coderoom-main.zip
- SHA256 1193157e2a338dbe8d057b125d36fffd2c05be694c1bfdaaf49d52e30bd08ebd
Overview
overview
10Static
static
10coderoom-m...ce.exe
windows10-ltsc 2021-x64
6coderoom-m...wd.exe
windows10-ltsc 2021-x64
10coderoom-m...ad.exe
windows10-ltsc 2021-x64
10coderoom-m...SQ.exe
windows10-ltsc 2021-x64
3coderoom-m...st.exe
windows10-ltsc 2021-x64
3coderoom-m...wd.exe
windows10-ltsc 2021-x64
7coderoom-m...gs.exe
windows10-ltsc 2021-x64
10coderoom-m...ad.exe
windows10-ltsc 2021-x64
10coderoom-m...sa.exe
windows10-ltsc 2021-x64
7coderoom-main/fun.exe
windows10-ltsc 2021-x64
3coderoom-m...ja.exe
windows10-ltsc 2021-x64
10coderoom-m...hg.exe
windows10-ltsc 2021-x64
7coderoom-m...oa.exe
windows10-ltsc 2021-x64
10coderoom-m...wd.exe
windows10-ltsc 2021-x64
10coderoom-m...wd.exe
windows10-ltsc 2021-x64
7coderoom-m...ad.exe
windows10-ltsc 2021-x64
1coderoom-m...wh.exe
windows10-ltsc 2021-x64
10coderoom-m...sd.exe
windows10-ltsc 2021-x64
10coderoom-m...wd.exe
windows10-ltsc 2021-x64
7coderoom-m...aw.exe
windows10-ltsc 2021-x64
10coderoom-m...rg.exe
windows10-ltsc 2021-x64
10coderoom-m...th.exe
windows10-ltsc 2021-x64
10coderoom-m...wd.exe
windows10-ltsc 2021-x64
10coderoom-m...ad.exe
windows10-ltsc 2021-x64
1coderoom-m...yh.exe
windows10-ltsc 2021-x64
10coderoom-m...rg.exe
windows10-ltsc 2021-x64
10Behavioral task
behavioral1
Sample
coderoom-main/Service.exe
Resource
win10ltsc2021-20250218-en
windows10-ltsc 2021-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
coderoom-main/biopderfawd.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
coderoom-main/biyhoksefdad.exe
Resource
win10ltsc2021-20250218-en
windows10-ltsc 2021-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
coderoom-main/boilfdsefSQ.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
coderoom-main/boost.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
coderoom-main/boyjhpskdfawd.exe
Resource
win10ltsc2021-20250218-en
windows10-ltsc 2021-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
coderoom-main/crossings.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
13 signatures
150 seconds
Behavioral task
behavioral8
Sample
coderoom-main/dawothjkjad.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
11 signatures
150 seconds
Behavioral task
behavioral9
Sample
coderoom-main/fffffffsa.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
coderoom-main/fun.exe
Resource
win10ltsc2021-20250218-en
windows10-ltsc 2021-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
coderoom-main/jthkadktjhja.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
11 signatures
150 seconds
Behavioral task
behavioral12
Sample
coderoom-main/jtijhkasdjrhg.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
coderoom-main/monrealetrussoa.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
11 signatures
150 seconds
Behavioral task
behavioral14
Sample
coderoom-main/mvtijadjtrhawd.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
coderoom-main/nbtoaesudjajwd.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
12 signatures
150 seconds
Behavioral task
behavioral16
Sample
coderoom-main/nbtypsfikkad.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
coderoom-main/nbvtojsdawh.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
12 signatures
150 seconds
Behavioral task
behavioral18
Sample
coderoom-main/nbyosapefdkhasd.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
19 signatures
150 seconds
Behavioral task
behavioral19
Sample
coderoom-main/nobtpajdjthawd.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
12 signatures
150 seconds
Behavioral task
behavioral20
Sample
coderoom-main/nogtpjadthaw.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
8 signatures
150 seconds
Behavioral task
behavioral21
Sample
coderoom-main/ntohlasdlrg.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
22 signatures
150 seconds
Behavioral task
behavioral22
Sample
coderoom-main/ntohlsakdth.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
13 signatures
150 seconds
Behavioral task
behavioral23
Sample
coderoom-main/nyoilsafkjawd.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
12 signatures
150 seconds
Behavioral task
behavioral24
Sample
coderoom-main/oyjijsfjjtyhad.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
coderoom-main/thawdtyh.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
8 signatures
150 seconds
General
- Target coderoom-main.zip
- Size 29.1MB
- Sample250311-tp2gvsxpv2
- SHA256 1193157e2a338dbe8d057b125d36fffd2c05be694c1bfdaaf49d52e30bd08ebd
- MD5 94aa1a3b984ebf5ec74236ce0fafd13f
- SHA1 38703919e4d90f1fe1aa663aac9039cd67e1fcbe
- SHA512 f6be1f93408bef9c4730fb037ac7baf0c880d8db5e0f7bcd56edc4204cfdd3e86ce1402034fcebb448711740c79532a36a85387977ebae1cc162a87a990de78d
- SSDEEP 786432:HvFD0El0jsJmrZc/fbUnJ5kHyMBnh0Fyrw9iSXtp8zdgrZQtOk0us1NKKHJ7dIdm:PJE2mm/fonJ5kH5rw99rUs1NKKp7CzA
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
remcos
Version
-
6.1.0 Light
Botnet
-
Firefox
C2
-
91.135.156.200:8109
Attributes
-
audio_folder
Ìèêðîôîííûå çàïèñè
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Firefox spr
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
6C@=0;K.dat
-
keylog_flag
false
-
keylog_folder
firefox tsms
-
mouse_option
false
-
mutex
Ðìê-ZYOV7X
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Ñêðèíøîòû
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
Family
-
remcos
Botnet
-
firefox tsms
C2
-
91.135.156.200:8109
Attributes
-
audio_folder
Ìèêðîôîííûå çàïèñè
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
firefox tsm.exe
-
copy_folder
firefox tsm
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
temp.dat
-
keylog_flag
false
-
keylog_folder
data firewall
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Ðìê-QPMRI0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Ñêðèíøîòû
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
Family
-
remcos
Botnet
-
firefox mts
C2
-
91.135.156.200:8109
Attributes
-
audio_folder
Ìèêðîôîííûå çàïèñè
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
app.exe
-
copy_folder
firefox tsms
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
cfg.dat
-
keylog_flag
false
-
keylog_folder
firefox mssd
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Ðìê-HQT17V
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Ñêðèíøîòû
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
Family
-
remcos
Botnet
-
new new
C2
-
135.125.189.140:1040
Attributes
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
uptime.exe
-
copy_folder
update
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
restarting.dat
-
keylog_flag
false
-
keylog_path
%Temp%
-
mouse_option
false
-
mutex
ROA35Q-Y3LF93
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
- DCRat payload 3 IoCs
resource yara_rule static1/unpack001/coderoom-main/nbvtojsdawh.exe family_dcrat_v2 static1/unpack001/coderoom-main/nbyosapefdkhasd.exe family_dcrat_v2 static1/unpack001/coderoom-main/ntohlsakdth.exe family_dcrat_v2 - Dcrat family
- Remcos family
-
resource yara_rule static1/unpack001/coderoom-main/fffffffsa.exe upx static1/unpack001/coderoom-main/nbtoaesudjajwd.exe upx - Unsigned PE 26 IoCs
Checks for missing Authenticode signature.
