Samples.zip
- SHA256 af8a19443518dd4b892c8080ea61b6d87674c73faf1f8f4061d025eec3999649
Overview
overview
10Static
static
10New folder...la.exe
windows7-x64
4New folder...la.exe
windows10-2004-x64
4MaterialDe...rs.dll
windows7-x64
1MaterialDe...rs.dll
windows10-2004-x64
1MaterialDe...pf.dll
windows7-x64
1MaterialDe...pf.dll
windows10-2004-x64
1Microsoft....re.dll
windows7-x64
1Microsoft....re.dll
windows10-2004-x64
1SharpSteam.dll
windows7-x64
1SharpSteam.dll
windows10-2004-x64
1System.Man...on.dll
windows7-x64
1System.Man...on.dll
windows10-2004-x64
1UWPHook.exe
windows7-x64
3UWPHook.exe
windows10-2004-x64
3VDFParser.dll
windows7-x64
1VDFParser.dll
windows10-2004-x64
1New folder...c.meow
windows7-x64
3New folder...c.meow
windows10-2004-x64
3New folder...er.exe
windows7-x64
7New folder...er.exe
windows10-2004-x64
7New folder...ye.exe
windows7-x64
10New folder...ye.exe
windows10-2004-x64
10New folder/Mantas.exe
windows7-x64
6New folder/Mantas.exe
windows10-2004-x64
6New folder...re.exe
windows7-x64
1New folder...re.exe
windows10-2004-x64
1New folder...AT.exe
windows7-x64
10New folder...AT.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
New folder/AgentTesla.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
New folder/AgentTesla.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
MaterialDesignColors.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
MaterialDesignColors.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
MaterialDesignThemes.Wpf.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
MaterialDesignThemes.Wpf.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Microsoft.Management.Infrastructure.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Microsoft.Management.Infrastructure.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
SharpSteam.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
SharpSteam.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
System.Management.Automation.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
System.Management.Automation.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
UWPHook.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
UWPHook.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
VDFParser.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
VDFParser.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
New folder/Emotet.doc.meow
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
New folder/Emotet.doc.meow
Resource
win10v2004-20250217-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
New folder/FreeYoutubeDownloader.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral20
Sample
New folder/FreeYoutubeDownloader.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral21
Sample
New folder/HawkEye.exe
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral22
Sample
New folder/HawkEye.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral23
Sample
New folder/Mantas.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
New folder/Mantas.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral25
Sample
New folder/Meoware.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
New folder/Meoware.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
New folder/RevengeRAT.exe
Resource
win7-20250207-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral28
Sample
New folder/RevengeRAT.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target Samples.zip
- Size 3.4MB
- Sample250303-han3fazry7
- SHA256 af8a19443518dd4b892c8080ea61b6d87674c73faf1f8f4061d025eec3999649
- MD5 7c7df277d04b8fd41501a3679c5e5fac
- SHA1 638cafa51d2feb43dea3533f9fa9c74926e27fa9
- SHA512 3a11eb6109128ee1d402e26ff98de822f8e76a5286c19da18b6481af00849c0a94004b41595d4330d5dff8a65e9316dd02b3da2ba16fa43c8f0785caff968bb2
- SSDEEP 98304:tjpLX5eripJhpQwa3GNkPXPFgYK82sTrPtcBNtY:tjNX5etEuKYR2cr1QNK
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
revengerat
Botnet
-
Guest
C2
-
0.tcp.ngrok.io:19521
Mutex
-
RV_MUTEX
Signatures
- RevengeRat Executable 1 IoCs
resource yara_rule static1/unpack001/New folder/RevengeRAT.exe.meow revengerat - Revengerat family
-
resource yara_rule static1/unpack001/New folder/Mantas.exe.meow upx - Unsigned PE 14 IoCs
Checks for missing Authenticode signature.
