quarantine.rar
- SHA256 5cd5b457dec50b2fbca33e0cd340035ac272b47d120e85d6cd5ea7afaf503694
Overview
overview
10Static
static
100EznZvf.exe
windows10-2004-x64
30EznZvf.exe
windows11-21h2-x64
32f34b5X.exe
windows10-2004-x64
102f34b5X.exe
windows11-21h2-x64
10EioNXAE.msi
windows10-2004-x64
8EioNXAE.msi
windows11-21h2-x64
8O6rSznO.exe
windows10-2004-x64
10O6rSznO.exe
windows11-21h2-x64
10OGm4PbD.exe
windows10-2004-x64
10OGm4PbD.exe
windows11-21h2-x64
10QoxOWld.exe
windows10-2004-x64
1QoxOWld.exe
windows11-21h2-x64
1clp1.exe
windows10-2004-x64
7clp1.exe
windows11-21h2-x64
7clp2.exe
windows10-2004-x64
7clp2.exe
windows11-21h2-x64
7clp3.exe
windows10-2004-x64
3clp3.exe
windows11-21h2-x64
3random.exe
windows10-2004-x64
8random.exe
windows11-21h2-x64
8vkGsO6Q.exe
windows10-2004-x64
10vkGsO6Q.exe
windows11-21h2-x64
10wpnAjnT.exe
windows10-2004-x64
7wpnAjnT.exe
windows11-21h2-x64
7zx.exe
windows10-2004-x64
7zx.exe
windows11-21h2-x64
7Behavioral task
behavioral1
Sample
0EznZvf.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0EznZvf.exe
Resource
win11-20250905-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
2f34b5X.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral4
Sample
2f34b5X.exe
Resource
win11-20250610-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral5
Sample
EioNXAE.msi
Resource
win10v2004-20250619-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral6
Sample
EioNXAE.msi
Resource
win11-20250610-en
windows11-21h2-x64
22 signatures
150 seconds
Behavioral task
behavioral7
Sample
O6rSznO.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral8
Sample
O6rSznO.exe
Resource
win11-20250619-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral9
Sample
OGm4PbD.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
OGm4PbD.exe
Resource
win11-20250619-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
QoxOWld.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
QoxOWld.exe
Resource
win11-20250619-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
clp1.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
clp1.exe
Resource
win11-20250905-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
clp2.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
clp2.exe
Resource
win11-20250619-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
clp3.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
clp3.exe
Resource
win11-20250619-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
random.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral20
Sample
random.exe
Resource
win11-20250610-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral21
Sample
vkGsO6Q.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral22
Sample
vkGsO6Q.exe
Resource
win11-20250619-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral23
Sample
wpnAjnT.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral24
Sample
wpnAjnT.exe
Resource
win11-20250619-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral25
Sample
zx.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
zx.exe
Resource
win11-20250610-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target quarantine.rar
- Size 35.5MB
- Sample250930-aa4twszjs3
- SHA256 5cd5b457dec50b2fbca33e0cd340035ac272b47d120e85d6cd5ea7afaf503694
- MD5 d14448520dbfb36c029ccaa411f076a0
- SHA1 d7c3aef8b10003ebc8789fa459ebc699ee3686e0
- SHA512 e7fe4b599e0433919e50604c4a640ef8a86ec60f30f5f0b739ec63ff51a9d7f18296a547981cc0ca4beee8ea63d665e7a6bd6e65585241db7fb476c3d2048d8f
- SSDEEP 786432:4VeUxcHvD5E0jHPQZIn+nUTEa9oq4g1ZFpBKipP7PH/gGL8ch:40ScHvDJWImUTEl6nhlT3gGB
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
vidar
Version
-
15.6
Botnet
-
8abde2dd70fb74562671bec21e396c1fn
C2
-
https://steamcommunity.com/profiles/76561198783900411
-
https://telegram.me/rif0lm
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0
Signatures
- Detects SvcStealer aka Diamotrix Clipper Payload 1 IoCs
SvcStealer or Diamotrix Clipper swaps clipboard crypto wallet addresses with the attacker's.
resource yara_rule static1/unpack004/zx.pyc family_svcstealer_3 - Svcstealer family
- Vidar family
- Codesign digest Mismatch 2 IoCs
File was altered after it was signed.
