533.7z
- SHA256 3730e9cba4a93bc985ef7cd2368ccbf5eccd4724f514b38b20e320e5553dd08d
Overview
overview
10Static
static
10533.7z
windows7-x64
533.7z
windows10-2004-x64
533.7z
android-10-x64
533.7z
android-13-x64
533.7z
macos-10.15-amd64
533.7z
ubuntu-18.04-amd64
533.7z
debian-9-armhf
533.7z
debian-9-mips
533.7z
debian-9-mipsel
084c57449c...0e.exe
windows7-x64
10084c57449c...0e.exe
windows10-2004-x64
10084c57449c...0e.exe
android-13-x64
084c57449c...0e.exe
android-13-x64
084c57449c...0e.exe
macos-10.15-amd64
084c57449c...0e.exe
ubuntu-18.04-amd64
084c57449c...0e.exe
debian-9-armhf
084c57449c...0e.exe
debian-9-mips
084c57449c...0e.exe
debian-9-mipsel
14b94844b9...c3.exe
windows7-x64
1014b94844b9...c3.exe
windows10-2004-x64
1014b94844b9...c3.exe
android-11-x64
14b94844b9...c3.exe
android-13-x64
14b94844b9...c3.exe
macos-10.15-amd64
14b94844b9...c3.exe
ubuntu-18.04-amd64
14b94844b9...c3.exe
debian-9-armhf
14b94844b9...c3.exe
debian-9-mips
14b94844b9...c3.exe
debian-9-mipsel
2daa514408...2e.exe
windows7-x64
102daa514408...2e.exe
windows10-2004-x64
102daa514408...2e.exe
android-11-x64
2daa514408...2e.exe
android-13-x64
2daa514408...2e.exe
macos-10.15-amd64
Resubmissions
25/03/2025, 13:12
250325-qfl42aznw91025/03/2025, 13:09
250325-qdtq4aznv61025/03/2025, 13:05
250325-qbtcjszns31025/03/2025, 13:01
250325-p9k86awxat1025/03/2025, 12:55
250325-p58tnawwe11025/03/2025, 12:51
250325-p3txqazmt61005/02/2025, 11:16
250205-ndjvsavrdm1016/07/2024, 08:54
240716-kt64gavakp10Static task
static1
17 signatures
Behavioral task
behavioral1
Sample
533.7z
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
533.7z
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
533.7z
Resource
android-x64-20240624-en
android-10-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
533.7z
Resource
android-33-x64-arm64-20240624-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
533.7z
Resource
macos-20241101-en
macos-10.15-amd64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
533.7z
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
533.7z
Resource
debian9-armhf-20240611-en
debian-9-armhf
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
533.7z
Resource
debian9-mipsbe-20240611-en
debian-9-mips
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
533.7z
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
300 seconds
Behavioral task
behavioral11
Sample
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
18 signatures
300 seconds
Behavioral task
behavioral12
Sample
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
Resource
android-33-x64-arm64-20240624-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
Resource
android-33-x64-arm64-20240624-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
Resource
macos-20241106-en
macos-10.15-amd64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
Resource
debian9-armhf-20240418-en
debian-9-armhf
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
Resource
debian9-mipsbe-20240611-en
debian-9-mips
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
300 seconds
Behavioral task
behavioral20
Sample
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
23 signatures
300 seconds
Behavioral task
behavioral21
Sample
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe
Resource
android-x64-arm64-20240624-en
android-11-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe
Resource
android-33-x64-arm64-20240910-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe
Resource
macos-20241106-en
macos-10.15-amd64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe
Resource
debian9-armhf-20240611-en
debian-9-armhf
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe
Resource
debian9-mipsbe-20240418-en
debian-9-mips
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
2daa5144081dd288c1dc936ec27b1c8bd709633450ceb73f235fccd1c3d3c62e.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral29
Sample
2daa5144081dd288c1dc936ec27b1c8bd709633450ceb73f235fccd1c3d3c62e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral30
Sample
2daa5144081dd288c1dc936ec27b1c8bd709633450ceb73f235fccd1c3d3c62e.exe
Resource
android-x64-arm64-20240624-en
android-11-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
2daa5144081dd288c1dc936ec27b1c8bd709633450ceb73f235fccd1c3d3c62e.exe
Resource
android-33-x64-arm64-20240910-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
2daa5144081dd288c1dc936ec27b1c8bd709633450ceb73f235fccd1c3d3c62e.exe
Resource
macos-20241101-en
macos-10.15-amd64
0 signatures
300 seconds
General
- Target 533.7z
- Size 2.7MB
- Sample250205-ndjvsavrdm
- SHA256 3730e9cba4a93bc985ef7cd2368ccbf5eccd4724f514b38b20e320e5553dd08d
- MD5 7aded2388d27c5dc782dca435f160857
- SHA1 744f53fe1f4c7a43a82e1a942eb71f4175da8935
- SHA512 518957e9248e65c5231e10c3977d01f7d3b4aa43f08b00c668be8501a88e06d1eaa2a5aaf976ab9caa1d2eacbc7a2029731d5a7054df230aaf93a79294d9083b
- SSDEEP 49152:BdRLSYLgm9h2iT/1Xd6STMtS07Cqjgfzj8flramouva2dd1ALRNyndSBSJQIQV:BdNtJPDJXd62MY50R+a5X1my8BSJQzV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
blackmatter
Version
-
1.2
Botnet
-
512478c08dada2af19e49808fbda5b0b
Credentials
-
Username
-
Password
120Heisler
Credentials
-
Username
-
Password
Tesla2019
Credentials
-
Username
-
Password
iteam8**
C2
-
https://paymenthacks.com
-
http://paymenthacks.com
-
https://mojobiden.com
-
http://mojobiden.com
Attributes
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
rsa_pubkey.base64
aes.base64
Signatures
- Blackmatter family
- Chaos Ransomware 6 IoCs
resource yara_rule static1/unpack001/14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe family_chaos static1/unpack001/2e6f094748124800d8cf6bdb28bb8aa4caa066923cf3e9778dae8bcb2b6e85ec.exe family_chaos static1/unpack001/49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24.exe family_chaos static1/unpack001/5199b64b50f678d75f85cb0c3ac97d7df67f23471815e21236b1a790d008fe3c.exe family_chaos static1/unpack001/6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe family_chaos static1/unpack001/e48bd2f16b53a3630f3fca69d0d236d15bc23b08754d980bd29b15841b0fdf14.exe family_chaos - Chaos family
- Detects Mimic ransomware 1 IoCs
resource yara_rule static1/unpack001/2e96b55980a827011a7e0784ab95dcee53958a1bb19f5397080a434041bbeeea.exe family_mimic - GandCrab payload 2 IoCs
resource yara_rule static1/unpack001/da6f543313480695aab95a5e685741a8d185fba0600363f74063eb1cda0f672e.exe family_gandcrab static1/unpack001/f08c1c26d375f6881990756e39208017b02af75fca0ebddb72f5e5c14e20363f.exe family_gandcrab - Gandcrab family
- Lockbit family
- MAKOP ransomware payload 2 IoCs
resource yara_rule static1/unpack001/084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe family_makop static1/unpack001/56f7b48f3877743c44aef0f3e990b3387dd6185f1c40a7477f5b6bad64960659.exe family_makop - Makop family
- Mimic family
- ModiLoader Second Stage 2 IoCs
resource yara_rule static1/unpack001/606b88fce1441e6d83e1fb2ba1b511e4a9e68f7fc01c55b7c53e08fd28f9a0c4.exe modiloader_stage2 static1/unpack001/fcb68445068ebf4cd526d316622f9aa3e8065f9a9f42e5330f66f5cb160be393.exe modiloader_stage2 - Modiloader family
- Nefilim family
- Nefilim ransomware executable 1 IoCs
File contains patterns typical of Nefilim samples.
resource yara_rule static1/unpack001/2daa5144081dd288c1dc936ec27b1c8bd709633450ceb73f235fccd1c3d3c62e.exe nefilim_ransomware - Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule static1/unpack001/f7caf7d69cef15d5c3b9983513e4e40edc3a31c5ead4139bc41d1500442a966a.exe family_lockbit -
resource yara_rule static1/unpack001/3a7265305386f955adbeb6bd7c711f03395963ac36be82e5bb6b1d7b2034c859.exe upx - Unsigned PE 32 IoCs
Checks for missing Authenticode signature.