resource unpack001/coderoom-main/Service.exe unpack001/coderoom-main/biopderfawd.exe unpack001/coderoom-main/biyhoksefdad.exe unpack001/coderoom-main/boilfdsefSQ.exe unpack001/coderoom-main/boost.exe unpack001/coderoom-main/boyjhpskdfawd.exe unpack001/coderoom-main/crossings.exe unpack001/coderoom-main/dawothjkjad.exe unpack001/coderoom-main/fffffffsa.exe unpack001/coderoom-main/fun.exe unpack001/coderoom-main/jthkadktjhja.exe unpack001/coderoom-main/jtijhkasdjrhg.exe unpack001/coderoom-main/monrealetrussoa.exe unpack001/coderoom-main/mvtijadjtrhawd.exe unpack001/coderoom-main/nbtoaesudjajwd.exe unpack001/coderoom-main/nbtypsfikkad.exe unpack001/coderoom-main/nbvtojsdawh.exe unpack001/coderoom-main/nbyosapefdkhasd.exe unpack001/coderoom-main/nobtpajdjthawd.exe unpack001/coderoom-main/nogtpjadthaw.exe unpack001/coderoom-main/ntohlasdlrg.exe unpack001/coderoom-main/ntohlsakdth.exe unpack001/coderoom-main/nyoilsafkjawd.exe unpack001/coderoom-main/oyjijsfjjtyhad.exe unpack001/coderoom-main/thawdtyh.exe unpack001/coderoom-main/vktyhkakwdrg.exe
File Explorer
-
coderoom-main.zip.zip 29.1MB
-
coderoom-main/Service.exe.exe 281KB
-
coderoom-main/biopderfawd.exe.exe 6.8MB
-
coderoom-main/biyhoksefdad.exe.exe 1.3MB
-
coderoom-main/boilfdsefSQ.exe.exe 431KB
-
coderoom-main/boost.exe.exe 5KB
-
coderoom-main/boyjhpskdfawd.exe.exe 612KB
-
coderoom-main/crossings.exe.exe 487KB
-
coderoom-main/dawothjkjad.exe.exe 1.2MB
-
coderoom-main/fffffffsa.exe.exe 3.1MB
-
coderoom-main/fun.exe.exe 6KB
-
coderoom-main/jthkadktjhja.exe.exe 1.2MB
-
coderoom-main/jtijhkasdjrhg.exe.exe 538KB
-
coderoom-main/monrealetrussoa.exe.exe 1.3MB
-
coderoom-main/mvtijadjtrhawd.exe.exe 1.3MB
-
coderoom-main/nbtoaesudjajwd.exe.exe 3.1MB
-
coderoom-main/nbtypsfikkad.exe.exe 6.8MB
-
coderoom-main/nbvtojsdawh.exe.exe 1.3MB
-
coderoom-main/nbyosapefdkhasd.exe.exe 830KB
-
coderoom-main/nobtpajdjthawd.exe.exe 922KB
-
coderoom-main/nogtpjadthaw.exe.exe 1.3MB
-
coderoom-main/ntohlasdlrg.exe.exe 363KB
-
coderoom-main/ntohlsakdth.exe.exe 2.4MB
-
coderoom-main/nyoilsafkjawd.exe.exe 487KB
-
coderoom-main/oyjijsfjjtyhad.exe.exe 538KB
-
coderoom-main/thawdtyh.exe.exe 486KB
-
coderoom-main/vktyhkakwdrg.exe.exe 1.3MB
coderoom-main/Service.exe
- IMPHASH 130fc8026b4bf89fff6e2a7baf60ffea
- SHA256 31bbfded45a9815b54db6f95ea71498dc8c18eede71a3a6810bdf5b37ab5f56b
- MD5 c6063e70d5165d1186696d84a18576b2
- SHA1 7bfa0e4e935cdf264c84c050c717c67257a0a99f
- SHA512 03e448e09092bd569c2ace54637d390d78af04a06e8e18d584885b8972289a95b0b637c05858d37bfc3fdbdaa23e21b18f8d06d72f60ae35ed39533b61f7715c
- SSDEEP 3072:bjTaw17mBiuYusL/ZWNLgAlkVQFFpeC/e6PTFsNpN8LCAlSFtkSmjJ53u8mWPowV:Sifus7QniVQFFAC/PFSAGf3mNJ/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
49112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\danar\OneDrive\Рабочий стол\LoaderV2\ClientLoader\x64\Release\ClientLoader.pdb
kernel32
GetLastError
CloseHandle
GetConsoleWindow
CreateProcessA
Sleep
GetComputerNameA
GetExitCodeProcess
SetEndOfFile
WriteConsoleW
HeapSize
CreateDirectoryA
WaitForSingleObject
CreateFileW
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
ReadFile
EnumSystemLocalesW
WideCharToMultiByte
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
RtlUnwind
user32
ShowWindow
shell32
SHGetFolderPathA
ShellExecuteA
ws2_32
connect
recv
htons
WSAGetLastError
send
WSAStartup
inet_pton
closesocket
WSACleanup
socket
wininet
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile
Name
.text
Size
183KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=175, id=261, version=30795,
count=16, id=260, version=30795,
count=10, id=259, version=34321,
count=16, id=260, version=34321,
count=89, id=261, version=34321,
count=13, id=257, version=30795,
count=155, id=1, productName=Unmarked objects,
count=1, id=265, version=34808,
count=1, id=255, version=34808,
count=1, id=258, version=34808,
coderoom-main/biopderfawd.exe
- IMPHASH de41d4e0545d977de6ca665131bb479a
- SHA256 d01f06838b39583de6738d8b0e9d2b7c0414b4801ccab1d71b2b03c2958a528c
- MD5 fe820cfa43aa340205ae839e565de86c
- SHA1 0d07304a76c97bd5096c3b1125546f02971d543d
- SHA512 9b7a1c098018d06eb2399c20767cd45e73314cfc8e20ebd4baecdfb5031fa7358d32e42193180937523bf89656e10f4251ff9e9594e0330fa576bb6205bb0851
- SSDEEP 98304:SHfOJnz/aIxjHwoot8th47wcE9qOL3Cmo85hlZMrLa5WaIfu0csdsWqcCh03Y:SH2jrwb8z47wcE37voChDAagp2L0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
_wcsicmp
_wcsnicmp
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
memset
signal
strlen
strncmp
vfprintf
wcscat
wcscpy
wcslen
wcsncmp
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6.8MB
Virtual Size
6.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
coderoom-main/biyhoksefdad.exe
- SHA256 70870a58aa5a47c9cb1e913883e8c7e08fb49c9018dc08e05af3cad3dad203d8
- MD5 67af8a00aba060d6508df2389989d85d
- SHA1 455950022329a0fde1bd4c3e050f1635464cdb51
- SHA512 54eaeecc53dc31b1d4b41d0dcc5b30cac6d29f601c8d9c0bee2cde2b430ad043476faa106e5faa40de3323ebae05eeb91ab2d899c1c4b96dd067e8cd484c9472
- SSDEEP 24576:7XH6QghP23MghHx6e3KVLYEbDsGM4hRAeXEm5UaZlnKKw3GQWGh:DHDgHuKVjfWmzDLlA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
33878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
167KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
174KB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
915KB
Virtual Size
916KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
coderoom-main/boilfdsefSQ.exe
