KB
-
yk.exe.exe 378KB
-
yk1.exe.exe 184KB
(Client)_KEY.rar
- SHA256 922eba8e6e4b9c183d62d6a88be1900cf46da34a502bc2e3b902a21b32e99ca9
- MD5 644e1c99983c55c55c50b375815eef3c
- SHA1 9112a708aa5da5a9b59b0220b0af1136c4c3afd8
- SHA512 19ce068d6fcf554b01ab55900a96f6f13e6c0b5d191e105447ce70d237cc978efee27a3cbfee546965b97d4d72d655e662dec9446ee77cc55783a4c1873809ea
- SSDEEP 24576:bfn1WKcDdcTfAM2F5kefT/7mztonVRLsJ6KgRHBPy6udgdTr:bv1Wx+DAMM5tfvdOJ/gjEqP
- MD5 SHA1 SHA512 SSDEEP
Password
infected
SConfig.ini
- SHA256 1729434483f33bdf2f14138be8628f305098e879532fd2c74b3714bd30297f4a
- MD5 d8feb424647c7a797fc1e8a3af89fb00
- SHA1 c2d4c37b840e831d7bcd48667b1323ec3efd2e6f
- SHA512 bbeff21e09b95fe74f8b772aec9291640de05e65f552d1bf2bce9631ea7dfeada2b45d71c24de9c6cadea07febe58f44f0243b5aba47ca8c203395891c440d61
- MD5 SHA1 SHA512
客户端(Client)_KEY.exe
- IMPHASH baa93d47220682c04d92f7797d9224ce
- SHA256 e182e12f86fcc70e57c6ed760c5789e6c1a08dac5b4bfb005509c1a7038e9990
- MD5 b0aacc897731ccf1adee875390c6cfcf
- SHA1 494182a125ce93921252c79f155d4c10db049899
- SHA512 b3f8f4793d9b00f1015ea0f9a77a0cf6672fc700036781adf5d5e4c559573f191d4ef982e57e964f7ad107664995d6f5cab6bd20d81f9f6f592602468fab2eab
- SSDEEP 24576:4zOhmv9L5ldZz5NLDvHvK2OZkh0y634ek4cKWd6JqjzD8E:wZHzz6y63Jk4bg0VE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
3006464
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
comctl32
InitCommonControls
Name
Size
384KB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
988KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
pyajvcsw
Size
796KB
Virtual Size
796KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
ergjshnt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=5, id=12, version=7291,
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=7, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=93, version=2179,
count=44, id=14, version=7299,
count=791, id=1, productName=Unmarked objects,
count=37, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=197, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=22, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=120, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=93, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
06432
- SHA256 7b06be1d204ee0b5ebc0d4cb287133b796bb28b18414ce3b1e8d31691db8b172
- MD5 9a51d462452001e1f04dd68cf4336c54
- SHA1 594d570708fa03d0ab37a0306b38c134be90becc
- SHA512 e89c9abca2fce011ecade9763fdf738af4b642d5bad22af9a78b25e6a229409b1cb823e446569f7d647ccdd88f6d55094bcf7f4c591951d01f72b7b6d8e4deb6
- SSDEEP 6144:AH0cwGaZNuEtdb3usKYgoJ4o+dp5ky7aIq1/axpR9yMl0gXQYjTwk73o:AHZwBTdbFKVy+dp5kZIlL08QgwGo
- MD5 SHA1 SHA512 SSDEEP
1.exe
- SHA256 9ebf4c7da32ee2a39ed57364ad5d79697dcdc7cb24d41f4bb7cc01db55f646ca
- MD5 26162a10ad7f77d367b92ab22f8e6fd4
- SHA1 c497c4ad6be12606c909646598b92cb9f8c7f15f
- SHA512 c71e04b2bad4282f70b24734284f7bc2d4bd4f31484623741413c1f5706972c02088ed4470d292df4d1668f8dd7e7526e7bd937ae076d1b2eed7e0ba5de5e7f3
- MD5 SHA1 SHA512
518_2.exe
- IMPHASH 9b707ded22e05293ffd8d13fa0664210
- SHA256 aec671efacaa95db6e4487bc2914038f80939be5889d4b313aa137ac1ca91549
- MD5 4ad86e5001f11f30b6f67344c325609f
- SHA1 4bcd6382f5d095f271f81f235d0285305a48ab02
- SHA512 bbf47ebacc510575081296d8160ae8e62e9619f56192c80f9d52a38f607cfa19027cfb04e507fc263b44f77135f32454ea1da0af4cd8046ccd6dcdca2ffef434
- SSDEEP 768:EkHn8ozagGwcfAXZq6Imvy0D6SbUtOpgAq0:E8n7Gw5p1IqrAtOp3f
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
1a:ae:5a:d2:3a:44:77:7b:4b:e5:0a:a6:01:bb:f7:5d:69:a5:ef:88
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Axialis SA,O=Axialis SA,POSTALCODE=75008,STREET=1\, rue de Stockholm,L=Paris,ST=IDF,C=FR
Chains
Mar 7, 2013
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Axialis SA,O=Axialis SA,POSTALCODE=75008,STREET=1\, rue de Stockholm,L=Paris,ST=IDF,C=FR
Serial Number
54:70:46:b7:b2:a6:fc:fa:4e:a0:6b:2a:81:a3:af:8f
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 26, 2010 - May 25, 2013
Minor OS version
0
Major OS version
4
Entry point
14020
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
imagehlp
MakeSureDirectoryPathExists
kernel32
GetVersionExA
LocalFree
HeapAlloc
GetProcessHeap
VirtualAlloc
VirtualProtect
VirtualFree
GetProcAddress
LoadLibraryA
IsBadReadPtr
HeapFree
FreeLibrary
Sleep
CloseHandle
WriteFile
CreateFileA
ReadFile
GetFileSize
SetFilePointer
HeapReAlloc
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
IsBadWritePtr
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetLastError
SetConsoleCtrlHandler
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
LocalAlloc
InterlockedExchange
Name
.text
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=61, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=12, version=7291,
count=10, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=15, id=14, version=7299,
count=30, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=6, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
520.exe
- IMPHASH 2c8ea7e5a762ee60507eaab54fccc798
- SHA256 0f254db8f98e6626c487e0bb534b27f33fce6c280ce77303ad356f8c1ce01e11
- MD5 4757d1138e38d916bad87bfa92cf90c9
- SHA1 06d7fd312e50eb34512c5e9ac7eea29f76c8e667
- SHA512 002382b2b860657b17b15b194b160d4e6dc880ef068ac9a5733617a960e7da8afe9d33e5efe520ab0361ae2b014e049cfab1006e96ac65759c29aeec66548e86
- SSDEEP 384:wVQPhCc4EMap5JN1VY8ianYPLI46OXBc1yoMOmFi6j:kQ50EMaX9V3ianaXBc1f3mb
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
93:9e:ec:ae:c5:79:9e:e3:59:a8:88:13:cb:02:83:4f:32:5c:17:d5
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN
Chains
Apr 5, 2015
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN
Serial Number
61:06:86:2c:00:00:00:00:00:02
Issuer
CN=VeriSign Class 3 Code Signing 2011-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)2011,O=VeriSign Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2011 - Nov 17, 2511
Minor OS version
0
Major OS version
4
Entry point
9542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_controlfp
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_ftol
asin
printf
strlen
strcmp
??3@YAXPAX@Z
??2@YAPAXI@Z
malloc
free
realloc
memset
_except_handler3
memcpy
imagehlp
MakeSureDirectoryPathExists
wininet
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
kernel32
FreeLibrary
HeapFree
IsBadReadPtr
LoadLibraryA
GetProcAddress
VirtualFree
VirtualProtect
Sleep
VirtualAlloc
GetProcessHeap
HeapAlloc
WriteFile
CreateFileA
ReadFile
GetFileSize
SetFilePointer
GetModuleHandleA
GetStartupInfoA
CloseHandle
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
996B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=6, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=3, id=4, version=8047,
count=52, id=1, productName=Unmarked objects,
count=3, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
711_2.rar
- SHA256 32776ab4377a0f9be820b120bd27dafe8d6ce1438c1a48ac1046dab474a1a636
- MD5 d3696e10dab576df1abfd483ed9c55e0
- SHA1 905ce39aeb506e2a6a98dc86aaf9d757035f2f9c
- SHA512 2aa7e23f6037c57121658d8f38908359d612ca01bd0cffc8b57aabab4ae7b25a6f5a19f277eaee30087241e62d5cb1df32b4d84f1a89a0507de30ef867359533
- SSDEEP 24576:Zwx0wLnaeHbTOp+rXXzRVwUujCRUZHmB3hz1aEjdQnwfRfrBA3:ZGRae7SArXXzIUujOUZGBTnjqnwJO3
- MD5 SHA1 SHA512 SSDEEP
Password
infected
10711.exe
- IMPHASH a0701968874db905ad2f19b441b018da
- SHA256 b388b34512371975ed665d676875ed1499ffbf7be9f74407e2c6f796efd4d8ef
- MD5 3ec6e71ee9670117bb68bce1172913cb
- SHA1 f1891cce37b395e10314b369130cad628c9f87a6
- SHA512 d167f125f64206f73f95cf42049b34a32e07fbbdd93c9b29956222f752d922f4f2d3da3b1bd7183728178b19cb35ac65f63489eda973ce13af542bc7fb7ecf19
- SSDEEP 12288:49o2HYYuxp9Mc8QTmWWcGLh3OJMxFdYlBaCuYO4fN77OihGewG:jYuSWU+JMxKaC7f1i6zw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
324289
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