resource unpack001/084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe unpack001/14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe unpack001/2daa5144081dd288c1dc936ec27b1c8bd709633450ceb73f235fccd1c3d3c62e.exe unpack001/2e96b55980a827011a7e0784ab95dcee53958a1bb19f5397080a434041bbeeea.exe unpack001/34c392448fc0818278cd19bb0841adf573e967be8a0f73bb42bb367a5835b6ea.exe unpack001/37d8add251cb4179224ebbc0e28f8d9e26b5e64bbaec37f26a996bf51556f04c.exe unpack001/3a7265305386f955adbeb6bd7c711f03395963ac36be82e5bb6b1d7b2034c859.exe unpack002/out.upx unpack001/49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24.exe unpack001/4a2ad49c934f9ae6ca6b5d0c7cc34f5e12d349640012fa8cf8eb7e2d3acd6c9f.exe unpack001/5199b64b50f678d75f85cb0c3ac97d7df67f23471815e21236b1a790d008fe3c.exe unpack001/55c30024aed833336eb4720a1a4a40c78496efb27b3c4d5c3f1d1b5935c12715.exe unpack001/56f7b48f3877743c44aef0f3e990b3387dd6185f1c40a7477f5b6bad64960659.exe unpack001/5a96b929383817aa298eec8cca019bcd984fcd71dd8ee353541392c1082756a4.exe unpack001/606b88fce1441e6d83e1fb2ba1b511e4a9e68f7fc01c55b7c53e08fd28f9a0c4.exe unpack001/6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe unpack001/71b46e95fba31267475537a338f49ce1cd0bc56c0f15346b05b673051cbe90a8.exe unpack001/7d98972d5c78e1d4969da76856d6818942b606c267efa67fd31d39ae77497e9c.exe unpack001/87b9b910d5d5a053e3b39989cc6fd51601abdaea207a26c765f21f43a4cd4dcb.exe unpack001/8958d7b8c51215d6a27444b2760f1ce843a414d380052e6e71c2af6e9ab69ce2.exe unpack001/ab5be9e6911b43f0974e01dabec772b968274d9b5ea39ba2ad7cd294056e5d09.exe unpack001/b228a698ee826b42e19307f2d34c2620819a67a0e98fd2af08aae570b8178cc0.exe unpack001/c864a70f78fb972f505ae5b13c0ad984e64c547194beb258926bb4c323fac31d.exe unpack001/cfd5d9a4e67799f2428c6071dcc13fcf726f49ec3e706f0302b4592a3a0a08f0.exe unpack001/da6f543313480695aab95a5e685741a8d185fba0600363f74063eb1cda0f672e.exe unpack001/e05323d9ca6df47d9add5b2f757ea2490ebd11dfe1b56b82a9e93ba9d814e162.exe unpack001/e48bd2f16b53a3630f3fca69d0d236d15bc23b08754d980bd29b15841b0fdf14.exe unpack001/ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d.exe unpack001/f08c1c26d375f6881990756e39208017b02af75fca0ebddb72f5e5c14e20363f.exe unpack001/f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe unpack001/f7caf7d69cef15d5c3b9983513e4e40edc3a31c5ead4139bc41d1500442a966a.exe unpack001/fcb68445068ebf4cd526d316622f9aa3e8065f9a9f42e5330f66f5cb160be393.exe
File Explorer
-
533.7z.7z 2.7MB
-
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe.exe 49KB
-
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe.exe 87KB
-
2daa5144081dd288c1dc936ec27b1c8bd709633450ceb73f235fccd1c3d3c62e.exe.exe 70KB
-
2e6f094748124800d8cf6bdb28bb8aa4caa066923cf3e9778dae8bcb2b6e85ec.exe42KB
-
2e96b55980a827011a7e0784ab95dcee53958a1bb19f5397080a434041bbeeea.exe.exe 2.0MB
-
34c392448fc0818278cd19bb0841adf573e967be8a0f73bb42bb367a5835b6ea.exe.exe 92KB
-
37d8add251cb4179224ebbc0e28f8d9e26b5e64bbaec37f26a996bf51556f04c.exe.exe 1.3MB
-
3a7265305386f955adbeb6bd7c711f03395963ac36be82e5bb6b1d7b2034c859.exe.exe 80KB
-
out.upx.exe 67KB
-
49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24.exe.exe 44KB
-
4a2ad49c934f9ae6ca6b5d0c7cc34f5e12d349640012fa8cf8eb7e2d3acd6c9f.exe.exe 1.9MB
-
5199b64b50f678d75f85cb0c3ac97d7df67f23471815e21236b1a790d008fe3c.exe.exe 54KB
-
55c30024aed833336eb4720a1a4a40c78496efb27b3c4d5c3f1d1b5935c12715.exe.exe 56KB
-
56f7b48f3877743c44aef0f3e990b3387dd6185f1c40a7477f5b6bad64960659.exe.exe 42KB
-
5a96b929383817aa298eec8cca019bcd984fcd71dd8ee353541392c1082756a4.exe.exe 57KB
-
606b88fce1441e6d83e1fb2ba1b511e4a9e68f7fc01c55b7c53e08fd28f9a0c4.exe.exe 362KB
-
6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe.exe 71KB
-
71b46e95fba31267475537a338f49ce1cd0bc56c0f15346b05b673051cbe90a8.exe.exe 57KB
-
7d98972d5c78e1d4969da76856d6818942b606c267efa67fd31d39ae77497e9c.exe.exe 894KB
-
87b9b910d5d5a053e3b39989cc6fd51601abdaea207a26c765f21f43a4cd4dcb.exe.exe 79KB
-
8958d7b8c51215d6a27444b2760f1ce843a414d380052e6e71c2af6e9ab69ce2.exe.exe 959KB
-
ab5be9e6911b43f0974e01dabec772b968274d9b5ea39ba2ad7cd294056e5d09.exe.exe 88KB
-
b228a698ee826b42e19307f2d34c2620819a67a0e98fd2af08aae570b8178cc0.exe.exe 65KB
-
c864a70f78fb972f505ae5b13c0ad984e64c547194beb258926bb4c323fac31d.exe.exe 67KB
-
cfd5d9a4e67799f2428c6071dcc13fcf726f49ec3e706f0302b4592a3a0a08f0.exe.exe 68KB
-
da6f543313480695aab95a5e685741a8d185fba0600363f74063eb1cda0f672e.exe.exe 117KB
-
e05323d9ca6df47d9add5b2f757ea2490ebd11dfe1b56b82a9e93ba9d814e162.exe.exe 195KB
-
e48bd2f16b53a3630f3fca69d0d236d15bc23b08754d980bd29b15841b0fdf14.exe.exe 137KB
-
ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d.exe.exe 52KB
-
f08c1c26d375f6881990756e39208017b02af75fca0ebddb72f5e5c14e20363f.exe.exe 70KB
-
f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe.exe 217KB
-
f7caf7d69cef15d5c3b9983513e4e40edc3a31c5ead4139bc41d1500442a966a.exe.exe 152KB
-
fcb68445068ebf4cd526d316622f9aa3e8065f9a9f42e5330f66f5cb160be393.exe.exe 426KB
084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
- IMPHASH b7b88f9fba96375d4eebc5d049319af3
- SHA256 084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e
- MD5 50248697e19117027d4823c6a3be6db5
- SHA1 fb81c35ffe11180c1d6269006db2fc775eec4741
- SHA512 abc04de0ee5dfc9ca1afccc6b46f9bb4b56d3d9e9ec11165dfc9d3630a597e865941c2c33f4284807f155f69d8255ac3279c418f3bdb2a7f6b4e8678ba7fd6ed
- SSDEEP 768:acaQRffDB31aCytHLykiKPT3JATD2qBwV2ckjbnsb0Ah99De0YAD8hMWsddOC86t:acai318HxZATvnsblYO8hMWsdoC86+r
- MD5 SHA1 SHA512 SSDEEP
-
MAKOP ransomware payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpr
WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW
kernel32
ReadFile
CreateFileW
GetFileSizeEx
MoveFileW
SetFileAttributesW
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
GlobalAlloc
GlobalFree
GetVersion
PeekNamedPipe
GetProcAddress
LoadLibraryA
GetComputerNameW
SetEvent
CreateEventW
TerminateThread
SetFilePointerEx
GetFileType
GetModuleHandleA
DuplicateHandle
GetCurrentProcessId
ExitProcess
GetModuleHandleW
CreatePipe
LocalFree
GetCommandLineW
GetEnvironmentVariableW
CreateProcessW
GetLocaleInfoW
GetModuleFileNameW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetSystemWindowsDirectoryW
SetHandleInformation
GetTempPathW
GetTempFileNameW
CreateDirectoryW
GetStdHandle
WriteFile
Sleep
TryEnterCriticalSection
FindClose
GetLastError
GetFileAttributesW
GetLogicalDrives
WaitForSingleObject
CreateThread
GetVolumeInformationW
SetErrorMode
FindNextFileW
GetDriveTypeW
WaitForMultipleObjects
FindFirstFileW
TerminateProcess
DeleteCriticalSection
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CloseHandle
OpenProcess
user32
DialogBoxParamW
RegisterHotKey
PostMessageW
EndDialog
KillTimer
ShowWindow
wsprintfA
MessageBoxW
SetWindowTextA
SendMessageW
GetShellWindow
UnregisterHotKey
SetTimer
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CloseClipboard
GetWindowTextA
EmptyClipboard
GetDlgItem
OpenClipboard
GetWindowThreadProcessId
ReleaseDC
SystemParametersInfoW
GetDC
DrawTextA
EnableWindow
SetClipboardData
wsprintfW
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
DeleteObject
SelectObject
SetBkMode
advapi32
CryptGenRandom
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DuplicateTokenEx
OpenProcessToken
SetTokenInformation
GetTokenInformation
CryptDecrypt
CryptAcquireContextW
CryptSetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptDestroyKey
shell32
ord680
ShellExecuteExW
CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ole32
CoInitialize
CoTaskMemFree
CoUninitialize
msimg32
GradientFill
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=125, productName=VS2005 build 50727, version=50727,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=133, id=1, productName=Unmarked objects,
count=17, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 14b94844b99ac43c014ea73c3400097e3239a7307d1618e84159a741ab0e8ac3
- MD5 d77f7e460e5036f65677b24ed24c2dff
- SHA1 053afa00864c3c0c896e48be382436c417cabb34
- SHA512 f447b9b9a60f7a6fddd137a228efc7c056b989c698c85c30e6eda7c3b3990fb7a82fe2387b8fb8ee38d21704f9924a989a2a87f1d34badf20a3c89a2b9dfe3b9
- SSDEEP 1536:1o2ECd3kfHr9PZAKodFF2QRa/oDc10QxsSmCDo/PjsXMbyxFmwYSDfgCso:1oWd3kfr9P5QRaADc17xAKRjFr4Lo
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
2daa5144081dd288c1dc936ec27b1c8bd709633450ceb73f235fccd1c3d3c62e.exe
- IMPHASH 3ee8aa55414a94ea0a841ea0069bd261
- SHA256 2daa5144081dd288c1dc936ec27b1c8bd709633450ceb73f235fccd1c3d3c62e
- MD5 193e702195e8ed5c50cc482569559462
- SHA1 47a5307b78fa2c60c20ce63c553aef4a6d5a3e1c
- SHA512 d5ae5a8bccfc08bc07834caaebaed7a6cde1911170eb8de99322bf15be3ad111b5042d6401dcb06e64a6a429eee19d964878089af205474b377b77627bb63a35