- IMPHASH f2fe0712ecb6c4feca65be4f410e904e
- SHA256 f41eafd14e60035082f6313e0f7cbbff3a6e90defe48aa3e000793b94b007e87
- MD5 e5a997dcd4d6fc4d01ba75c6acfdc098
- SHA1 5cd75897d56bfe125823a49720364f6674b02a31
- SHA512 fee1c60b3f9e7dbdab90cc966921acd68a5903683d33228aa8d9a651c0ecd6b57c6ca4a12dd5aa4dede69a439f452056c4edb064206c2cc8719e2703b5e3b7a5
- SSDEEP 6144:JIdUXq44bq4LrqMUz2y6cdjJ4nCb0KhEekcdK5xAO2XjXapGc3Fou:JIdU6tdyDJZQKhEe7WAXWp7ou
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
182778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
HeapAlloc
GetProcAddress
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetCurrentProcess
GetSystemDirectoryA
GlobalAlloc
GlobalLock
GetCurrentProcessId
GetTickCount
GlobalUnlock
LocalAlloc
GetModuleHandleA
GlobalFree
MulDiv
SizeofResource
QueryDosDeviceW
FindFirstVolumeW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
lstrlenW
GetStdHandle
RemoveDirectoryW
FindResourceA
OpenProcess
lstrcatW
LockResource
LoadLibraryW
LoadResource
LocalFree
GetFileSize
FindVolumeClose
GetVolumePathNamesForVolumeNameW
lstrcpyW
SetConsoleOutputCP
FormatMessageA
FindNextVolumeW
VirtualFree
GetLastError
GetModuleFileNameA
lstrcpynA
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapReAlloc
GetACP
GetModuleHandleExW
MoveFileExW
RtlUnwind
RaiseException
LoadLibraryExW
SetLastError
VirtualProtect
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetLocaleInfoA
ExitProcess
CreateMutexA
GetModuleFileNameW
AllocConsole
GetLongPathNameW
ExpandEnvironmentStringsA
FindNextFileA
WaitForSingleObject
FindFirstFileA
MoveFileW
SetFilePointerEx
GetLogicalDriveStringsA
DeleteFileW
DeleteFileA
SetFileAttributesW
GetFileAttributesW
CreateFileW
FindClose
lstrlenA
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindFirstFileW
CreateDirectoryW
CreateProcessA
Sleep
PeekNamedPipe
CreatePipe
TerminateProcess
WriteFile
ReadFile
HeapFree
HeapCreate
CreateEventA
GetLocalTime
CreateThread
CloseHandle
SetEvent
CreateEventW
lstrcmpW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
SetEndOfFile
user32
SetWindowTextW
TranslateMessage
DispatchMessageA
GetMessageA
GetWindowTextW
SetForegroundWindow
SetClipboardData
GetClipboardData
EnumWindows
ExitWindowsEx
EmptyClipboard
CloseClipboard
OpenClipboard
ShowWindow
CreatePopupMenu
TrackPopupMenu
DefWindowProcA
CreateWindowExA
AppendMenuA
MessageBoxW
IsWindowVisible
CloseWindow
GetWindowThreadProcessId
SendInput
EnumDisplaySettingsW
mouse_event
MapVirtualKeyA
DrawIcon
GetSystemMetrics
GetIconInfo
SystemParametersInfoW
GetForegroundWindow
RegisterClassExA
GetCursorPos
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDIBits
DeleteDC
DeleteObject
CreateDCA
GetObjectA
BitBlt
advapi32
RegCreateKeyA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegEnumKeyExA
GetTokenInformation
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegDeleteKeyA
shell32
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
ShellExecuteW
shlwapi
StrToIntA
PathFileExistsA
PathFileExistsW
winmm
PlaySoundW
mciSendStringA
mciSendStringW
ws2_32
inet_addr
WSASetLastError
gethostbyname
gethostbyaddr
WSAGetLastError
recv
connect
socket
send
WSAStartup
closesocket
htons
htonl
getservbyname
inet_ntoa
ntohs
getservbyport
urlmon
URLOpenBlockingStreamW
URLDownloadToFileW
gdiplus
GdiplusStartup
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipLoadImageFromStream
wininet
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFile
Name
.text
Size
303KB
Virtual Size
303KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=241, version=40116,
count=165, id=243, version=40116,
count=30, id=242, version=40116,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=199, version=41118,
count=25, id=259, version=24237,
count=58, id=261, version=24237,
count=34, id=260, version=24237,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=291, id=1, productName=Unmarked objects,
count=100, id=265, version=24247,
count=1, id=255, version=24247,
count=1, id=258, version=24247,
coderoom-main/boost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 86db4cd31548241c2ced14ad3d6e7949d103c09526cb89b70575cd3dcb3eb6da
- MD5 5f330c7aa002e2fa6eb293eed9827070
- SHA1 44e9197e3946e3182c20ab88f3dfb0ebfc89ca3d
- SHA512 02879f1a66bce86759baff813bea3884b0d4b703470b6ff85616a431c71b74ffb2ab51219a25801b9999e93ecd48c047c0adad4655a176ecbb78922056780cd3
- SSDEEP 48:65XV5JV1OK2oMuBQpikGKteuNMpt1lBwByNa8wz4HBfyH5UVabWbTTCtDtl+bpFD:ONV1OK2gSpbJEwUM/Q5YUVaSb2gkzNt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\danar\OneDrive\Рабочий стол\boost\boost\obj\Debug\boost.pdb
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
coderoom-main/boyjhpskdfawd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3742bec392d2ec8b02a3f77594cd0f5ac303dc1a4d2eadb4821547e345333ed9
- MD5 648e084538b7622bd34496caf04784c1
- SHA1 f38fc56b8c3f0c11d629d30b48ccabf147333683
- SHA512 dd1f8e8a7739a7fd6cb77bf5bc464030de1b51c33fa4524c69e12ea9173c84e0e44b167290621500f4b3df37b0096484535526d82049b547a44fb1fc5dc9d3d3
- SSDEEP 12288:hPCznW14HnBprKl8lxxhQGYcjOZ3w1dquzu89/p7:NCznXBprtldQswyku9h
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
632350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
610KB
Virtual Size
609KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
coderoom-main/crossings.exe
- IMPHASH 41e05d591d7d93bdd5bc6d5da04da74b
- SHA256 c0297a465ab62db781cd06295004e14eac2d87905b5015b1cc02b446a34bf042
- MD5 db59bfef32bc15d53bdf499dd1ae62c4