J:\SVN2\trunk\小陈\反向\Manager\Release\Manager.pdb
ws2_32
WSASocketA
setsockopt
WSAIoctl
accept
listen
send
closesocket
socket
bind
gethostname
WSACleanup
htons
WSAGetLastError
select
WSAStartup
WSARecv
WSASend
recv
gethostbyname
inet_addr
inet_ntoa
ntohs
kernel32
InterlockedIncrement
GetCPInfo
GetOEMCP
GetThreadLocale
FileTimeToSystemTime
GetModuleHandleW
WritePrivateProfileStringA
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetFullPathNameA
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
TlsSetValue
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapFree
GetCommandLineA
GetStartupInfoA
HeapAlloc
RtlUnwind
RaiseException
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitProcess
HeapSize
GetACP
IsValidCodePage
SetHandleCount
GetStdHandle
GetFileType
HeapCreate
VirtualFree
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
TlsFree
CompareStringW
SetEnvironmentVariableA
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GlobalFlags
GetCurrentProcessId
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
InterlockedDecrement
GetModuleFileNameW
GlobalAlloc
FormatMessageA
LocalFree
MulDiv
lstrlenA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
CompareStringA
LoadLibraryA
SetLastError
lstrcmpW
GetModuleHandleA
GetProcAddress
GetVersionExA
GlobalLock
GlobalUnlock
GlobalFree
FreeResource
GetModuleFileNameA
GetLocalTime
MultiByteToWideChar
GetTickCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
OpenEventA
CreateEventA
SetEvent
CreateThread
InterlockedExchange
TerminateThread
WaitForSingleObject
GetCurrentThreadId
MoveFileA
CloseHandle
FindClose
FindFirstFileA
GetFileSizeEx
ReadFile
WriteFile
SetFilePointer
CreateFileA
PostQueuedCompletionStatus
CancelIo
GetLastError
GetQueuedCompletionStatus
CreateIoCompletionPort
DeleteFileA
Sleep
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
GetProcessHeap
LocalReAlloc
InterlockedCompareExchange
TerminateProcess
CreateFileW
user32
GetSysColorBrush
LoadCursorA
UnregisterClassA
InvalidateRect
SetCapture
ReleaseCapture
CharNextA
CopyAcceleratorTableA
IsRectEmpty
SetRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
CharUpperA
RegisterClipboardFormatA
PostThreadMessageA
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
ReleaseDC
GetDC
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowThreadProcessId
SetCursor
GetMessageA
TranslateMessage
GetDlgItem
IsWindowEnabled
GetCursorPos
ValidateRect
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
RegisterWindowMessageA
EndPaint
GetParent
GetNextDlgTabItem
EndDialog
SetWindowLongA
GetWindowLongA
GetWindowRect
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
GetFocus
AppendMenuA
GetSystemMenu
LoadIconA
SendMessageA
EnableWindow
SetMenu
gdi32
ExtTextOutA
SaveDC
RestoreDC
TextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetStockObject
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
DeleteDC
GetViewportExtEx
CreateRectRgnIndirect
GetDeviceCaps
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
RectVisible
PtVisible
GetWindowExtEx
DeleteObject
SetMapMode
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
RegOpenKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegCloseKey
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
PathStripToRootA
PathRemoveFileSpecW
PathFindExtensionA
PathIsUNCA
oledlg
ord8
ole32
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoInitializeEx
oleaut32
VariantCopy
SysAllocStringByteLen
SysFreeString
SysStringLen
SysAllocStringLen
VariantInit
VariantChangeType
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
VariantClear
iphlpapi
GetAdaptersInfo
Name
.text
Size
509KB
Virtual Size
508KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=150, version=20413,
count=31, id=149, productName=VS2008 build 21022, version=21022,
count=196, id=131, productName=VS2008 build 21022, version=21022,
count=179, id=132, productName=VS2008 build 21022, version=21022,
count=573, id=1, productName=Unmarked objects,
count=29, id=123, productName=VS2005 build 50727, version=50727,
count=31, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
711.exe
- IMPHASH 160ca90966867f92a1e8064697edb02d
- SHA256 c724a936a8f9482f7182e1511038482a67237ffebe66502d2e96ff42c4da55aa
- MD5 f219bf2848d3e5f636405c3c77438e79
- SHA1 39514f84960978978b7e2295c2af5a2ad5574878
- SHA512 8eb975b4ae072b5559c3d1081d7ae8068b64b9ba50047f015cba9022e2bc2627465d0534fc14988649e81bd1df5fc7cd4d6c20192e7b16b5765e4bd0dbcc4083
- SSDEEP 12288:v1lAhHtn1bvzSP6iTn1UserksHkU5KrVclb6ajydnl:v1ShHLvmP6+19egRG10nl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
13724
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\SVN\trunk\小陈\IntergrateCHK\Release\IntergrateCHK.pdb
kernel32
GetVersionExA
GetLastError
Sleep
CloseHandle
GetSystemWow64DirectoryA
CreateDirectoryA
WriteFile
CreateFileA
DeleteFileA
SizeofResource
LoadResource
FindResourceA
SetFilePointer
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
ReadFile
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
advapi32
StartServiceA
DeleteService
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
ControlService
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
478KB
Virtual Size
477KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=109, id=131, productName=VS2008 build 21022, version=21022,
count=44, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=101, id=1, productName=Unmarked objects,
count=3, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
TSmm
- SHA256 df0506cdecf09a8879920a133ef2f9d215bb858a0f8c9131838607036a5479e9
- MD5 c2e14a973f432b9488fdb0535c019797
- SHA1 322fa15337433e93e6138bf72c3d47d4b95f1366
- SHA512 bb4cbcc02c9c16d64523f17c1e2cb61c9aac7817722758e57ee0cbfc5d28e975464b08a2ff12ae10015c050fc29f1323aea853a7e1a87483f3dd295074f89c24
- SSDEEP 24576:hNJp/2SkgT4KUAopmhDO2Aan9XgnU6tZAf4Nzbm6g+qF2SdYOrhGg+bL+cH8y6LL:hNvOx/Vp/2bn9XgnNtmf28rhLbccIwhL
- MD5 SHA1 SHA512 SSDEEP
Drkv
- SHA256 a17ca067bd6f74817a0516e6083c0739fc9b9e36aafd95b74fddc84343972cda
- MD5 3df5c5e26e2d9fd4946c8121299cd513
- SHA1 efaa2e397773a5eda58a68ddce1d9e17a90fdbd3
- SHA512 9574af57a2984065c6c348f7242533211051c5e9e03c74d6926023c64f61805b4d28698a3c77c3c33ffe33b84f0224f308889a5071bfeca3557fd58043dcca78
- SSDEEP 24576:e845rGHu6gVJKG75oFpA0VWeX4q2y1q2rJp0:745vRVJKGtSA0VWeoJu9p0
- MD5 SHA1 SHA512 SSDEEP
-
MrBlack trojan
FCK_RSC.dump
- IMPHASH e23b2990e58346a0a026310d32a82b0a
- SHA256 8b1d4870fdc940da538f225251996794f2f10ab7fff718d1aa884be8468dcfce
- MD5 aabeb05e642b2f9acb86a5dc1a600813
- SHA1 abba695b782c0e644b971b65d4dc7b8349714488
- SHA512 730fd04e4624f4db8c7c92e786148139d457c5bdc28badb3b1cbb70b61fd7b20655c2feab90c5c91b0d30f42a2d7bccb2ce0120752e223e6df2139c371b4be8a
- SSDEEP 96:b/TFVUFXleWwunodJsFDgt1CEiRgWY3ZbBNVyJ6/xMWwWHB6KJAso9Rdtoewc:fUFXlemctwgRPNVyJ6/eWwWhlDoHgzc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
6140
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ExitProcess
GetProcAddress
lstrcpynA
LockResource
LoadResource
SizeofResource
FindResourceA
CreateProcessA
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
GetTempPathA
GetLastError
CreateMutexA
lstrcmpiA
GetModuleFileNameA
WaitForSingleObject
GetTickCount
GetLogicalDrives
FindClose
FindNextFileA
SetFileAttributesA
CopyFileA
GetFileAttributesA
FindFirstFileA
lstrcpyA
WaitForMultipleObjects
TerminateThread
ResumeThread
SetThreadPriority
CreateThread
FreeLibrary
SetEvent
CreateEventA
DisableThreadLibraryCalls
LoadLibraryA
lstrcatA
GetSystemDirectoryA
shell32
ord64
shlwapi
PathFindExtensionA
PathAppendA
PathFindFileNameA
LpkDllInitialize
LpkDrawTextEx
LpkEditControl
LpkExtTextOut
LpkGetCharacterPlacement
LpkGetTextExtentExPoint
LpkInitialize
LpkPSMTextOut
LpkTabbedTextOut
LpkUseGDIWidthCache
ftsWordBreak
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