resource unpack001/New folder/AgentTesla.exe.meow unpack002/MaterialDesignColors.dll unpack002/MaterialDesignThemes.Wpf.dll unpack002/Microsoft.Management.Infrastructure.dll unpack002/SharpSteam.dll unpack002/System.Management.Automation.dll unpack002/UWPHook.exe unpack002/VDFParser.dll unpack001/New folder/FreeYoutubeDownloader.exe.meow unpack001/New folder/HawkEye.exe.meow unpack001/New folder/Mantas.exe.meow unpack003/out.upx unpack001/New folder/Meoware.exe.meow unpack001/New folder/RevengeRAT.exe.meow
File Explorer
-
Samples.zip.zip 3.4MB
-
New folder/AgentTesla.exe.meow.exe 2.8MB
-
MaterialDesignColors.dll.dll 292KB
-
MaterialDesignThemes.Wpf.dll.dll 7.1MB
-
MaterialDesignThemes.Wpf.xml.xml 91KB
-
Microsoft.Management.Infrastructure.dll.dll 36KB
-
SharpSteam.dll.dll 5KB
-
System.Management.Automation.dll.dll 352KB
-
System.Management.Automation.xml.xml 6.8MB
-
UWPHook.exe.exe 831KB
-
UWPHook.exe.config.xml 1KB
-
VDFParser.dll.dll 15KB
-
New folder/Emotet.doc.meow.meow .docm 139KB
-
New folder/FreeYoutubeDownloader.exe.meow.exe 396KB
-
New folder/HawkEye.exe.meow.exe 232KB
-
New folder/Mantas.exe.meow.exe 40KB
-
out.upx.exe 64KB
-
New folder/Meoware.exe.meow.exe 244KB
-
New folder/RevengeRAT.exe.meow.exe 4.0MB
New folder/AgentTesla.exe.meow
- IMPHASH 7eae418c7423834ffc3d79b4300bd6fb
- SHA256 18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9
- MD5 cce284cab135d9c0a2a64a7caec09107
- SHA1 e4b8f4b6cab18b9748f83e9fffd275ef5276199e
- SHA512 c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f
- SSDEEP 49152:4HEHIHP6z9goDKncJkYgCB7UODoQvjZMElnp0zGMPokHz5xZtYgxsdexHwNbUMb:ZdRFBmnQ7rjZMYSzGbkHzXxWeu6W
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13252
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
MoveFileW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
lstrcmpW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
ReadFile
MulDiv
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
WritePrivateProfileStringW
FreeLibrary
GetPrivateProfileStringW
GetModuleHandleW
LoadLibraryExW
user32
GetWindowRect
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
ScreenToClient
EnableMenuItem
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
SystemParametersInfoW
EndDialog
RegisterClassW
DialogBoxParamW
CreateWindowExW
GetClassInfoW
DestroyWindow
CharNextW
ExitWindowsEx
SetWindowTextW
LoadImageW
SetTimer
ShowWindow
PostQuitMessage
wsprintfW
SetWindowLongW
FindWindowExW
IsWindow
CreatePopupMenu
AppendMenuW
GetSystemMetrics
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow
gdi32
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
shell32
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFileInfoW
SHFileOperationW
SHBrowseForFolderW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ord17
ImageList_Destroy
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=164, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
MaterialDesignColors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 976eea4567656d536a6344b3834f958f2b9e27401b94c643681770437d5abc68
- MD5 39367419516f5f3df9ab1f9e5d0bbcd5
- SHA1 762c9acdb09bfdf40e700645131999202abbc871