- SSDEEP 768:lXStkFWTBhyugDC60CPJkEBx9w7mSDh3vkkjvshT3ED18nv04ZPqpb348Uq1krHO:liMWV3gDCk6EBwT/kJbvkbuq1krj0z
- MD5 SHA1 SHA512 SSDEEP
-
Nefilim ransomware executable
File contains patterns typical of Nefilim samples.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
16196
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Administrator\Desktop\New folder\Release\NEFILIM.pdb
kernel32
GetTickCount
GetProcessHeap
WriteFile
Sleep
ReadFile
CreateFileW
GetFileSizeEx
GetStdHandle
GetLastError
SetLastError
GetProcAddress
MoveFileW
GetLogicalDrives
LoadLibraryA
lstrcmpiW
FindNextFileW
CloseHandle
CreateThread
ExitProcess
GetModuleFileNameW
WideCharToMultiByte
ExitThread
MultiByteToWideChar
CreateMutexA
WaitForSingleObject
HeapFree
SetFilePointerEx
GetCurrentProcess
HeapAlloc
GetDriveTypeW
lstrlenA
FindFirstFileW
FindClose
GetSystemDefaultLangID
GetStringTypeW
LCMapStringW
IsValidCodePage
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapSize
GetModuleHandleW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
HeapReAlloc
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
advapi32
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
CryptHashData
shell32
ShellExecuteW
shlwapi
PathFindExtensionW
PathIsDirectoryW
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=158, productName=VS2010 build 30319, version=30319,
count=68, id=170, productName=VS2010 build 30319, version=30319,
count=31, id=171, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=8, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
2e6f094748124800d8cf6bdb28bb8aa4caa066923cf3e9778dae8bcb2b6e85ec.exe
- SHA256 2e6f094748124800d8cf6bdb28bb8aa4caa066923cf3e9778dae8bcb2b6e85ec
- MD5 790cd1ca1e1e862544d527a807a1e6b1
- SHA1 2ee282a9f6158b0e60bf338c1e354e4667bc36b4
- SHA512 b1c3e537e30f7e8fb53a0303b446bd1c4171b967d2365509f9ecdefcc924ba2e58ff7b67c346f727ab0ec240e953b2a374eacf7cd38944e66aed529b5b00b20d
- SSDEEP 768:zqj7UWPjjkzEr9npTQi/zRUNWv39Hf6F0BkfLSV3F8Ftqel59CHAOLw0:ej7ZjjkzEr9npj/WN4/6F0BkDSGtqeLm
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
2e96b55980a827011a7e0784ab95dcee53958a1bb19f5397080a434041bbeeea.exe
- IMPHASH ec5356d8e0f77a28432ffd3fb34115c9
- SHA256 2e96b55980a827011a7e0784ab95dcee53958a1bb19f5397080a434041bbeeea
- MD5 d42d34d87e404aa93862a40e997f8f6d
- SHA1 8ea71ea5177d46c9feea0e1cd19069a3441e1758
- SHA512 3d17176d804b555ff1ad180ec789c73012512bfa87732d39c9927a0b9a87051fb2e41923326cf12af3cfdaacee95ede6b63f704f565accebe4d5b08fd08ccb3f
- SSDEEP 24576:w/iIzkQF+KpPnF1Fx+CszLyQ9lkxIQVki//47JhUhio7Z6OI93lGFtPtnNON+IjE:whBPrElwNkto7VINlGFtPtnwjjOaHo
- MD5 SHA1 SHA512 SSDEEP
-
Detects Mimic ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1230391
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcatW
lstrcpyW
CreateIoCompletionPort
CreateTimerQueue
GetCurrentProcess
SetProcessShutdownParameters
LocalAlloc
GetCurrentThread
LocalFree
GetSystemWindowsDirectoryW
QueryDosDeviceW
FindFirstFileW
SetPriorityClass
FindNextFileW
TerminateProcess
RemoveDirectoryW
FindClose
GetVersionExW
K32GetProcessImageFileNameW
DuplicateHandle
CreateToolhelp32Snapshot
GetExitCodeThread
ProcessIdToSessionId
Process32NextW
K32GetProcessMemoryInfo
Process32FirstW
GetNativeSystemInfo
LoadLibraryW
Module32FirstW
GetWindowsDirectoryW
GetProcAddress
WTSGetActiveConsoleSessionId
CreateProcessW
GetModuleHandleW
CreateRemoteThread
Module32NextW
QueryFullProcessImageNameW
K32GetMappedFileNameW
CreateFileMappingW
GetTickCount
lstrcmpW
IsWow64Process
VirtualQueryEx
InitializeCriticalSectionEx
RaiseException
DecodePointer
GetComputerNameExW
GlobalMemoryStatusEx
ReadProcessMemory
GetStdHandle
GetEnvironmentVariableW
GetFileType
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
QueryPerformanceCounter
GetSystemTimeAsFileTime
FormatMessageW
DeleteFiber
ConvertFiberToThread
FreeLibrary
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
CancelIo
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
GetProcessHeap
HeapAlloc
HeapFree
GetCurrentProcessId
SetCurrentDirectoryW
Wow64RevertWow64FsRedirection
Sleep
OpenProcess
Wow64DisableWow64FsRedirection
GetCommandLineW
WideCharToMultiByte
GetLocalTime
PostQueuedCompletionStatus
GetFileInformationByHandle
SetFileAttributesW
GetFileAttributesW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateThread
MapViewOfFile
CreateEventA
CreateFileMappingA
ResetEvent
SetEvent
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateMutexW
WaitForMultipleObjects
AllocConsole
GetConsoleWindow
ReadFile
SetConsoleCP
GetFileTime
GetDriveTypeW
FindNextVolumeW
GetSystemTime
GetVolumePathNamesForVolumeNameW
CopyFileW
SystemTimeToFileTime
FindVolumeClose
SetVolumeMountPointW
GetDiskFreeSpaceExW
ExitThread
SetFileTime
IsValidLocale
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
ExitProcess
ResumeThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
DeviceIoControl
lstrlenW
FindFirstVolumeW
GetLogicalDrives
GetVolumeInformationW
CreateDirectoryW
lstrcmpiW
MultiByteToWideChar
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
SwitchToThread
TryEnterCriticalSection
AreFileApisANSI
GetFullPathNameW
GetQueuedCompletionStatus
DeleteTimerQueue
DeleteCriticalSection
FindFirstFileExW
GetCurrentDirectoryW
QueryPerformanceFrequency
GetStringTypeW
CreateTimerQueueTimer
CreateFileW
GetFileSizeEx
GetModuleFileNameW
FlushFileBuffers
MoveFileW
SetFilePointerEx
CloseHandle
DeleteFileW
GetLastError
SetEndOfFile
WriteFile
HeapSize
user32
wsprintfW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
wvsprintfW
GetMessageW
UnregisterHotKey
PostMessageW
ShowWindow
PeekMessageW
RegisterHotKey
advapi32
ReportEventW
RevertToSelf
GetTokenInformation
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
ConvertSidToStringSidW
SetSecurityInfo
InitializeAcl
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
LookupPrivilegeNameW
RegCloseKey
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetSecurityDescriptorSacl
LookupPrivilegeValueW
QueryServiceStatusEx
DuplicateTokenEx
EnumServicesStatusW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegisterEventSourceW
DeregisterEventSource
RegGetValueW
EqualSid
CreateWellKnownSid
GetUserNameW
LookupAccountSidW
CloseServiceHandle
OpenSCManagerW
ControlService
EnumDependentServicesW
ChangeServiceConfigW
OpenServiceW
SetThreadToken
shell32
CommandLineToArgvW
SHCreateItemFromParsingName
SHEmptyRecycleBinW
ole32
CoSetProxyBlanket
CoTaskMemFree
CoGetObject
CoInitializeEx
CoCreateInstance
CoInitialize
CoInitializeSecurity
CoUninitialize
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
shlwapi
StrStrIA
PathFileExistsW
StrStrIW
PathRemoveFileSpecW
PathStripPathW
PathFindExtensionW
PathGetArgsW
PathRemoveExtensionW
StrStrW
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
ws2_32
gethostbyname
closesocket
WSAIoctl
bind
recv
send
WSASocketW
WSAStartup
socket
WSAAddressToStringW
WSAGetLastError
setsockopt
htons
WSACleanup
shutdown
inet_ntop
getsockopt
gethostname
WSASetLastError
inet_ntoa
iphlpapi
GetIpNetTable
GetAdaptersInfo
netapi32
NetShareEnum
NetApiBufferFree
mpr
WNetGetConnectionW
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
rstrtmgr
RmGetList
RmShutdown
RmStartSession
RmRegisterResources
RmEndSession
everything32
Everything_GetNumResults
Everything_SetRequestFlags
Everything_Exit
Everything_CleanUp
Everything_GetLastError
Everything_QueryW
Everything_GetResultFullPathNameW
Everything_GetResultSize
Everything_DeleteRunHistory
Everything_SetSort
Everything_IsDBLoaded
Everything_SetSearchW
bcrypt
BCryptGenRandom
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
457KB
Virtual Size
456KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=28900,
count=195, id=261, version=28900,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=199, version=41118,
count=25, id=259, version=26706,
count=133, id=261, version=26706,
count=36, id=260, version=26706,
count=26, id=260, version=28900,
count=29, id=257, version=28900,
count=373, id=1, productName=Unmarked objects,
count=21, productName=Unmarked objects (old),
count=493, id=260, productName=VS2019 v16.10.0 build 30037, version=30037,
count=29, id=265, version=27048,
count=1, id=255, version=27048,
count=1, id=258, version=27048,
34c392448fc0818278cd19bb0841adf573e967be8a0f73bb42bb367a5835b6ea.exe
- IMPHASH f86dec4a80961955a89e7ed62046cc0e
- SHA256 34c392448fc0818278cd19bb0841adf573e967be8a0f73bb42bb367a5835b6ea
- MD5 21c2b2d0bfc15b3d4bc72263f9db5547
- SHA1 9f65f98ae2b418425a1d98b8d86bef88edab4d7c
- SHA512 aeeb64dc1130f6e5ccf6ab9abedf01e2a59e149f4897a44b02c32f816ddd1d1698a59447f7ce03dab966972f7714977b49f4b7e0fd258b0bedd936ac1926060a