700B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
522B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=45, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
FUCK360.exe
- SHA256 8a7ad72fd6d3936ea3ad0ecadc063b382c6f0f8ff65b4839df1f3169f0135216
- MD5 7ab51c2e2fdac53f3360bb5c8b73734e
- SHA1 076d233ef06971a64f9b009c03627a491444a422
- SHA512 35a6247f16a0295140782d0ea73754a37aafa09ba62d1f2be0a822d7f1b548921bad94b563ff16f1c817060544560f3c66856f0a85862cdbdfd85e29462abfee
- SSDEEP 6144:XaLSyXt5iZ6hyebe81XrTE4/Cw5E2XppJZxA:qLtyGe81XU4rttQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94208
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.data
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
36KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
rhxcujm
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rol
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
GetPass.exe
- IMPHASH a1ed4cd324f7b8102ea860429d3d02f5
- SHA256 07fc745c29db1e2db61089d8d46299078794d7127120d04c07e0a1ea6933a6df
- MD5 d25ab00267a9da1944bad9e1115ad428
- SHA1 9470006b8763054e14d0e4708a3708e490cacfe9
- SHA512 a5906883361a4ce9ee6e3556808f886ee05e84063bbc7e394a33463767e8670eba5cb9f76abef894fcd8607eb3d197ef69e321996246c1f93d463748aaacb206
- SSDEEP 768:Feizs4ulZdVEUHw+0QcKbUyQV8gmDzQn3pVok:w3vpHwPQngyOWDCVok
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
GetModuleHandleA
FreeLibrary
OpenProcess
ReadProcessMemory
GetVersionExA
GetCurrentProcess
WideCharToMultiByte
lstrcmpiA
LoadLibraryA
CloseHandle
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetLastError
GetFileAttributesA
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
FlushFileBuffers
MultiByteToWideChar
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=15, id=14, version=7299,
count=63, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=5, id=19, version=8034,
count=58, id=1, productName=Unmarked objects,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
HkMh.exe
- SHA256 83e96c76e59b2d12849e2f92306c76bb90687194326b79546ac9ed2a1d8b6162
- MD5 1cd12a8269d6ed7af46c6d82dbf0db28
- SHA1 cf47e4ce299999ce9b584e29f29cd3942d8abf27
- SHA512 20106eba738c1e0ef1f544879b4036b81cf19aba8c6d581aa6c546af68c819bd7f283138ba9fed55f82feacfcb4c4dd4ba1e0b5af8bf8de481444292109a9baa
- SSDEEP 6144:xBcBaz+oA9IxnN8veMdpRTAZbl/NMe5F+/fAsluDXKVBopxC1rUniJ734maajc3A:sBaz+oA9IxnN8WmAZbRNZOAy3BUHniJX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
176128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Ip
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
150KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.qnk
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
HkMh_2.exe
- SHA256 1e3c843183830bb4c4f6078e866780b19f6967fa200d809998657f184934998d
- MD5 6d5aeb2b084f4fcc5defcd584953acf1
- SHA1 56513de25668afef7ee860fec5934d7820a9f1f2
- SHA512 44f75c3f346d8de8911673ea75ebbdcd54a574b907cb5437ba3f457f487877b33f4e93372179b59e66ccf34383f273298c28ff4e0b6a1fa6cd4e030c84e308bb
- SSDEEP 6144:bCahtHLoObzXYsWWYbEqaMyveyjV+nByskr:bNYdbgeyjwyr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
69632
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
gzlyoze
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wtq
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
HkMh_3.exe
- IMPHASH b39d2a8818e34e573819e4d3d2aced3a
- SHA256 5fa749158a4dd5dd030bb97a5ca74a542ae4661b2a76ec69b29d41c3a32e8767
- MD5 0cae2144249cca11917ce26657fc0281
- SHA1 e7ffc36c62c26e987c6954e4739a306a95d119e1
- SHA512 50c5ea18407b74fc5d741d602c87a28c0bfebb348a8ff1710026951937b1e9077a353ee0b9bf2eb648b83a60e34a5e934d8b95c1b7e1202933aea875e6975027
- SSDEEP 3072:MBFDC2a8kkalMLmNTMeN1vT72dPxIhf+5HS5LTbl2NBX9ZdebJR3u:M/inHlN1vTyTIBEHkTbl2zn0bJR
- MD5 SHA1 SHA512 SSDEEP
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
109926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
OpenEventA
CreateMutexA
CopyFileA
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
lstrcpyW
LocalReAlloc
GlobalMemoryStatusEx
WinExec
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
Module32Next
Module32First
CreateRemoteThread
GetModuleHandleA
OpenProcess
FreeLibrary
GetDiskFreeSpaceExA
GetDriveTypeA
ReadFile
LocalAlloc
LocalFree
GetLocalTime
CreateFileA
GetFileSize
SetFilePointer
lstrlenA
WriteFile
GetTempPathA
GetTickCount
MoveFileExA
SetFileAttributesA
GetSystemDirectoryA
DeleteFileA
GetModuleFileNameA
GetShortPathNameA
GetEnvironmentVariableA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
ResumeThread
CreateThread
TerminateThread
lstrcpyA
GetWindowsDirectoryA
lstrcatA
GetStartupInfoA
CreateProcessA
GetProcAddress
GetFileAttributesA
GetLastError
MoveFileA
CancelIo
InterlockedExchange
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
Sleep
LoadLibraryA
LocalSize
user32
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
GetMessageA
PostThreadMessageA
GetInputState
SetClipboardData
LoadIconA
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
CloseDesktop
SetThreadDesktop
OpenInputDesktop
IsWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
CloseClipboard
mouse_event
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyA
keybd_event
SendMessageA
SystemParametersInfoA
BlockInput
wsprintfA
DestroyCursor
LoadCursorA
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
RegisterClassA
MessageBoxA
gdi32
GetDIBits
BitBlt
GetStockObject
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
DeleteObject
advapi32
OpenProcessToken
GetTokenInformation
LookupAccountSidA
GetUserNameA
AbortSystemShutdownA
QueryServiceStatus
ControlService
RegDeleteKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
RegCloseKey
RegSetValueExA
RegCreateKeyA
DeleteService
OpenServiceA
OpenSCManagerA
RegQueryValueExA
RegOpenKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegCreateKeyExA
StartServiceCtrlDispatcherA
CloseServiceHandle
StartServiceA
UnlockServiceDatabase
ChangeServiceConfig2A
LockServiceDatabase
CreateServiceA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
msvcrt
_onexit
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
strlen
??0exception@@QAE@ABV0@@Z
_strcmpi
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_iob
memcpy
__dllonexit
??1type_info@@UAE@XZ
calloc
_snprintf
_beginthreadex
atol
_mbscmp
_mbsstr
wcscpy
wcstombs
wcslen
mbstowcs
_errno
strncpy
strncmp
rand
atoi
realloc
strncat
exit
strrchr
sprintf
_except_handler3
free
malloc
strchr
strstr
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
memmove
ceil
_ftol
ws2_32
WSAStartup
gethostname
ioctlsocket
__WSAFDIsSet
recvfrom
sendto
listen
accept
getpeername
bind
ntohs
WSACleanup
WSAIoctl
inet_addr
inet_ntoa
getsockname
send
closesocket
recv
select
socket
gethostbyname
setsockopt
connect
htons
urlmon
URLDownloadToFileA
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
avicap32
capGetDriverDescriptionA
msvfw32
ICSeqCompressFrame
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
iphlpapi
GetIfTable
netapi32
NetUserGetInfo
NetUserDel
NetUserSetInfo
NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum
NetLocalGroupAddMembers
NetUserAdd
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsA
WTSQuerySessionInformationA
WTSDisconnectSession
WTSLogoffSession
Name
.text
Size
108KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
qvafjlz
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=11, version=8047,
count=3, id=12, version=7291,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=4, id=14, version=7299,
count=12, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=284, id=1, productName=Unmarked objects,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Killbash.x
- SHA256 95fb9e93efec22c8426f3d557a0c353ff63aa323f42180ecacdf9cd7cfe4c5aa
- MD5 7622b6a703b61b767a8f15fe24801ff8
- SHA1 d987be4df6349f1ed7934b4e0154ce743bce863d