- SHA512 20ea8a64a14579ef5403eae8a6345afa0f9b12229fdb8bc869f7a8cdd4e785093b9f60f9445be738266a161d75f53a8b8e42a69b2f9b4cbf4684f5dbf5113ae9
- SSDEEP 1536:2ZJb/nKyGMbYrE4jKg4J4A+0MDR1TU7fKoVxbYCCMIRFxcE5istk0uWE1Ci4oggj:2DDrYrE6oJU907fKoVxb+Y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
304930
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\MaterialDesignColors.Wpf\obj\Release\net45\MaterialDesignColors.pdb
mscoree
_CorDllMain
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MaterialDesignThemes.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 013a42b8c6ffa29e2198eed4faf6168247b6550a4c4ed5d82023a1d82a08e27e
- MD5 fbd761926164043ac71ee9b83ab37fd1
- SHA1 38d44b0f40fa31124ba139adeb6f7adc7e53ee19
- SHA512 c2a0be2d8b5b98dc19ad167aadc1e68905ad259e3b0e020cfb95a8a816964549c98a9c5bc44b8f4640147bfd8555e799216b8dba13bf0eefed9582782da552d2
- SSDEEP 98304:OXJDntBksKY+ND3WyA4+TLVei10vMzPv8/4C8B5XVS49Xzy83IiEcJMrCR2fShTf:onJ45/9iD54+V11bFv4z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7426462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\MaterialDesignThemes.Wpf\obj\Release\net45\MaterialDesignThemes.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
7.1MB
Virtual Size
7.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MaterialDesignThemes.Wpf.xml
- SHA256 26cc592ac318b8965f07a5dabef211dc5c71c51d83e0136679e075d6a2a17b44
- MD5 2e77f3e2bff6c6f9360de69b43570561
- SHA1 d1454e0d658590f46f578d312b5311c732ee74ac
- SHA512 bdbaf43e137a1a016b3e1c5125acf79a6f7fcf5137969eea69a18b682ed326734d3303fd178c93cd4c4a4779d5fb145aec67356db6000394c2b76065ef069581
- SSDEEP 1536:+wTCzaNeW6efGe3Pe5041CRjaJgk0K5gHlwL1Cf9xibn585Kg1shLJkQnaRp+iyO:+xRnkQBdUd
- MD5 SHA1 SHA512 SSDEEP
Microsoft.Management.Infrastructure.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cbec9a910488cadbad860c850ceae521a2a346619c5a9da579e5051e270f114c
- MD5 3998804194188c25df75f505ac5c531a
- SHA1 6b15b2d779e7c46e31fcc864fc1ef326fb3d2b50
- SHA512 d7cd7457c753190fd1ae5386a62dffbe5907ace02227ef873f4c890f4a4e987914fb94ab1ec8318f48a76fc55cfe8e7de83b75cfcbec0bb8ff0e18d2d956abdc
- SSDEEP 768:droEzop6gC66+666M66666+vvvvvvvvvvvvvF66666K66n6666666666ZpkLEyXD:nNLEyXCL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SharpSteam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 74a89211b2a1bcf84796785fb93647ac6a1e5efbb2bbd14ddcee2e50c15153a4
- MD5 aa6d1a798829536972ac5ba7d01d0c77
- SHA1 8ec399faa7c428e9962f116b2baf6efca636e8c8
- SHA512 a937d3840bd6102c321ebaa06e01bda575d383aa152c1c0bfc8faa870109a7672a9957c50a6a259ecf481b47450df1814d7d152334e396780fe15760281be870
- SSDEEP 48:6O/89d6LfKuNpIoijbm2EjW6NINM/OMeZSCo1bumqMzxSu4tM/klXWRO6uFF:0uNpI7j6jWyPgysCcl8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11090
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Brian\Documents\GitHub\SharpSteam\SharpSteam\obj\Release\SharpSteam.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c3a5868584a777422cebcf31d6718fd2b26d5e2314d3b5ba6d8e47aa40faba0c
- MD5 835e9ede7e7c774e7a2d56cfdf6e9b17
- SHA1 a43ed886b68c6ee913da85df9ad2064f1d81c470