resource unpack001/O6rSznO.exe unpack001/OGm4PbD.exe - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/zx.exe pyinstaller - Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack001/0EznZvf.exe unpack001/2f34b5X.exe unpack001/QoxOWld.exe unpack001/clp1.exe unpack001/clp2.exe unpack001/clp3.exe unpack001/random.exe unpack001/vkGsO6Q.exe unpack001/wpnAjnT.exe unpack002/$PLUGINSDIR/nsExec.dll unpack001/zx.exe
File Explorer
-
quarantine.rar.rar 35.5MB
-
0EznZvf.exe.exe 4.8MB
-
2f34b5X.exe.exe 2.3MB
-
EioNXAE.msi.msi 14.7MB
-
O6rSznO.exe.exe 9.2MB
-
OGm4PbD.exe.exe 8.6MB
-
QoxOWld.exe.exe 426KB
-
clp1.exe.exe 285KB
-
clp2.exe.exe 2.5MB
-
clp3.exe.exe 219KB
-
random.exe.exe 2.1MB
-
vkGsO6Q.exe.exe 2.4MB
-
wpnAjnT.exe.exe 1.5MB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
$TEMP/Analysts.accde258KB
-
$TEMP/Breasts.accde127KB
-
$TEMP/Clinical.accde.cab 534KB
-
Bc2KB
-
Bondage85KB
-
Booty91KB
-
Chances62KB
-
Chapter132KB
-
Falling103KB
-
Girl84KB
-
Interests122KB
-
Parking115KB
-
Precise100KB
-
Settled61KB
-
Title63KB
-
Watts61KB
-
$TEMP/Leon.accde220KB
-
$TEMP/Patents.accde25KB
-
$TEMP/Periods.accde103KB
-
$TEMP/Truck.accde195KB
-
zx.exe.exe 5.6MB
-
zx.pyc2KB
0EznZvf.exe
- IMPHASH ff906d5ae0d3218e00c9d571874cb7f8
- SHA256 5b9f13a92a778876650781c21ae46bac51f5df203d13a1a958b7c68dd50b7d26
- MD5 c034d05b0a2251cccc0f933b019c7d58
- SHA1 55ca34b941507a02dfc195b8043688ca3f7e630f
- SHA512 137dc68891d4194be99fcf6286f44257a79ad7bd211f2a8d301453dd606132c42a9e75da7acf7946e084615c9b2c43655e2dfbebecf22f4925cf6eff30310547
- SSDEEP 49152:22Tp0Z1UvelS4n8umJoVTraSGj6sP/IUVBQu3YAKC0OXeWUiHfzXuzjG6EG/FEW4:26kGG1DwwTr3Mz2226ruztPHY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4212844
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RtlUnwind
SetEndOfFile
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
user32
MessageBoxW
mpr
WNetGetConnectionW
wininet
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetReadFile
Name
.text
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.EXT
Size
661KB
Virtual Size
661KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
2f34b5X.exe
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 2dd15d74151531c7156a20297429cd371a603b458326d7972b2a95fed0e37ad4
- MD5 17bd4081b31d476755b7768cd4d732a3
- SHA1 92f40cea85051da8032040ceb6a0a44c81efeb7e
- SHA512 cb391645f09e1889aed76f1512f8ea50edd7a27161277db04c9edc7dac941257aa1b4cd9ed90ac9c33ba30ea308711c6d7b2283b7c8064b076d934613a785ac2
- SSDEEP 49152:387Ccat21HcKVhXze73RyQMHjiFp2+TlfxMQnTcoyW8dRX34aZ:6bZBzqsjiFp2+TVxM2Tt94RX3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6524928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
lstrcpy
Name
Size
316KB
Virtual Size
816KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
ovyrmmxb
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
koyjqdyc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.taggant
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=6, id=259, version=30795,
count=170, id=261, version=30795,
count=18, id=260, version=30795,
count=10, id=259, version=34321,
count=16, id=260, version=34321,
count=87, id=261, version=34321,
count=3, id=257, version=30795,
count=126, id=1, productName=Unmarked objects,
count=12, id=265, version=34809,
count=1, id=258, version=34809,
EioNXAE.msi
- SHA256 ddc99d20bd11e08d73f5ce056ee868a46194c7bcada8654045740dbfa943934f
- MD5 6e2a3c6f0afacd6e4d91bd86b8d2fb38
- SHA1 411a25814e0c98a816619fdcb4d2196655845498
- SHA512 d2c24648b4d2a4aa8488dd76dd4980a18f5b1d39c9a4d71d6e6e7cfa0029191e37233c071385135e265cb8a1e35493e57c21e8a7becd039409b8c2e60fdb29d5
- SSDEEP 393216:KmkEdQ03NldhmkEdEmkEdmmkEdfmkEdfmkEdFmkEd:WE2cxbEWEsEzEnEZE
- MD5 SHA1 SHA512 SSDEEP
O6rSznO.exe
- IMPHASH e984c9552167c47b13f80743eea201e4
- SHA256 a34839575f5c229fc83227e0f48fc0eda198a8a17aea8a46d63fa75971d6af2c
- MD5 4204fd41af3dfb7cff54464ea8a4e7e4
- SHA1 16d8d3a532c37e755ddf9700e68ac5e8c094dd09
- SHA512 114beebaa94eb43325ad91e18880442d7874aa81e6bd43cf1391a1792ecabc6762556254dc4b61116884592bd380e5b900ba7c526003cd20f85bcd4d20553d50
- SSDEEP 196608:228xNY5CNVUFTIIvQYnwQsL8tSRAw21Vqi3SRv4bNiMpj:uxNY5ouNI8ML3ZsV3SRQ9J
- MD5 SHA1 SHA512 SSDEEP
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
05:ef:57:c9:ff:42:17:ef:de:68:3e:96:9c:61:73:a6:65:14:b6:21:66:a1:48:4b:74:a7:48:dc:82:f7:63:f9
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 31, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ff:12:38:7c:f7:c1:65:d6:a1:00:01:00:00:01:ff
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
7038898
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetCurrentProcess
CreateFileW
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
Sleep
GetCurrentThreadId
MultiByteToWideChar
GetStringTypeW
GetLocaleInfoEx
WideCharToMultiByte
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
WakeAllConditionVariable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
WriteFile
HeapFree
HeapAlloc
OutputDebugStringW
GetTimeZoneInformation
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
CloseHandle
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
Name
.text
Size
Virtual Size
444KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
247KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.%ve
Size
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.TgC
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.=K.