- SHA512 e950f0eb8b971980342f889b36b2794b883925879e6a8105c1179e9b99492006f324f0aeedc62f77ed7ca8a0cf13c99eb7b6a2e38f4e6bd41e511ac38143fa00
- SSDEEP 6144:wFE15RyBAwujPOjS7624nLqFLof5cAw+l0qbRQ2Aj4qewO3TjC45:jllGSWlnLIoRcAw+lFbSsve45
- MD5 SHA1 SHA512 SSDEEP
Server.rar
- SHA256 74743a683dc86b059013eed2e1132b87b135cc52152d369d84b671bf4a13aab3
- MD5 8df130d8669f2b14a0bc94f2b3b6333a
- SHA1 17db12be5c4bd7101704313320c1119d5b2a12e1
- SHA512 1697a0a538b2df646d8dc2fed0a65ee1af2a9d2ee5db6d63c15df6225e7c4d7bd2fa58c7f977972f7abe30924d3f6dd6e3dafaa54aa43d88529a350e7bcb3973
- SSDEEP 98304:je+uMohJdODIEsY2UMTk0QxLPFT7h7RQlYLj71OzhBG:je+uVDMsg2idxjh7pRQlYLHeBG
- MD5 SHA1 SHA512 SSDEEP
ShellCodeDec.bat
- SHA256 3c5b9126bc245f99f4d89ff7871af4f333f92405ed40e197aa8314b2644c1e6c
- MD5 381744f92d0d5fc08efad4272d334474
- SHA1 f4152e1d4498023c6377092b79a6746f19cf7c60
- SHA512 ff5d6a7f9a86a32cfb36647b501ee0391014f2a8f648eb75fab702581454f2d7668f9f592903765ee17d0897202f5114538ab16b237059f1c9608bddfb955b08
- SSDEEP 1536:sg01tN3rHoLzvODn5qchGGxfP361DssRfAQ:q1ILDcn5qaGGhP3614sRfAQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
59679
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, productName=Unmarked objects (old),
count=22, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=4, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=171, id=1, productName=Unmarked objects,
count=3, id=4, version=9782,
count=12, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=12, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
TSmm
- SHA256 8c22df5b0aa0fb2cd4ceb88f905383508ce5bae4ccf422c061ba0a1cf7802ce5
- MD5 9a6841cdb36f21d523cd346975bbb7c9
- SHA1 69f5a3bf605c513ecb0a67ed8f4f5aff9d126dd8
- SHA512 cc2b2ed0262c222df74f3fd8c2a132628d87b9d203fae2ab3c8570e281985f597bff2cbd8d3920f00f24acbc418fb00d1f1570087ca2bba6167ca587febf353c
- SSDEEP 768:onP9R7JLjULRm7oKYNEfOVmXVtje7heNcfb5:69D3cD6WcFtC7h51
- MD5 SHA1 SHA512 SSDEEP
Trustr
- SHA256 0e6b7297e0d268689c958889a39733a7367e6836eadd82c475f577f26b64d7de
- MD5 8e300a75d4dc0bb5ad7ca16f3b982c4d
- SHA1 acb3a0014a41c7002507281fa203051c2bfd6df7
- SHA512 f0f5b84911bf027b2af783d10b23e2711a43fa7492dc7058d0a64bc109f06ed5f4f32c82bea73861c3786956783c7bd73cff5d1c359729a1a672dbb5312c725b
- SSDEEP 24576:hNJp/2SkgT4KUAopmhDO2Aan9XgnU6tZAf4Nzbm6g+qF2SdYOrhGG+bL+cH8y6LL:hNvOx/Vp/2bn9XgnNtmf28rhpbccIwhL
- MD5 SHA1 SHA512 SSDEEP
UDP.exe
- IMPHASH fc6a2966c254e32428f6c0585b67594c
- SHA256 f73a89b6a5c42d21ee4f7a4d79ad784cdfd896bbe2453b60cf9688786f7a9d98
- MD5 161f6beec09cd33d710f8f97365ee6f6
- SHA1 9c408d1b53a1d03e8c7a3f85e050870f3d9a741f
- SHA512 e9f2afd6ad8216fa0f34cca29ba4d8753a03b187f4e9c29a0607e9b2ad932b788cb9a75db54df0db522e2a20d54a12992ed2396f40f06ab8cd76a89bcbf1e6be
- SSDEEP 384:+ubvs5ed2wcTZr5bDDOp61lpHwdkJAqJDPHYM:hshb9r5b3Op8lVbJTJwM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10018
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mfc42
ord1089
ord5199
ord2396
ord3346
ord3922
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord3663
ord641
ord790
ord800
ord2514
ord2621
ord1134
ord1199
ord1247
ord5440
ord6383
ord823
ord5450
ord6394
ord540
ord5265
ord4376
ord4853
ord4998
ord4710
ord6052
ord2512
ord5731
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4673
ord3597
ord324
ord4234
ord6055
ord1776
ord5290
ord3402
ord3716
ord1146
ord1168
ord860
ord567
ord2298
ord2370
ord2302
ord6111
ord4160
ord2863
ord2379
ord755
ord470
ord1105
ord858
ord6334
ord1200
ord665
ord6215
ord1979
ord5186
ord354
ord2818
ord2554
ord4486
ord6375
ord4274
ord1775
ord4078
ord4425
ord1576
msvcrt
_XcptFilter
exit
_acmdln
_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_onexit
__dllonexit
_setmbcp
malloc
free
srand
__CxxFrameHandler
??1type_info@@UAE@XZ
_CxxThrowException
kernel32
GetTickCount
TerminateThread
GetExitCodeThread
GetCurrentProcessId
GetModuleHandleA
GetStartupInfoA
user32
IsIconic
GetSystemMenu
DrawIcon
GetClientRect
GetSystemMetrics
AppendMenuA
SetTimer
KillTimer
EnableWindow
SendMessageA
LoadIconA
wsock32
setsockopt
socket
sendto
closesocket
ioctlsocket
Name
.text
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vsp
Size
Virtual Size
1B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=6, id=19, version=8034,
count=1, id=14, version=7299,
count=1, id=11, version=8047,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=11, version=8569,
count=3, id=4, version=8569,
count=163, id=1, productName=Unmarked objects,
count=4, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
a
- SHA256 dd77459b8d76d9be75dde3f2aa8e8434b266bc98acd15966c6ae65a6620b10db
- MD5 84839072ae06ae3e47d93f3b79067305
- SHA1 eb578777ca88dcaa72cb9b22720618b2e3aa770f
- SHA512 3b004be47b8aef3ce9ee821d267ef4e36dfb2a17bdbbf8630f24f119f3ad26c862a79a1e8afafe7e98422479eb58dd8b2ee5c644d3aef84f9bb2eab991f878de
- SSDEEP 24576:X8BHnVsZc1VZneCEuvLmJ7p9fomAmgAspprQYlGtmgmH1LJSwYS3uJdE0cG/v5FH:YHnVec1VZnezuvLmJrfvAmgAspprVlGR
- MD5 SHA1 SHA512 SSDEEP
arm1
- SHA256 8366aea8087a354cbd178f920770b35d785f988ec3649bb7e282d1e3272a6b77
- MD5 cb75be331a7b5cb54bae9db9f4ca643d
- SHA1 789ccb024361d7a4911dfc77bf1c93442491c3c9
- SHA512 d16e503bb8434c324976747b9f90092fafdaafcc877c588b18c8d1c14c9d813552389dea496a1b2cacaea4e2ebfdec6a630c68e44c645d1a25da9076e6f4c32f
- SSDEEP 12288:erXiRPpwBSHJB2A6f13P5D79dmuxlNzJs4dm3yxiD1WjfGAIFDFvyq766Pd8YTQ0:jvwlP5DJdrRJsskWU5RPdg2ByWwK3R
- MD5 SHA1 SHA512 SSDEEP
bj.exe
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
- MD5 a770ebf2e59e29c7460a01241a0a493f
- SHA1 97e59e483e1fa524a305828157a50203e918ada9
- SHA512 4cf99a862fc6e2299e33113bb757dd31a0543c5b5716146de2051fbabe86a122e895a8ced9d4f2290ae82dd9f6093dc883abcb2a6747caa90e8fd46e061f6140
- SSDEEP 6144:WsItKnWUQpBTyPRqyhYPbncTBlhHrbndnkv0oX90wRudOl1YTSgux1p2iPtGZ5da:btWUzJq8YPbncT3+bRHfYTSgS21NPE+S
- MD5 SHA1 SHA512 SSDEEP
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
CODE
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata2
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.qnk
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=2, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=130, id=1, productName=Unmarked objects,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=9, id=11, productName=VS98 (6.0) build 8168, version=8168,
bjyk.exe
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
- MD5 a770ebf2e59e29c7460a01241a0a493f
- SHA1 97e59e483e1fa524a305828157a50203e918ada9
- SHA512 4cf99a862fc6e2299e33113bb757dd31a0543c5b5716146de2051fbabe86a122e895a8ced9d4f2290ae82dd9f6093dc883abcb2a6747caa90e8fd46e061f6140
- SSDEEP 6144:WsItKnWUQpBTyPRqyhYPbncTBlhHrbndnkv0oX90wRudOl1YTSgux1p2iPtGZ5da:btWUzJq8YPbncT3+bRHfYTSgS21NPE+S
- MD5 SHA1 SHA512 SSDEEP
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
CODE
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata2
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.qnk
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=2, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=130, id=1, productName=Unmarked objects,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=9, id=11, productName=VS98 (6.0) build 8168, version=8168,
blah.rar
- SHA256 4856335b2cff5b4f9e453c231b5d0464d329f8d901bf1d1f2ee1be0ed2d3b4b1
- MD5 bca65d37dfdd27991815934d4359409f
- SHA1 6727be030bab60a34ffba0d256aeb15cb76c02ec
- SHA512 de06ac4cdedddcdba9170999a16a053c14a0d1d9f17c4df208605d36b94a1c64ff2badb3804fdf012d323724a882d344a1c382cbfa2bdcdb51ea773c1762530f
- SSDEEP 768:YNJpu+BLlmeByxg3pbcy8/VwAx/ho2qa7K5/KTI8zJKUvM80apf2lrx:YNG+NlmIF98ZxVDK0lzJDvDDFUrx
- MD5 SHA1 SHA512 SSDEEP
cctv.exe
- SHA256 744d37a30b3e0085b55fb62c9f226a4fd42a2545bd246105ba5e99c8fbfe1011
- MD5 dc655daf16748469712aa1d26336e087
- SHA1 ad9df22536f9913229849d8ac7b3baff93529d71
- SHA512 0e2c839ce3d7bcf3ea2766e07970b5c5fb77f8909d1f70225b2c075faced3f130e1a37104d6ecd17a8fa00e3303d90a46d0c296b22bac3e2762ae30f315c3e46
