250611-dyhhcaytey.bin
- SHA256 b1e1d1d4234a4eca32f6b20fbf3eeaeca26278e728d6f2fdc8563ab7b0aa83e3
Behavioral task
behavioral1
Sample
Clien123.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Final123.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
NqydMiBpgE71.html
Resource
win10v2004-20250502-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
Pls.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral5
Sample
joker12321.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 250611-dyhhcaytey.bin
- Size 9.7MB
- Sample250611-fxf91aam91
- SHA256 b1e1d1d4234a4eca32f6b20fbf3eeaeca26278e728d6f2fdc8563ab7b0aa83e3
- MD5 262959ccb1b5b10d07d1b666fbf90aa1
- SHA1 183e214a3340384636c3e32b2a717185fed9f36a
- SHA512 bee960bed44ad0ed4d4dc3f42b5988a9687ae7ed3ddfb298a53354bffde0b50c066a0b86c84c3e26b0bb394a807d0e70df12884f7b92b6c01f77651ee95868d2
- SSDEEP 196608:f+3F/hDNA5ySlR9IC2Zveiz0WkrG0KYIw72oxAHyQRuO8aQex9GzK9SE:f+V/I+C2Zveiz03G0KYl72oxnQRuEg2H
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
78.142.218.142:5353
Mutex
-
r4NoCZGiIE3OaQHF
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/Clien123.exe family_xworm - Xworm family
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/Clien123.exe unpack001/Final123.exe unpack001/Pls.exe unpack001/joker12321.exe unpack001/neploskiy_crypted_LAB.exe
File Explorer
-
250611-dyhhcaytey.bin.rar 9.7MB
-
0318482370b943e2efd6869d5f23f4d6acc28220fd68a6b260d9d6bf293e1c43.bin6KB
-
090da884f6f667f19ecdee8f746c8683d215a60a3e76050555b952610e2e058c.bin6KB
-
1b590f4d159c180d56879915cc69c051bd59842cbc21cf2cf2ca4a9ccae9c069.bin6KB
-
292077f278b86cd454fa540ef96797ff483643dd1e790fc7916340dafb6c82e7.bin6KB
-
3a5fe17d2c17886c89c34a731640f95436c0da4f3dca7a97f2d0c0c7eb8fc03a.bin6KB
-
3c913fb78fa97595474db3794f8ec673feda96d56aa6d654f0656d52e03b4e89.bin6KB
-
435e1c1e8ad4cfaed8eb6eae4e889159e0b8b8fbe25dbd0f6c6e5240f5634995.bin6KB
-
4573db2cb64b760546e79655f15c896bbf4eb7a0e718f751d1bd7965eba57bfe.bin6KB
-
4dc4fe5db9c2d34ea0e5de7dc8368b5f8b91b57f5558368b354003aa0e88cc9b.bin6KB
-
5671db0edaeab25b3a6dc2c7a6248151ebf1b01fa131852ee0118594a943343b.bin6KB
-
6d1153630a554d363e660a8bd5ee5f88a833410a60f4076b83d04804a5117eca.bin6KB
-
70477bd732f8f89f28078800c3807a6f6af96a3cafa37b5023bf0563e36f723c.bin6KB
-
71703279d270c858cec42ff2f7240a51ebe20a3ecb3430e6e536818346cbc983.bin6KB
-
7dc7da7399422df05db37c0013f17e7be43d98ced2ced2ff474dd06f0650e880.bin6KB
-
830e2340ff49f0f5121f4a0eca8c352284a5465d79571c7af5b8dab6ba12bef5.bin6KB
-
8778e05a78556ecaff4766447ae94d5f5b57fbe07f3938969146a74b88e866df.bin6KB
-
9403ee5681882cb6a1764433e7a4de1bef4dbbca1f1ff4064d80758dbee511f8.bin6KB
-
Clien123.exe.exe 36KB
-
Final123.exe.exe 550KB
-
NqydMiBpgE71.html .js 32KB
-
Pls.exe.exe 6.9MB
-
cf84d7e0cb40e3ee71aa30a8e48f0b07a2e0a9da9d040a7808c98b4fc6aa3fad.bin6KB
-
e8d48287d594a262ad90a33a5146962f0d5c7c5b19dc1bc6d4dda1fe6da2b388.bin6KB
-
ea4049105f96604d66a2432b02520f25c4361c52665911d88338367a87535e1e.bin6KB
-
f20051a7816b99e820106d7416973ef1456ce81f4f22957eb4010fcb538a9bbe.bin6KB
-
joker12321.exe.exe 1.7MB
-
neploskiy_crypted_LAB.exe.exe 1.4MB
-
xlogin-private.exe.html .js 4KB
0318482370b943e2efd6869d5f23f4d6acc28220fd68a6b260d9d6bf293e1c43.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
090da884f6f667f19ecdee8f746c8683d215a60a3e76050555b952610e2e058c.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
1b590f4d159c180d56879915cc69c051bd59842cbc21cf2cf2ca4a9ccae9c069.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
292077f278b86cd454fa540ef96797ff483643dd1e790fc7916340dafb6c82e7.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
3a5fe17d2c17886c89c34a731640f95436c0da4f3dca7a97f2d0c0c7eb8fc03a.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
3c913fb78fa97595474db3794f8ec673feda96d56aa6d654f0656d52e03b4e89.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