- SSDEEP 1536:lBwl+KXpsqN5vlwWYyhY9S4AE4SLlaSXrgKcQ48bcWHpOZ2yr+e72eIGZZyb1j:vw+asqN5aW/hL6dhamQoBU4yTi17j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
43472
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\crysis\Release\PDB\payload.pdb
kernel32
GetProcAddress
LoadLibraryA
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLastError
EnterCriticalSection
ReleaseMutex
CloseHandle
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=1, productName=Unmarked objects,
count=11, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
37d8add251cb4179224ebbc0e28f8d9e26b5e64bbaec37f26a996bf51556f04c.exe
- IMPHASH 02ed3575b7f1b355edc24642727fb2e7
- SHA256 37d8add251cb4179224ebbc0e28f8d9e26b5e64bbaec37f26a996bf51556f04c
- MD5 af24c3030002d1487c6455fdb1a09eec
- SHA1 72732ddefce71c13297df596267260a5d8e892f3
- SHA512 470a0cf695add143555eaa45f3fe5c462edb1cea2cd1589b19f55029b488fae58da2bd588bf79cdb16eeb4518bc7b7189eba764d611d008b1b27145ca0e8a2e3
- SSDEEP 24576:Auh7HYGSWwFda6lBbXUqcTGKcr5YrcRBlBnNmkE9pneHiAvuQnL1mp/DVmu6KUi0:Dhkkw7LNNmTDqnRmJDx61i0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
695074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Legion\source\repos\last project\Release\curl.pdb
ws2_32
recv
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
closesocket
normaliz
IdnToAscii
wldap32
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord301
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord200
ord22
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
kernel32
HeapFree
HeapAlloc
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
GetCommandLineW
GetCommandLineA
WriteFile
GetModuleFileNameA
GetDateFormatW
SetFilePointerEx
GetModuleHandleExW
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
RaiseException
RtlUnwind
WaitForSingleObject
LoadLibraryW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetExitCodeProcess
CreateProcessA
SetStdHandle
GetTimeZoneInformation
HeapReAlloc
HeapSize
FindFirstFileExA
IsValidCodePage
FindNextFileA
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
SetEndOfFile
ExitProcess
CreateFileW
GetLogicalDrives
FindFirstFileW
Process32First
FindNextFileW
TerminateProcess
GetDriveTypeA
FindClose
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CloseHandle
FreeConsole
lstrcmpW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetLastError
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SetLastError
FormatMessageA
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
GetCurrentThread
GetThreadTimes
UnregisterWaitEx
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindFirstFileExW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetModuleHandleW
CreateDirectoryExW
CopyFileW
MoveFileExW
FormatMessageW
GetStringTypeW
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
Name
.text
Size
981KB
Virtual Size
981KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
231KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=241, version=40116,
count=186, id=243, version=40116,
count=31, id=242, version=40116,
count=6, id=199, version=41118,
count=26, id=259, version=26706,
count=134, id=261, version=26706,
count=37, id=260, version=26706,
count=45, id=261, productName=VS2019 v16.0.0 build 27508, version=27508,
count=255, id=1, productName=Unmarked objects,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=260, productName=VS2019 v16.0.0 build 27508, version=27508,
count=1, id=265, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
3a7265305386f955adbeb6bd7c711f03395963ac36be82e5bb6b1d7b2034c859.exe
- SHA256 3a7265305386f955adbeb6bd7c711f03395963ac36be82e5bb6b1d7b2034c859
- MD5 e3269531cf93d040b08074bfb31b72a0
- SHA1 45b6d89dcea02cc90ae054d72ec80a2eb1036a7e
- SHA512 e4de5613557ff15f23e2c28763fee6443c81351401974389e1c01cb979efc81c0ff397b85ba3fc6f0204f7c5e0c7617617130d38b441748446e72a0fbb7a12b0
- SSDEEP 1536:NE+VYVYMC2F7Aoter2j1lYgpM2HT02F4mHI5PsOqy:2+G3eaj0g+2HT025Hs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
87024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
33KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 a6fbf55fafcf68634bfc24149e0626ee1d8ca9c0e587850d8382436c6abfed9d
- MD5 b976d86caac14a71b0326e4da3accced
- SHA1 40fcfb07f10a62964ddfe502a9c04c8ebc710ab9
- SHA512 433d260508326bf4d33a30ce1186bd81c0d6d422f8ddc90f647109714414f89a6230be28d7522a01cc30150b78863bc050119350c48981a83336307ab0c5bfff
- SSDEEP 768:YDjahoICS4AIiaVRShxdEe+T0iN2QwdincJ9JGEKvr1Bg2QpXeCggfV:6zICS4AT6GxdEe+TOdincJXvKvQZg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
59605
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 49aca08f5b259860364fc224601a944aa17161bb1da688e24621038457472d24
- MD5 7977bc8781a00875b4d465bc2a90d5d4
- SHA1 9f4b2858edcff694fee76636bf8cf33a366fc237
- SHA512 245d65b9301b759097cded2a2f078e4e41c7b68e303a71fccd465a6fa230b48e13e571c4e57e03710934a5e6b9536ed634e0edc502ba35433b02147760e5f05b
- SSDEEP 768:0AxEin+Z8W9KCZLhaY4m9lUOmMayPpfHlynRUhMgAA9dEmCJ:7xESW9KC1hxJ9lJPQLH
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4a2ad49c934f9ae6ca6b5d0c7cc34f5e12d349640012fa8cf8eb7e2d3acd6c9f.exe
- IMPHASH ae80b4ecb14ba8e602aaba0e2180c87d
- SHA256 4a2ad49c934f9ae6ca6b5d0c7cc34f5e12d349640012fa8cf8eb7e2d3acd6c9f
- MD5 4f85eec9e23dc664c814cea272dcd5b8
- SHA1 4eda594a01aee9622604924ffecfa9dbd6135bc0
- SHA512 97fdf815bb43f7fbfff03b6ca9e7a94d72a17faa0667091951b0be2a1ea3757f6f051e16c9a583f808b5df3fcbea525c570729b120499d1a47c530c7f179db18
- SSDEEP 12288:6s2cBCtdB3+j+3EEQ5NX2l0Y/iaJDdI+VrzrzzczNzzE:6s2Jtn3aOEN5NX2l0Y/iaJDn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
16069
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
crypt32
CryptBinaryToStringA
CryptImportPublicKeyInfo
CryptStringToBinaryA
CryptDecodeObjectEx
wininet
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
InternetOpenA
HttpSendRequestA
shlwapi
PathRemoveExtensionW
StrCmpNIA
StrToIntA
StrChrA
StrToInt64ExA
StrSpnA
PathFindFileNameW
StrStrIA
StrCmpNW
StrChrIA
StrCpyNW
PathMatchSpecW
StrCmpNIW
StrPBrkA
PathCombineW
PathSkipRootW
StrStrIW
PathUnquoteSpacesW
StrChrW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoA
mpr
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
imagehlp
CheckSumMappedFile
ws2_32
htons
sendto
socket
WSAStartup
inet_ntoa
inet_addr
htonl
shutdown
closesocket
gethostbyname
kernel32
WaitForSingleObject
SetEvent
OutputDebugStringW
SetFileTime
WriteFile
InitializeCriticalSection
Sleep
LeaveCriticalSection
GetTimeFormatW
GetFileAttributesW
FileTimeToSystemTime
ReadFile
GetFileSizeEx
MoveFileW
EnterCriticalSection
CreateEventW
SizeofResource
GetFileTime
DeleteCriticalSection
CloseHandle
FileTimeToLocalFileTime
lstrcpyW
CreateThread
LoadResource
FindResourceW
FreeResource
LocalFree
ExitProcess
lstrcpynA
MultiByteToWideChar
GetTempFileNameW
GetFileSize
MapViewOfFile
UnmapViewOfFile
FreeLibrary
CreateProcessW
LoadLibraryExW
LoadLibraryW
CopyFileW
ReadProcessMemory
GetSystemWow64DirectoryW
lstrcpynW
TerminateProcess
FlushInstructionCache
SetFilePointerEx
GetTempPathW
VirtualAllocEx
CreateFileMappingW
OpenEventW
WinExec
GetWindowsDirectoryW
DeleteFileW
WriteProcessMemory
ResumeThread
FindFirstFileW
GetModuleFileNameW
FindClose
SetFileAttributesW
WideCharToMultiByte
CreateMutexW
GetCurrentProcess
GetCurrentThreadId
SetFilePointer
SetThreadPriority
WaitForMultipleObjects
SetCurrentDirectoryW
OutputDebugStringA
SetProcessShutdownParameters
GetFileAttributesA
lstrlenA
SearchPathW
lstrcpyA
GetEnvironmentVariableW
IsBadWritePtr
TlsAlloc
GetVersionExW
lstrcmpiA
GetTickCount
GetModuleFileNameA
GetDateFormatW
GetProcAddress
lstrlenW
lstrcatW
MulDiv
GetSystemDirectoryW
CreateToolhelp32Snapshot
LockResource
SetErrorMode
GetSystemWindowsDirectoryW
GetModuleHandleW
GetVolumeInformationW
GetLastError
OpenMutexW
VirtualProtect
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
VirtualAlloc
GetModuleHandleA
QueryDosDeviceW
FindNextFileW
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
GetComputerNameA
lstrcmpiW
ExpandEnvironmentStringsW
CreateDirectoryW
Process32NextW
GetSystemInfo
OpenProcess
GetCurrentThread
IsBadStringPtrA
GetHandleInformation
IsBadCodePtr
IsBadStringPtrW
RtlUnwind
CreateFileW
FlushFileBuffers
Process32FirstW
IsBadReadPtr
advapi32
RegOpenKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetKernelObjectSecurity
LookupPrivilegeValueW
CreateWellKnownSid
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
DuplicateToken
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
GetLengthSid
RegSetValueExW
RegFlushKey
RegOpenKeyW
AdjustTokenPrivileges
RegCreateKeyExW
RegEnumValueW
RegEnumKeyW
CryptDestroyKey