- SHA1 e809baf170ae36169a2e2e1eac96c6283bd43b52
- SHA512 f4c307335699f75acb1eff4ccef003d3e27ffccbf9793021881c81f370b3c1b56ee93dbc3d827f5c6e2852b261e11d9bf1270ddc7fd5b962690e163d684fddd0
- SSDEEP 6144:HIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6GJ:H200OFp+G0imvHn3Cp6qyBP+YdsvZGo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
216420
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FindFirstFileA
FindNextFileA
ExpandEnvironmentStringsA
GetModuleFileNameW
GetLongPathNameW
CopyFileW
GetLocaleInfoA
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetTempPathW
lstrcatW
GetCurrentProcessId
GetTempFileNameW
GetSystemDirectoryA
GlobalAlloc
GlobalLock
GetTickCount
GlobalUnlock
WriteProcessMemory
ResumeThread
GetThreadContext
ReadProcessMemory
CreateProcessW
SetThreadContext
LocalAlloc
GlobalFree
MulDiv
SizeofResource
QueryDosDeviceW
FindFirstVolumeW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
lstrlenW
GetStdHandle
SetFilePointer
FindResourceA
LockResource
LoadLibraryW
LoadResource
LocalFree
FindVolumeClose
GetVolumePathNamesForVolumeNameW
lstrcpyW
SetConsoleOutputCP
FormatMessageA
TerminateThread
AllocConsole
lstrcmpW
GetModuleFileNameA
lstrcpynA
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetModuleHandleExW
MoveFileExW
LoadLibraryExW
RaiseException
RtlUnwind
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
MultiByteToWideChar
DecodePointer
EncodePointer
TlsFree
TlsSetValue
GetModuleHandleA
RemoveDirectoryW
MoveFileW
SetFilePointerEx
GetLogicalDriveStringsA
DeleteFileW
DeleteFileA
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
GetFileSize
FindClose
lstrlenA
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetModuleHandleW
ExitProcess
GetProcAddress
Process32FirstW
Process32NextW
OpenMutexA
GetLastError
CreateToolhelp32Snapshot
OpenProcess
CreateMutexA
GetCurrentProcess
CreateProcessA
PeekNamedPipe
CreatePipe
TerminateProcess
ReadFile
HeapFree
HeapCreate
CreateEventA
GetLocalTime
CreateThread
SetEvent
CreateEventW
WaitForSingleObject
Sleep
CloseHandle
ExitThread
CreateFileW
WriteFile
FindNextVolumeW
TlsGetValue
TlsAlloc
SwitchToThread
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
SetEndOfFile
user32
SetClipboardData
EnumWindows
ExitWindowsEx
EmptyClipboard
ShowWindow
SetWindowTextW
MessageBoxW
IsWindowVisible
CloseWindow
SendInput
EnumDisplaySettingsW
mouse_event
MapVirtualKeyA
DrawIcon
GetSystemMetrics
GetIconInfo
SystemParametersInfoW
GetCursorPos
RegisterClassExA
AppendMenuA
CreateWindowExA
TrackPopupMenu
TranslateMessage
DispatchMessageA
GetMessageA
GetWindowTextW
wsprintfW
GetClipboardData
UnhookWindowsHookEx
GetForegroundWindow
ToUnicodeEx
GetKeyboardLayout
SetWindowsHookExA
CloseClipboard
OpenClipboard
GetKeyboardState
GetWindowThreadProcessId
GetWindowTextLengthW
GetKeyState
DefWindowProcA
SetForegroundWindow
GetKeyboardLayoutNameA
CallNextHookEx
CreatePopupMenu
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDIBits
DeleteDC
DeleteObject
CreateDCA
GetObjectA
BitBlt
advapi32
LookupPrivilegeValueA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegEnumKeyExA
GetTokenInformation
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
OpenProcessToken
shell32
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
ShellExecuteW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
shlwapi
StrToIntA
PathFileExistsW
PathFileExistsA
winmm
mciSendStringA
PlaySoundW
mciSendStringW
waveInClose
waveInStop
waveInPrepareHeader
waveInUnprepareHeader
waveInOpen
waveInAddBuffer
waveInStart
ws2_32
gethostbyname
WSASetLastError
inet_addr
gethostbyaddr
getservbyport
ntohs
getservbyname
htonl
htons
inet_ntoa
closesocket
WSAStartup
send
socket
connect
recv
WSAGetLastError
urlmon
URLDownloadToFileW
URLOpenBlockingStreamW
gdiplus
GdipSaveImageToStream
GdipDisposeImage
GdipGetImageEncodersSize
GdiplusStartup
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipFree
GdipLoadImageFromStream
wininet
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
Name
.text
Size
348KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=241, version=40116,
count=171, id=243, version=40116,
count=30, id=242, version=40116,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=199, version=41118,
count=62, id=261, version=26706,
count=33, id=260, version=26706,
count=26, id=259, version=26706,
count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=327, id=1, productName=Unmarked objects,
count=100, id=265, version=27053,
count=1, id=255, version=27053,
count=1, id=258, version=27053,
coderoom-main/dawothjkjad.exe
- SHA256 a51011b9f87c36b6ac3c29fa310b51e0d19cda3938d1f4e61b46432d8e39969e
- MD5 991758c06a5a177ccd6af5f29bd95046
- SHA1 35201332aeb5fa8a9f93460c8b6c422b9501b84d
- SHA512 2ce2b45e2f03b25e0852950e4d1b498718e9073aa6a1c5f0088f9653fa2b7069d9c9bd6281f6a38ddda7ce02366e08eefedebed68fbd42f49c1b4ba22c04341b
- SSDEEP 24576:vf+EvcpmOZqSqXIJ3w4b22MZ0XctAfGfE99tSG1sNpHJB8n2C:3+ocwGs41lM06AOsntTC82C
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
35072
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
162KB
Virtual Size
312KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
174KB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
916KB
Virtual Size
920KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
coderoom-main/fffffffsa.exe
- SHA256 e2797eec2f82e9f93bed5c70adacecab791441199814ae333c45c7bf1c70ab6b
- MD5 ceba3115edddb819dff6e0dd35d080c1
- SHA1 75ce40d65431629863ce6dd55bbdcc6fed821da7