435e1c1e8ad4cfaed8eb6eae4e889159e0b8b8fbe25dbd0f6c6e5240f5634995.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
4573db2cb64b760546e79655f15c896bbf4eb7a0e718f751d1bd7965eba57bfe.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
4dc4fe5db9c2d34ea0e5de7dc8368b5f8b91b57f5558368b354003aa0e88cc9b.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
5671db0edaeab25b3a6dc2c7a6248151ebf1b01fa131852ee0118594a943343b.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
6d1153630a554d363e660a8bd5ee5f88a833410a60f4076b83d04804a5117eca.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
70477bd732f8f89f28078800c3807a6f6af96a3cafa37b5023bf0563e36f723c.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
71703279d270c858cec42ff2f7240a51ebe20a3ecb3430e6e536818346cbc983.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
7dc7da7399422df05db37c0013f17e7be43d98ced2ced2ff474dd06f0650e880.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
830e2340ff49f0f5121f4a0eca8c352284a5465d79571c7af5b8dab6ba12bef5.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
8778e05a78556ecaff4766447ae94d5f5b57fbe07f3938969146a74b88e866df.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
9403ee5681882cb6a1764433e7a4de1bef4dbbca1f1ff4064d80758dbee511f8.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
Clien123.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f4a34b07a3844cf4fd2e7f8db292832fe2322888c2b7ff474a80b8f2b083124c
- MD5 533e0fe585b1b45ee738c6860f5fc730
- SHA1 e0da93022c2d611b9e354464c8bfad23448eaf4f
- SHA512 6369898ed765e6c64a3ec3b82a818f0ce2077c805a98bcac8c0774c59f7483ea674cb700590e0549d1ceec4186a377c47237388bbc51e91b9272dc98f6138e33
- SSDEEP 768:MQ2A5Unv1+tybbH3GASaKy4bFf9kcOMhG3XPS:12A5Unv1+oHHWgKywFf9kcOMkPS
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Final123.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fb11dff450543b8d892e77e8a4e6e87d49a44dab1edf9535cfc9a023aed471b5
- MD5 54d9d4c0b062758f3f13079a5e0187c7
- SHA1 3eb6b874059895f51ab9cf9264af7f2456a81fe7
- SHA512 753145611234c037c5ef74f2eff50825645e425fe494436048255a7c66fea5c490fdcff29d4bed0eba65a9e0085a8fb708ab1769f56e4a7a5e91247d1fdec00b
- SSDEEP 12288:W3mWw0D3jsRDJ7lGr3dQzgSsXnocJqUuX:7J0/wzG7eXs37sZX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
569198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
548KB
Virtual Size
547KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NqydMiBpgE71
- SHA256 29cc3887cca50a37c28cfb6def03e9af553d32aa911a0dbbfcb32f9b26ce16c5
- MD5 b08f8ecf2e6b1154c7433df46b74eb6d
- SHA1 6b88abaf95a84498b65401759e7a2faa106e3a5a
- SHA512 b7f15afb6de293d0cac3ff1d9b861f73a9067faa4217f56253e064f33ff3838c3ab5f5f72d12f50649def298b247702703a38153589c5bc67b63f41a7c399d6a
- SSDEEP 768:FhzykDy7RwOUHBcR3io931z9RywhDqSYOYp9//oohAObAqNNt/0NpzUv0+Y44Um:FhzykDy7RpiowRphWqN72w8+Y44Um
- MD5 SHA1 SHA512 SSDEEP
Pls.exe
- IMPHASH 12e12319f1029ec4f8fcbed7e82df162
- SHA256 c598101df884baa2a9db9162b00fe4ab7adf469ae87d764e6d8b210fe095e565
- MD5 c7a64827a51b9e2b028cc2a96bbe6ba2
- SHA1 32f77327ba5eb6251d90aedd7ebe144b2cd80677
- SHA512 e394da425a0c6fc2d1b6a3a936585d4dbff834203e09f806ed8bd749e365325b4cae86a26426e4c74c66a04b9e5f0511750ebba6b0f485417b38c2c26de7f41e
- SSDEEP 196608:pAjTWdoZO1DCuJI0wqavB85Pa3onMRRA3D5L83PzRU:pnNQ58gfExkPVU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
128304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
DecodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
LocalFree
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
oleaut32
SysAllocString
SysFreeString
VariantClear
gdiplus
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree
Name
.text
Size
199KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=142, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=253, version=30625,
count=19, id=260, version=30625,
count=23, id=259, version=30625,
count=52, id=261, version=30625,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=277, id=1, productName=Unmarked objects,