CryptAcquireContextW
CryptGetKeyParam
RegDeleteValueW
CryptEncrypt
RegQueryValueExW
user32
wsprintfW
DispatchMessageW
DefWindowProcW
RegisterClassW
CreateWindowExW
PeekMessageW
TranslateMessage
wsprintfA
CharLowerBuffA
GetSystemMetrics
GetKeyboardLayoutList
ReleaseDC
SystemParametersInfoW
GetDC
DrawTextA
FillRect
GetLastInputInfo
RegisterClassExW
UnregisterClassW
GetForegroundWindow
ole32
CoCreateInstance
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoUninitialize
shell32
ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHChangeNotify
ntdll
ZwOpenSection
RtlFreeUnicodeString
NtDeleteFile
isspace
RtlDosPathNameToNtPathName_U
memmove
ZwOpenProcess
ZwClose
ZwOpenDirectoryObject
ZwQuerySystemInformation
_chkstk
ZwQueryInformationProcess
_allmul
memcpy
_alldiv
memset
_aulldvrm
NtQueryVirtualMemory
oleaut32
SysAllocString
SysFreeString
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject
netapi32
NetUserEnum
NetUserGetInfo
NetApiBufferFree
Name
.text
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=396, id=1, productName=Unmarked objects,
count=83, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
5199b64b50f678d75f85cb0c3ac97d7df67f23471815e21236b1a790d008fe3c.exe
- SHA256 5199b64b50f678d75f85cb0c3ac97d7df67f23471815e21236b1a790d008fe3c
- MD5 1f6297e052951ae79aaec997dbb202d4
- SHA1 ab27665f5b886bf553b2c9a91c65e2abca5c1d01
- SHA512 4cf533b824503cd1783f583c9f100e67f84578afac31b7b2b1c23192f4504d457ae7f522d53c40b62b59daafd5ad92580a9b67baad612f20f74d6712c8e94e00
- SSDEEP 768:/z7z/zxACAm8YHxxSoxS1RKRQGdGGdnQN4L6hhho9h9qfP821824x:/zp8dGdGGde4L67q9h9qfETXx
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
55c30024aed833336eb4720a1a4a40c78496efb27b3c4d5c3f1d1b5935c12715.exe
- IMPHASH 851a0ba8fbb71710075bdfe6dcef92eb
- SHA256 55c30024aed833336eb4720a1a4a40c78496efb27b3c4d5c3f1d1b5935c12715
- MD5 4ab785bba778bd582b33baeac2cc9c22
- SHA1 23db0ae4d5b7b4fe8698583e25e50e1b89cf9411
- SHA512 916cc0d2e0e623a897d4d515e2148c0b08dd3c308b27b53032def045eafbd625ac2031fd5713e055f4f323a840ed534aaaa5da06586928cc2dbafb46cb276955
- SSDEEP 1536:bNeRBl5PT/rx1mzwRMSTdLpJyCfPAIotcQ:bQRrmzwR5JyNO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpr
WNetEnumResourceW
WNetUseConnectionW
WNetOpenEnumW
WNetCloseEnum
ws2_32
ioctlsocket
getpeername
ntohl
select
WSAGetLastError
htons
recv
socket
closesocket
getsockopt
WSAAddressToStringW
htonl
connect
iphlpapi
GetIpAddrTable
winhttp
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSendRequest
kernel32
FindClose
FindNextFileW
SystemTimeToFileTime
OpenProcess
FindFirstFileW
MoveFileW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
GetCurrentThreadId
GetLocalTime
ExitProcess
SetFilePointer
WaitForSingleObject
GetComputerNameW
SetEvent
GetLogicalDrives
GetTickCount
Sleep
CopyFileW
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
CreateEventW
WaitForMultipleObjects
CloseHandle
SetFileAttributesW
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResetEvent
DeleteCriticalSection
AllocConsole
WriteFile
WideCharToMultiByte
WriteConsoleW
GetStdHandle
CreateMutexW
CreateProcessW
GetCurrentProcess
SetHandleInformation
HeapFree
GetLocaleInfoW
ReadProcessMemory
TerminateProcess
GetModuleFileNameW
FlushFileBuffers
OpenMutexW
GetLastError
GetProcAddress
Process32FirstW
GetExitCodeThread
CreatePipe
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
ReleaseMutex
GetVersion
DeleteFileW
GetCurrentProcessId
GetVolumeInformationW
ExpandEnvironmentStringsW
HeapAlloc
GetProcessHeap
HeapReAlloc
QueryPerformanceCounter
user32
GetWindowThreadProcessId
GetShellWindow
advapi32
FreeSid
LookupPrivilegeValueW
OpenProcessToken
GetTokenInformation
EqualSid
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
LookupAccountSidW
AllocateAndInitializeSid
DuplicateTokenEx
RegQueryValueExW
shell32
ShellExecuteExW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=18, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
56f7b48f3877743c44aef0f3e990b3387dd6185f1c40a7477f5b6bad64960659.exe
- IMPHASH 364f4eb85abb3fe033aa9cfae7ac6b24
- SHA256 56f7b48f3877743c44aef0f3e990b3387dd6185f1c40a7477f5b6bad64960659
- MD5 abb04a0418be9cc4618f393d7fc9d76b
- SHA1 dbe3b07ab1383e4d693bb6cab17ad8a7c1c5cd7b
- SHA512 f7bce71f01ffae675a8b8a23a8f2e4d162ccefc349beadb84ffcca890dc68ed636acf4f7d694145c779125078f6634f30aed5f5651ee6c12dc4768f7c0a0f47b
- SSDEEP 768:QO1oR/8VS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDsHw67ZY23IWSjNV:QgS1FKnDtkuImsHw6V73ejNV
- MD5 SHA1 SHA512 SSDEEP
-
MAKOP ransomware payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
kernel32
ReadFile
CreateFileW
GetFileSizeEx
MoveFileW
SetFileAttributesW
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
GetVersion
GetProcAddress
LoadLibraryA
GetCurrentProcessId
OpenProcess
SetFilePointerEx
GetModuleHandleA
DuplicateHandle
ExitProcess
GetEnvironmentVariableW
CreateProcessW
CreatePipe
LocalFree
GetCommandLineW
Process32NextW
CreateMutexA
CreateToolhelp32Snapshot
GetLocaleInfoW
GetModuleFileNameW
Process32FirstW
GetSystemWindowsDirectoryW
SetHandleInformation
GetTempPathW
GetTempFileNameW
CreateDirectoryW
WriteFile
Sleep
FindClose
GetLastError
GetFileAttributesW
GetLogicalDrives
WaitForSingleObject
CreateThread
GetVolumeInformationW
SetErrorMode
FindNextFileW
GetDriveTypeW
WaitForMultipleObjects
FindFirstFileW
TerminateProcess
DeleteCriticalSection
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CloseHandle
GetFileType
PeekNamedPipe
user32
wsprintfA
GetShellWindow
wsprintfW
GetWindowThreadProcessId
ReleaseDC
SystemParametersInfoW
DrawTextA
GetDC
gdi32
CreateFontW
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject
SetBkMode
DeleteDC
SetTextColor
GetObjectW
GetDeviceCaps
GetDIBits
advapi32
CryptGenRandom
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
DuplicateTokenEx
OpenProcessToken
SetTokenInformation
GetTokenInformation
CryptDecrypt
CryptDestroyKey
CryptAcquireContextW
CryptSetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
shell32
ord680
CommandLineToArgvW
SHGetSpecialFolderPathW
msimg32
GradientFill
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=125, productName=VS2005 build 50727, version=50727,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=110, id=1, productName=Unmarked objects,
count=17, id=114, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
5a96b929383817aa298eec8cca019bcd984fcd71dd8ee353541392c1082756a4.exe
- IMPHASH 851a0ba8fbb71710075bdfe6dcef92eb
- SHA256 5a96b929383817aa298eec8cca019bcd984fcd71dd8ee353541392c1082756a4
- MD5 a6092621b7db8dc1f2c1f93a9a7ced9f
- SHA1 d4fd035605baa14375c9a59a93849b959df36bc4
- SHA512 380318805a8fbed4b6e4a1270c697116de2b5a562bace4ab857e653dae5b319a5ace3a90c02f3235d6a95eec996a6632335c01df55136f051c13a01b82a5f4a4
- SSDEEP 1536:RNeRBl5PT/rx1mzwRMSTdLpJOycgw04NxJ:RQRrmzwR5Jhcg74L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpr
WNetEnumResourceW
WNetUseConnectionW
WNetOpenEnumW
WNetCloseEnum
ws2_32
ioctlsocket
getpeername
ntohl
select
WSAGetLastError
htons
recv
socket
closesocket
getsockopt
WSAAddressToStringW
htonl
connect
iphlpapi
GetIpAddrTable
winhttp
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSendRequest
kernel32
FindClose
FindNextFileW
SystemTimeToFileTime
OpenProcess
FindFirstFileW
MoveFileW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
GetCurrentThreadId
GetLocalTime
ExitProcess
SetFilePointer
WaitForSingleObject
GetComputerNameW
SetEvent
GetLogicalDrives
GetTickCount
Sleep
CopyFileW
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
CreateEventW
WaitForMultipleObjects
CloseHandle
SetFileAttributesW
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResetEvent
DeleteCriticalSection
AllocConsole
WriteFile
WideCharToMultiByte
WriteConsoleW
GetStdHandle
CreateMutexW
CreateProcessW
GetCurrentProcess
SetHandleInformation
HeapFree
GetLocaleInfoW
ReadProcessMemory
TerminateProcess
GetModuleFileNameW
FlushFileBuffers
OpenMutexW
GetLastError
GetProcAddress
Process32FirstW
GetExitCodeThread
CreatePipe
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
ReleaseMutex
GetVersion
DeleteFileW
GetCurrentProcessId
GetVolumeInformationW
ExpandEnvironmentStringsW
HeapAlloc
GetProcessHeap
HeapReAlloc
QueryPerformanceCounter
user32
GetWindowThreadProcessId
GetShellWindow
advapi32
FreeSid
LookupPrivilegeValueW
OpenProcessToken
GetTokenInformation
EqualSid
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
LookupAccountSidW
AllocateAndInitializeSid
DuplicateTokenEx
RegQueryValueExW
shell32
ShellExecuteExW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=18, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
606b88fce1441e6d83e1fb2ba1b511e4a9e68f7fc01c55b7c53e08fd28f9a0c4.exe