Size
9.0MB
Virtual Size
9.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
167KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
OGm4PbD.exe
- IMPHASH 5a04a0e7e62f8b207804df45b5571588
- SHA256 d3e31c5dfea816f01a4cd5cb415ac2223bd1f18bea2178861162387d1b6efb10
- MD5 53e0943978d1606268efce672412aee7
- SHA1 cadfd71eb86028212734a7a97705e45b5fb05bc6
- SHA512 5cf6519c50f6ad5bf03b5e80001381f4d90219ec24d80d4a4fd3f0214ea227e6660429d1e77cf2ce255a1e72313fa9bb1269ed53165c1a523b791e469116889b
- SSDEEP 196608:n/dGwsdWWPEgf8SjAblkhhJZT+pXjuyJTK:nFTWPxf8SsKJEBE
- MD5 SHA1 SHA512 SSDEEP
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
55:31:f8:43:40:88:15:f5:83:7b:a7:5f:aa:9b:4d:cf:4b:1f:61:b5:36:62:93:45:10:ca:0e:1b:5f:26:29:62
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 31, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ff:12:38:7c:f7:c1:65:d6:a1:00:01:00:00:01:ff
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
5590961
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseHandle
IsBadReadPtr
SetFilePointer
ReadFile
GetModuleFileNameW
CreateFileW
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetProcessHeap
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MapViewOfFile
GetCommandLineA
GetCPInfo
GetOEMCP
GetLastError
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
HeapFree
HeapAlloc
GetModuleHandleExW
TerminateProcess
ExitProcess
GetCurrentProcess
WriteFile
GetStdHandle
RaiseException
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateFileMappingW
GetCommandLineW
VirtualQuery
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
GetModuleHandleW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
MultiByteToWideChar
LocalFree
lstrlenW
GetACP
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadStringA
GetWindowThreadProcessId
GetWindowTextW
EnableWindow
InvalidateRect
DialogBoxParamW
GetWindowTextLengthA
CheckDlgButton
GetDlgItem
MapDialogRect
CharUpperA
SetCursor
SendMessageA
SetDlgItemTextA
IsDlgButtonChecked
MoveWindow
IsWindowEnabled
SetWindowTextA
GetWindowLongA
GetWindowTextA
SetWindowLongA
ShowWindow
LoadStringW
DialogBoxParamA
SetWindowTextW
TranslateMessage
SendMessageW
ScreenToClient
CharPrevA
EndDialog
GetWindowRect
CharUpperW
GetWindowTextLengthW
EnumDesktopWindows
PostMessageA
DestroyWindow
GetDC
GetSystemMetrics
SetWindowLongPtrA
DefWindowProcA
PostQuitMessage
GetForegroundWindow
ReleaseDC
GetCursorPos
SetTimer
KillTimer
GetWindowLongPtrA
GetMessageA
MessageBoxW
RegisterClassW
GetDesktopWindow
CreateWindowExW
LoadCursorA
LoadIconA
DispatchMessageA
gdi32
GetStockObject
GetDeviceCaps
ole32
CoUninitialize
CoInitialize
oleaut32
VariantClear
VariantCopy
SysAllocString
SysStringByteLen
comctl32
ord17
comdlg32
GetOpenFileNameW
GetOpenFileNameA
shell32
CommandLineToArgvW
Name
.text
Size
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rrx
Size
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.8FY
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.`Dj
Size
8.4MB
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
QoxOWld.exe
- IMPHASH 49404a2848514cd699a7688be7169c8c
- SHA256 84053411fb0297305b893d8786ea90d828a648608bfe6c827fde518f2e67c7f5
- MD5 ad08de15741bbcda5ac1b3dc0ee135f1
- SHA1 cd0d60525254f43cf6effc882e089e708b50e5cc
- SHA512 6b34fca1364db84b47ab108a60b4edaebd6633b4b5dff20952c61a5616a22400e48e98396cac0013f6378bc0e12fc60321297ea79109b01b5f9cefb40df4acd0
- SSDEEP 6144:/raxDt86AF82Noe7ex4VyoEsQNackstjsKr4jWMhp8UeplsZ3DtBq+0:yDt81F16eSackEsimC3pW1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
229328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleHandleA
OpenProcess
GetExitCodeThread
GetTempPathA
GetLastError
CreateFileA
VirtualProtectEx
GetThreadContext
GetProcAddress
VirtualAllocEx
CreateFileMappingA
CreateRemoteThread
VirtualFreeEx
MapViewOfFile
SetThreadContext
OpenThread
HeapFree
TerminateThread
lstrcpyA
CreateThread
ExitProcess
ReadFile
GetFileSizeEx
GetFileAttributesExA
lstrlenW
ExpandEnvironmentStringsA
LocalAlloc
CreateFileW
lstrcmpA
MultiByteToWideChar
Process32NextW
Process32FirstW
LocalFree
GetFileSize
lstrcpynA
WideCharToMultiByte
CreateProcessA
CreateDirectoryA
GetModuleHandleExW
GetModuleFileNameW
GetProcessId
LoadLibraryW
Module32FirstW
ReadProcessMemory
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
Module32NextW
VirtualFree
VirtualAlloc
IsWow64Process
VirtualQueryEx
GetCurrentProcess
GetLocaleInfoW
GetVolumeInformationA
GetTimeZoneInformation
GetLogicalProcessorInformationEx
GetWindowsDirectoryA
GetLocalTime
GetComputerNameA
TerminateProcess
GetCurrentThreadId
K32GetModuleFileNameExA
GetFileAttributesA
GlobalSize
GlobalAlloc
GlobalLock
GetSystemTime
GlobalUnlock
GetModuleFileNameA
OpenEventA
FindFirstFileW
FindNextFileW
UnmapViewOfFile
SetErrorMode
SetFilePointer
GetEnvironmentVariableA
DeleteFileW
GlobalFree
GetLogicalDriveStringsA
CreateProcessW
FreeLibrary
CopyFileW
WinExec
CreateEventA
lstrcmpW
FileTimeToSystemTime
SystemTimeToFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
IsProcessorFeaturePresent
WriteConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FlsGetValue
FlsSetValue
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
HeapSize
HeapReAlloc
RaiseException
RtlUnwindEx
EncodePointer
TlsGetValue
TlsSetValue
RtlPcToFileHeader
ResumeThread
SuspendThread
WaitForSingleObject
Thread32First
Thread32Next
WriteFile
WriteProcessMemory
GetProcessHeap
HeapAlloc
DeleteFileA
CopyFileA
lstrcatA
FindClose
lstrlenA
FindNextFileA
FindFirstFileA
GetTickCount
GlobalMemoryStatusEx
GetSystemInfo
CloseHandle
Process32Next
Sleep
CreateToolhelp32Snapshot
GetDriveTypeA
Process32First
user32
CloseDesktop
wsprintfA
GetCursorPos
GetForegroundWindow
GetWindowTextA
GetAsyncKeyState
ReleaseDC
CharToOemA
GetKeyboardLayoutList
GetClassNameA
GetSystemMetrics
CreateDesktopA
OpenDesktopA
CloseWindow
GetWindowRect
GetDC
wsprintfW
GetDesktopWindow
EnumDisplayDevicesA
gdi32
GetDeviceCaps
DeleteObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
CreateDCA
advapi32
RegCloseKey
RegGetValueA
RegEnumKeyExW
RegGetValueW
CloseServiceHandle
OpenSCManagerA
GetCurrentHwProfileA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA
GetUserNameA
shell32
ShellExecuteExW
ShellExecuteExA
SHGetFolderPathA
SHFileOperationA
ole32
CreateStreamOnHGlobal
GetHGlobalFromStream
CoCreateGuid
shlwapi
StrStrA
PathFileExistsA
ord156
PathMatchSpecW
PathMatchSpecA
ord155
StrStrIA
crypt32
CryptBinaryToStringA
CryptUnprotectData
wininet
HttpOpenRequestA
InternetReadFile
InternetConnectA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
InternetSetOptionA
HttpQueryInfoA
bcrypt
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptDestroyKey
BCryptGenerateSymmetricKey
dbghelp
SymMatchString
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=260, version=33140,
count=27, id=257, version=33140,
count=275, id=1, productName=Unmarked objects,
count=8, id=259, version=35207,
count=13, id=260, version=35207,
count=38, id=261, version=35207,
count=148, id=261, version=30795,
count=10, id=259, version=30795,
count=12, id=260, version=30795,
count=15, id=265, version=35211,
count=1, id=255, version=35211,
count=1, id=258, version=35211,
clp1.exe
- IMPHASH 81b187eca349978e3078c7638f065375
- SHA256 07bbff7609b94e8853575e3a6803f33435e8d3ede7d96edd83237b583b76b716
- MD5 d9160a72105c9d6cb90640bca60aa426
- SHA1 9d9a05370565419710e8dcc869af231e95f6fa08
- SHA512 244e8e1b596e08d3dced74cd962faa76c0e3292ccc04d363ca5373907bcb79e68e6c67df49fc2acf58b605de19d8a08409817e9c656c5b91801cb46bff04cdc2
- SSDEEP 6144:e08PTg5OfhLPzDnHfCeQKIwOYTQBMrvSq+8+ck/aZ:e0O3uKJOq+8+r/a
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15508
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
SHGetFolderPathW
shlwapi
StrStrA
advapi32
LookupPrivilegeValueA
RegSetValueExW
RegCloseKey
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
user32
wsprintfW
kernel32
SetFilePointerEx
WriteConsoleW
CreateFileW
HeapAlloc
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
ExitProcess
GetCurrentProcess
Sleep
CloseHandle
CreateDirectoryW
CreateRemoteThread
OpenProcess
CopyFileW
GetModuleFileNameW
GetLastError
VirtualProtectEx
VirtualAllocEx
Process32FirstW
IsWow64Process
Process32NextW
lstrcatW
CreateMutexA
CreateToolhelp32Snapshot
ReleaseMutex
GetWindowsDirectoryW
DeleteFileW
WriteProcessMemory
SetFileAttributesW
GetVolumeInformationW
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineW
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
HeapSize
RtlUnwindEx
GetStdHandle
WriteFile
HeapFree
RtlPcToFileHeader
RaiseException
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
GetStartupInfoW
GetModuleHandleW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
HeapReAlloc
OutputDebugStringW
LoadLibraryW
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
206KB
Virtual Size
215KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=185, version=30716,
count=113, id=1, productName=Unmarked objects,
count=35, id=207, version=50628,
count=87, id=206, version=50628,
count=9, id=205, version=50628,
count=7, id=211, version=50727,
count=1, id=201, productName=VS2012 build 50727, version=50727,
count=1, id=204, productName=VS2012 build 50727, version=50727,
clp2.exe
- IMPHASH 8ed6aa9152dc039d4f6a043fa84760ed
- SHA256 1cb6e45260ceb3e87ed70186e68a76387c87f02fafdb1ea1a643ac396f4ebeb6
- MD5 1ccf1a899a976e837ebd6ea25ab9ed2d
- SHA1 adeaa80c9762c42ccf43c4bae9dca4feb63d9561
- SHA512 7ffe75a76f41c03afe1491bef5f0fb011ecdcc45d93ace45dc1ddbcdfa90ed1d91b3d2563f40f47529572533d6d34fac1ee06a848afd4a0a3af28e226ae3ee4d
- SSDEEP 24576:r4gqDgxMEMLb0BcepQ+VhTHO9VkQbX6v1MDZ88Z8yYRK/WQib24/+UbPE/pF7t7K:r4LMmEB5O9RMyhSb1I/pFRK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2062324
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetEndOfFile
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
ole32
CoInitializeEx
user32
MessageBoxW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
comctl32
InitCommonControlsEx
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.bss
Size
285KB
Virtual Size
285KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
clp3.exe
- IMPHASH 00fdb61bc742b9dfa47c3d013f510010
- SHA256 d5028ec38afef94feba1e756701f684e5163c833b706d636c78db0869546a0b4
- MD5 e6e10a62d3a63acad5ab7d34e614b03b
- SHA1 f6ba076545d51d7943200a0b4d2bc26e49346e73
- SHA512 6b8b8a9fe851ae6a564f88c9b246de2e01d2e61c1adf4a4b31fbcbf2b9699fd4b2a7a2603ada26f99ffcfb1127ff82407d4f65622c46ffb2d9d1833305653ffe
- SSDEEP 3072:u5j76SvHoc773/Oyf054mxIOjAjyM3KZj5lJGvVQSzr0T1u0nOWLLa92bB2M870x:cBH+54m2OCy/JGv/zYJOQATxFe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
73117
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
GetUserNameA
kernel32
FindFirstFileA
FindNextFileA
FindClose
GetFileAttributesA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WriteConsoleW
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetFileSizeEx
SetFilePointerEx
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapFree
CloseHandle
HeapReAlloc
HeapAlloc
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
SetEndOfFile
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=174, id=261, version=30795,
count=21, id=260, version=30795,
count=21, id=259, version=33731,
count=18, id=260, version=33731,
count=5, id=257, version=30795,
count=93, id=1, productName=Unmarked objects,
count=78, id=261, version=33731,
count=1, id=265, version=33812,
count=1, id=258, version=33812,
random.exe
- IMPHASH 12e12319f1029ec4f8fcbed7e82df162
- SHA256 02fa7b3938307308295d97e268427d7f9e303157c55b9ad5186944687f9361ab
- MD5 315bd7da1fcc900d1271b312eb91d09d
- SHA1 40e81d42da142d02db54a4c17d0fca9346e23a2a
- SHA512 d253bdf78ddb0b90eb1ad4da6858ca7b8dc08ad6cb4aa06710762a92336dad7da5ac1c4f91ec9efabd1c603cbffdc86cfb748db00f83e10b74137ef0183f677e
- SSDEEP 49152:IBJpTpc8iYMg+rINgOmgHGPBUlZ7eHupDPl4:yvTFMkiDBU77eHuc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
128304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
DecodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
LocalFree
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
oleaut32
SysAllocString
SysFreeString
VariantClear
gdiplus
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree
Name
.text
Size
199KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=142, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=253, version=30625,
count=19, id=260, version=30625,
count=23, id=259, version=30625,
count=52, id=261, version=30625,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=277, id=1, productName=Unmarked objects,