- SHA512 bfd3582863f3f107dd2c9933d69ce91fe1e5db332f968d772db998fd9a146b7caadd88b1dd5c8e5c3bc404d7d5ef8967a963fec65c8ea2cb48425167e0131917
- SSDEEP 49152:sPvhU/6SJEDEQenaDlLlDz2Q4kMQjD1rcZ46Q/EKkpgurSzGIBQ3PaCUa3YAWM:sPpy6SJmKOlLlcKD1ws8eu9n3j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
12036320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
coderoom-main/fun.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e572f5c5137fc96f2c7472069fc96b12285c3467385d113dc7ffef21a8e226e5
- MD5 3eb3ebece2c0e0d6b2be4ec64ed0509c
- SHA1 44359c3314ddae27a90106d3c1be44f7d008261f
- SHA512 efba74eee95bcd545e3e58261b5cf6bd1842b2d01ab465c2d36f741cf84dc87cb5ba5443a55527d8b6edcf04077030910d8d50118147fb9d6291edc2108f1437
- SSDEEP 96:DqQZXJH7/ataW0T+DZjaxOk3jQEdRqBzNt:DbFJBW0T6ZGxOk3jQww
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\danar\source\repos\fun\fun\obj\Debug\fun.pdb
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
coderoom-main/jthkadktjhja.exe
- SHA256 c3efd5418abf873a15fbce5e230bb81ef09a0ca01f39c483b5086d2854c760a0
- MD5 1b95cb89010eb9b1e170aad0385b6ee2
- SHA1 2d3fe7b72f884f6ea8e286d4a0c29233e0e85098
- SHA512 3864cf8655f8e1e05214778a24a4c92d6f4fe02b4f8a2122784d20cb549a05e569ad2e3c8f1328919e840ccbe6af1256bb79599a2d7f7614723c08d93ee664e2
- SSDEEP 24576:ihGcBHlXqRoyjEtPg/Ajv5HCmgRT2lP+/9awru0RP22mvu4Z0ihRDwcn6PwQP:TcBHVyo1LZCWJDOVRP22QuE9hRDwcmb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
132836
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
162KB
Virtual Size
312KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
174KB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
916KB
Virtual Size
920KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
coderoom-main/jtijhkasdjrhg.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 077364482914188a642ea8de919005104d1609840ac543f6479bf63fc3c54d67
- MD5 a0c0ee4d7de0c9cac81661a23530bafb
- SHA1 b2027c880471cfc27de4465c0f008b8cb6038a84
- SHA512 449dc825e4daa0b108b0362c15dce8599f6a78863b3f25fd3076812f89183f69ff64e7c458ac0ad0b427868b6cc89d6e9d6e8c9bb9495786fbc31472026e191f
- SSDEEP 6144:EYqdc0NkzDV4L3eTIlA41qpcN3p0NIb88WsNMPaKFP3b2V122J0sL:E9J8+jPycN3CNIb88WsNMP5F1k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
182990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
366KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
coderoom-main/monrealetrussoa.exe
- SHA256 1f3227891f6009399911bd4b45509cabae874807a3557348890a7cc0055973bb
- MD5 a3b6b2d3c89dfa65fa6d61798f8ca670
- SHA1 0ff6bb9be4a137b477bde9f297e8d14c5379c385
- SHA512 684e35b03a1baa3ba3954b1851a54ebfa3f3b20c2542d8d857297249e4d03f6a0d98c5342b94b186ff331dd4f0b12b2f1f9ef62c8e7f376288e4318244fd690a
- SSDEEP 24576:DiL9EzuF7sCuiMg/mrpBFeoIUxlFQxPaufCfztGMMqN37rWbiVRYi1NKgLc:D8sutsCuimVBFeoItx8EM9rWiFc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
85750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
167KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
9KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
174KB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
920KB
Virtual Size
920KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
coderoom-main/mvtijadjtrhawd.exe
- SHA256 d63d458494c853be3e861c15d6a206990e1f13d9551ac700b1265151faab20e2
- MD5 f1cddf5591ac025c3af911319e1a51f7
- SHA1 c0f2c2accb99cfdf09522f2fee12d451b3692c0c
- SHA512 522bded624be8141e9dc4ad110ad65bcac95989519475d9da86129571e85b8b871532c16a1563db644d1e4f7e4fefb0c6cf693e8dc4bb2bceaa0b5c4b44a42b8
- SSDEEP 24576:wkuGD0eGx0lGXL3SQzCeTBFX3EfzJJDufWDPLt5qKFGEvRzSRVVwH5/nODh5S50o:luGD0eGawb3+eT3X0MWH1FG6eG/Oy5fz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
125131
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
166KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
174KB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
916KB
Virtual Size
920KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
coderoom-main/nbtoaesudjajwd.exe
- SHA256 cfdf1d2768ed773c3f5b2c2a03d7892551ea79b181068c23a765f1e09a8c90b1
- MD5 baa1353f2955138fe781da218ecfbfec
- SHA1 951164e7150e31d64d1770ec8903a39caddf2009
- SHA512 ce1fb896c9d2ccaeabb04bc0d0d84665d6e312cba388a4360e636fa2ef7907905af6aa4e1826053d0dbecd99db206c017604849c482a10cd1aa1c6f1b3a47b76
- SSDEEP 98304:VFRopLT6zpNrQePFVACFD0MCqjub5uWij5nMyP8O:8LT6tNcODFYMgBitnfk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
12035504
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
coderoom-main/nbtypsfikkad.exe
- IMPHASH de41d4e0545d977de6ca665131bb479a
- SHA256 76de12fc1c2446150168ccb2520dea6b5f30ab53fb5cfae8926abcebf5c8364d
- MD5 8bbc3cca3905e7ada419a806de48006c
- SHA1 d9527797784197257a37c743da36f4de8197e924
- SHA512 66f9d6bd184be4e70acda9ea2a5757fb6ff31e76cf895b01143e2fbf3a342f1a14492ef8ad08ba27f323ab1ede351eab7f1f57efa35ef7978a2e80442d11bfcd
- SSDEEP 196608:FMk+nb1nuqMbwhIEkfnpmLA9EFRJouTX:FSrkfnsLAeRr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
_wcsicmp
_wcsnicmp
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
memset
signal
strlen
strncmp
vfprintf
wcscat
wcscpy
wcslen
wcsncmp
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6.8MB
Virtual Size
6.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
coderoom-main/nbvtojsdawh.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cb888774ee7f7ddf235b38e08b267ddb86bd9458b6e8701593a871977033e3f3
- MD5 347f809ee23c43c837f31a1f3faea31e
- SHA1 483ce5fd414d27c0db77a62082ca9eac9417e618