- SHA256 606b88fce1441e6d83e1fb2ba1b511e4a9e68f7fc01c55b7c53e08fd28f9a0c4
- MD5 7c3f60037ac11106ab2994058cc553c9
- SHA1 1a7c827670c46bdc90691605f974e7d7a0941fb1
- SHA512 c1e2e4bde4b1a4a739ba9408b90b4e088cd7a55f1b7595f99154a6aa0ce98ac0543f8f629aece802f21856301bac6e1b0c497eb8ea46fc0f5ba5c0afec04ae45
- SSDEEP 6144:aNkgpZOuI7Am6xeTH2kxEiG68N/xc2iPpz1TumNf/qP+7WzQ9qsNlN:rgXOvIUTVmxUP7lqP+6zL2
- MD5 SHA1 SHA512 SSDEEP
-
ModiLoader Second Stage
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
317180
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
306KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
18KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6bda9faf719bb7a55e822667d909086193d323d8fa06b1a3d62437fcf6a9e24b
- MD5 8f033c07f57f8ce2e62e3a327f423d55
- SHA1 57ac411652d7b1d9accaa8a1af5f4b6a45ef7448
- SHA512 f3712e7d5d55b27a4c20de07cce136e6d58ce62fa146d29b34dece6248e4456139703c50df10cb318346311cfeee0a8449d49163e821744efcde3ecfe8b880df
- SSDEEP 768:zncoLkaCbCq2l52DbnoPV0Yglwlu1y7e7th3BuItxn:QoLkaCb12l0DbCV6Wqyixn
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
71b46e95fba31267475537a338f49ce1cd0bc56c0f15346b05b673051cbe90a8.exe
- IMPHASH 851a0ba8fbb71710075bdfe6dcef92eb
- SHA256 71b46e95fba31267475537a338f49ce1cd0bc56c0f15346b05b673051cbe90a8
- MD5 8f7bc58c754d6fb7bb0b31fe8a5821e3
- SHA1 f2dccd378d7be5e6bddbf133a78369fdc800432b
- SHA512 765be9549ed493432dc4945f1987982254b25308cc3b757ef1eca23b75517adc7ea4fe10f0aaafc35dd021bcba668d9f3a8e5a9e70ffc5e50ddfae3c014f28e3
- SSDEEP 1536:vNeRBl5PT/rx1mzwRMSTdLpJ//OGCDmR+53H:vQRrmzwR5JLCKyX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpr
WNetEnumResourceW
WNetUseConnectionW
WNetOpenEnumW
WNetCloseEnum
ws2_32
ioctlsocket
getpeername
ntohl
select
WSAGetLastError
htons
recv
socket
closesocket
getsockopt
WSAAddressToStringW
htonl
connect
iphlpapi
GetIpAddrTable
winhttp
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSendRequest
kernel32
FindClose
FindNextFileW
SystemTimeToFileTime
OpenProcess
FindFirstFileW
MoveFileW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
GetCurrentThreadId
GetLocalTime
ExitProcess
SetFilePointer
WaitForSingleObject
GetComputerNameW
SetEvent
GetLogicalDrives
GetTickCount
Sleep
CopyFileW
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
CreateEventW
WaitForMultipleObjects
CloseHandle
SetFileAttributesW
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResetEvent
DeleteCriticalSection
AllocConsole
WriteFile
WideCharToMultiByte
WriteConsoleW
GetStdHandle
CreateMutexW
CreateProcessW
GetCurrentProcess
SetHandleInformation
HeapFree
GetLocaleInfoW
ReadProcessMemory
TerminateProcess
GetModuleFileNameW
FlushFileBuffers
OpenMutexW
GetLastError
GetProcAddress
Process32FirstW
GetExitCodeThread
CreatePipe
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
ReleaseMutex
GetVersion
DeleteFileW
GetCurrentProcessId
GetVolumeInformationW
ExpandEnvironmentStringsW
HeapAlloc
GetProcessHeap
HeapReAlloc
QueryPerformanceCounter
user32
GetWindowThreadProcessId
GetShellWindow
advapi32
FreeSid
LookupPrivilegeValueW
OpenProcessToken
GetTokenInformation
EqualSid
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
LookupAccountSidW
AllocateAndInitializeSid
DuplicateTokenEx
RegQueryValueExW
shell32
ShellExecuteExW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=18, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
7d98972d5c78e1d4969da76856d6818942b606c267efa67fd31d39ae77497e9c.exe
- IMPHASH d999d23008cd11044758e92d9fe0a834
- SHA256 7d98972d5c78e1d4969da76856d6818942b606c267efa67fd31d39ae77497e9c
- MD5 ec8fef72a73ff94440235fc1b3f3f690
- SHA1 e651cd12a2493b9c2d7ebd8287a2fd29b8f4cd9c
- SHA512 b62f2f518f4ed3d74d96551a8c7431d50bd3349221b4b01dded18a270cbdbd1441f13f3eef7a6cc0db4aad200f1cf2babeb8e937edf8827faa7a03e4b59a35f2
- SSDEEP 12288:d31hZus7pQqiiyuuFuawu2zhjWBv4+1FMUUfW75CXQKXTZ1VG:1r1S+NjWx4+1SWV6Q4n
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetDriveTypeA
GetLogicalDrives
CreateMutexA
GetCurrentProcessId
ExitProcess
TerminateProcess
OpenProcess
GetModuleFileNameA
Sleep
CopyFileA
GetUserDefaultLangID
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateThread
CreateFileW
GetConsoleCP
GetFullPathNameW
GetFileAttributesA
FindNextFileW
FindFirstFileExW
FindClose
MoveFileA
lstrcmpiA
CloseHandle
WriteFile
SetFilePointerEx
SetEndOfFile
ReadFile
GetFileSizeEx
OpenMutexA
CreateFileA
FlushFileBuffers
ReadConsoleW
GetConsoleMode
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
EncodePointer
GetModuleHandleExW
HeapValidate
GetSystemInfo
GetStdHandle
GetACP
GetStringTypeW
GetCurrentThread
GetFileType
OutputDebugStringA
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
HeapReAlloc
HeapQueryInformation
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
DecodePointer
user32
wsprintfA
advapi32
CryptEncrypt
CryptImportKey
CryptExportKey
CryptSetKeyParam
CryptDestroyKey
CryptGenKey
CryptAcquireContextA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
CryptDecrypt
shell32
ShellExecuteA
shlwapi
PathFindFileNameA
Name
.text
Size
702KB
Virtual Size
701KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
156KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
260B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=24610,
count=145, id=261, version=24610,
count=18, id=260, version=24610,
count=1, id=199, version=41118,
count=19, id=259, version=24723,
count=49, id=261, version=24723,
count=18, id=260, version=24723,
count=11, id=257, version=24610,
count=126, id=1, productName=Unmarked objects,
count=6, id=261, version=25019,
count=1, id=255, version=25019,
count=1, id=258, version=25019,
87b9b910d5d5a053e3b39989cc6fd51601abdaea207a26c765f21f43a4cd4dcb.exe
- IMPHASH 202fa14f574c71c2f95878e40a79322d
- SHA256 87b9b910d5d5a053e3b39989cc6fd51601abdaea207a26c765f21f43a4cd4dcb
- MD5 c8579ccb6690e1f2102f9ba887c12f9e
- SHA1 e8e46e3f88011aa43c90cde3c9945e3508986a25
- SHA512 f579e9b39400a0b3879dc8a1c41bd829d8f6b399d9d0a97302f7157a76f036ede5e4391eeb12bd2285a7f523969d572a92f482cf415ed2fb023d96d745f82244
- SSDEEP 1536:hxpkWBeG/vEbKsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2Xsf8:/BeQsKsrQLOJgY8Zp8LHD4XWaNH71dLH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
44016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
OpenProcess
GetTickCount
GetModuleHandleA
GetProcAddress
LoadLibraryA
lstrcmpW
lstrlenW
SetVolumeMountPointW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
lstrlenA
GetCommandLineW
FindClose
FindFirstFileW
FindNextFileW
GetFileSizeEx
GetCurrentProcess
ReadFile
SetFileAttributesW
SetFilePointerEx
WaitForSingleObject
CreateMutexA
WaitForMultipleObjects
GetCurrentProcessId
ExitProcess
CreateThread
ExitThread
SetProcessShutdownParameters
GetSystemInfo
lstrcmpiW
lstrcpyW
lstrcatW
OpenMutexA
MoveFileExW
WideCharToMultiByte
HeapAlloc
HeapFree
GetProcessHeap
ReleaseSemaphore
CreateSemaphoreA
TerminateProcess
Sleep
GetLastError
CloseHandle
GetVolumePathNamesForVolumeNameW
GetDriveTypeW
FindVolumeClose
FindNextVolumeW
GetLogicalDrives
FindFirstVolumeW
user32
wsprintfA
advapi32
QueryServiceStatusEx
OpenSCManagerA
EnumDependentServicesA
ControlService
CloseServiceHandle
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
OpenServiceA
shell32
SHEmptyRecycleBinA
CommandLineToArgvW
ShellExecuteW
netapi32
NetShareEnum
NetApiBufferFree
rstrtmgr
RmGetList
RmStartSession
RmEndSession
RmRegisterResources
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
WNetGetConnectionW
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.CRT
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=30034,
count=15, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=10, id=261, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=258, productName=VS2019 v16.11.9 build 30139, version=30139,
8958d7b8c51215d6a27444b2760f1ce843a414d380052e6e71c2af6e9ab69ce2.exe
- IMPHASH 216df81b1ef7bc2aa8ec52bbeef137c9
- SHA256 8958d7b8c51215d6a27444b2760f1ce843a414d380052e6e71c2af6e9ab69ce2
- MD5 734f101d7a5822e1bf2c66e398ab8c45
- SHA1 cafb5d0e3db6804693e8461b32abf678e8c70f3d
- SHA512 63cf6ae43a26ce38c062ec69bbc084ba3e8777d3f6f574e6a0a09242cacb46989d01c1dcb32943692c47361f8d6fb8e5009a4cc917a80ffa567cb2a853f1a2fb
- SSDEEP 24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpd2F:Ujrc2So1Ff+B3k796Q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
786320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathAppendW
activeds
ord9
ord15
kernel32
CreateProcessW
GetSystemTime
lstrlenW
LocalFree
advapi32
CheckTokenMembership
CreateWellKnownSid
ole32
CoCreateInstance
CoSetProxyBlanket
Name
.text
Size
896KB
Virtual Size
895KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
62KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
470B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26126,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=1, productName=Unmarked objects,
count=8, productName=Unmarked objects (old),
count=60, id=265, version=27043,
count=7, id=259, version=27043,
count=1, id=258, version=27043,
ab5be9e6911b43f0974e01dabec772b968274d9b5ea39ba2ad7cd294056e5d09.exe
- IMPHASH 87bed5a7cba00c7e1f4015f1bdae2183
- SHA256 ab5be9e6911b43f0974e01dabec772b968274d9b5ea39ba2ad7cd294056e5d09
- MD5 56299609780e2286ccc2cf5857d531e8
- SHA1 ef7baf17905784df491641906645f00f73eff1d1
- SHA512 a44053d0c810448adddcd17e51682e43d51710de948644c82a141a1a8104cacedd44a274f13ea79de89f5cdfbb0e436791565baad1552d9853a5a94b446398cb
- SSDEEP 1536:7vie0XQsxILOW3Sm9S4AndhgXCpC1VYEzcM5BD11e0z:OeBsxInSNnhgX4CzwM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
41056
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\crysis\Release\PDB\payload.pdb
kernel32
LoadLibraryA
GetProcAddress
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=1, productName=Unmarked objects,
count=11, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
b228a698ee826b42e19307f2d34c2620819a67a0e98fd2af08aae570b8178cc0.exe
- IMPHASH 2bb3003ccae03cc3071abb5c44555c92
- SHA256 b228a698ee826b42e19307f2d34c2620819a67a0e98fd2af08aae570b8178cc0
- MD5 1f31e5377d64f9f26c12f3b7a5545c16
- SHA1 b54fdfadaa8c9eec27f2f48e462bde898383f0ba
- SHA512 ff6d85ed6be933d5c90dc8a2554cdc69eeb00f1dbc20a6016ec4813feb9310eab25e93071f93f1d65f1f7453f65d5a830e8e7ff9b1d0846fe969b55a2a340129
- SSDEEP 768:5PuzmZ5OzkfCQxmGgV5YlpJ6RIDWeRdppvO/9rjca9zsUKh51zb2Z:5PEz5Qxd6m3WIw9oh5B2Z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrlenA
SetFilePointerEx
WriteFile
WideCharToMultiByte
ReadFile
CreateFileW
GetFileSizeEx
GetLastError
ExitProcess
GetEnvironmentVariableW
GetTempFileNameW
FindFirstFileW
SetFilePointer
lstrcpynA
CreateProcessW
MoveFileExW
GetLogicalDrives
lstrcpyA
GetDriveTypeA
Sleep
CopyFileW
GetFileAttributesW
GetModuleFileNameW
MultiByteToWideChar
GetStdHandle
lstrcmpiA
FindClose
lstrcmpiW
lstrcatW
FindNextFileW
CompareStringA
lstrcpyW
SetFileAttributesW
HeapFree
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
lstrlenW
lstrcatA
CreateProcessA
HeapCreate
GetProcessHeap
HeapAlloc
GetCommandLineA
user32
wsprintfA
advapi32
RegCloseKey
GetCurrentHwProfileW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
ole32
CoCreateGuid
StringFromGUID2
shlwapi
PathRemoveFileSpecW
StrStrA
PathFindFileNameW
Name
odyqxub
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=8, id=110, productName=VS2005 build 50727, version=50727,
count=4, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=1, productName=Unmarked objects,
count=21, id=228, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
c864a70f78fb972f505ae5b13c0ad984e64c547194beb258926bb4c323fac31d.exe
- IMPHASH 2bb3003ccae03cc3071abb5c44555c92
- SHA256 c864a70f78fb972f505ae5b13c0ad984e64c547194beb258926bb4c323fac31d
- MD5 5854152baa338613d80ee24af054cfbe
- SHA1 2f779048a40cb601af32fe70188c9d3e53e71efe
- SHA512 55572a3e99a5ee08dd1319ad565584a4d6680a0aaf50819228c6ec7ab0b6a509dba25de539213e9f3b5bb6e3720344db4d26e52f0fe08c028511f9830f552b18
- SSDEEP 768:RVel5lzkfCQxmGgV5YlpJ6RIDWeRdppvO/9rjca9fsUKhnLZbp:Rcz5Qxd6m3WIw9EhX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10402
Magic Number
267
Subsystem
MAGE_SUBSYSTEM_UNKNOWN
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrlenA
SetFilePointerEx
WriteFile
WideCharToMultiByte
ReadFile
CreateFileW
GetFileSizeEx
GetLastError
ExitProcess
GetEnvironmentVariableW
GetTempFileNameW
FindFirstFileW
SetFilePointer
lstrcpynA
CreateProcessW
MoveFileExW
GetLogicalDrives
lstrcpyA
GetDriveTypeA
Sleep
CopyFileW
GetFileAttributesW
GetModuleFileNameW
MultiByteToWideChar
GetStdHandle
lstrcmpiA
FindClose
lstrcmpiW
lstrcatW
FindNextFileW
CompareStringA
lstrcpyW
SetFileAttributesW
HeapFree
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
lstrlenW
lstrcatA
CreateProcessA
HeapCreate
GetProcessHeap
HeapAlloc
GetCommandLineA
user32
wsprintfA
advapi32
RegCloseKey
GetCurrentHwProfileW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
ole32
CoCreateGuid
StringFromGUID2
shlwapi
PathRemoveFileSpecW
StrStrA
PathFindFileNameW
Name
.rdata
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=8, id=110, productName=VS2005 build 50727, version=50727,
count=4, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=1, productName=Unmarked objects,
count=21, id=228, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
cfd5d9a4e67799f2428c6071dcc13fcf726f49ec3e706f0302b4592a3a0a08f0.exe
- IMPHASH 2bb3003ccae03cc3071abb5c44555c92
- SHA256 cfd5d9a4e67799f2428c6071dcc13fcf726f49ec3e706f0302b4592a3a0a08f0
- MD5 5de719d56f38039bb9c915d689a5a4da
- SHA1 f46d4ed9851b0980d5a9139defd456a58c6aaaaa
- SHA512 48756ac79f23cb26620ff135fe93a87768cf9a02b941ade68e3e27981adc8431f76d58aa057525de88742c7ec900b4ea02c52abb3889cd176a3ae14e956dc678
- SSDEEP 768:oY53/zkfCQxmGgV5YlpJ6RIDWeRdppvO/9rjca9nsUKhK:B/z5Qxd6m3WIw9MhK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10402
Magic Number
267
Subsystem
MAGE_SUBSYSTEM_UNKNOWN
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrlenA
SetFilePointerEx
WriteFile
WideCharToMultiByte
ReadFile
CreateFileW
GetFileSizeEx
GetLastError
ExitProcess
GetEnvironmentVariableW
GetTempFileNameW
FindFirstFileW
SetFilePointer
lstrcpynA
CreateProcessW
MoveFileExW
GetLogicalDrives
lstrcpyA
GetDriveTypeA
Sleep
CopyFileW
GetFileAttributesW
GetModuleFileNameW
MultiByteToWideChar
GetStdHandle
lstrcmpiA
FindClose
lstrcmpiW
lstrcatW
FindNextFileW
CompareStringA
lstrcpyW
SetFileAttributesW
HeapFree
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
lstrlenW
lstrcatA
CreateProcessA
HeapCreate
GetProcessHeap
HeapAlloc
GetCommandLineA
user32
wsprintfA
advapi32
RegCloseKey
GetCurrentHwProfileW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
ole32
CoCreateGuid
StringFromGUID2
shlwapi
PathRemoveFileSpecW
StrStrA
PathFindFileNameW
Name
.rdata
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=8, id=110, productName=VS2005 build 50727, version=50727,
count=4, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=1, productName=Unmarked objects,
count=21, id=228, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
da6f543313480695aab95a5e685741a8d185fba0600363f74063eb1cda0f672e.exe
- SHA256 da6f543313480695aab95a5e685741a8d185fba0600363f74063eb1cda0f672e
- MD5 bca754bd6e7b4c7b23e17d0244e425d0
- SHA1 257cef8651509e1e33d95b07d5a7b07fcf1f6f4f
- SHA512 02cab68478ad9b3c14336d2178a642d27b7ca3af6beb9ecfbddd8f6c5641164d0728df9821e5c59385831cb63178e7837670f779b81a66e079ada5cb66eac7d4
- SSDEEP 3072:xd5BJOoMqqDL2/OvvdHv3uqz3++OAYWgO:xdJODqqDL6gvdHveqi+GWgO
- MD5 SHA1 SHA512 SSDEEP
-
GandCrab payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
19232
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
_ReflectiveLoader@0
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=223, version=20806,
count=2, id=224, version=20806,
count=2, id=224, productName=VS2013 build 21005, version=21005,
count=1, productName=Unmarked objects (old),
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=134, id=1, productName=Unmarked objects,
count=20, id=229, version=21005,
count=1, id=220, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
e05323d9ca6df47d9add5b2f757ea2490ebd11dfe1b56b82a9e93ba9d814e162.exe
- IMPHASH f2446e70194057c6d86e5807958fb117
- SHA256 e05323d9ca6df47d9add5b2f757ea2490ebd11dfe1b56b82a9e93ba9d814e162
- MD5 ed9150c61fd66757f5dc1357c1384617
- SHA1 220466f711e96f202c107d4ed05ffe837c1099a3
- SHA512 4690335470be0512010db4b4ffde42043602fdff9587ecc930fbbcec694bf934e7c140ccdec4e8c7aa3d1aff97940ee4c75ba27a71ee29a3c3fc5cf873154fd4
- SSDEEP 3072:Jquj3THroBGHnTKslI0rjxHTgLcbE/6i6e1eXC/T9CJg29LV4q9/:B3THkBGHTKLMtHTd4/UbXUT9X2rP9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
108940
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ntdll
NtSetInformationFile
RtlUnwind
NtQueryInformationFile
NtWriteFile
NtCreateFile
NtReadFile
NtClose
RtlDosPathNameToNtPathName_U
RtlFreeHeap
shlwapi
wvnsprintfA
PathCombineW
wininet
InternetSetOptionW
InternetQueryOptionW
InternetQueryDataAvailable
InternetCloseHandle
HttpOpenRequestW
HttpQueryInfoW
InternetOpenW
HttpSendRequestW
InternetConnectW
InternetReadFile
InternetCrackUrlW
mapi32
ord11
ord23
ord21
kernel32
ExitProcess
LCMapStringW
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
WideCharToMultiByte
WriteFile
FreeEnvironmentStringsW
GetCPInfo
SetLastError
TlsFree
TlsSetValue
MultiByteToWideChar
OutputDebugStringA
GetCurrentProcess
GetTickCount
GetCurrentThread
GetProcessHeap
GetProcessTimes
GetCurrentThreadId
GetCurrentProcessId
GetThreadTimes
LoadLibraryW
Sleep
GetProcAddress
GetFileSize
FindFirstFileW
ReadFile
CreateFileW
FindNextFileW
CloseHandle
LocalFree
HeapReAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
InterlockedCompareExchange
HeapCreate
HeapSize
GetDriveTypeW
GetLogicalDriveStringsW
GetLongPathNameW
ExpandEnvironmentStringsW
GetModuleHandleW
SetUnhandledExceptionFilter
SetEndOfFile
MoveFileExW
CreateDirectoryW
FindFirstFileExW
GetEnvironmentStringsW
GetFileAttributesW
GetLastError
FindClose
DeleteFileW
SetFileAttributesW
GetNativeSystemInfo
GetComputerNameW
GetSystemTimeAsFileTime
GetVersionExW
CreateProcessW
TerminateProcess
GetModuleFileNameW
GetWindowsDirectoryW
CreateThread
CreateMutexW
SetEvent
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
WriteConsoleW
CreateEventW
WaitForMultipleObjects
DeleteCriticalSection
TlsGetValue
TlsAlloc
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
DecodePointer
EncodePointer
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
QueryPerformanceCounter
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeW
IsProcessorFeaturePresent
FlushFileBuffers
SetStdHandle
CopyFileW
user32
DefWindowProcW
UpdateWindow
GetSystemMetrics
CreateWindowExW
ShowWindow
RegisterClassExW
TranslateMessage
SetForegroundWindow
PostQuitMessage
GetMessageW
DispatchMessageW
GetClientRect
GetWindowLongW
SetWindowLongW
GetFocus
GetCapture
GetKBCodePage
GetForegroundWindow
GetDesktopWindow
GetActiveWindow
GetClipboardOwner
GetShellWindow
GetOpenClipboardWindow
advapi32
RegEnumValueW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegFlushKey
RegCreateKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
RegSetValueExW
RegDeleteValueW
shell32
SHGetFolderPathW
ShellExecuteW
ole32
CoGetClassObject
OleInitialize
OleSetContainedObject
oleaut32
VariantInit
SafeArrayAccessData
VariantClear
SysAllocString
SafeArrayDestroy
SafeArrayCreate
__local_entry@4
__remote_entry@0
Name
.text
Size
137KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=100, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=216, id=1, productName=Unmarked objects,
count=295, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
e48bd2f16b53a3630f3fca69d0d236d15bc23b08754d980bd29b15841b0fdf14.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e48bd2f16b53a3630f3fca69d0d236d15bc23b08754d980bd29b15841b0fdf14
- MD5 9b02b542834573f9502ca83719a73a01
- SHA1 f3bc7cf16eec977772455f3fce87fed505fb18e3
- SHA512 290c7a5bfc921817d1803ddbe8dd07210301082498945bcabdb597368f92c6fc1050cefec514e6d250571cb4afd6427d8e4ab7cd15d7a46a44cb088cd4d1b031
- SSDEEP 3072:Eoy7AHYqr9ACDYVbu4sijUtSWnFA22WnVaxs2gzx+IjBz2:0mr9AHVycjUgWnFAGms2gzoch
- MD5 SHA1 SHA512 SSDEEP
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
145950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
135KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d
- MD5 ba9210de03de945901f02792f7994871
- SHA1 20c4569cbb6f2650b02f6a5257faa8a8dfb298bd
- SHA512 277d26eea627b3da26664aaa4f72a7b79cd50311e45c59333563b4f58b76e6562cbaa1d55127c69d0830864721efa890fa824e1be381cca5e84bddc98f2b44d0
- SSDEEP 1536:EJJRZQJes5b0k5bbyu6hXOKJrkH6sNNW:oJRa4kLmNVOKJIasNE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
58446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f08c1c26d375f6881990756e39208017b02af75fca0ebddb72f5e5c14e20363f.exe
- IMPHASH 8735e6cad23590d9b5b60978db488a28
- SHA256 f08c1c26d375f6881990756e39208017b02af75fca0ebddb72f5e5c14e20363f
- MD5 4784fae86332064057d0ab8b73a1b67e
- SHA1 f38b61a64119b8b1c2562ca8a6416a2b0c7528b8
- SHA512 62312d637d0feda0f565841274ecff5f07cfada08d7a899d68deb314f52d9d5e64733ba6a8fae7b979625b0302e9f270419cf1801239cf597c5af19b47aaf686
- SSDEEP 1536:1ZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:kd5BJHMqqDL2/Ovvdr
- MD5 SHA1 SHA512 SSDEEP
-
GandCrab payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
19232
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ReadFile
SetFilePointer
GetFileAttributesW
GetLastError
MoveFileW
lstrcpyW
SetFileAttributesW
CreateMutexW
GetDriveTypeW
VerSetConditionMask
WaitForSingleObject
GetTickCount
InitializeCriticalSection
OpenProcess
GetSystemDirectoryW
TerminateThread
Sleep
TerminateProcess
VerifyVersionInfoW
WaitForMultipleObjects
DeleteCriticalSection
ExpandEnvironmentStringsW
lstrlenW
SetHandleInformation
lstrcatA
MultiByteToWideChar
CreatePipe
lstrcmpiA
Process32NextW
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
FindFirstFileW
lstrcmpW
FindClose
FindNextFileW
GetNativeSystemInfo
GetComputerNameW
GetDiskFreeSpaceW
GetWindowsDirectoryW
GetVolumeInformationW
LoadLibraryA
lstrcmpiW
VirtualFree
CreateThread
CloseHandle
lstrcatW
CreateFileMappingW
ExitThread
CreateFileW
GetModuleFileNameW
WriteFile
GetModuleHandleW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetEnvironmentVariableW
lstrcpyA
GetModuleHandleA
VirtualAlloc
GetProcAddress
Process32FirstW
GetTempPathW
GetProcessHeap
HeapFree
HeapAlloc
lstrlenA
CreateProcessW
ExitProcess
IsProcessorFeaturePresent
user32
BeginPaint
wsprintfW
TranslateMessage
LoadCursorW
LoadIconW
MessageBoxA
GetMessageW
EndPaint
DestroyWindow
RegisterClassExW
ShowWindow
CreateWindowExW
SendMessageW
DispatchMessageW
DefWindowProcW
UpdateWindow
wsprintfA
GetForegroundWindow
SetWindowLongW
gdi32
TextOutW
advapi32
FreeSid
RegSetValueExW
RegCreateKeyExW
RegCloseKey
CryptExportKey
CryptAcquireContextW
CryptGetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptGenKey
CryptDestroyKey
GetUserNameW
RegQueryValueExW
RegOpenKeyExW
AllocateAndInitializeSid
shell32
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
crypt32
CryptStringToBinaryA
CryptBinaryToStringA
wininet
InternetCloseHandle
HttpAddRequestHeadersW
HttpSendRequestW
InternetConnectW
HttpOpenRequestW
InternetOpenW
InternetReadFile
psapi
EnumDeviceDrivers
GetDeviceDriverBaseNameW
_ReflectiveLoader@0
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=223, version=20806,
count=2, id=224, version=20806,
count=2, id=224, productName=VS2013 build 21005, version=21005,
count=1, productName=Unmarked objects (old),
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=134, id=1, productName=Unmarked objects,
count=20, id=229, version=21005,
count=1, id=220, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f
- MD5 406cf11bdb84c3eae3e61f66ea596a46
- SHA1 b6acd4fd42b3dca2c2cb75faf48025c2f4880184
- SHA512 c34a97b5d2854d862ca165136269302cda613833d83b8c9ec1d72774dd8717b5174a3077b69654435459a94d2d3f1111b9b3973bb3ab35c8826075fca0e126af
- SSDEEP 3072:PhXD6M9my8NbPYOBLujYx5I8XDZW0956w/J+UdSZWa/rnV9Yxcqz3:PhT6+mntYOJ9FR60hd/a/rnV9q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
160430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\ConsoleApp2.pdb
mscoree
_CorExeMain
Name
.text
Size
149KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f7caf7d69cef15d5c3b9983513e4e40edc3a31c5ead4139bc41d1500442a966a.exe
- IMPHASH 41fb8cb2943df6de998b35a9d28668e8
- SHA256 f7caf7d69cef15d5c3b9983513e4e40edc3a31c5ead4139bc41d1500442a966a
- MD5 b7d9639f1f70059d9249516c0d03abc0
- SHA1 0e5e147a78296405fd52008d8dbe30997bb6aa88
- SHA512 ff373e11c67de45cb606b67a9ac107b0e12fcb7b40be609ac38bed2f917b8951479a2f63eb75dceb2c44711e9b1aa75444c2d51ace1b9421d906e69f51c0b6da
- SSDEEP 3072:n6glyuxE4GsUPnliByocWepzSL6OuWnuxWWKoa2d:n6gDBGpvEByocWe0GZ
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
103535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
SetDCBrushColor
SelectPalette
GetTextColor
GetDeviceCaps
CreateSolidBrush
user32
DefWindowProcW
CreateMenu
EndDialog
GetDlgItem
GetKeyNameTextW
GetMessageW
GetWindowTextW
IsDlgButtonChecked
LoadImageW
LoadMenuW
DialogBoxParamW
kernel32
SetLastError
LoadLibraryW
GetTickCount
GetLastError
GetCommandLineW
GetCommandLineA
FreeLibrary
Name
.text
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
fcb68445068ebf4cd526d316622f9aa3e8065f9a9f42e5330f66f5cb160be393.exe
- SHA256 fcb68445068ebf4cd526d316622f9aa3e8065f9a9f42e5330f66f5cb160be393
- MD5 1a5f7a43dd60834fe1395bce342d62dd
- SHA1 89a3709f3ffdbe31d9a01f17cba207cbc2cb5e46
- SHA512 5b75aff679513a9c692143c30023c5075e052d7782174532f28791d90a156338b9c377f9a92af926f5acef57147cb01da10acbb5fdbd94effbb17b4e04ba6caa
- SSDEEP 12288:jRTGcFnqBvJ0vekmSg4Tjh7bA8v7jQVr65uxjjNQUeCij8:jRTG4AvJ0WkmSg4Tjh7bA8v7jQVr60x/
- MD5 SHA1 SHA512 SSDEEP
-
ModiLoader Second Stage
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
378600
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
366KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