count=49, id=261, version=30709,
count=1, id=256, version=30709,
count=1, id=255, version=30709,
count=1, id=258, version=30709,
vkGsO6Q.exe
- IMPHASH 73109aabc46d7fe64b61778f5bdbb540
- SHA256 da14768bd291ad71f8c10c39c71d3c869e488aeca2bb382d9d393fd0597641d6
- MD5 d41807076538827c81a4a11e5947206c
- SHA1 f542a3c6bc24f2ef7fd87e0503a682f2e0f7ad47
- SHA512 9413f49633978681bd489ce34fbc9753de883645cd3ee61b4ecff39a1fa14c412eee520d5eaaaae3fde617b39392212d20c35f63811e00052e6498ed96e724cf
- SSDEEP 49152:zyq1pQ0SNj9Ofs4dQWcp5WJv15CC8YfVwV/lKlaa:z9pQ98s4CWwWT5CV+2LK1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1958148
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetEndOfFile
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
user32
MessageBoxW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
comctl32
InitCommonControlsEx
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.TLS
Size
240KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
wpnAjnT.exe
- IMPHASH 32f3282581436269b3a75b6675fe3e08
- SHA256 f19e395f6af72b7882f8f6c1603e6d762b9c7dfa088759410b0fbc18c458854b
- MD5 335c9a9b811b79bb2da5dcee26b34502
- SHA1 c9c0ce60617a348e951c0fb742de037b86635a82
- SHA512 a0ed0c8959bb30d893114c355a59130a3d5e035769602af861cf897e4cbe500062099044720cc63d7d8f60922d4eefce70de5e20bb777a6b3b3c3ab9a9507242
- SSDEEP 24576:fHuK+rT7nCRR8q/aHzu5f4xUshxkPKamOSzio/q8dAQvaY6mfdmQp8WvM02l:4AnaHzukUsh8KDLWoCkAFLmfRnM02l
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
14819
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA
user32
GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation
advapi32
RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
415KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
772KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=172, id=1, productName=Unmarked objects,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/nsExec.dll
- IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyW
MultiByteToWideChar
lstrlenA
lstrcmpiW
lstrlenW
ExitProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcpynW
GetCommandLineW
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
GetModuleHandleW
GetTickCount
GetStartupInfoW
CreatePipe
GetVersionExW
GlobalLock
DeleteFileW
lstrcatW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
PeekNamedPipe
GetCurrentProcess
user32
CharPrevW
CharNextW
SendMessageW
FindWindowExW
wsprintfW
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
454B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=46, id=1, productName=Unmarked objects,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
$TEMP/Analysts.accde
- SHA256 9a96fc245cd75b7a8c8ce4dbe6ffe4f05d8bd608f4cd63d5a1d1f20cb447e783
- MD5 957c6548da79923c10f3abe1348150b8
- SHA1 d8a41ff0d8f9b1b9a06417cd8f917ec7f4376f8f
- SHA512 0faa85ceb554df8778bda98c71dd0597d1c1d179362440906f2d41fa470aab5c36584401eb01606d156579c64a83b447fac21618197bb24f87c175a9ba90ba49
- SSDEEP 6144:A//KzEH0ZCdiZkSOpt/cmXDpH/LglPjfWOosnsbky:2/Ku0ZCdYkSet/cmXDpfmPDWOpmky
- MD5 SHA1 SHA512 SSDEEP
$TEMP/Breasts.accde
- SHA256 c9cfeaf5d6de9fe8841a36fe07281ed8e68af8a714afebcc3a6fa847d0a4fdd4
- MD5 cc3db45f1b3688940a419ad771d687fd
- SHA1 4dc81ea3b890dd666b27b2bac39f2df079f006db
- SHA512 9d868f436ce272eedf54ee153dde746b4821c19b4f17104b6f9259a0d3b2988e9e8ce2b55e570baf3cefaa9723b1b2474c2f6a00016754d60e3c5355e3563b52
- SSDEEP 3072:5wRm7ovO0fFan4tcehiGgntvFmBAk68MDt23xwQ5S9OAg3MSNV:5bovO06WcebgnZFm6k3MDYg8AgcIV
- MD5 SHA1 SHA512 SSDEEP
$TEMP/Clinical.accde
- SHA256 b13a9c195aa404449c4fb603a79339e714361cf384398c2e4c6867a37b2b984e
- MD5 348ea005abc62ae3b793876e2c0c8c0a
- SHA1 3022dd4b1314d69faa952cdd486d7037f8d3dff6
- SHA512 21611babc75d70b4111b35a884e1a4e50d3524e6126262d2f9bd823fced60668f74c0f1f8f32df74cdbe09a8d915a139e28ff3e912264ad50b7b447241a7c2a6
- SSDEEP 12288:CXvGD2Q1NRa8Vf1xJD3aHslEktKNn32LQtWlfF+IWwLLl:GmRBfR3aHslEYS32LWWlYIWwt
- MD5 SHA1 SHA512 SSDEEP
Bc
- SHA256 b628c6d82e1f62049be5f714052f485dd885b4257b49e43ff2af902dca640020
- MD5 ea4b8f19cbfcfbc6fbf59d8cd3eaa51a
- SHA1 7fd36ec0aac6db2be5ca31010703c8bb5192d8b9
- SHA512 0c7233a846070d1613f8f1a26cc6fcea9265826500d70201eec5e37820ba724c68286f0f9bb41c95d9df03f0ffbfec2de5aedfdfc5025e24a9c1f77459d513f1
- MD5 SHA1 SHA512
Bondage
- SHA256 4a1109c1b37ada793f222686042625c5d6a554ec1f95e5e0b18e969d0f8af93d
- MD5 7e94193121a2010f2c49524f8a5205ef
- SHA1 17038c71f56164546f9ab025980e6478c7a0e0cc
- SHA512 852b7b0404ad7b1ef9f91caa9f6dd70ee56329db7b8d9d2749357536941b681d3a508efe150ed36df62242b83ebfd0892c470de39c0a0db02d312395ddbd8e22
- SSDEEP 1536:X8dwzGUbFi5/0DImKPEUSbqpTjTvkQr2Ny3GEfGxfPkDiHyvlHFLppp14wW:MKz50/0DIPEXbeTjDiNyWEfGxciSvbDG
- MD5 SHA1 SHA512 SSDEEP
Booty
- SHA256 76f84b0ba3cae2ede6f5b492489f6cd316fc76afb50cbf9652eb9682ba05bb62
- MD5 d0a9d5da058e0e9aae1981e44ec87122
- SHA1 6ea96f603825aae7f0a24e0dd3063ff36b429c72
- SHA512 afd92d63bad70c3d15e68e3e6c9a4ed6cf06ebcf986ad93f97f7923f97af866bdbe1eeffd0900b2ea31a4659d45e17e2afa4a03809fb840381fa68473b826a58
- SSDEEP 1536:29GTnb+aTOpA0KOWZ59Dqd2LoanG5Yh+f863I5DypFOlJL4x7KBgtIZnsjAZNLn8:Cenii0yD1LoanUveooL4x7KBgtEnsjA0
- MD5 SHA1 SHA512 SSDEEP
Chances
- SHA256 bc278f2209fb4d8e20aa5498936e774c04e8f06f4a1cf44c1c5a3b64f59c4e4e
- MD5 0cd5c213c2171ded9c1b85e2b9693b24
- SHA1 52e69f13f525281913509e02c63bbefa59d51975
- SHA512 bc0069fdb949952fbf3c2a117a8fad165861a8afc3e417edea87627a1515c7dcead76e449963f9673d2a4a4178d3e838ad0c4ae732690ae34dcc6670517628d8
- SSDEEP 768:B06NwTJTqJ1w0FtgqUzRCM2q26e41P5P395YNJ0m3PHM1lnQwcERUVMpnNnPz1gU:3NwFqGqUqHHM/cZ+nVz1gNlySkcFs1dv
- MD5 SHA1 SHA512 SSDEEP
Chapter
- SHA256 0f89d919524aae4c670222ec277b103357b32a39f8372507626c3b7bafe3514b
- MD5 d3208a100bbf9f1231fa54062ed4dfce
- SHA1 d33add79ea4fb40d7993b5d8747c9194021180cc
- SHA512 dc6121886dbc29ffcc59874b70b1b0a3d858399f39623f02e287465e6bcd99dd6cdb95e04182f44e877b98a8a68a0bb30d26296307119598c4d44d9387d7323d
- SSDEEP 3072:VinlsgIhs3kmTmwZDgGbDHVAc6jG31Izxsp:VilsgIhy4sDVbDHV7A3ip
- MD5 SHA1 SHA512 SSDEEP
Falling
- SHA256 6de036787a251d9aa3c9fbb2d28f93fb486ce2adcd9c595923bef39b2efde511
- MD5 eee149f9a346dde12471d90c282df863
- SHA1 0e33a8ab4e2939f9793f9cc0f0ed662434e5f55f
- SHA512 2fccf1baa38f43f6515cd00f300d4c93814af843c0e52e4b8da388cefb6c03148e85452624f6bcde6633b280aadcff37d1ed5d0f9a41bccaafcae07c6f753270
- SSDEEP 1536:7jKd1bS1wwQOchO+534IY1GsTrkerRIb+cgbrnoZwknr63Er:yd1bvhOYSQurhrRIb+c2oZxr6e
- MD5 SHA1 SHA512 SSDEEP
Girl
- SHA256 35f4c21ee3bb01139d36fc02668d5f59cf48b02eefd6f293fadd43403e925d97
- MD5 11abdfd2b482d88fa9924ec70ded5233
- SHA1 82209b92f0347dae888e40bb6f242e873001cf02
- SHA512 ff7cc42cadbe005f91404f94baafc816dc32bf3632652b7a8f3c7a1d9e19cbe05023fcb044200912e7a47e5718ead495fd214396bb6172838706ed58eba2beb4
- SSDEEP 1536:rNBTCUXIH42r7snyuXG5egqzIU15AG73prFCZ:JBZ4trwnNX51ztE
- MD5 SHA1 SHA512 SSDEEP
Interests
- SHA256 8d6f897b3f65c0b9f39b950625b40658dc29b0038d6779bfd3a49bf7962c44bd
- MD5 bdaaa3d9d8854afd5750a19b00c41e7f
- SHA1 43f2909cca51fedb07f2df8b14650df5eaa000a5
- SHA512 79bb5a62a283038913f3922cd86d2df7dfb5783f4315d0d552ba028cc1e0d55ceadef48cabc46f896ad3ae211f59803c6fcebbcabaf54b98f45f079abd6f8912
- SSDEEP 3072:Z36sVtT6H04k5h6m/Fy0UhMsqu5OonZkFNrsj8:B6snrZ/FfUhMsqu53mFxsj8
- MD5 SHA1 SHA512 SSDEEP
Parking
- SHA256 d2bfc6f9d78b842c5afa43cb56d4c11431ac462cb7b4987c77067072be9eb85c
- MD5 3ab297193f16a61d58140d5d0275e01c
- SHA1 a8344526b33f008ec708d04b8dd4f622db14a9a7
- SHA512 6bff87aad2d860b12b9f54423f6c4ab2db9828f876fe778a71a31baed0eb0e4e2b4b4663dce0d7a16ee43a086dd2941cc800b744e3ca484bdadc7c19ac1c89d5
- SSDEEP 768:2XsmOuyxhSaAwuhXGc/mex/Sm1fBAGWRqA60TojLsyuR24dvTcc+HGdT:oQu5aAwurPtRB6j6rs84dvTcAT
- MD5 SHA1 SHA512 SSDEEP
Precise
- SHA256 abb04500401f1dfa43b764c3f9a8f5913e24ee0225df7430fea16f9896ad6991
- MD5 daf64827732d52099773ced0d1e42a09
- SHA1 0cdd5f79ba8d2c72049ebed166d5a70813d59846
- SHA512 56f06be82516e416e209d6e309daf4215e055e9d1fdb09961cacd1bdcc9b7fd4a114a482e31d08f56662bc27d19c3f66056339712de045f98fb1a8c7669c623a
- SSDEEP 1536:Vh50sYpwy8c1BY/6Qaa2W+GOq7owMa4IY1GsCPeFmHz1vNq8S4pG+3DY0kkraxjZ:VR1yciPWprowM3Qm23DjOH4IoVcfH
- MD5 SHA1 SHA512 SSDEEP
Settled
- SHA256 cd4b21960ec2d4ef121fd2ca944e21c1e9807c0e8225d54eed6a0769247adf16
- MD5 619a00fff482ac66bd374285efd5fcaa
- SHA1 a0e322b0499325ed9ec008fcd5219bdb34d1cf87
- SHA512 4570c9ebd2798cc690499e44e0d01a82653cbaab5751dc01bfe9237f5ee895c4c468d85ed9d167502280cbe916fd400cef0a56810f5a5b8856b4af78e8401f2f
- SSDEEP 1536:IebjpcU8VSCxAp1HElS4F1ZoLz3BuXTHdToONU7DYr8:4U8QCgh+qLzxc9TvNU7DYr8
- MD5 SHA1 SHA512 SSDEEP
Title
- SHA256 27da49e4aeca98b65396c6af99ab6f6b8186365beb23a0fadb273456a1062fa7
- MD5 8e7511594c2911c2d9daea4d0aec1ef2
- SHA1 3ab5788615f495bc8774b3d3a9b87b48f4b006aa
- SHA512 e29eef9141017098da6c2d8a018ba9d509c31d049cbf1b83ce950587f95cf965f856b4528ca84636e04c98c1ed6eb0befbb4996fd75892aa8ad3f64d968abfe8
- SSDEEP 1536:oMvAS8W+ogxSOaSUHPljMWsUvNFk5RMnH:oUhijUvlgTRMH
- MD5 SHA1 SHA512 SSDEEP
Watts
- SHA256 1206ad73d8b17b8378769e3c0d9570f663162a2a92a6fff25236b98fc8b984a0
- MD5 cc2434d1355435e6671bad80b877144e
- SHA1 3aa2760347e23d3b6d7cf623772d11900554918a
- SHA512 8c9c8ec8d0366985f66228eb1119e757514c9da0c7857cf266563cad4bcf6c4b8f74005a6727647fc1917245b738db162e252481e763b95451fa748209fc4b6c
- SSDEEP 768:sr8qcDP8WBosd0bHazf0Tye4Ur2+9Bkk2TalOSVWV9+k:srDWyu0uZo2+9B4u0SQ
- MD5 SHA1 SHA512 SSDEEP
$TEMP/Leon.accde
- SHA256 f77380d4714d8371354554e3abba0cf03b10d66084c536a368453b2cfc436878
- MD5 4ff509ce2e3af3f04c1ab45c8020c9f0
- SHA1 bca331ebdb7631e9b72e1ec7b9765a6bdc2ffa44
- SHA512 23ea761d58a174a0c81c6ce7c011453e6c640b4426e47979deb3e4baf77e1354501a2df3855d767f2876fd999538212f58f0932c0e2653f7980feab317ee8bf4
- SSDEEP 6144:aqu7iEVAzMMKioHnCsQijENiws1JuTvL/:aqu2EVFiY0l7sCn/
- MD5 SHA1 SHA512 SSDEEP
$TEMP/Patents.accde
- SHA256 7215bb11d3ed9aea0c39186451fa69787c559e9b3dffde904ef6fa60144486d3
- MD5 a4fce407e63f0622230c7907f3e4f6dd
- SHA1 a33b1fc43812a73150e31e5534cbefde5e79ae29
- SHA512 dc53650bf9a2859281f5ca1a8a9e620156b93a67bc3375c3e4cd3d8309f5e585df68a25d420f3e89ad9a7687e9914ab36c1d5bca17ca5c442c5d61412d90dfbc
- SSDEEP 384:9lprF0ANSuICAv1ykicIEPWvpDEN86B8v0lKBXAB17Gxt2ZX:9llFZ9WykHIrpA66q8AXi17GH+
- MD5 SHA1 SHA512 SSDEEP
$TEMP/Periods.accde
- SHA256 f16f5bcd5d15019f690e851417360b3c2d582d27dc57a24c8ebf756fcb12e59d
- MD5 8e928d55896a32b6760bbc81d7efcc1a
- SHA1 a9c12bf7eb2b3e7a01546fbdd0e30112cb3dcd88
- SHA512 39a9424a28f382310ae6490c1ae8bc8d50bdf4d8d8eeb3d7fced7c01e361ddc74904d2c230b782cfed8601aebe583b1fda1a5062f712e8a0daaf1bebc22402a9
- SSDEEP 1536:ttNoLpDLZaXoNG0fJ2L54/JJOxtUqg8huWH4R5Qf9I+Q/Hy05mfoBsbvsaAen8It:B0Gwc6w7HYRyf9I+pySoBsjs1enXv
- MD5 SHA1 SHA512 SSDEEP
$TEMP/Truck.accde
- SHA256 e26b4a790558c6492e227fea8abf8a81fe29f0bbf884816ac3f90d5dbed37e4f
- MD5 a30a9881bbf4552d955a8b8a06680511
- SHA1 67024de53225c8cef3c6fd9a0e41570779cb57c9
- SHA512 403d6e1b55e60955c5226fba707c5a4ad134e3bbe48e9f892177c3b2c38a26bece1271f16fc2991a3795f0f04c29bb9cdf95fb7f5cef88bc70fb801726021692
- SSDEEP 6144:lnoN5eJTnxzKNY4teN9sbUIROFN3F81G0:U5eJc/8N9zHPCo0
- MD5 SHA1 SHA512 SSDEEP
zx.exe
- IMPHASH 456e8615ad4320c9f54e50319a19df9c
- SHA256 4bbfdd9676fecb9b771efa9d6edd7756e6fa88e45b8e73258a52b760c43cd95a
- MD5 b1afd38d3dc427e0b39c85add64ad1b9
- SHA1 a637be3178a9c205023ae44f534b3a388475708d
- SHA512 2d2186a407ddadbed054da9aaf218f71792fc4bbcc89a221d1ccdaa331d44f7db2a25f5aee45503b607c9e7891650fbf7bc8387d6aecd1f2334f0dc82d15e3ee
- SSDEEP 98304:QeEq2B/JWHioVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAx06btVUJFae583qIb:Qf0HiouWJysVYvsOaoyMxxvjDDAx0ai
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
49360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
GetLastError
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
IsProcessorFeaturePresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=180, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=33731,
count=9, id=259, version=33731,
count=17, id=260, version=33731,
count=40, id=261, version=33731,
count=11, id=257, version=30795,
count=145, id=1, productName=Unmarked objects,
count=25, id=260, version=33811,
count=1, id=258, version=33811,
zx.pyc
- SHA256 c6aeb9e58c976c2dc4329532653ec651cfe8da7306b270f5487535bdf193770b
- MD5 2c7128c8b848a58c242c732bbbe2b263
- SHA1 8c7304a04222858631ad2b5eb1f42fe2ac59de12
- SHA512 c7444a25aec9d4b0632fa06ae29ecd265cfe6998b0085e0fb50db425671adbdc5fcfa98ea4031093cbcf1205a68b89a79a99ff77f55d7ed8cda2bc2bb8a4cbde
- MD5 SHA1 SHA512
-
Detects SvcStealer aka Diamotrix Clipper Payload
SvcStealer or Diamotrix Clipper swaps clipboard crypto wallet addresses with the attacker's.