- SHA512 718817ddb5a5ed4a2a77bf00fc3979e5904cb4eb1a85682172ce738dd652498ac8586223d92da2bfe81508042266db3d84f39d56ef8b6b9290f020132c910111
- SSDEEP 12288:UDN1ULnJjGfpoAJiy8/PoiMWOLonc8EvrHaFykDsdj9HdP97pqI0wD9GqzsahPq6:UhIslJT8/v8ku5L8KTD+oiQrr/61+
- MD5 SHA1 SHA512 SSDEEP
-
DCRat payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1373198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
coderoom-main/nbyosapefdkhasd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 708b90620e944806d2ad832646b09f6b94d64935fb1eb6c056ac6da6049055d4
- MD5 bac01e445ee98d0f5786cbe5db0b5af1
- SHA1 c425da1b35f88971c74396faea1456eb2e57c1ab
- SHA512 494a4add1138834bd48817f99a2726b3cd80c1800bc036da44517063562e6de2a0a2ba90e810538e2482f47e6317609f8d36a4954a69280355f006b9e6276a68
- SSDEEP 12288:RPl1fce/+C4pmDH5ejE3wKI5wzuuGhP/Sknk7HtxCxXGLzz+Y3Q9TEbuX61+:RdJSpMEjn19qNaDX61+
- MD5 SHA1 SHA512 SSDEEP
-
DCRat payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
856494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
828KB
Virtual Size
828KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
coderoom-main/nobtpajdjthawd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c1a4e75659105f547ab3ed1d3cd2b159f59841db1d77288601d005655132fe22
- MD5 37866be1ef3af2eb9f96671722a52ccf
- SHA1 bc5fe4fed193686eee771c729c4d4144988e652e
- SHA512 cc8c0aeed01223eb458a0c2c538bfb457d83d0220176b79495eb9cff9e52074af93f25681081933398f00b6c79009e3e7237808e3be59f68562c0b4ed5ca9b06
- SSDEEP 24576:3fW/iayD+nYAcFyS13cfrf5GGGIt1rq7IUk:3TlDcYAcgY3XlsdGIUk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.CSS
Size
911KB
Virtual Size
911KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dotnet
coderoom-main/nogtpjadthaw.exe
- SHA256 f4aa315f8ff0c107dce56c88112e061f4e6260682eaf0ffc42a5bcf0d5fd6b8d
- MD5 2e070594f72d17abe15d822aca9f7d40
- SHA1 4d9ed6638bcf8749e2de2a42f379c81781e63e77
- SHA512 1f5251136f144d95da7578ae02f896c11dd7d59b2abb485ffe896a899044d2140e9609326ccfeafabf3f0c2d14adf562c72af03923bbe59a631865fdd9f5dc2e
- SSDEEP 24576:1jASJswj6381I/N9/hhgfzDoTxrp6TFwu2kBL3ryop:1cSw81I/oHgxrp6BwuH+o
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
151965
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
167KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
174KB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
918KB
Virtual Size
920KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
coderoom-main/ntohlasdlrg.exe
- IMPHASH 4044a08bb46cb5d99a7c173c2742fad9
- SHA256 cfb21d5e810fd19a459bb7f099ce1095c8811cf0674e4d7940f6ca2d29593a9f
- MD5 fbc3147905f3dad4828a8f0fe07b557d
- SHA1 46f73ab06c67a4214e8ceced910cf4ca618a5b6b
- SHA512 8c82e6e3ea07403ce7cddb110df26c7388caa52088e4699b530615a87f45053f7687b0045b4ee4c870ee83b9820631059c34dfa8b58d53283d5c4e2617789ff2
- SSDEEP 6144:NvnDvkb760jsiLwHwMGeOypBUK/4q6Pt236RttQyjBjz3J+AOza+eHpLipm:VnDv50ATwreGE6k3MtQkz3II+26
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
65010
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
WriteConsoleW
FindClose
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
SetFilePointerEx
GetConsoleCP
HeapSize
SetEndOfFile
WaitForSingleObject
CloseHandle
WriteFile
CreateFileW
DeleteFileW
GetTempFileNameW
GetTempPathW
MulDiv
ExitProcess
GetLastError
CreateMutexW
GlobalUnlock
GlobalFree
GlobalAlloc
GlobalLock
Sleep
FlushFileBuffers
HeapAlloc
HeapFree
ReadConsoleW
GetConsoleMode
ReadFile
GetACP
GetStdHandle
GetModuleHandleExW
ExitThread
RaiseException
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleHandleA
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
user32
SetClipboardData
CloseClipboard
MessageBoxW
RegisterClassExW
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
GetClipboardData
GetSystemMetrics
MoveWindow
ShowWindow
UpdateWindow
SetTimer
SetLayeredWindowAttributes
GetClientRect
GetDC
ReleaseDC
DefWindowProcW
PostQuitMessage
EmptyClipboard
OpenClipboard
RegisterClassW
DestroyWindow
ReleaseCapture
SetCapture
GetKeyState
gdi32
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
TextOutW
SetTextColor
SetBkMode
CreateFontW
GetDeviceCaps
Rectangle
CreatePen
SelectObject
CreateSolidBrush
GetStockObject
advapi32
RegSetValueExW
RegCreateKeyExW
RegCloseKey
shell32
ShellExecuteExW
Shell_NotifyIconW
gdiplus
GdipCloneImage
GdipSaveImageToFile
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipFree
GdipAlloc
GdiplusStartup
GdipGetImageEncoders
GdipDisposeImage
wininet
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW
Name
.text
Size
263KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=18, id=241, version=40116,
count=157, id=243, version=40116,
count=30, id=242, version=40116,
count=22, id=259, version=26706,
count=120, id=261, version=26706,
count=36, id=260, version=26706,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=211, id=1, productName=Unmarked objects,
count=2, id=265, version=27053,
count=1, id=255, version=27053,
count=1, id=151,
count=1, id=258, version=27053,
coderoom-main/ntohlsakdth.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 77f89edc608310294fb98dd03be1c1b855482cebf1222b7bed671f59961f1b52
- MD5 47a277db4adbef8222b360460c39a313
- SHA1 b213b2ffb02d3b3a145e9325ffe37803e89c8657
- SHA512 880f2341c2f71062b2e8fa4e0023d6afd880b7d0f419c7299abc5e8f5c69847bc66ea3542116c9a6f755fe34c3f55f6292d3d5c94498b9645e0e33a5ad7fae10
- SSDEEP 24576:s0QPOqTLvACw7sULd3yUJVd4CUGgblBiIRXmfpbsNP0gSClSiSLpHDcr1TY6D+:FQPNTLv20KAzXdP0dISFmT
- MD5 SHA1 SHA512 SSDEEP
-