- SHA512 74284fd44497beb74326d11a0f63d96aff20aa44cfa8385f6b63b7e6743403c36e2ea4fb0d991767117a97d320e04d2b21f0a4730916244af4ffdaf51e834a26
- SSDEEP 3072:d/SDqTIE+QQVVBCTmAG17iT+Lt8D/1L2iLZdrs81sDotEKjRmarzRm+5gSBZqoEJ:d/PXS6WK2iLZdgotEKj9rzRmkgSBAot
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
359678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
344KB
Virtual Size
343KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Management.Automation.xml
- SHA256 91f3d6351285f8976739460142ae9e390895f03acc6abdad37c615e31fe263c8
- MD5 ed8ef3dc9d3ac8c179d4e70836e59bef
- SHA1 5a6fd18e7e3632b08b399aa163e8ca5d27e29bff
- SHA512 f1f98b2a1c21b70d06451e5ee5bfbd9342cfd54b965bc7a958d58451b67d5f405e720fc06960c90f05227a3a2bff0869ab1a1da9275fb5ab2ec88a5bddc1db9b
- SSDEEP 24576:6JmkwcDZzs/v5yJKY12nB3OGrXC8pfQwt0xPBGjwWcrz:4hVQ30JV2B3lfQwt0xpGjwWcrz
- MD5 SHA1 SHA512 SSDEEP
UWPHook.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d55baebe14b8e68afd44227d3ae7307fa07dbbdd91331b892edde93fd027ca6e
- MD5 9aa4929291eff01d727b9fb88bba080c
- SHA1 820321cd5e8fbf81db43f024e93ee190811b8906
- SHA512 b52e18c3c8f4f30479c974e4c19e00cacdb850df6e631aeed553cbfee77703e664136385ff7a6b38c90ddf18e0c29a08c51264ad7696c5d8278b8876d3b7fe1f
- SSDEEP 12288:O4IH5S68xqbLLjo9LfPw3ytl8dSkc6ZubYpE0EjcUBS4BJ:O35R8xf143yte6epEdjcUBzBJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
788126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Brian\Documents\GitHub\UWPHook\UWPHook\obj\Release\UWPHook.pdb
mscoree
_CorExeMain
Name
.text
Size
762KB
Virtual Size
761KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UWPHook.exe.config
- SHA256 af825bd6de06ddb2d1f90d51a6c77ec517c9594dc684075a654adea4dca00613
- MD5 b2540cbb6ec9839a292c292ea7ac8b65
- SHA1 ee91fb07609d9e435206386d94fb43d9ac78c70f
- SHA512 c8047d7b2c602ecc4fe021c0eef58fdcfa8f31408d652e9027b7b9849b89bb4079c65ec3c78f85f60d6b8fb9d227a01925b0adaa481913acb75174439a37cd0a
- MD5 SHA1 SHA512
VDFParser.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 503804161cd8ff82756292f6d4d24107e6c8ac4cf43df89378f7b5d3782cc2ad
- MD5 17351a51f020d8352c3d8144bf89ab40
- SHA1 80a46c4dd6be71f789183daaa6677629654ebe68
- SHA512 ab5b16f296d787a72fed58bcb00e1295a543d4fb5eff00cb82c065fe336d18a572884003e2b519f5d4880546ce592aa9d903ad096a7d78dedf5f72b76034c983
- SSDEEP 384:GEI1akrMmNix7WLptEEEEEEEEEEEEEEEEEEEDl/hJOhE75MuODENhtN:lyMvWLptEEEEEEEEEEEEEEEEEEE5JwaJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
New folder/Emotet.doc.meow
- SHA256 c378387344e0a552dc065de6bfa607fd26e0b5c569751c79fbf9c6f2e91c9807
- MD5 b92021ca10aed3046fc3be5ac1c2a094
- SHA1 0fb1ad5b53cdd09a7268c823ec796a6e623f086f
- SHA512 bbeb5cfd7c5a890456b0805234a9ae325abc4a08dbad70b4ed1b3635dee4470a1f86869d5532809cecb595b9a89708f378921d733bd061aef693bfc5ee77ebb4
- SSDEEP 3072:/Msknok2er/yR5DpQKajNDu1CkBwN0pqJfWSq:zkoRoKDpQZqQkmN0scR
- MD5 SHA1 SHA512 SSDEEP
New folder/FreeYoutubeDownloader.exe.meow
- SHA256 cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
- MD5 13f4b868603cf0dd6c32702d1bd858c9
- SHA1 a595ab75e134f5616679be5f11deefdfaae1de15
- SHA512 e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24