- SSDEEP 6144:jzu6Kqcii29Z/3sXnr1eEKNTVCDk0PVLOgE:jp7i2wbJ0Vc/JE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
mkchaqe
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.spm
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cctv_2.exe
- IMPHASH eb58ab5a3c8a863c4d8c4b2e9f905cdd
- SHA256 71ef7e43615e286a5d424d2bafca90c03b05a1c216f1b3ac81997ee2d6bda8d7
- MD5 e0a1361af24cc075e0cfb9e6a6a09cd3
- SHA1 6b81a0773fd5a5f588302ef2231d2461544868aa
- SHA512 70815a447784599b423a4a4fb0c9d6821dd95244af8dd529ac51afa8d644ee16658cce748501b5f3283eec75ea1c967b225fb5400813f8fa5dc0c2dbe4de2401
- SSDEEP 768:g+jOttjAoHTtNErVhg4xz8Jgo4KR3py9ma1Qxxbr:PiAgT0rVfF8JB4KR5omamx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11272
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetLastError
WaitForSingleObject
CloseHandle
CreateThread
GetSystemInfo
Sleep
GetCurrentProcessId
CreateMutexA
GetTickCount
GetModuleHandleA
GetStartupInfoA
advapi32
RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
ws2_32
gethostbyname
select
__WSAFDIsSet
recv
inet_addr
socket
connect
send
gethostname
inet_ntoa
WSAStartup
WSASocketA
WSAGetLastError
setsockopt
htons
htonl
sendto
closesocket
WSACleanup
WSAIoctl
iphlpapi
GetIfTable
msvcrt
fprintf
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strstr
??2@YAPAXI@Z
strcpy
_local_unwind2
_except_handler3
sprintf
rand
memset
printf
memcpy
_iob
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
gscixgv
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=68, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
cn.exe
- SHA256 5b81c2781d2c953f46fa7fdd815a31eebdaf8d402ab96457814cdf87583eaf1d
- MD5 2033a6d7d02690c31fa53d8717fc7ffb
- SHA1 5ff0fb65c1322fba3f30a325097bd140ac9f508e
- SHA512 8ec8cd260a54d138145ce1a2591ab3768f535518f7ea75967f5e7d89a1569a8ff4cdb33c85fb2fb31497e27aaf2a661c11fd7702fee73a0fa4652ed146d136c3
- SSDEEP 12288:H8D0Pn8yQAOWqNujygoH8qCTxQSza+bqHKNci1/9aa:H8D0/JO/ujy9yTxDza3q2i1/9f
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.packed
Size
512B
Virtual Size
576KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.RLPack
Size
518KB
Virtual Size
535KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=8, id=19, version=8078,
count=1, id=18, version=8444,
cn1.exe
- SHA256 fe23577d1480bedcd63037921bbd5a55e86171c1a7dc97667df6a674ca0044fc
- MD5 0731b597e61c2fd74577239fc53c794b
- SHA1 85bf7df302e1e4e096ad8d385cac2ef004457ba9
- SHA512 6bf34bd045020a852dc2553869f67c30d13857c9fb228ae966fd2f794f607f7157933a4772c9e13e19c85bfec1f585d6e350cbcafb58c624f0aade78085664f4
- SSDEEP 3072:zwSn0zvOvtYzwnqSioDXx4uE9w2qbMUeZPorQ/4/464Is9Um:U00zvOvtgSiod4uYzqAvZ1/w46Iym
- MD5 SHA1 SHA512 SSDEEP
cook
- SHA256 cbdcb94e86f2c76f30a3696bba1aa0fe5030506f06353212bc7ab0f985c1a139
- MD5 c2a46126876138bd43294aa58e031952
- SHA1 6dcad423367be0113c9e27dccdc7a5c569e23952
- SHA512 12c3852c5d09c186addbb8d5bcd6af73dff68425d00fb51335083066df12fef4c0abe1330562675d1c27482451acf3852c14a08eaaf1f4882414d4a22bba3036
- MD5 SHA1 SHA512
dhl.exe
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
- MD5 a770ebf2e59e29c7460a01241a0a493f
- SHA1 97e59e483e1fa524a305828157a50203e918ada9
- SHA512 4cf99a862fc6e2299e33113bb757dd31a0543c5b5716146de2051fbabe86a122e895a8ced9d4f2290ae82dd9f6093dc883abcb2a6747caa90e8fd46e061f6140
- SSDEEP 6144:WsItKnWUQpBTyPRqyhYPbncTBlhHrbndnkv0oX90wRudOl1YTSgux1p2iPtGZ5da:btWUzJq8YPbncT3+bRHfYTSgS21NPE+S
- MD5 SHA1 SHA512 SSDEEP
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
CODE
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata2
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.qnk
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=2, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=130, id=1, productName=Unmarked objects,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=9, id=11, productName=VS98 (6.0) build 8168, version=8168,
dot.rar
- SHA256 5ffb0b40dd3cdb654b674d8b3a00ea45d5eec62764f0bf86ab781614fff8fdbb
- MD5 8a57967b61dcdbdb40328b84c4d925c2
- SHA1 638d9b0208effc1c751d5b5088ba1f73def4bb55
- SHA512 ddc01577efcf68f0c8459c05ba3820194e7c8351b2abd10c94a6cb410582f686aa984b84a5ad72c2f82a8b7a4d3b7ad4216cfc2e6dd036f584e066074b347adc
- SSDEEP 1536:YNG+NlmIF98ZxVDK0lzJDvDDFUrbax1EpJDW:jymK03DK07gpU
- MD5 SHA1 SHA512 SSDEEP
java
- SHA256 59755333ce8c0e16e45340984a22a50f4cb6cb92f8fb85e452dfbec7596a4859
- MD5 e2be8944ce24abb4c0ed6858eb8d6157
- SHA1 a9511dd764080aa0437fb586f2babd1c18214a6a
- SHA512 815bed537eede7461d03b9ffab84b3f77ac43f3d5e47284b4c8a5052ab2eb82bc1563ab7375e3928dfb4a4179096d429143423bd780f2e037ec29ae8a4fee17a
- SSDEEP 24576:hNJp/2SkgT4KUAopmhDO2Aan9XgnU6tZAf4Nzbm6g+qF2SdYOrhGB+bL+cH8y6LL:hNvOx/Vp/2bn9XgnNtmf28rhObccIwhL
- MD5 SHA1 SHA512 SSDEEP
java (2)
- SHA256 18b0893f3b143a70dc60b0d4da10b63f5fd172fedb63b857b281e0c19a0b0dbe
- MD5 29096b156ac5bbd5bf44448d4c92f47a
- SHA1 fec10cfed79d87d6d6867867f8730ffa39be31c9
- SHA512 f0f5d259b4d57e8361ea1d8bde69fa1eef6bd3a7614761b3d157a228f71bbf40ea1a2ab8edaa4760a332f6d7ff5404374cc11a437f57eee613eec4cf7b145380
- SSDEEP 768:onP9R7JLjULRm7oKYNEfOVmXVtje7heNcfb+QuKfUGH4k53:69D3cD6WcFtC7h5CQXUGYk53
- MD5 SHA1 SHA512 SSDEEP
java1
- SHA256 fc10540c1effe99bdd7a9e1025bdda6813f5dbbdb6e89acdbf79df443a5bba49
- MD5 b94d195896ac0aa647a2334f74e1aa73
- SHA1 58792006cd89f0689a2eb4766af298305954c653
- SHA512 1d4f0427d6ffc456afa34e5edb1742a238866106a3cdbfa7866692aadd4810114f53111671d2fecbe396cf42f590f6beee29afee74893eb33bb0854ef78a3ef1
- SSDEEP 24576:hNJp/2SkgT4KUAopmhDO2Aan9XgnU6tZAf4Nzbm6g+qF2SdYOrhGz+bL+cH8y6LL:hNvOx/Vp/2bn9XgnNtmf28rh0bccIwhL
- MD5 SHA1 SHA512 SSDEEP
k5.exe
- IMPHASH 2abfb21dbfa1afea540d42cc1884f155
- SHA256 ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da
- MD5 145c9edca1151d477e5c339b6d797cbd
- SHA1 f09d773d50f87c47500305e79bc1e6fcf503ebd6
- SHA512 10f5d6cacbbc96fa22c097f5b519fe1738a5531820518af00cedf8ca9112808bc2c2871845f85f496a1d08695441262ab3ed57068e6d029ec1e5aabdb32d47df
- SSDEEP 1536:bcPk2vG+Yq6GrXdOOq52m0HLxEulgsteEY+cZv8FYOicNx1q/6:v2vGM6GLdu52hHL6ulgsteEY+cZ90Nx1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetShortPathNameA
GetModuleFileNameA
ExitProcess
CloseHandle
ReleaseMutex
OpenMutexA
GetTempPathA
GetEnvironmentVariableA
WaitForSingleObject
GetLastError
CreateMutexA
GetCurrentThreadId
GetWindowsDirectoryA
TerminateProcess
OutputDebugStringA
ExitThread
GetSystemDirectoryA
GetTickCount
GetStartupInfoA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
CreateProcessA
ResumeThread
GetSystemDefaultUILanguage
GetVersionExA
lstrcpyA
GlobalMemoryStatusEx
GetSystemInfo
GetModuleHandleA
GlobalAlloc
GlobalFree
lstrlenA
LoadLibraryA
GetProcAddress
Sleep
CreateThread
lstrcatA
user32
GetInputState
GetMessageA
GetDesktopWindow
PostThreadMessageA
wsprintfA
advapi32
OpenServiceA
StartServiceCtrlDispatcherA
RegOpenKeyA
OpenSCManagerA
CloseServiceHandle
DeleteService
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
ws2_32
connect
WSAIoctl
setsockopt
send
recv
__WSAFDIsSet
select
WSAStartup
socket
gethostbyname
inet_addr
sendto
WSASocketA
WSACleanup
htonl
inet_ntoa
htons
closesocket
msvcrt
_exit
rand
_strrev
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_except_handler3
strncat
strchr
realloc
malloc
__CxxFrameHandler
_CxxThrowException
atoi
strncpy
strcspn
strstr
sprintf
free
??2@YAPAXI@Z
exit
strncmp
??3@YAXPAX@Z
??1type_info@@UAE@XZ
__dllonexit
_onexit
srand
_XcptFilter
_acmdln
__getmainargs
iphlpapi
GetIfTable
shlwapi
SHDeleteKeyA
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
molptqp
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=134, id=1, productName=Unmarked objects,
count=5, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
ly1
- SHA256 fe686bb110b6af61f109de5b71239bb76ea75e0588ece3a0570393f310eb1026
- MD5 7878dedc8f99659f1e0bd43a8b20b25f
- SHA1 968c61c19237efad875fb5da9ef468303fd18500
- SHA512 dd71e1da4bc6f82bd03110431e22fbed130b10c27ae16bf3d8c6760c0b11c5486dc475ba98cd0d35192bedf5bba836424d41289ba25c678bca8a636c117b7b0c
- SSDEEP 6144:UTOzkT3puxmMmp9HovF3VBkFuPIMM2IutuXie+w7EQEtXqdTqBYWXChQyurnbOq3:2jHovzRu1ddTqDnUsIdk0KE43dcTDVSN
- MD5 SHA1 SHA512 SSDEEP
mh.exe
- SHA256 22e44f753597c056b7b1eba9728043e7e6dbdf94f0f66f06e6bdd1fdba096fb2
- MD5 990ced068a35be3f8092c491bf2a6dbb
- SHA1 b9303bd5671d66b7b5520da2a12f7243b05235f4
- SHA512 28ee629fc56a204f2e40f6f1c42e45dd142800ea07277d8d89f3d7522fbe290d32240668543e679b6e40e6d68b2f9a65cd6bf6168a4d9a79859e49df2ae5f48e
- SSDEEP 1536:oPoRMUAPWbUFADNjKxoxQhy45mXKhpwvv2Uj281XQoYYqA:oP4ZSbENer5Toz6qXQ3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
215464
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
60KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
31KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
vawkmrz
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=11, version=8047,
count=3, id=12, version=7291,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=4, id=14, version=7299,
count=12, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=284, id=1, productName=Unmarked objects,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
mips
- SHA256 5d9f4ec734cf44f342a45f7de4ba0e208ec141ce47e32b3bc7d0666eff538fe5
- MD5 a883bae381125e862c109af67b3cfda4
- SHA1 852f169460932eb49c13fb6050fcdbafcd354af9
- SHA512 40a9804c5f900c3370ac856172c496347faec0187489c9e5d496923dc27f7b2138bfa2c43550acab44fb331ced5e2993fe84ff737f87275fbb74a4eb7b502738
- SSDEEP 12288:v0gZjw/mGyri7g8Nyllxm+KYCy1aPrfWf47b/d+qdeaQklaHhmM7tL+GSPlXJZra:VETLPAFHcMJ6l5ZZVtGAi3YKhAxtK
- MD5 SHA1 SHA512 SSDEEP
pjhxx
- SHA256 609a5f0e44f1723d29f258c4459a532b75c9c1b2bd26607384d17352150dd3a6
- MD5 c819b1705f2938ac258397c29618fceb
- SHA1 f6079e473b0f937e3dd6a8f9b76549925ca32f60
- SHA512 70b564bcd85289e3a7f00d98b3f587db8255ea1eca7938988f1f6c6673214e50de8c0e3ecb8d554d32bd5489d758c45fe4901d462c0f013ef28b8676bcd8f53b
- SSDEEP 12288:yCAn8AR1vaStp/35mnngohox5aczgLXKJFV+61m0nwyhes/tB:yCa8ARRfmnnphS5aczgzKJFVhtwyhD
- MD5 SHA1 SHA512 SSDEEP
rootkit
- SHA256 548d1e891b2837e28c6e495fd1e5788ab650d169c53ade1f0cadf005d8657316
- MD5 80b21dcc410fcd97098e8b804ba1dd27
- SHA1 8eab144db8af9bfb3c633b373489c6799f2ad5cf
- SHA512 7f8a5335a0b37bf760825c00fb0b685f85bebed212533c725748e3cafd8f4e79fa09e1b152bb7612ee1091bed49f35aa728a5f42e775bc80788535c16e34a60d
- SSDEEP 6144:4LZVne1+4AtZTefDUuipumMP+tjwPn2OFfRA/7pmuxEkV3ufBrCkRNcl4/YGA/u:4dVne09J8UbpumMP+tjwPn22pAjN3ufv
- MD5 SHA1 SHA512 SSDEEP
s_3.txt
- SHA256 54f35bf11f4ef7e0e366c696fbb080e039c799efdf821eba2356e9fca30a4ded
- MD5 603cd36623e88c1a69dae68f3d9e5399
- SHA1 613b1f441fd5164d36f3b2deb79a1e3a54f358fe
- SHA512 e66f6f878bf10c9de31d4370f56f5f19a2b666a19a0b04b06707efdb73313844fedd90370be23da297d290f2df842b1b51aec0ecfdce1ecdda819dca4815f267
- SSDEEP 6144:ecVRbrnwQK8yHqwuQMCEmSVz8Pg2nO184bHmr066yha+oBgA+Q5yKUI9G+kG9j7B:30TXEmSdYr7NHkZCqxtHr2366NI/5
- MD5 SHA1 SHA512 SSDEEP
se.exe
- IMPHASH 2f42d9bf2e4bd6a55ae0fba78a741ee5
- SHA256 589b185221797c8dc67bc586f8c2e3c463a06771e53744afa082c04be7fe5763
- MD5 b7b347f1aebf2ef10369faf14e0bb2fb
- SHA1 258e9a1ec916d66b510849192fba6c05fdcdaec7
- SHA512 4baa49881edb3dea09d6ba8a71cbbcfc597a94657ef2265a5bffb38d2d481579e4215c5674360d490bd3a2913017b606c7e14564db64f645d910e809271b44d3
- SSDEEP 1536:GRtxXnig5/VUJyWryEXe8T1g6hypxc/lkJ5jj1fV8cGDmtY:GhN5/VmbTC6hyQ/OJRj1V8cGCtY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38675
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
inet_addr
inet_ntoa
gethostname
closesocket
sendto
htonl
htons
setsockopt
WSAGetLastError
WSASocketA
select
__WSAFDIsSet
recv
WSAIoctl
connect
send
socket
WSAStartup
gethostbyname
pdh
PdhAddCounterA
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhEnumObjectItemsA
PdhOpenQueryA
PdhCloseQuery
iphlpapi
GetAdaptersInfo
GetIfTable
user32
wsprintfA
advapi32
CreateServiceA
OpenServiceA
StartServiceA
RegSetValueExA
CloseServiceHandle
RegOpenKeyExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
kernel32
GetStringTypeA
MultiByteToWideChar
FlushFileBuffers
SetFilePointer
SetUnhandledExceptionFilter
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
GetStringTypeW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
WideCharToMultiByte
SetPriorityClass
GetTickCount
GetLocalTime
Sleep
ExitThread
GetCurrentProcessId
GetLastError
GetSystemTimes
GetVersionExA
CreateThread
WinExec
GetProcAddress
GetTempPathA
LoadLibraryA
ResumeThread
CreateProcessA
SetThreadPriority
GetCurrentThread
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
SetFileAttributesA
GetWindowsDirectoryA
CloseHandle
WaitForSingleObject
ExitProcess
CreateMutexA
lstrlenA
CopyFileA
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
CreateDirectoryA
TerminateProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
RaiseException
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
Name
.text
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=20, id=14, version=7299,
count=10, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=84, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=77, version=2144,
count=121, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
server.exe
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
- MD5 a770ebf2e59e29c7460a01241a0a493f
- SHA1 97e59e483e1fa524a305828157a50203e918ada9
- SHA512 4cf99a862fc6e2299e33113bb757dd31a0543c5b5716146de2051fbabe86a122e895a8ced9d4f2290ae82dd9f6093dc883abcb2a6747caa90e8fd46e061f6140
- SSDEEP 6144:WsItKnWUQpBTyPRqyhYPbncTBlhHrbndnkv0oX90wRudOl1YTSgux1p2iPtGZ5da:btWUzJq8YPbncT3+bRHfYTSgS21NPE+S
- MD5 SHA1 SHA512 SSDEEP
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
CODE
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata2
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.qnk
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=2, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=130, id=1, productName=Unmarked objects,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=9, id=11, productName=VS98 (6.0) build 8168, version=8168,
smss.exe
- IMPHASH c61b25c77e0b3cab046182a90ef2f53a
- SHA256 20105bd3112e1467d5081400343a6c4baa915c12012db77fadddd5a84e7a0b75
- MD5 27fe3482f2f12435310a3c84544f4f0b
- SHA1 dcef2cd3c551bf22b748556d7cdcd439a6cc5274
- SHA512 2324d9e10f410c3573d99dcdf3daf0960965e0e09a5134d21ad25e9cf6d0f91919e38cf37513b27baa25c3ade79825096dd88c50dfa5ddb82ff8ed36c32b2c48
- SSDEEP 6144:AVx3d4gxU0UqWTYFa6u+CaTy8ZcILWlxwbtEW3kT4:An3S90y8aX+/RciixwbtkT
- MD5 SHA1 SHA512 SSDEEP
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
180224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetSystemDirectoryA
GetLocalTime
GetModuleHandleA
GetSystemInfo
GetComputerNameA
OpenEventA
GetTickCount
SetErrorMode
GetExitCodeProcess
GetShortPathNameA
GetModuleFileNameA
ExitProcess
CreateMutexA
GlobalFree
GlobalUnlock
CreateToolhelp32Snapshot
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
OutputDebugStringA
lstrcpyW
GlobalMemoryStatusEx
WinExec
lstrcmpiA
Module32Next
Module32First
CreateRemoteThread
GetCurrentThreadId
Process32First
OpenProcess
LocalSize
Process32Next
GetCurrentProcess
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
CreateEventA
GetWindowsDirectoryA
lstrcpyA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
Sleep
CancelIo
InterlockedExchange
ResetEvent
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
CloseHandle
GlobalLock
user32
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
GetProcessWindowStation
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
keybd_event
ReleaseDC
GetCursorInfo
GetCursorPos
GetWindowThreadProcessId
OpenWindowStationA
SetProcessWindowStation
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
ExitWindowsEx
CharNextA
wsprintfA
SendMessageA
DispatchMessageA
BlockInput
SystemParametersInfoA
DestroyCursor
GetDesktopWindow
LoadCursorA
IsWindow
CloseClipboard
TranslateMessage
GetMessageA
CloseWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
EnumWindows
IsWindowVisible
gdi32
DeleteObject
CreateDIBSection
BitBlt
GetDIBits
SelectObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
advapi32
LookupPrivilegeValueA
GetTokenInformation
LookupAccountSidA
GetUserNameA
AbortSystemShutdownA
QueryServiceStatus
ControlService
RegCreateKeyExA
IsValidSid
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
LsaFreeMemory
RegCloseKey
RegQueryValueA
RegOpenKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExA
RegOpenKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
CloseServiceHandle
RegSetValueExA
StartServiceA
OpenServiceA
CreateServiceA
OpenSCManagerA
StartServiceCtrlDispatcherA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
shell32
SHGetSpecialFolderPathA
SHGetFileInfoA
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysFreeString
msvcrt
__setusermatherr
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_strcmpi
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
??1type_info@@UAE@XZ
calloc
_beginthreadex
atol
_mbscmp
_mbsstr
_CxxThrowException
wcscpy
strncmp
wcstombs
wcslen
strncpy
mbstowcs
strncat
sprintf
atoi
exit
strrchr
_except_handler3
free
malloc
strchr
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
winmm
waveInReset
waveInStop
waveInUnprepareHeader
waveInStart
waveInAddBuffer
waveInOpen
waveInClose
waveOutReset
waveOutUnprepareHeader
waveOutWrite
waveInPrepareHeader
waveInGetNumDevs
waveOutPrepareHeader
waveOutClose
waveOutGetNumDevs
waveOutOpen
ws2_32
WSACleanup
setsockopt
connect
htons
gethostbyname
socket
select
recv
closesocket
send
getsockname
htonl
WSAStartup
WSAIoctl
msvcp60
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
wininet
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
msvfw32
ICSeqCompressFrame
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
netapi32
NetUserDel
NetUserSetInfo
NetUserGetLocalGroups
NetApiBufferFree
NetUserGetInfo
NetUserEnum
NetLocalGroupAddMembers
NetUserAdd
iphlpapi
GetTcpTable
psapi
GetModuleFileNameExA
EnumProcessModules
wtsapi32
WTSEnumerateSessionsA
WTSQuerySessionInformationW
WTSFreeMemory
WTSLogoffSession
WTSDisconnectSession
WTSQuerySessionInformationA
Name
.text
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rmnet
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=12, version=7291,
count=3, id=14, version=7299,
count=1, id=11, version=8047,
count=11, id=10, version=8047,
count=4, id=4, version=8047,
count=12, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, productName=Unmarked objects (old),
count=317, id=1, productName=Unmarked objects,
count=33, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=20, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
sqlrer
- SHA256 fb678d38d8b75262a123a71f5568ed872ecd92a2e3fa38cdf7a8b22031f982db
- MD5 b324fddf10dc3f02d54dc5a4a9905c47
- SHA1 74b1e753d096e7a30102a94007f9b1a328837fa8
- SHA512 b8005ebdd218133f6c4b2807c98e0e5310bd08e244527d291cacd47184da903b4e1ebd6196b8da7919e1c00ff4ad3cdbfc9bf8be75d451afb4032aea987004ca
- SSDEEP 24576:hNJp/2SkgT4KUAopmhDO2Aan9XgnU6tZAf4Nzbm6g+qF2SdYOrhG6+bL+cH8y6LL:hNvOx/Vp/2bn9XgnNtmf28rhRbccIwhL
- MD5 SHA1 SHA512 SSDEEP
squld
- SHA256 0d84c93d895c48a00aacf0dbc0565ebde3ab720badf5eff0d85c43aa29027835
- MD5 368c8cbc67d3ce1ff7d2735cfe84f670
- SHA1 f66ab3403c34e4c5d4202b9f93098e77e30df653
- SHA512 450dbab685b5a274224db793e8b2587c5468a77f464badea4b5dc12548eda8af88a333e08bfa65bcec77d6fe106b86675b0400f8bcadcc6df02638db9025598d
- SSDEEP 24576:4vRE7caCfKGPqVEDNLFxKsfaqI+gIGYuuCol7r:4vREKfPqVE5jKsfaqRHGVo7r
- MD5 SHA1 SHA512 SSDEEP
-
MrBlack trojan
ssh.sh
- SHA256 af0e78daa3ef5fec5084820ef80c12f88a2779b9c1ae3f57dda7fc93e033715f
- MD5 5e3c944adaad38594a1f3f6fe3e3268f
- SHA1 b6c8fffead670eac332c60836c1a88760261dabc
- SHA512 23994c04f7c2b79e0aad2512554aebbea41bffec06e9642e3e2070fc630a55b6ce62892e63255de0a1002a41912cfdf88a65a1420e87f985a94b913f59e5a439
- MD5 SHA1 SHA512
taskmgr.exe
- IMPHASH 8a3f6e86b732126f2306d30c08600c88
- SHA256 554c68f17fb687c3941f0cc2b141e25541d1ce66e47ad512d7cfd80f3ea5c026
- MD5 bc59e8a47d288a3411399884af9ed624
- SHA1 f3abc633afb3b1a8d1439499e05a507f9899df73
- SHA512 03aeb3e64f78e6df60e32bedf5a50408708ab562e55ec92221a92290e1599ff527a2a8bdac0b043b2c97fa8507f7c57f21db4b4f9acd87a313384a4f5422bc01
- SSDEEP 6144:5gZNATdYlG4AnjhEkgS1bW4+QZbOQUhFS+W9RPNuULSWlJZg:5gZNodYlG4qEk1dYhFSbDNP14
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9233
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceW
GetEnvironmentVariableW
CloseHandle
WriteFile
CreateFileW
GetModuleFileNameA
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
MultiByteToWideChar
CreateDirectoryW
GetFileAttributesW
SetFileTime
GetModuleHandleA
GetStartupInfoA
user32
wsprintfW
shell32
ShellExecuteW
msvcrt
_XcptFilter
??2@YAPAXI@Z
__CxxFrameHandler
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
_CxxThrowException
wcscat
sprintf
calloc
free
malloc
wcslen
wcscpy
wcsstr
_exit
??0exception@@QAE@ABQBD@Z
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
_controlfp
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, version=8047,
count=7, id=19, version=8034,
count=55, id=1, productName=Unmarked objects,
count=5, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
win.exe
- IMPHASH 205aeb3f447d4abc4db53c705847d3e0
- SHA256 9754217d0fdfb2e06982be84ea1a13dc29ad50a2c5bfd33ae5a14de1fd9568c6
- MD5 745397b18fccf1d75f5a0ba6c0f5f268
- SHA1 82ae742f32707d70fb7ef40821ccdac2989cab60
- SHA512 31dea28e08d42095391c936b4d3b7a89bdcddac2a332517712ff49771504e459535b9391ee23012595250b9ea0359e83e9ca027bc039a735cb3fb0f043b8dd50
- SSDEEP 3072:luju5gwYsAp6wXhZIStIyyzdxu3N6Rnl2PO:luj1wYXUwEAyxqN6Rnl2G
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
20171
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateProcessA
CopyFileA
SetPriorityClass
FreeLibrary
GetProcAddress
GlobalMemoryStatus
GetShortPathNameA
ExitProcess
GetLastError
SetErrorMode
WriteFile
ReadFile
WinExec
GetSystemInfo
GetTickCount
lstrcpyA
lstrcatA
CreateMutexA
LoadLibraryA
DeleteFileA
GetVersionExA
CreateFileW
HeapSize
WaitForSingleObject
ResumeThread
SetThreadPriority
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
WideCharToMultiByte
CloseHandle
LCMapStringW
GetStringTypeW
WriteConsoleW
ReadConsoleW
SetStdHandle
OutputDebugStringW
SetFilePointerEx
LoadLibraryExW
SetEndOfFile
HeapReAlloc
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
Sleep
GetEnvironmentVariableA
CreateThread
CreateDirectoryW
GetCPInfo
GetOEMCP
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA
EncodePointer
DecodePointer
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
DeleteCriticalSection
HeapFree
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
GetStdHandle
GetFileType
GetModuleFileNameW
GetProcessHeap
GetConsoleCP
GetConsoleMode
IsValidCodePage
GetACP
user32
wsprintfA
advapi32
CheckTokenMembership
AdjustTokenPrivileges
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
OpenProcessToken
GetUserNameA
LookupPrivilegeValueA
FreeSid
AllocateAndInitializeSid
ws2_32
select
recv
inet_ntoa
WSASocketA
WSAGetLastError
WSACleanup
WSAStartup
gethostname
WSAIoctl
socket
setsockopt
sendto
send
ntohl
inet_addr
htons
htonl
connect
closesocket
gethostbyname
__WSAFDIsSet
dnsapi
DnsFree
DnsQuery_A
shlwapi
PathRemoveFileSpecA
PathFindFileNameA
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
32KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
xwqcbzg
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=43, id=225, productName=VS2013 build 21005, version=21005,
count=21, id=223, productName=VS2013 build 21005, version=21005,
count=131, id=224, productName=VS2013 build 21005, version=21005,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=148, id=1, productName=Unmarked objects,
count=5, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
wm
- SHA256 45d821a50bb23a092cf136fd79f151abef502f8735ec80d6118b769f98d4326e
- MD5 45b2c35b3655e5f8c2ce5bfb6641b91c
- SHA1 ec29095588f75ab201beb83100f78c1ded66f818
- SHA512 7008075a751b093c3c5712869aa67671bbc0803b5ae119ef6079bdf477c05cd1c9c172d52ecd01809ed52f522daab9f504f1f298d0a1b3c8a97d013fa6926da0
- SSDEEP 96:3aRM8+Nz5NgSCENafR5JzDL0BQXmw9vxcSYy653LgyS8fbI59IT:3a2ZNzCDLqDwN1YyyOp/IT
- MD5 SHA1 SHA512 SSDEEP
wrt1
- SHA256 f309a43e4c8ea82cb5569a9656640e4501a3c0700c1352adb9f788dcef4f2ae1
- MD5 d745749640359f5c5461b893d8865fd8
- SHA1 74c667c6252142393c7bf21f8d23d3dabcd97236
- SHA512 1d86014f318a945eb5e105c7fcaee4d62e0ff83357b67c3f2ee734f8ceb0045f2e8230d4007427b74254375a87f8a0725ad445c876e9fd5c8f49de3b4bf1c0f1
- SSDEEP 24576:qsFkPsgRseqq7s7L23vHkF/CZ5lfwNjcpzdmMqMSjG2oedCp/mpyS1lFhextK:leLsL23vEF/CZ5lfwNjcpzdmMqMSjG2d
- MD5 SHA1 SHA512 SSDEEP
xm.exe
- IMPHASH c812e1a6ad9f5238ea5742cba100d24c
- SHA256 d28b2cbecf6d771d85551b357b72c9aa939a57fdc74aee1ebc63ba334ed1e7df
- MD5 b16999f6fc3826ef598b459a2b8731ce
- SHA1 d24402ff822c4e7d1606f96bd3bdab0ece841474
- SHA512 79afff783ae58c410f5a92f09a4488b29dec8424b06b8e1780741ec834202faca0eba6e4d51350866a74f6060a6f593a4c1d9a8fc554ef0858deb46df1952c98
- SSDEEP 768:sjCSpftPzWIYHqfwyV0vsYRvNxLSywUlcVYeXSiaMHX3ZL+yd0ZgrvZQ:s+SLiIasV0vztNxCUlcVjXaMHX3M0W
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CloseHandle
WaitForSingleObject
DeleteFileA
GetModuleHandleA
GetStartupInfoA
CreateThread
GetSystemInfo
Sleep
LoadLibraryA
GetProcAddress
GetCurrentProcessId
GetTickCount
user32
wsprintfA
advapi32
OpenServiceA
DeleteService
RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
ws2_32
select
__WSAFDIsSet
recv
closesocket
setsockopt
sendto
WSAStartup
htons
socket
connect
send
inet_addr
gethostbyname
iphlpapi
GetIfEntry
GetIfTable
GetInterfaceInfo
msvcrt
free
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
??1type_info@@UAE@XZ
time
localtime
memset
memcpy
??3@YAXPAX@Z
rand
strrchr
??2@YAPAXI@Z
strcpy
sprintf
strcat
malloc
strstr
__CxxFrameHandler
_CxxThrowException
exit
_controlfp
Name
.data
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=11, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=68, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
yk.exe
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
- MD5 a770ebf2e59e29c7460a01241a0a493f
- SHA1 97e59e483e1fa524a305828157a50203e918ada9
- SHA512 4cf99a862fc6e2299e33113bb757dd31a0543c5b5716146de2051fbabe86a122e895a8ced9d4f2290ae82dd9f6093dc883abcb2a6747caa90e8fd46e061f6140
- SSDEEP 6144:WsItKnWUQpBTyPRqyhYPbncTBlhHrbndnkv0oX90wRudOl1YTSgux1p2iPtGZ5da:btWUzJq8YPbncT3+bRHfYTSgS21NPE+S
- MD5 SHA1 SHA512 SSDEEP
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
204800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
CODE
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata2
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.qnk
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=2, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=130, id=1, productName=Unmarked objects,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=9, id=11, productName=VS98 (6.0) build 8168, version=8168,
yk1.exe
- IMPHASH b39d2a8818e34e573819e4d3d2aced3a
- SHA256 5ecc331e0704bb6756aaacc19bd3d356d9c6851819c18df5be8ef76ba46cde95
- MD5 76eb54ffd5a2a2e161b45a9b4e24b71b
- SHA1 4031978e9de0805858233e45b9109c376dce1db1
- SHA512 119807cddeb634de800d82fa7eae3d11a40bf2732bac8e6a3a31c14600dee1abcdb945fbb5349895b945120c70a5e4fa9629c26f33cc5972ad0449489ef569d1
- SSDEEP 3072:9BFDC2a8kkalMLmNTMeN1vT72dPxIhf+sHS5LTblIdp4nNtmPvqgl:9/inHlN1vTyTIBVHkTblIGUSgl
- MD5 SHA1 SHA512 SSDEEP
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
109926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
OpenEventA
CreateMutexA
CopyFileA
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
lstrcpyW
LocalReAlloc
GlobalMemoryStatusEx
WinExec
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
Module32Next
Module32First
CreateRemoteThread
GetModuleHandleA
OpenProcess
FreeLibrary
GetDiskFreeSpaceExA
GetDriveTypeA
ReadFile
LocalAlloc
LocalFree
GetLocalTime
CreateFileA
GetFileSize
SetFilePointer
lstrlenA
WriteFile
GetTempPathA
GetTickCount
MoveFileExA
SetFileAttributesA
GetSystemDirectoryA
DeleteFileA
GetModuleFileNameA
GetShortPathNameA
GetEnvironmentVariableA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
ResumeThread
CreateThread
TerminateThread
lstrcpyA
GetWindowsDirectoryA
lstrcatA
GetStartupInfoA
CreateProcessA
GetProcAddress
GetFileAttributesA
GetLastError
MoveFileA
CancelIo
InterlockedExchange
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
Sleep
LoadLibraryA
LocalSize
user32
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
GetMessageA
PostThreadMessageA
GetInputState
SetClipboardData
LoadIconA
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
CloseDesktop
SetThreadDesktop
OpenInputDesktop
IsWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
CloseClipboard
mouse_event
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyA
keybd_event
SendMessageA
SystemParametersInfoA
BlockInput
wsprintfA
DestroyCursor
LoadCursorA
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
RegisterClassA
MessageBoxA
gdi32
GetDIBits
BitBlt
GetStockObject
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
DeleteObject
advapi32
OpenProcessToken
GetTokenInformation
LookupAccountSidA
GetUserNameA
AbortSystemShutdownA
QueryServiceStatus
ControlService
RegDeleteKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
RegCloseKey
RegSetValueExA
RegCreateKeyA
DeleteService
OpenServiceA
OpenSCManagerA
RegQueryValueExA
RegOpenKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegCreateKeyExA
StartServiceCtrlDispatcherA
CloseServiceHandle
StartServiceA
UnlockServiceDatabase
ChangeServiceConfig2A
LockServiceDatabase
CreateServiceA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
msvcrt
_onexit
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
strlen
??0exception@@QAE@ABV0@@Z
_strcmpi
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_iob
memcpy
__dllonexit
??1type_info@@UAE@XZ
calloc
_snprintf
_beginthreadex
atol
_mbscmp
_mbsstr
wcscpy
wcstombs
wcslen
mbstowcs
_errno
strncpy
strncmp
rand
atoi
realloc
strncat
exit
strrchr
sprintf
_except_handler3
free
malloc
strchr
strstr
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
memmove
ceil
_ftol
ws2_32
WSAStartup
gethostname
ioctlsocket
__WSAFDIsSet
recvfrom
sendto
listen
accept
getpeername
bind
ntohs
WSACleanup
WSAIoctl
inet_addr
inet_ntoa
getsockname
send
closesocket
recv
select
socket
gethostbyname
setsockopt
connect
htons
urlmon
URLDownloadToFileA
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
avicap32
capGetDriverDescriptionA
msvfw32
ICSeqCompressFrame
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
iphlpapi
GetIfTable
netapi32
NetUserGetInfo
NetUserDel
NetUserSetInfo
NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum
NetLocalGroupAddMembers
NetUserAdd
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsA
WTSQuerySessionInformationA
WTSDisconnectSession
WTSLogoffSession
Name
.text
Size
108KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
yvosmwp
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=11, version=8047,
count=3, id=12, version=7291,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=4, id=14, version=7299,
count=12, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=284, id=1, productName=Unmarked objects,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,