DCRat payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2531726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
coderoom-main/nyoilsafkjawd.exe
- IMPHASH 41e05d591d7d93bdd5bc6d5da04da74b
- SHA256 fa1c16a3024d35ebc4f6996d1791ead89a08dae2ebd87e39c9997c04613c4645
- MD5 0bea38a3f664f5c8d72ab74db022aacd
- SHA1 d185b86120ea6fcae137edcff25547fda2b6d4a5
- SHA512 22089f02f5d941ff4ea4f0fdbf3c7b2cdfdb3bacfda7ac3151dd87d68621fa550c0bf3c13e0d512aa5f5823e8f786b13d12c7ea4699574a895c31b3d6f85de42
- SSDEEP 12288:P200OFp+G0imvHn3Cp6qyBP+YdsvZGH3:e0Zp+ViehBWY0ZS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
216420
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FindFirstFileA
FindNextFileA
ExpandEnvironmentStringsA
GetModuleFileNameW
GetLongPathNameW
CopyFileW
GetLocaleInfoA
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetTempPathW
lstrcatW
GetCurrentProcessId
GetTempFileNameW
GetSystemDirectoryA
GlobalAlloc
GlobalLock
GetTickCount
GlobalUnlock
WriteProcessMemory
ResumeThread
GetThreadContext
ReadProcessMemory
CreateProcessW
SetThreadContext
LocalAlloc
GlobalFree
MulDiv
SizeofResource
QueryDosDeviceW
FindFirstVolumeW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
lstrlenW
GetStdHandle
SetFilePointer
FindResourceA
LockResource
LoadLibraryW
LoadResource
LocalFree
FindVolumeClose
GetVolumePathNamesForVolumeNameW
lstrcpyW
SetConsoleOutputCP
FormatMessageA
TerminateThread
AllocConsole
lstrcmpW
GetModuleFileNameA
lstrcpynA
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetModuleHandleExW
MoveFileExW
LoadLibraryExW
RaiseException
RtlUnwind
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
MultiByteToWideChar
DecodePointer
EncodePointer
TlsFree
TlsSetValue
GetModuleHandleA
RemoveDirectoryW
MoveFileW
SetFilePointerEx
GetLogicalDriveStringsA
DeleteFileW
DeleteFileA
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
GetFileSize
FindClose
lstrlenA
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetModuleHandleW
ExitProcess
GetProcAddress
Process32FirstW
Process32NextW
OpenMutexA
GetLastError
CreateToolhelp32Snapshot
OpenProcess
CreateMutexA
GetCurrentProcess
CreateProcessA
PeekNamedPipe
CreatePipe
TerminateProcess
ReadFile
HeapFree
HeapCreate
CreateEventA
GetLocalTime
CreateThread
SetEvent
CreateEventW
WaitForSingleObject
Sleep
CloseHandle
ExitThread
CreateFileW
WriteFile
FindNextVolumeW
TlsGetValue
TlsAlloc
SwitchToThread
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
SetEndOfFile
user32
SetClipboardData
EnumWindows
ExitWindowsEx
EmptyClipboard
ShowWindow
SetWindowTextW
MessageBoxW
IsWindowVisible
CloseWindow
SendInput
EnumDisplaySettingsW
mouse_event
MapVirtualKeyA
DrawIcon
GetSystemMetrics
GetIconInfo
SystemParametersInfoW
GetCursorPos
RegisterClassExA
AppendMenuA
CreateWindowExA
TrackPopupMenu
TranslateMessage
DispatchMessageA
GetMessageA
GetWindowTextW
wsprintfW
GetClipboardData
UnhookWindowsHookEx
GetForegroundWindow
ToUnicodeEx
GetKeyboardLayout
SetWindowsHookExA
CloseClipboard
OpenClipboard
GetKeyboardState
GetWindowThreadProcessId
GetWindowTextLengthW
GetKeyState
DefWindowProcA
SetForegroundWindow
GetKeyboardLayoutNameA
CallNextHookEx
CreatePopupMenu
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDIBits
DeleteDC
DeleteObject
CreateDCA
GetObjectA
BitBlt
advapi32
LookupPrivilegeValueA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegEnumKeyExA
GetTokenInformation
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
OpenProcessToken
shell32
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
ShellExecuteW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
shlwapi
StrToIntA
PathFileExistsW
PathFileExistsA
winmm
mciSendStringA
PlaySoundW
mciSendStringW
waveInClose
waveInStop
waveInPrepareHeader
waveInUnprepareHeader
waveInOpen
waveInAddBuffer
waveInStart
ws2_32
gethostbyname
WSASetLastError
inet_addr
gethostbyaddr
getservbyport
ntohs
getservbyname
htonl
htons
inet_ntoa
closesocket
WSAStartup
send
socket
connect
recv
WSAGetLastError
urlmon
URLDownloadToFileW
URLOpenBlockingStreamW
gdiplus
GdipSaveImageToStream
GdipDisposeImage
GdipGetImageEncodersSize
GdiplusStartup
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipFree
GdipLoadImageFromStream
wininet
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
Name
.text
Size
348KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=241, version=40116,
count=171, id=243, version=40116,
count=30, id=242, version=40116,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=199, version=41118,
count=62, id=261, version=26706,
count=33, id=260, version=26706,
count=26, id=259, version=26706,
count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=327, id=1, productName=Unmarked objects,
count=100, id=265, version=27053,
count=1, id=255, version=27053,
count=1, id=258, version=27053,
coderoom-main/oyjijsfjjtyhad.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b3f87af043d22e844171b6bf66e4a6d966d880c0dd8e8aa61f25ac382546b3af
- MD5 bd0fdaabed40d16fffeac608d7a68822
- SHA1 f2a5d6a2be78424dc598ebb636401add7f2feef9
- SHA512 4db0cfb69e03d0658874389180bdac7c20d75565fbd77ec9adffb00ce59250ef036497bc9cf46383baa449528ba1208bdfbfc06f06c45df94fbc348612f3f45f
- SSDEEP 6144:sYqdc0NkzDVUTfmTIlA41tBcN3p0NIb88WsNMPaKFP3b2V122J0sL:s9J8qjXLcN3CNIb88WsNMP5F1k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
182990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
366KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
coderoom-main/thawdtyh.exe