- SSDEEP 12288:jANwRo+mv8QD4+0V16nkFkkk2kyW9EArjaccoH0qzh4:jAT8QE+kHW9EAr+fr4i
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
152680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
New folder/HawkEye.exe.meow
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838
- MD5 60fabd1a2509b59831876d5e2aa71a6b
- SHA1 8b91f3c4f721cb04cc4974fc91056f397ae78faa
- SHA512 3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a
- SSDEEP 3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
222286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
212KB
Virtual Size
209KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
New folder/Mantas.exe.meow
- SHA256 7b5dec6a48ee2114c3056f4ccb6935f3e7418ef0b0bc4a58931f2c80fc94d705
- MD5 53f25f98742c5114eec23c6487af624c
- SHA1 671af46401450d6ed9c0904402391640a1bddcc2
- SHA512 f460775308b34552c930c3f256cef1069b28421673d71e3fa2712b0467485861a98285925ae49f1adea1faf59265b964c873c12a3bb5de216122ac20084e1048
- SSDEEP 768:rz4RBkfbi/FG9Of8Ejex0a6zALVlXt32KtYFPYA3HxAnIIGSEsu:4Ciw9a8EG05zMt3jKYA3xAYns
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
38KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=10, id=14, version=7299,
count=9, id=19, version=8034,
count=55, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
out.upx
- SHA256 bf60c162e73990b39850f8af4ba051eb4cac3bb7b2bd8577e056a785903a3da3
- MD5 99b1b58b59aed219a64637642a545b04
- SHA1 d6d9f8cda7d82c857193c3a6c389dc69a4a1d99a
- SHA512 3e42ff0077c9ae279ecea8fa9f90a1a77e9de9276d58a91f15cedc2cdbb1ba21e9082d194a71eebb72c93b9f79ee938d87121eccdb00ea8ea36cec73fff8dc17
- SSDEEP 768:zjS4UaBRvYluUUpnHWJ9Jj+XCOd2uOwGCcOrplBvawsGVcjlt1zmnPG6HYtUXP+:zHBnU9JCyy2uOpuplsltIPG6HC8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=10, id=14, version=7299,
count=9, id=19, version=8034,
count=55, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
New folder/Meoware.exe.meow
- IMPHASH b0a7afa39910489440caebf317bd64b9
- SHA256 77898bbfd090997263a450e0daa35593b5a295b464e53053fb68a84cad8d0927
- MD5 86349691dac930f52bd797a44b18dd00
- SHA1 452e3feaf0aa4ea3df0b520c42def39d56b0e6a1
- SHA512 952b12f983b441eb483edf8b8a248859495898176a8470d5bbd88672157407f2e47ff60301dff808d1c430c8d16d166f51b60635043721d1d0ecab195379e577
- SSDEEP 3072:+FeSgiY5JN7vY7n3KAJ3GHo27yMP0ZJm1sxLip940gW8TClAf5rB6:K/ghU7aAJ3GHN8694TnTvBB6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
memcpy
memset
signal
strerror
strlen
strncmp
vfprintf
wcslen
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1024B
Virtual Size
925B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/97
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/RevengeRAT.exe.meow
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885
- MD5 1d9045870dbd31e2e399a4e8ecd9302f
- SHA1 7857c1ebfd1b37756d106027ed03121d8e7887cf
- SHA512 9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909
- SSDEEP 1536:SGZiTHzreu+4SHYEJicHHkxcPiwlJ6BjQaJ7ehgQpmnp3bDBq+AD3tSYxV:Z8AHxicHEuP5l/aJ7ehgiYDk9SYz
- MD5 SHA1 SHA512 SSDEEP
-
RevengeRat Executable
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
116734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