count=49, id=261, version=30709,
count=1, id=256, version=30709,
count=1, id=255, version=30709,
count=1, id=258, version=30709,
cf84d7e0cb40e3ee71aa30a8e48f0b07a2e0a9da9d040a7808c98b4fc6aa3fad.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
e8d48287d594a262ad90a33a5146962f0d5c7c5b19dc1bc6d4dda1fe6da2b388.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
ea4049105f96604d66a2432b02520f25c4361c52665911d88338367a87535e1e.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
f20051a7816b99e820106d7416973ef1456ce81f4f22957eb4010fcb538a9bbe.bin
- SHA256 d9ff7e0fd2a5adc8d318a78eaae0b79a3023bd1c11a494ff7eca10bdcc43a157
- MD5 58162aab3f28bd0893e6472b2e19f981
- SHA1 bbebafe3096d504692f5ebd82788bc7b6e3b7191
- SHA512 91b247ebb01a3c34ff54d33d422ec1ba4ce0f2e517d92a5fa81a9375f9d1ba5130c68b2bac0f260f226a5f2c26d24b9d5f987dabe7357432fe7caeec3064ccb3
- SSDEEP 192:ckWouTQAyg9Vx4j1RgcXEzmL5xyZnZ4H7HIV:dkTMxN+mRbK
- MD5 SHA1 SHA512 SSDEEP
joker12321.exe
- IMPHASH 53ff33fd5198e78ab468db682bbdf2b7
- SHA256 8d8ad298846b53c543af2edc24dcc9a919a9e2973ea0f979527cbf38a9618855
- MD5 77287c1b514c155b3667a7bd980979a2
- SHA1 c1bb9b7353873a2133f74b7d4e4790b9af60aab2
- SHA512 b5a8789b2ce900b55c37694f237762fe92eb0e3f0c9174399d0a4d0940a2dc1a00e2c90e3f6d8d1e799ba0aa752aac694e2c751903cfc866e704298ed538b39f
- SSDEEP 49152:31eXynVBc80eXqT6ArSea60KBecbV/nXRFwyP4U7:317qkqmAO/6ZdnXYyP4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
29385
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WaitForSingleObject
LoadLibraryW
CreateThread
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
CloseHandle
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetCPInfo
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
SetEndOfFile
RaiseException
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
ReadFile
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
CreateFileW
ReadConsoleW
HeapSize
WriteConsoleW
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cSs
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=177, id=261, version=30795,
count=21, id=260, version=30795,
count=3, id=257, version=30795,
count=124, id=1, productName=Unmarked objects,
count=21, id=259, version=34321,
count=18, id=260, version=34321,
count=85, id=261, version=34321,
count=1, id=265, version=34435,
count=1, id=258, version=34435,
neploskiy_crypted_LAB.exe
- IMPHASH 6d9849ec5bb78ad1155656c6bba60909
- SHA256 2d93bc4ef064b8a824825af4672da00b1651ea42b9b58009816019d801f7ef0d
- MD5 6fdd3fc5b0799393d7ea782b9a5b84bc
- SHA1 a49a3d1fb9e720b36e5bd734c6a46bce605f3686
- SHA512 86952cbf89c6e832671a50ec12f9b55ee810c1bc39715c526a9756852aa378ca29e4ab95108525a59519d8e41d9f1b5cb1965ce0deee90c81f6eef8829308582
- SSDEEP 24576:Ji/6qs1pm4sWw2rHhw9tYlFka94SD4S4xf0gT+fYou5:Ji/671pdHwABstol4yocm+f
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
829540
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
AcquireSRWLockExclusive
CloseHandle
CompareStringW
CreateFileW
CreateThread
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetExitCodeThread
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetEndOfFile
SetEnvironmentVariableW
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
WaitForSingleObjectEx
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
Name
.text
Size
943KB
Virtual Size
944KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.tcp
Size
349KB
Virtual Size
349KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
xlogin-private.exe
- SHA256 8b3e6773d93bbab65f3c4da453fc4921d3e1e09e48ca88eb5d593993407d3132
- MD5 9eb6e8c9fc89af1f2ab61706e6724d4c
- SHA1 b30ff9e1019077b7956f8cdfffaf78117257c725
- SHA512 69602447b142cc91f1314ff6ab1fe5c6dd61652819fd8e3de4e63ebd7790c42f774b08f748ea83d09a80d0f9deb980e8cc74c09f46a81998b55d4c15d8f388d9
- SSDEEP 96:fjFj7jOjEHDK/D5DMFGzLeiO/t8G+XSFqZNeBuk7RbslvaQxvbzM:fjFj7jOjEjK/VounOVxqZyuk7qlCejzM
- MD5 SHA1 SHA512 SSDEEP