- IMPHASH 41e05d591d7d93bdd5bc6d5da04da74b
- SHA256 78cc96452121dc657a87c79561272f3669f781d24265a7a2ab853a5670fff80d
- MD5 cf8c5debe04e96be1a022ce0796d868b
- SHA1 f91900f49ea42776bcbd81f59b656740a01b9cf3
- SHA512 4ceb541f8162f370bd2dcedd3a8335cc4f40bb5d4ec8232ece4d0d685c9a1a663f9edfdccbb480b8c13d24dc8fc961da4d31dad1ad538aa6442b339167b732e9
- SSDEEP 6144:JIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6UJ:J200OFp+G0imvHn3Cp6qyBP+YdsvZGC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
216420
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FindFirstFileA
FindNextFileA
ExpandEnvironmentStringsA
GetModuleFileNameW
GetLongPathNameW
CopyFileW
GetLocaleInfoA
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetTempPathW
lstrcatW
GetCurrentProcessId
GetTempFileNameW
GetSystemDirectoryA
GlobalAlloc
GlobalLock
GetTickCount
GlobalUnlock
WriteProcessMemory
ResumeThread
GetThreadContext
ReadProcessMemory
CreateProcessW
SetThreadContext
LocalAlloc
GlobalFree
MulDiv
SizeofResource
QueryDosDeviceW
FindFirstVolumeW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
lstrlenW
GetStdHandle
SetFilePointer
FindResourceA
LockResource
LoadLibraryW
LoadResource
LocalFree
FindVolumeClose
GetVolumePathNamesForVolumeNameW
lstrcpyW
SetConsoleOutputCP
FormatMessageA
TerminateThread
AllocConsole
lstrcmpW
GetModuleFileNameA
lstrcpynA
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetModuleHandleExW
MoveFileExW
LoadLibraryExW
RaiseException
RtlUnwind
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
MultiByteToWideChar
DecodePointer
EncodePointer
TlsFree
TlsSetValue
GetModuleHandleA
RemoveDirectoryW
MoveFileW
SetFilePointerEx
GetLogicalDriveStringsA
DeleteFileW
DeleteFileA
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
GetFileSize
FindClose
lstrlenA
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetModuleHandleW
ExitProcess
GetProcAddress
Process32FirstW
Process32NextW
OpenMutexA
GetLastError
CreateToolhelp32Snapshot
OpenProcess
CreateMutexA
GetCurrentProcess
CreateProcessA
PeekNamedPipe
CreatePipe
TerminateProcess
ReadFile
HeapFree
HeapCreate
CreateEventA
GetLocalTime
CreateThread
SetEvent
CreateEventW
WaitForSingleObject
Sleep
CloseHandle
ExitThread
CreateFileW
WriteFile
FindNextVolumeW
TlsGetValue
TlsAlloc
SwitchToThread
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
SetEndOfFile
user32
SetClipboardData
EnumWindows
ExitWindowsEx
EmptyClipboard
ShowWindow
SetWindowTextW
MessageBoxW
IsWindowVisible
CloseWindow
SendInput
EnumDisplaySettingsW
mouse_event
MapVirtualKeyA
DrawIcon
GetSystemMetrics
GetIconInfo
SystemParametersInfoW
GetCursorPos
RegisterClassExA
AppendMenuA
CreateWindowExA
TrackPopupMenu
TranslateMessage
DispatchMessageA
GetMessageA
GetWindowTextW
wsprintfW
GetClipboardData
UnhookWindowsHookEx
GetForegroundWindow
ToUnicodeEx
GetKeyboardLayout
SetWindowsHookExA
CloseClipboard
OpenClipboard
GetKeyboardState
GetWindowThreadProcessId
GetWindowTextLengthW
GetKeyState
DefWindowProcA
SetForegroundWindow
GetKeyboardLayoutNameA
CallNextHookEx
CreatePopupMenu
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDIBits
DeleteDC
DeleteObject
CreateDCA
GetObjectA
BitBlt
advapi32
LookupPrivilegeValueA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegEnumKeyExA
GetTokenInformation
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
OpenProcessToken
shell32
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
ShellExecuteW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
shlwapi
StrToIntA
PathFileExistsW
PathFileExistsA
winmm
mciSendStringA
PlaySoundW
mciSendStringW
waveInClose
waveInStop
waveInPrepareHeader
waveInUnprepareHeader
waveInOpen
waveInAddBuffer
waveInStart
ws2_32
gethostbyname
WSASetLastError
inet_addr
gethostbyaddr
getservbyport
ntohs
getservbyname
htonl
htons
inet_ntoa
closesocket
WSAStartup
send
socket
connect
recv
WSAGetLastError
urlmon
URLDownloadToFileW
URLOpenBlockingStreamW
gdiplus
GdipSaveImageToStream
GdipDisposeImage
GdipGetImageEncodersSize
GdiplusStartup
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipFree
GdipLoadImageFromStream
wininet
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
Name
.text
Size
348KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=241, version=40116,
count=171, id=243, version=40116,
count=30, id=242, version=40116,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=199, version=41118,
count=62, id=261, version=26706,
count=33, id=260, version=26706,
count=26, id=259, version=26706,
count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=327, id=1, productName=Unmarked objects,
count=100, id=265, version=27053,
count=1, id=255, version=27053,
count=1, id=258, version=27053,
coderoom-main/vktyhkakwdrg.exe
- SHA256 d5acf2451a1683b2e702f8da1dee3c0c908f6683b899e5ebe8b4614f1870a410
- MD5 bc270342cd8a60fbcb34f401914fe1c4
- SHA1 0f30f3e48550f1e1ebcb46d48c7d7a50499352b9
- SHA512 42dfa739a610a7fe073256dfb1a52a517dc35989b5c40c631fbfbf36ba5307c2e9c84bd855f01b46d1ffa625214ea0d496f4337ee61d38cbcd1e46be7b5005d4
- SSDEEP 24576:3AECXHcTq2XPHhxRX1PVUZli+wa2iMQXU4TL+sNgC6BvRNFE4Fe3EknBrxgXf:wEC33Yrqq+FXRToC6fNV43Eknvi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
122387
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
162KB
Virtual Size
312KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
174KB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
928KB
Virtual Size
928KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE