251028-vkjxpaxrap_pw_infected.zip
- SHA256 6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445
Password
infected
Overview
overview
10Static
static
10251028-vkj...ed.zip
windows10-2004-x64
1251028-vkj...ed.zip
windows11-21h2-x64
1Malware-1-master.zip
windows10-2004-x64
1Malware-1-master.zip
windows11-21h2-x64
1Malware-1-....0.zip
windows10-2004-x64
1Malware-1-....0.zip
windows11-21h2-x64
1Malware-1-...ad.exe
windows10-2004-x64
4Malware-1-...ad.exe
windows11-21h2-x64
3Malware-1-...ed.swf
windows10-2004-x64
3Malware-1-...ed.swf
windows11-21h2-x64
3Malware-1-...ti.exe
windows10-2004-x64
5Malware-1-...ti.exe
windows11-21h2-x64
5Malware-1-...re.exe
windows10-2004-x64
10Malware-1-...re.exe
windows11-21h2-x64
10Malware-1-...he.exe
windows10-2004-x64
10Malware-1-...he.exe
windows11-21h2-x64
10Malware-1-...op.exe
windows10-2004-x64
7Malware-1-...op.exe
windows11-21h2-x64
7Malware-1-...ue.exe
windows10-2004-x64
1Malware-1-...ue.exe
windows11-21h2-x64
1Malware-1-.../o.exe
windows10-2004-x64
3Malware-1-.../o.exe
windows11-21h2-x64
3Malware-1-...B8.exe
windows10-2004-x64
10Malware-1-...B8.exe
windows11-21h2-x64
10Malware-1-...dme.md
windows10-2004-x64
3Malware-1-...dme.md
windows11-21h2-x64
3Malware-1-...ig.exe
windows10-2004-x64
10Malware-1-...ig.exe
windows11-21h2-x64
10Malware-1-...sm.exe
windows10-2004-x64
10Malware-1-...sm.exe
windows11-21h2-x64
3Malware-1-...er.zip
windows10-2004-x64
1Malware-1-...er.zip
windows11-21h2-x64
1Resubmissions
22/11/2025, 17:35
251122-v57jgsbn8x1022/11/2025, 17:26
251122-vz93esbn4z22/11/2025, 17:15
251122-vsrmhabm4v1022/11/2025, 17:02
251122-vkblbavldp1022/11/2025, 16:57
251122-vggyxsvkgr1022/11/2025, 16:49
251122-vb6ebsbk511022/11/2025, 13:45
251122-q2m88aaj4t1021/11/2025, 21:15
251121-z4cpyagj3w12/11/2025, 03:22
251112-dw9ttaxrgx10Behavioral task
behavioral1
Sample
251028-vkjxpaxrap_pw_infected.zip
Resource
win10v2004-20251016-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
251028-vkjxpaxrap_pw_infected.zip
Resource
win11-20251015-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
Malware-1-master.zip
Resource
win10v2004-20251016-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
Malware-1-master.zip
Resource
win11-20250502-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
Malware-1-master/Blocked-v1.0.zip
Resource
win10v2004-20251016-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
Malware-1-master/Blocked-v1.0.zip
Resource
win11-20251015-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
Malware-1-master/Download.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral8
Sample
Malware-1-master/Download.exe
Resource
win11-20251015-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral9
Sample
Malware-1-master/GunMayhem1unblocked.swf
Resource
win10v2004-20251016-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral10
Sample
Malware-1-master/GunMayhem1unblocked.swf
Resource
win11-20251015-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral11
Sample
Malware-1-master/Illuminati.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral12
Sample
Malware-1-master/Illuminati.exe
Resource
win11-20251015-en
windows11-21h2-x64
13 signatures
300 seconds
Behavioral task
behavioral13
Sample
Malware-1-master/Software.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
9 signatures
300 seconds
Behavioral task
behavioral14
Sample
Malware-1-master/Software.exe
Resource
win11-20250619-en
windows11-21h2-x64
9 signatures
300 seconds
Behavioral task
behavioral15
Sample
Malware-1-master/apache.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
23 signatures
300 seconds
Behavioral task
behavioral16
Sample
Malware-1-master/apache.exe
Resource
win11-20251015-en
windows11-21h2-x64
22 signatures
300 seconds
Behavioral task
behavioral17
Sample
Malware-1-master/butterflyondesktop.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
17 signatures
300 seconds
Behavioral task
behavioral18
Sample
Malware-1-master/butterflyondesktop.exe
Resource
win11-20251015-en
windows11-21h2-x64
17 signatures
300 seconds
Behavioral task
behavioral19
Sample
Malware-1-master/eternalblue.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral20
Sample
Malware-1-master/eternalblue.exe
Resource
win11-20250610-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral21
Sample
Malware-1-master/o.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral22
Sample
Malware-1-master/o.exe
Resource
win11-20251015-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral23
Sample
Malware-1-master/qOA7iZJcoB8.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral24
Sample
Malware-1-master/qOA7iZJcoB8.exe
Resource
win11-20251015-en
windows11-21h2-x64
7 signatures
300 seconds
Behavioral task
behavioral25
Sample
Malware-1-master/readme.md
Resource
win10v2004-20251016-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral26
Sample
Malware-1-master/readme.md
Resource
win11-20251015-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral27
Sample
Malware-1-master/rig.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
9 signatures
300 seconds
Behavioral task
behavioral28
Sample
Malware-1-master/rig.exe
Resource
win11-20251015-en
windows11-21h2-x64
9 signatures
300 seconds
Behavioral task
behavioral29
Sample
Malware-1-master/sysm.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral30
Sample
Malware-1-master/sysm.exe
Resource
win11-20250502-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral31
Sample
Malware-1-master/wannakey-master.zip
Resource
win10v2004-20251016-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
Malware-1-master/wannakey-master.zip
Resource
win11-20251015-en
windows11-21h2-x64
0 signatures
300 seconds
General
- Target 251028-vkjxpaxrap_pw_infected.zip
- Size 45.4MB
- Sample251122-vb6ebsbk51
- SHA256 6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445
- MD5 1fcf428d37f7ae7b425fba9668098b14
- SHA1 34f4131bd058cca977147eaf957464837b5d7ada
- SHA512 3d96349fd73e3ba35060419d8401df78550d21e203a6b7e30a10345cc0622342a6ba64dc9a12cf7a94f58c9c649fed27870f0cdafee302516d41f89cc2691518
- SSDEEP 786432:a5sC4IUx4TDGguUu80jqUg69lYBjKYRDm6kWB/Q+7uOZ+c1WfMQVZr/EapS621oP:a5tHHYz80jLJYIYsKXT/1/Qj5wX4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- XMRig Miner payload 1 IoCs
resource yara_rule static1/unpack002/Malware-1-master/rig.exe xmrig - Xmrig family
-
resource yara_rule static1/unpack002/Malware-1-master/rig.exe vmprotect - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/Malware-1-master/Software.exe autoit_exe static1/unpack002/Malware-1-master/wintonic.exe autoit_exe - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack002/Malware-1-master/sserv.jpg -
resource yara_rule static1/unpack002/Malware-1-master/Illuminati.exe upx static1/unpack002/Malware-1-master/apache.exe upx static1/unpack002/Malware-1-master/mysqlconf.exe upx - Unsigned PE 31 IoCs
Checks for missing Authenticode signature.
resource unpack002/Malware-1-master/2530.exe unpack002/Malware-1-master/2887140.exe unpack002/Malware-1-master/32.exe unpack002/Malware-1-master/5.exe unpack002/Malware-1-master/96591.exe unpack002/Malware-1-master/Amadey.exe unpack002/Malware-1-master/Download.exe unpack002/Malware-1-master/Illuminati.exe unpack002/Malware-1-master/MEMZ-Clean.exe unpack002/Malware-1-master/MEMZ-Destructive.exe unpack002/Malware-1-master/Petya.exe unpack002/Malware-1-master/Software.exe unpack002/Malware-1-master/WannaCry.EXE unpack002/Malware-1-master/Win32.EvilClusterFuck.exe unpack002/Malware-1-master/apache.exe unpack002/Malware-1-master/butterflyondesktop.exe unpack002/Malware-1-master/crb.exe unpack002/Malware-1-master/eternalblue.exe unpack002/Malware-1-master/fear.png.exe unpack002/Malware-1-master/iimo3.exe unpack002/Malware-1-master/jey.exe unpack002/Malware-1-master/m.exe unpack002/Malware-1-master/mo3.exe unpack002/Malware-1-master/mo332.exe unpack002/Malware-1-master/mysqlconf.exe unpack002/Malware-1-master/o.exe unpack002/Malware-1-master/qOA7iZJcoB8.exe unpack002/Malware-1-master/rig.exe unpack002/Malware-1-master/stak.exe unpack002/Malware-1-master/sysm.exe unpack002/Malware-1-master/youwin.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack002/Malware-1-master/butterflyondesktop.exe innosetup
File Explorer
-
251028-vkjxpaxrap_pw_infected.zip.zip 45.4MB
-
Malware-1-master.zip.zip 45.4MB
-
Malware-1-master/2530.exe.exe 1.2MB
-
Malware-1-master/2887140.exe.exe 144KB
-
Malware-1-master/32.exe.exe 1.2MB
-
Malware-1-master/5.exe.exe 312KB
-
Malware-1-master/96591.exe.exe 1.2MB
-
Malware-1-master/Amadey.exe.exe 49KB
-
Malware-1-master/Blocked-v1.0.ipa.zip 1.1MB
-
Payload/Blocked.app/0s.png.png 415B
-
Payload/Blocked.app/1s.png.png 297B
-
Payload/Blocked.app/2s.png.png 390B
-
Payload/Blocked.app/3s.png.png 409B
-
Payload/Blocked.app/4s.png.png 332B
-
Payload/Blocked.app/5s.png.png 367B
-
Payload/Blocked.app/6s.png.png 413B
-
Payload/Blocked.app/7s.png.png 345B
-
Payload/Blocked.app/8s.png.png 428B
-
Payload/Blocked.app/9s.png.png 413B
-
Payload/Blocked.app/Blocked.macho 170KB
-
Payload/Blocked.app/Default.png.png 171KB
-
Payload/Blocked.app/Icon.png.png 5KB
-
Payload/Blocked.app/Info.plist.xml 1KB
-
Payload/Blocked.app/PkgInfo8B
-
Payload/Blocked.app/arrow_left.png.png 1KB
-
Payload/Blocked.app/arrow_right.png.png 1KB
-
Payload/Blocked.app/background.png.png 171KB
-
Payload/Blocked.app/block12.png.png 8KB
-
Payload/Blocked.app/block13.png.png 11KB
-
Payload/Blocked.app/block21.png.png 7KB
-
Payload/Blocked.app/block31.png.png 10KB
-
Payload/Blocked.app/blockgoal12.png.png 9KB
-
Payload/Blocked.app/blockgoal13.png.png 15KB
-
Payload/Blocked.app/blockgoal21.png.png 9KB
-
Payload/Blocked.app/blockgoal31.png.png 13KB
-
Payload/Blocked.app/boards.db29KB
-
Payload/Blocked.app/boards.sql133KB
-
Payload/Blocked.app/boards_schema.sql629B
-
Payload/Blocked.app/difficulty_1.png.png 965B
-
Payload/Blocked.app/difficulty_2.png.png 1KB
-
Payload/Blocked.app/difficulty_3.png.png 843B
-
Payload/Blocked.app/difficulty_4.png.png 1KB
-
Payload/Blocked.app/difficulty_5.png.png 1KB
-
Payload/Blocked.app/difficultybutton_1.png.png 3KB
-
Payload/Blocked.app/difficultybutton_2.png.png 3KB
-
Payload/Blocked.app/difficultybutton_3.png.png 2KB
-
Payload/Blocked.app/difficultybutton_4.png.png 3KB
-
Payload/Blocked.app/difficultybutton_5.png.png 3KB
-
Payload/Blocked.app/done_button.png.png 2KB
-
Payload/Blocked.app/done_stamp.png.png 10KB
-
Payload/Blocked.app/done_stamp_mini.png.png 3KB
-
Payload/Blocked.app/help.png.png 181KB
-
Payload/Blocked.app/help_button.png.png 2KB
-
Payload/Blocked.app/level.png.png 1KB
-
Payload/Blocked.app/level_grid_1.png.png 15KB
-
Payload/Blocked.app/level_grid_2.png.png 16KB
-
Payload/Blocked.app/level_grid_3.png.png 16KB
-
Payload/Blocked.app/level_grid_4.png.png 16KB
-
Payload/Blocked.app/level_grid_5.png.png 16KB
-
Payload/Blocked.app/level_small.png.png 811B
-
Payload/Blocked.app/levels_background.png.png 180KB
-
Payload/Blocked.app/levels_button.png.png 2KB
-
Payload/Blocked.app/records.db2KB
-
Payload/Blocked.app/records_schema.sql224B
-
Payload/Blocked.app/replay_button.png.png 2KB
-
Payload/Blocked.app/reset_button.png.png 2KB
-
Payload/Blocked.app/stamp.aif10KB
-
Payload/Blocked.app/undo_button.png.png 2KB
-
iTunesArtwork.jpg 122KB
-
Malware-1-master/Download.exe.exe 247KB
-
Malware-1-master/GunMayhem1unblocked.swf5.7MB
-
Malware-1-master/Header14B
-
Malware-1-master/Illuminati.exe.exe 1.1MB
-
Malware-1-master/LICENSE1KB
-
Malware-1-master/MEMZ-Clean.bat.bat .vbs 9KB
-
Malware-1-master/MEMZ-Clean.exe.exe 12KB
-
Malware-1-master/MEMZ-Destructive.bat.bat .vbs 13KB
-
Malware-1-master/MEMZ-Destructive.exe.exe 14KB
-
Malware-1-master/Petya.exe.exe 225KB
-
Malware-1-master/README.md123B
-
Malware-1-master/S28667145.tk.txt261B
-
Malware-1-master/SSL Comodo2KB
-
Malware-1-master/Software.exe.exe 1.6MB
-
Malware-1-master/TX3_ojTHxaEidvzTZOAvBPqzTUsyZYJYhArok5hFTyw87B
-
Malware-1-master/Us4XR_D8S5RQ7SdaFWEiR3sqgAz2IBsgrlxJCfNCEYA87B
-
Malware-1-master/WannaCry.EXE.exe 3.4MB
-
Malware-1-master/Win32.EvilClusterFuck.exe.exe 64KB
-
Malware-1-master/apache.exe.exe 252KB
-
Malware-1-master/butterflyondesktop.exe.exe 2.8MB
-
Malware-1-master/crb.exe.exe 139KB
-
Malware-1-master/eternalblue.exe.exe 886KB
-
Malware-1-master/fear.png.exe.exe 66KB
-
Malware-1-master/getr3kt.bat.bat .vbs 13KB
-
Malware-1-master/iimo3.exe.exe 1.7MB
-
Malware-1-master/jey.exe.exe 744KB
-
Malware-1-master/m.exe.exe 1.3MB
-
Malware-1-master/mo3.exe.exe 1.9MB
-
Malware-1-master/mo332.exe.exe 14.0MB
-
Malware-1-master/mysqlconf.exe.exe 252KB
-
Malware-1-master/o.exe.exe 110KB
-
Malware-1-master/qOA7iZJcoB8.exe.exe 400KB
-
Malware-1-master/readme.md154B
-
Malware-1-master/rig.exe.exe 2.4MB
-
Malware-1-master/sserv.jpg.exe 1.3MB
-
Malware-1-master/stak.exe.exe 3.0MB
-
Malware-1-master/sysm.exe.exe 234KB
-
Malware-1-master/wannakey-master.zip.zip 2.6MB
-
Malware-1-master/wintonic.exe.exe 1.6MB
-
Malware-1-master/youwin.exe.exe 379KB
Malware-1-master.zip
- SHA256 2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c
- MD5 ef37386fefe6fbbf646805a591add083
- SHA1 1abfc73d9a379c796036de72e5f7961b4295bf5e
- SHA512 112cccdada7554db108f3fd469e72fc0568aadbcad33b75a2046018827c5542d5fdcb6b454eb7bb0f58a6ea00e65bcd503a807222e1f21cc9a0f087c89453d3e
- SSDEEP 786432:8hXFC0opkN2sA1VYXb1ZfLKvrXpXyNoqpkHuMBWn3GhUclPgJ26GEa5+VX:+FnQCXb1ZzsyXpKdBEGeQP2Vj++p
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Malware-1-master/2530.exe
- IMPHASH f0a5716e00f06c2ac94766e26777ea6e
- SHA256 0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615
- MD5 568d17d6da77a46e35c8094a7c414375
- SHA1 500fa749471dad4ae40da6aa33fd6b2a53bcf200
- SHA512 7beb044f8bd366350b267c0fedc8466d2c5fd80b0f791f5697ce4577edced36b668401fd48df90b6c4ced05247d990c5e739e7232a2dcfc059dcc0c6a79d9427
- SSDEEP 12288:D+FwW6Se3oB/8WjH2fIGOVoDJLvfOqsUFY:D+qJSgZwEIGOVUJLnOqs+Y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
43120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wh@##weh.Pdb
ntdll
wcstol
gdi32
DeleteObject
AngleArc
GetTextFaceA
GetWindowExtEx
opengl32
glEvalMesh1
shlwapi
StrTrimA
mscms
UninstallColorProfileW
kernel32
GetNLSVersion
InitializeSListHead
SetConsoleCursorInfo
GetSystemRegistryQuota
GetModuleHandleA
oleaut32
SysStringLen
user32
UserHandleGrantAccess
CreateCaret
CallWindowProcA
GetSubMenu
GetCaretBlinkTime
Name
.text
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
4KB
Virtual Size
814B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
744KB
Virtual Size
742KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
360KB
Virtual Size
356KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Malware-1-master/2887140.exe
- IMPHASH d7854a9aa30702ffeeb9cbadd6e6d19e
- SHA256 dfaf75da62d0561d171217fe893bd818a72ebfccd9d7e7f4c046f5b3ca44794e
- MD5 fead887648bddd70a05cf7a7090411dd
- SHA1 250c0de3dc100d265ae495f045a2c47dad3520e9
- SHA512 e1f15de084a78bf27a1c62b5d0d31fabd10be13983dca05962c40ea1e8b3f7bb617e92f44a78048d3484d16f5d4b9e42bc8c5a4b02fda0e0f5eb69368149920a
- SSDEEP 3072:buY0LMcTrgw6mo4bnGkbUyh/h39iN/Ko8LdKpZbZo:SY0IkImZUyh/h3MOc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
18896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
winspool.drv
GetPrinterDataW
secur32
DecryptMessage
advapi32
LookupPrivilegeNameA
PrivilegeCheck
GetOldestEventLogRecord
IsTextUnicode
EnumServicesStatusW
winscard
SCardGetStatusChangeW
wininet
GetUrlCacheEntryInfoExW
shell32
ExtractAssociatedIconW
ExtractIconExA
kernel32
GetProcessTimes
GetCommandLineW
WritePrivateProfileStructA
FindFirstFileExW
GetLongPathNameA
IsValidLocale
EscapeCommFunction
EnumSystemCodePagesA
GetSystemTime
GetCurrentThread
GetThreadPriority
GetStringTypeW
WriteProfileStringW
user32
FindWindowExA
GetMenuStringW
GetScrollPos
GetShellWindow
GetFocus
GetDlgItemTextW
IsClipboardFormatAvailable
GetScrollRange
SetTimer
FindWindowW
MessageBoxW
EnumWindowStationsA
GetThreadDesktop
IsWindowEnabled
GetUpdateRect
GetMenuDefaultItem
gdi32
GetTextFaceA
GetTextColor
GdiSetBatchLimit
GetTextMetricsW
GetTextExtentPoint32W
GetCharacterPlacementW
GetStretchBltMode
GetObjectA
GetSystemPaletteUse
GetLogColorSpaceA
clusapi
GetClusterResourceNetworkName
msvcrt
fwrite
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.io
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.crt0
Size
100KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Malware-1-master/32.exe
- IMPHASH f0a5716e00f06c2ac94766e26777ea6e
- SHA256 0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615
- MD5 568d17d6da77a46e35c8094a7c414375
- SHA1 500fa749471dad4ae40da6aa33fd6b2a53bcf200
- SHA512 7beb044f8bd366350b267c0fedc8466d2c5fd80b0f791f5697ce4577edced36b668401fd48df90b6c4ced05247d990c5e739e7232a2dcfc059dcc0c6a79d9427
- SSDEEP 12288:D+FwW6Se3oB/8WjH2fIGOVoDJLvfOqsUFY:D+qJSgZwEIGOVUJLnOqs+Y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
43120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wh@##weh.Pdb
ntdll
wcstol
gdi32
DeleteObject
AngleArc
GetTextFaceA
GetWindowExtEx
opengl32
glEvalMesh1
shlwapi
StrTrimA
mscms
UninstallColorProfileW
kernel32
GetNLSVersion
InitializeSListHead
SetConsoleCursorInfo
GetSystemRegistryQuota
GetModuleHandleA
oleaut32
SysStringLen
user32
UserHandleGrantAccess
CreateCaret
CallWindowProcA
GetSubMenu
GetCaretBlinkTime
Name
.text
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
4KB
Virtual Size
814B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
744KB
Virtual Size
742KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
360KB
Virtual Size
356KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Malware-1-master/5.exe
- IMPHASH 4b9ee012c1a2bb86abb262a522ef8633
- SHA256 66ae33003289d8c6c3dc7c45c1b01110b4820281061292ac076b1783700a1f2d
- MD5 0b0dc2b2ccd4b46b3381508f7209a582
- SHA1 a67a1619f96914e4e50e4f86f656ebb54021879a
- SHA512 0715c2f6e01a923deb8bd5c4c70906942ee46dba6383bbd2edbde53e23a7b5c2ab8063e5f48a973925815f1dec18fe15c362fcf928d4f35d12dcf123f303cc37
- SSDEEP 3072:5ODQa/lz20bbn7yXO/7/rCaZXo3ZU+BfhYJMyTPkDDYvU:+Qahr7DZXSpnSs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
12797
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Represent\Fresh\would\direct\Office\Metal\Once\fresh\ShowBranch.pdb
kernel32
GetVolumeInformationA
Sleep
CreateEventA
GetSystemDirectoryA
GetEnvironmentVariableA
GetProcAddress
ResetEvent
LoadLibraryA
OpenMutexA
FindFirstChangeNotificationA
CreateMutexA
GetCurrentThreadId
DuplicateHandle
ReleaseMutex
FileTimeToLocalFileTime
GetCurrentThread
DeleteFileA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CloseHandle
SetFilePointer
GetCurrentProcess
GetVersion
PeekNamedPipe
HeapAlloc
GetCommandLineA
HeapFree
GetVersionExA
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
ClientToScreen
GetClassNameA
RegisterClassExA
IsWindowEnabled
DrawIcon
GetWindowTextLengthA
CheckMenuRadioItem
FrameRect
DispatchMessageA
SystemParametersInfoA
LoadImageA
RegisterHotKey
gdi32
TextOutA
SetViewportOrgEx
Name
.text
Size
104KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
136KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=125, productName=VS2005 build 50727, version=50727,
count=97, id=109, productName=VS2005 build 50727, version=50727,
count=42, id=110, productName=VS2005 build 50727, version=50727,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=114, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Malware-1-master/96591.exe
- IMPHASH f0a5716e00f06c2ac94766e26777ea6e
- SHA256 0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615
- MD5 568d17d6da77a46e35c8094a7c414375
- SHA1 500fa749471dad4ae40da6aa33fd6b2a53bcf200
- SHA512 7beb044f8bd366350b267c0fedc8466d2c5fd80b0f791f5697ce4577edced36b668401fd48df90b6c4ced05247d990c5e739e7232a2dcfc059dcc0c6a79d9427
- SSDEEP 12288:D+FwW6Se3oB/8WjH2fIGOVoDJLvfOqsUFY:D+qJSgZwEIGOVUJLnOqs+Y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
43120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wh@##weh.Pdb
ntdll
wcstol
gdi32
DeleteObject
AngleArc
GetTextFaceA
GetWindowExtEx
opengl32
glEvalMesh1
shlwapi
StrTrimA
mscms
UninstallColorProfileW
kernel32
GetNLSVersion
InitializeSListHead
SetConsoleCursorInfo
GetSystemRegistryQuota
GetModuleHandleA
oleaut32
SysStringLen
user32
UserHandleGrantAccess
CreateCaret
CallWindowProcA
GetSubMenu
GetCaretBlinkTime
Name
.text
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
4KB
Virtual Size
814B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
744KB
Virtual Size
742KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
360KB
Virtual Size
356KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Malware-1-master/Amadey.exe
- IMPHASH 38c46ebea9bb002b350ca86f8d8d7108
- SHA256 7fd898dde3a7ed047657e3dc81c3de50ed381857edc53744664332fd98476c54
- MD5 871294e398217876017702c96d0e7854
- SHA1 35a22da1522bf86659576ed59235f8ed7029e79b
- SHA512 047237e3a615839918fe32662524f2de5455734a01cbb2f66017c636f3d08207b3aead79cdff9a94729550ad7eddc2b5950d5e774fb25fba2d0d69e048ca7fe5
- SSDEEP 768:AN4a7os+Bd1CiSJfBFdiGOsSyS5/hhurlzdx:3a2xC5+YSyE/hgpzH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
GetUserNameA
kernel32
AddAtomA
CloseHandle
CreateDirectoryA
CreateFileA
CreateProcessA
ExitProcess
FindAtomA
FreeLibrary
GetAtomNameA
GetComputerNameA
GetFileAttributesA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetSystemInfo
GetTempPathA
GetVersionExA
GetVolumeInformationA
LoadLibraryA
SetUnhandledExceptionFilter
Sleep
WaitForSingleObject
WriteFile
msvcrt
_itoa
_strlwr
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
atoi
exit
fclose
fflush
fopen
fprintf
fread
free
fwrite
malloc
memcpy
memmove
memset
signal
strcat
strcmp
strcpy
strlen
strncat
shell32
ShellExecuteExA
user32
GetSystemMetrics
wsock32
WSACleanup
WSAStartup
closesocket
connect
gethostbyname
htons
inet_addr
inet_ntoa
recv
send
socket
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Malware-1-master/Blocked-v1.0.ipa
- SHA256 19c538fbb52c15ed9c739c2f45e5d78e432a916db0218f77c7297d96d72e709d
- MD5 bdf0fcbfaf2d9a0d788a3b6ace7c6b42
- SHA1 02b6be369997d4d0ddc7ea7cf9d0e0ad02470b5f
- SHA512 0c271a0df77f86fa6ecf483389f34ab1a95109dda468a84a150058e4e363bcc5021f538671a22fbca85516fc07815cfaf3027715e720a6e760061972ef172c47
- SSDEEP 24576:KxaqV2aFXljSo9osEv4gfyyYAcPEec5/KqnIqi9Yr21LT1qUDKIqSRPFgJIW:6zN9onpmB+xQLZ7DRFQIW
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Payload/Blocked.app/0s.png
- SHA256 b6d046a781d45db623a3bed912f3db09de4f37bfba007c8d87e9b538b36215af
- MD5 168f0c9b6b89caf6c146fe8b0a6a928c
- SHA1 7ad0e5ccb5bac0e01629482491b8f8d87ce805b9
- SHA512 bd21345f1e18fd10df1c5f6c18de8d8e9b86b8faf766e436bd78593105d3815eb2dcab5e718a832b140a111908051a0e6b84f3bfaac7d4dc2633f3e4cc6a6bb1
- MD5 SHA1 SHA512
Payload/Blocked.app/1s.png
- SHA256 a4ddfcf81ff90c7607baaaf2d6821e1491d43c1d48674d1df96c643a33cc3f14
- MD5 0282e3590d960290e9bf1324eb995f4b
- SHA1 83063a38faa5c049600777c82068ae36a7a2c2f1
- SHA512 ef88c5732351fb420cea5dbce2a42a8ecfcbddf0399572d5adf727eca27efe51f0c2d4d5f47118d35783790a192c97a0a80114aab9fee81a6f0085b93e1d3da6
- MD5 SHA1 SHA512
Payload/Blocked.app/2s.png
- SHA256 eb1ba0b22708bbef843b5dcb2b8f5737b47ce6347ee43d844b9f4877210d142b
- MD5 6a0c9c9a9869359df4f86af8614263c2
- SHA1 f11f62637f1f79b9db9897414696592b83148ca4
- SHA512 c9d9f2284241aa2412ce33901976639c60600901cd703b6ac64f35b684e17edca8401bcfb571533d189dae7fb05e5622fa0d3d706992f7fb064924e33bf134fb
- MD5 SHA1 SHA512
Payload/Blocked.app/3s.png
- SHA256 15a1ef1c5e2e7570bd562f813295e4be9c453589cec4e70f1920e7553e5a31f2
- MD5 dbdef900b8575d68bc988ec9cedfb237
- SHA1 f79b9f30cce322fd7af25904fdcdda406c768a67
- SHA512 8f31eef5347bd11bf8975c5574e3910138d20ad600a2068703e5c9247d745f95810b967e707ddfdad7f9f78de40d89dd55548ac63b38a63e7ffea4b203e805a0
- MD5 SHA1 SHA512
Payload/Blocked.app/4s.png
- SHA256 4856ff0872415c18b746eaa2fd9cc0b6e24bf31f678bf7ea25a4cccb15208f88
- MD5 d24f0b7c233eaac6ccbc230b3dadc0f1
- SHA1 8e8df6df8ab84687fa4ad83ae4a6d891d263a5a1
- SHA512 bc81db7b0554b5e26723b40a799a885241b52e5d71f2b9e7e27076b56452ba086761bfea791474d3a8618163e09e2e0e0b3472b388a8457f86a6ec6fb402944d
- MD5 SHA1 SHA512
Payload/Blocked.app/5s.png
- SHA256 1613241a39e93f0e46d29c97a3f99f90641abb42e037dc95d5ae5e3a45b2c0af
- MD5 559a0b76c65843f5bc5e4a5a4b3d78c5
- SHA1 b2b5a7f30d8033558316b7ab1d7bd5e101425041
- SHA512 85ffb1ba973b5308096df3f02768da3dd1dec2f29025f325d4ba72b859580c4299d210bd86a2ea9e487cb57ddc5787b08f415e76237ef0d31472e009c4f455a2
- MD5 SHA1 SHA512
Payload/Blocked.app/6s.png
- SHA256 7b13391a7501f126904433fd3d6aefe9fb2d3910de89f5fc8d9fa6a1f9ec956b
- MD5 035facec649bdf40039236dc0bfc3f60
- SHA1 a17e37fece8fa7a72433b5a89cde17460eb11046
- SHA512 dd2a4fdeef283e255ed31b6e3abdfe3e929f3b5bfd873644abd4b2058f2335660571595e18655592fb8a06034e47796568932d0f616fa7db077647d496487744
- MD5 SHA1 SHA512
Payload/Blocked.app/7s.png
- SHA256 e2cfc1bc51d084ad43300a412d9140fa982ab73fcd2c8d6e3afbb2dcb675e5c4
- MD5 0f96aa57f10c42f37742d62bd944a197
- SHA1 779d0c7a75648e184b08eb9d2522004fbec55151
- SHA512 6e157f012501dc7af7f93a0cebb5c7b051552ece56bdfd0d8f109abf5bade6331568ded02c8cd26185abbb0968ce3ae71d5a6dbc03f960f202eb850524f716e2
- MD5 SHA1 SHA512
Payload/Blocked.app/8s.png
- SHA256 2a991ac74eab86de790c952698c65b3d633d9b2712b92b33b990b0ee0548b2e0
- MD5 573177e4997943881bb0748f59055eae
- SHA1 f43287aa4621d75cad5e62549f43f9850b7fe2d2
- SHA512 08e34d77f0835e6ee16f5fd32ba804982b5a50400233431a5b3391a5f9f51095694d79dc180c3654e85f1f6c60b5ab58f40f03e488df2b1070d7c787f52ba4fb
- MD5 SHA1 SHA512
Payload/Blocked.app/9s.png
- SHA256 01c8d0358b98c03097a9697b47ad29062d91e13026bc49914a9a3c89d29d3989
- MD5 03013b35e10162561c3a521640545d81
- SHA1 fe2f4a9683aa3db716068e268d71701b21deac2f
- SHA512 20d1fcdc55207561024d62658d4f8ee38c434e4b8b1e0bef496eab8a25e0252c9617a90bddfcaf170b41da2ea8a5527639d66887cf07e05dd7ff50b38b01f31f
- MD5 SHA1 SHA512
Payload/Blocked.app/Blocked
- SHA256 6fcf45a371669201c312748fbf3c9c35b3b1f308b038ee529a46faebedae0150
- MD5 aa1faccd63301c7f8a1bec4cc8bdd74c
- SHA1 c2e12ab4eea8a5e3c03d604357a09762edfd60ef
- SHA512 337f5a7116df43aea077b635d51dee4a27a9dc586a7be8495441f1be40f73128ef75224177e45597374dcf38ec070615f2600db601bd93b04b9782abb09427f1
- SSDEEP 1536:oNOzOzhjBlTlQQ+nj/o3yJI4xbo9QTnnW3pS1gXnW9I16p5/U+LLDlu9wXW2OIp:oOzchjnTlQXDoKbNW41gXsI165/Rwy
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/Default.png
- SHA256 4d384545de41253c6d547284d57b23d079c496ff41e49b1607e8e400ffc7eb22
- MD5 60cdf4872557e673688e73878f005393
- SHA1 0d848c3abd1b8323d44c5f928ac6ce5623b9bd0a
- SHA512 9e8f7d2a4df9ed32a91e832a352686399b91c5a082d9f1605057df0feea398e3910a2105180047ee424320f9322dee4c5823ba16c986d8cb93322e368d4b8d1e
- SSDEEP 3072:B2h8zCsJo0P4fT5/6w7SOollLxzsWYzUu+RA/3jIQzoH6X7BXr7zy9JNK224xn:B2yChEA5Cw7Sv7xdXRA3oaXlPuZF
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/Icon.png
- SHA256 98e71aae7ae072ccf9da414a0c1674fc891e2b207fce64f263f4ab0ba241c3a6
- MD5 fc13dc6363e78a37aa10a55e3b473f0e
- SHA1 88fbc211a63ba89aac796ada883666c12d356b35
- SHA512 529097b1f17bed6a58da45b958357070e4eed0673d6adb0f2a8c169b79669c4a6d106f212f7e53fd5e6c2e34394a91e7f8d93671a68793c4ed6dcf651d6b346c
- SSDEEP 96:dG3627leDmELtp6JyeRd7uwaE4cxDmXOx1iHk0GEJNqtDK6U5uHdCi4UPJhStF8/:8RePpMJ/d77N4uXxUE0G2NqdPUpmncy/
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/Info.plist
- SHA256 87a395d49d9484cdc0249497990c164da7916c83087f0c0b6545d3207fcbd779
- MD5 0107e7b8a7b49aca950df7af1f108008
- SHA1 45bc4851a891296c8f415dd6afdcaca3f5341296
- SHA512 42d38519f5b4a16d2e8a843a1dae34eba3606c59385e8212ad9e9f4376968cc9d4cb71cb94be9be1bce5cdec9e90211b8180495a1517d199d0973f3193a1ede9
- MD5 SHA1 SHA512
Payload/Blocked.app/PkgInfo
- SHA256 82502191c9484b04d685374f9879a0066069c49b8acae7a04b01d38d07e8eca0
- MD5 23b7d7d024abb0f558420e098800bf27
- SHA1 9f9eea0cfe2d65f2c3d6b092e375b40782d08f31
- SHA512 f77d501528dd0ced155c80406cfbee38d5d3649b64d2a9324f3d6cee39491eb8f54cdebae49c6e21a20d2309d8fae1b01c41631224811e73483db25a2695738c
- MD5 SHA1 SHA512
Payload/Blocked.app/arrow_left.png
- SHA256 c4f7134c9f1c08b1c8b509224bf2e944e8f61a6b992a61b602a81f5e935f5d26
- MD5 23fbf2042cbfa39c0bafc357eb81f5a9
- SHA1 3df82a4a479c7483e2b4c9bf1914758df87eba70
- SHA512 c6a7e2b0f334ecef9525784d5a709e43801e80790a3b253b6800bad55e3c3e30e0fdd18a206d9a56b87e9dd150531dbddafcc6a4c79946e2addf5868f67e45b3
- MD5 SHA1 SHA512
Payload/Blocked.app/arrow_right.png
- SHA256 e1b533070d6c9b69d0b61184ab83cc1a70d46220dfc766948d8ecef50092e3ec
- MD5 450e9f7c7a44076d8b42782198f26695
- SHA1 d54c9f4eb05066264c9f33ff84137f990d6a2ef0
- SHA512 ba2dbf80547e4778bd66c77dd892a51cbbfcb95f753ba001d8f4179c4cdc00d735b83e30dd365d8293973b87091fff554e0d1461744ce52f0bfe3b2652a8bfc9
- MD5 SHA1 SHA512
Payload/Blocked.app/background.png
- SHA256 c8fd4736029e27ca9ed216748204a1fb560eb297dd85521fa2b757b7bf5ee6b5
- MD5 0c61725a20d58fb7990ac813201b89d7
- SHA1 bbbb7b6ab049e740cbade0ab10d92642ca5cdfe1
- SHA512 55a1800a05f486c04a192bfcc54756b4ad3d1db443f5612c8e0a279f30ae939b691d67552f9c6a066b5284f95094e8e8e3db21f3a9d1345501524f241c769a51
- SSDEEP 3072:hcc+arl0LJ4KQ+Fs+Q2HkC7Z67kyfNrab9CpS7BIBerdw6/gnQuSykSeLgm2k7Gc:hfh0Lk+FsRD2Z677NrapjCsrtokSWglY
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/block12.png
- SHA256 a4cac95aeaf6b9b7ce5638c9ee018bf0fdb396bbf2e5122077d2a1ee7fa12f11
- MD5 24ff6dc409edc2d6688697b7586aa239
- SHA1 8e738dceb47dd5061386e06084f51cb60eafee16
- SHA512 99e09d3851c7af18a839ddf56f6e627feae758f68cab77e3e43ad8c1499e3ee3e4d73a7846c7d586fc7afdf3bcce6dd626d24d91522b738b7056406df93f2dd9
- SSDEEP 192:3eAranatfO5WH62djdSiaiM1G+6Xm6UdIvx2J0jS5CqMOoAI:OAena9O5gNpSN1t6W6Us2J5CqMOG
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/block13.png
- SHA256 8fe5669d5a7a16e638ed4be658ac3f82848902551612c19254fd7bc1080f75bf
- MD5 14bdf25c752df4d91af370cf28056a3a
- SHA1 8fbeb72cff2f58a232c767f8bc2d5244fe08d4ce
- SHA512 e3a86a07543f9b8eff8158e80718039ff5b56ddbc2cafb9104f62fd6afd766621740b4923866d6b88cc6a6bd2e8be495ce6df85d82913cf2d4fd8c3abc4ce38d
- SSDEEP 192:IXvLgaOmlqIEL1M3020RsCNHjfxXmoqcNrWReaN1MuPtkWDzOAsL6+hMXv:SEaLsLSE1zN1WkaTJNDzIL6bXv
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/block21.png
- SHA256 38ad9a4eeaf28a62a7613a8d86a1197239519e1fe2552e55cdaed9ed980ae2a1
- MD5 84e84f5b7b4108e95e48c7b88da294ab
- SHA1 fa44e256db47dffd65cfd84ecba073ef6cca6e4c
- SHA512 d522edb6c6dc869bcbb9f978e2bf29d1b3d3c402e09f56130dd74728cb0f5d062fc7a23df060179abf28531021d98ac09b9f4f49cd2e93f885a0d2bed0ce395a
- SSDEEP 96:00J7nwh5DkX0oG4U+Hrt6j12CZwkNR5z5ffKhu+UIJniyFKPMVi6Vy1q9G5U0hdX:0OnwLDdH4d62CZvPfW7PsPv1q9wlr3l
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/block31.png
- SHA256 37df19e22e53f32a7fd69755183929954a49281b8e4babf175fbe6bebffc4768
- MD5 cbb073cbd8b37b3a4598c88cb7077fed
- SHA1 c44019f202b2dfcd566a0d9483206501271d66c8
- SHA512 c7b25f682cc53ef712bb7cd199bf64d5ea6dd1f7700837e422fdc2cb27a8c5407c554314f281e6f43def57061e5fe153cc113071cd1b2190613dd9b89e1b3a0b
- SSDEEP 192:D69uqmb9Ce34gc5T20FfGrRXU9sAxnueWONw+z+8GB97iMg/DxPEvFMGDZE4vnqb:kuqOnbcx2EnsSL2+z49i1PgMsKZ
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/blockgoal12.png
- SHA256 7917042de8b5804c6cd667dd1c3e0a478ae817469703d2639cba2fcb6e85daed
- MD5 e5b3f039250365916a21fbd4f1661db7
- SHA1 0f40fc82fd7a3b39e939d6b7c4648774bf4c3f8a
- SHA512 969cee8a9de890a8b639df52f6b716116c8b4313033bf980ec6ea80e49c40ade1d5cf4d828468f9c57bfaffb131212041e3327e5b7e1d971132cc07ecbcd0813
- SSDEEP 192:eI2U8/YaJxZgSuRkwtQs7FJBwMgImXbJyuzA38vY0+6DnuwvW47VD:Nv6zJTgSuiA7SI+bJylwY0+Muw+4hD
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/blockgoal13.png
- SHA256 7aa90824764ab2d2e66f96e15403fe7ed7da25f8a4a8720d05645c687affc625
- MD5 a64a0a604c23aa3155b5491c85d31807
- SHA1 9d88bc47c98312c602e6d803f3641fbd5e227322
- SHA512 5605f04894491725bbef5fbc0c04676c4c2495c8e39257a2952bef04e1f2d70f72cee5fa04c2643d469f80d0af069fecbd3c916834e8991ec61989225be33764
- SSDEEP 384:0cQ2tc2Zc4dCK1MBWpYlGH4X9ogTygYFvcFiGcd6Qmdx:0cQ2tc6ddPdiUHyN+LlcMzd63r
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/blockgoal21.png
- SHA256 cfb9bb60e5fe95cf80e214fdd76ca3ffdc12448bb87a6a5d2fd5545af8f83e8c
- MD5 7712b964510290d8e5b97207ded9a877
- SHA1 978f420429b909ec74b5ab5d02caeedbfbd7c5e0
- SHA512 31105a664bb8236ef1471c8cef3f188ddae92f9283c14beb07828ff0bcced529a844d28279b37942c77be60ba38a0a42924d8201b2399eed6cdf57bf4db73a6d
- SSDEEP 192:y+Zbe4n/JEYFLr2MtcZFFNeZ87N8onm2Yps2PS5w1q46xEqp:yINnampWFNeZON8onZYq2KD
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/blockgoal31.png
- SHA256 36450dc5d8675b34c13a349105bfafc850406bae8e7354376caa00f3af1b90d4
- MD5 839ca4aa9e1bccb7522a42f3e7c6e49d
- SHA1 53421636672000d802dc810869b61ccb07f13ac2
- SHA512 3dc82cad38a7b04be7c27df92134ae51ba6aa991a6e48ee9286313035000ea95c43a81f43be7712adff2971e4aa973b737cc5ad4349b1095e653d23cdfdd3ae8
- SSDEEP 384:jST0V8zPLWRijm0yp9l5gB4dhYNyFggVhlX5JuJ97Qn6m:j8xPSgF+b51digVhlp4JWn6m
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/boards.db
- SHA256 3733a13e4ccdae727dcc24322c2aa85ca3e2d6669cd2da322df662233cc043e6
- MD5 82e7d84c750d26e79c1ec69e80847666
- SHA1 fe376de6f95eb361964c3e1709739ff23b1fd703
- SHA512 2ba4763a3e024035909202faf1dca0b20dc3fe1e27de2918ecd11e5e28820f48066203decbe59c08f9e834537b2625141b4a8b9910e77aacdc73af7e377320b9
- SSDEEP 384:ajOtxyyRX+HDGU9Vj8UDDLnvZPN9nTJLCPmBG9MCfVwnCno+PkR820eX:L3RGDzBLBF9nTNCPmBGfVzQ
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/boards.sql
- SHA256 ce0dbcd1b905864e495787c998ed0b0feda828ce389f05fdf0dfeef4e081fd42
- MD5 1d8201c4935b185756a2411042be5c7e
- SHA1 dff07a88a31d0b2251898b46328d1baedcf09477
- SHA512 c0a953f10d8a7a0d58f57de7f4f60e995096d5b19af7ffc40269dd117537005c60d938dcea9f25000cc496d724472286e57ecc5b382bfda2d76047621998e30c
- SSDEEP 384:473d7TzGbF6bX0gwRM1q2VjtoIvaQxLj2x62AL+n5Ip0D42sAi8w:Gq2roIvagLj2sj
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/boards_schema.sql
- SHA256 07b4df53a76d2e44518bae6ef405bfafc57008744009564a1b8283c39fda16e9
- MD5 7129862e931bafc69d99693bce91c9a8
- SHA1 ce4659d1b4e1f65d123527bf962926b898e9e7fe
- SHA512 4842c6ea983f7fc9930c386a75e0d946815d98ba7271ddef7c5c3c9ad2d188a92952f55c8abc20a220e0f5b8ef18ab6e72a07d9b8afc166f63892f4154a21e9e
- MD5 SHA1 SHA512
Payload/Blocked.app/difficulty_1.png
- SHA256 9f0a09579c033c9a1ed07ec515dfdeadce8221606120f3908c59194622fc6dd3
- MD5 63da7f10314345886b2202eb807076fa
- SHA1 7bd10ccbc05a2df59dcbdd8769a1caa28adb642e
- SHA512 7203eceea6b0c1a40d640f464e9867afbba4c24d1b997f79b93112af7e2561ef240e63a1bacb6327790c49fcc8ae3da6de3af2010b3f8fad502b14f8b09d4542
- MD5 SHA1 SHA512
Payload/Blocked.app/difficulty_2.png
- SHA256 5f87cd150a0ce7fd8272d6c2499f25e9de84344f4567dfe429616d36c8e79bd7
- MD5 3eca9abb574a50ec06fbc184db1f9c01
- SHA1 1bd1e8d00bd9fda0336386d442dec1e39c34cdec
- SHA512 189adfe045ea9fb25630676c4027e2712e79107b3d248e54615dd8a9417336af32e8532eab9ffbfb93e17372e67bb63da9312480e49bf0ec70e07c4b0b127e70
- MD5 SHA1 SHA512
Payload/Blocked.app/difficulty_3.png
- SHA256 70dc2f62b525577eb3e7c9734e29fe7c937cc0d19c02290167997f365796607e
- MD5 b8ba7b53d7f0f1cf4fbcd03765e49f92
- SHA1 048d142cf26dcd042b0774f61aebb5d73fad0a60
- SHA512 4e329775e6a8268d589752ba3232d75e376220b23513079e0ffbfe6ca3ebb71e7698870ed213eab5fc9a2d13a8c29456ee364f63099281286dd34cf50498740a
- MD5 SHA1 SHA512
Payload/Blocked.app/difficulty_4.png
- SHA256 5d7826d134251c9198f910155f99fa3f37286daa689b0630722c986a7909e91a
- MD5 6e2dc237e12e31bbfd0cb26ce603d49d
- SHA1 819a79bb60ae8dc5396aa290e1936aaf3b883092
- SHA512 6fbe1732fefe2f667128661e8479a6ccc0b8df999e694d109b77708c3e3e20bf653dffaff2f5b3a6a0103b78a21800fe05d40c80f640d54c7bcb77a82946fbb0
- MD5 SHA1 SHA512
Payload/Blocked.app/difficulty_5.png
- SHA256 a615fea4c5abe53c27622d529684bbb007d88e5f2cbd767c146f37dcca92b8d8
- MD5 979e57fa0e1e4cc62cd54d09f93b05c4
- SHA1 7cd8a93897af1af70961a3f9da7b7de0bd06c587
- SHA512 54fa1f7bd43eef6a7edaec92fcecf05406319a40e987a3d4599c6eb0c82e4611197fc7acccd0e3c7600f415db96cb5a557e207e0af9028ae1659c7bca0256806
- MD5 SHA1 SHA512
Payload/Blocked.app/difficultybutton_1.png
- SHA256 b6e1c6321e58a651275210c64e98ead1c56c9c48886ee3c52d6c2fa4710ed648
- MD5 35bdf3087b7870b42969884ce2b8b5d5
- SHA1 279139d34007bab45810174f79d0d7c6dc4ab521
- SHA512 99bcea6238c41863c5f16d25180bb8f863781b559e3b07915ba71d75ae11328a4831a12f68474f9c7cdd14594a1a12c3391f2ecbe0936f5ea6c222fdfd88ed4f
- MD5 SHA1 SHA512
Payload/Blocked.app/difficultybutton_2.png
- SHA256 61927fc75220579bc3c50ad16da76280aee3995bb5dcb73c6d02d28cd4d942ef
- MD5 b244247929abab624a3c660603d7edc6
- SHA1 6e25c8dcd35e00795f908e1652c6c38d86598d2f
- SHA512 c0e63509bbeee265f24ecd5892cc7342906c792697276406092effaa1d48dd8d638f7acf8989c8c3711e1dd4c80cbfdaa76d2a0c7fb49df6ed0cd37b60ad84a3
- MD5 SHA1 SHA512
Payload/Blocked.app/difficultybutton_3.png
- SHA256 1eb7f83f503ddac9a8c392987001ea6286e5443e1ff63460f7975423837fef5c
- MD5 7cf8866f2c279923b99e5d2ec9406c96
- SHA1 5ae4b5a0521019102543a2f61b0a200c6ecfe9a6
- SHA512 0f58b1e8c4d8bb2c987bf4f961b9d9db06075dfc2ed27949db993c7f5fef6394752db223a47cb62c4cb21eedd9c1f6b6bad68935e479edcc2092fa37b88f30d8
- MD5 SHA1 SHA512
Payload/Blocked.app/difficultybutton_4.png
- SHA256 ae1d05b3aecbdb5d6bb2389aa8d43d35aad037296d10205b3743d41f74f2ba10
- MD5 e6d01d3829a35d371840191dc4d07926
- SHA1 03df44f93e8a95a699017906da446f3b46f31e3e
- SHA512 ca5ffe20a4b747df113331e14250cdd3c9b3340a1fd64fd6b8493c4c55d433094f084250365a0924d079635ea4e6730372191e70e2393eb0d4a072d05cdd5a73
- MD5 SHA1 SHA512
Payload/Blocked.app/difficultybutton_5.png
- SHA256 8a1d9e6ceb94c71be4d3d54059590d3cb0a84395c5f16cf90838e4c00954c14f
- MD5 31b7f4cd26eb44cc490eae296f0c99c2
- SHA1 90ab1e41678e89107f5bee955d8d0fa690e3dc20
- SHA512 3c61e6558e35d5382ea0fcc55a705a5c90a05aade49417ed51e5fac14f3e6f603f19177a8ade562540f09b5ec8af2864723a411d3774ff7bc38f91eef7a774b4
- MD5 SHA1 SHA512
Payload/Blocked.app/done_button.png
- SHA256 03a77674999d11c613b604950d32ae2a78f22f00ece810e69649a45109def831
- MD5 e96de18d1fe5a012a01c62468b70d694
- SHA1 d8061d043da11a43fc579e2985404b0cfcee554f
- SHA512 e7769f57ba975c16a4f4526be6b4ae7e257cdae4b3c3a4dbed240439a2f01cd42562bef87b9d6de4aa3b0be47a6b8f647ef3ab1bc7149a4a20473d470cbf4fdb
- MD5 SHA1 SHA512
Payload/Blocked.app/done_stamp.png
- SHA256 d74429eca443bb2f642bab95fdd00ce9ef01cc5458c07c9878199c77d478dca8
- MD5 67b5f3def9c32f559f8e6627bc55bd0e
- SHA1 2f85dac2842efa6b3dcc8493a52eef8bc070b9a9
- SHA512 ab2c07de071cd14008a5c9d8a9265b7713036dee53b03aa3cbf9bfeb07c15c66b4ce38af6388290356944fc083899c3eb38fc0667e1473adfb058c8a8ed1e14d
- SSDEEP 192:9QzOQxhO/WipSUxNiWoVupFoWRNeaIG0+mZ5nJRt4ewOD3OdHa3mwLoZbg:9QzVOPrFdrJVeDtpwIc7s
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/done_stamp_mini.png
- SHA256 a820c540bfcf1808e2ad1d83e4056805521804aa87e01958f77586a03ed7b2cd
- MD5 a04e9e15a621d2d1ac08f80834462003
- SHA1 6995d654af32622151b5d3c097dc172e6908e444
- SHA512 568317b6cd8db75eed1c498640ecdfa5c79674bb979bd10a1c544b97a1a1d470ae39285c06ccd6f10a53582503aceaa8229b18a8122797e5a08060c39e3c0803
- MD5 SHA1 SHA512
Payload/Blocked.app/help.png
- SHA256 4e5cb72ff3018bd7859e36402f3e41d1d9bc7ca9c757e7542d00c18c0a47200a
- MD5 6ff51a1bb5da5d0d50b8246bf5c8879b
- SHA1 ea4c61d1cb694d11742e067d881dd4ac8d0f8fe1
- SHA512 adbfe4882306e68dd931789a88e0eeec58b6286a8966b375cb983d24128d2c578bbe6b52f7984e6f1ad40045e913994c50f755ae4e748025d0c75748c53cdd89
- SSDEEP 3072:r14mtEMDBW36pFVfjWECn8KbWVbWI7x8gFKaN7Fo+0u5+H1MR3e91pyT:R4mtEMdW36TVfjWoVb7RY+U1MRu9S
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/help_button.png
- SHA256 31fc40104a29e39c311727941266c173b9bdf4e0f66a799e7f42b3f3aef7105e
- MD5 3ccbea3fd29b5be199b88ec06f8157fd
- SHA1 c9b0dc4d562c2be568d856b751de143c5bbcd75f
- SHA512 1550c4eeadb2fc8a106235c68abf145a37ef73ded84a4ba9a7614c7ae7c08af3f21e18fb392c08301e339954ada69043185e191e47418850abcfb0da89964093
- MD5 SHA1 SHA512
Payload/Blocked.app/level.png
- SHA256 97dbc8fd8e153b30885b4728aa1bfd466462070d4b851c025f7f3305fe531b5b
- MD5 8f6c8dc5016885c7c3d3e84018d5af89
- SHA1 06774fa62e944ebb0b230c99f34f94058e7b1d8b
- SHA512 b5fb3f3b77f91d6174b494eb9b77f7e3ea8e2d84a7eda74b0533f57019ed0a1666cc4a209b05eb565b28c8bc1ff6ca4ed02983ef0c93d749919e4945ea9d8735
- MD5 SHA1 SHA512
Payload/Blocked.app/level_grid_1.png
- SHA256 c24aa4339d1cf7180f689f2f8f42cc6d4d492517f474b5eeb320ef2a8227047b
- MD5 2d26150ba1054b3765aa39d212f4ccfc
- SHA1 3ab85912eab05ab84167b8a95ec667a04ba2809b
- SHA512 c43ee49fe7f078dfae0f1fe2095498345b8265ae20f29052cad199ea2341397dcea1d2204f00bfc339c02b652e90f2c12363dad51fa9ea68ebb76110b780ffce
- SSDEEP 384:y97fXMeZL+yXcBQLILkBw63HUcSJknURNTTyue+z8da8GQ8:Y8ebc2ILkK6XMOURQf+zaaQ8
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/level_grid_2.png
- SHA256 11b22577ceae3e7274ebc9482ca94589096c2295cae9fc55d387edaf6b717ef0
- MD5 0e191e906c62f2c722300de5530b477c
- SHA1 3ac39bd45072616ec98db404ef658d049fadc0d3
- SHA512 d3b9a2a7d1d4b8c180dab2bf661d06c1769bb49191638bfdebe6bbb7a91d9a0b48db7510da332499bafd76c41f64a786273736444e4a313f3ee8b12d42c88f80
- SSDEEP 384:I1xt5hH77wSSbb0m154NtGeTgV6B05fTaZbVx:I1LTHakmI23V6B054L
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/level_grid_3.png
- SHA256 667c60b14b3162c60852c3d9782c23bdae47fcc8ae0ba4682f40c0062f3a127b
- MD5 e48bbfeed3d963e26c1af9fc9e69396f
- SHA1 5485c161fb02b71b4287b97b77b84d6d096cfa1f
- SHA512 c44f90952393faebbce4e89cb5e2c22d213d32eb59ec461bd83a46f3bc0435f1b06c9b1a1e9e60225daf93c4121871212d24a9a1689019f2440bb7bbb5bf5e7f
- SSDEEP 384:f9kNrpSpjgOzhVc7YKqM3invjsJKF5Iikkyh8fWP8:fCNrcp5c7jdSnvjQKbI2W0
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/level_grid_4.png
- SHA256 55f309155358c623433d2a419dbc55eee20d150b45ef30161e0fb95c593740c0
- MD5 3557177df8d50539f5b7216b110b2ae6
- SHA1 c06e35d65ca673558d3e79e1608376d2b49c11ba
- SHA512 10e68eace4ff3e0d8da49fd99571bef9266e174c3cdaecf89eb752b9f9aa7c1b8311b6d9ed798e70a68ad73879bfe93d32a809c41de55cbb5e4a912b74885db2
- SSDEEP 384:XhXqMqPincXv+O+8llSJLIDB075rPAqGAxUxbj:xaMqT/28l8I9bp9j
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/level_grid_5.png
- SHA256 50456a4b88cfbd9fa9baef7c0205c81b84269bd947382c93c59d2fa83d71aaeb
- MD5 b57f37c678e9ea2b65bb50884ff99c48
- SHA1 1ebebecbe3319832565c4bb096f03641c86b0d46
- SHA512 881c10a6f6d683c2f37e11d1bb5953ada9b702b00d5444f8d3678b5614d0c874fbb4121fbf19052b251f8a57f1b113184e95d185ac44888144df537c6350e0d5
- SSDEEP 384:IXgqe0wEhExytSS3yKNQtrG1LgmlXGJ2L01fRsZBjAerp:t0wEhAyX3LNQ64hS
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/level_small.png
- SHA256 ba64cb2562630688e561b234764f0ee6df99f2634989aa5a0f52ac3beb2c9f53
- MD5 518990cafca262faf5b4f4b6e127ad44
- SHA1 ded784c80edc5281349eab7f2947de712a9e640a
- SHA512 2b480a5d548c6be0702d620b600d0c2f885dec54602e9f60a99a810b3431af559c9439fc9fb739ba0ac052b434e1500c27b118b3f562ae4f72a00703739880ed
- MD5 SHA1 SHA512
Payload/Blocked.app/levels_background.png
- SHA256 db158049f4415f0005ae7149f79b47404e9e88f419201da391f2b6e10aae5314
- MD5 9c2df71e0f5a2cc2a56d1fe553f356c4
- SHA1 26f6568b6758de55693a90a250f4475c72ed54b5
- SHA512 434471bda941f92fb90da1961980376ee41b70e1d200170f94bf2411f5814ceba143f3b1faf182554ec56c99fa2792b913e77865201eb262930ed51adad99e48
- SSDEEP 3072:mBnHEr5v3iCQnYE9j4yh6sagIBxdYDdzpE29U3y0u+C1aWcSucxIgQs5dVcB0JwD:EnHaujnh6NB3YD1pD94y0Ka7aWgQVowD
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/levels_button.png
- SHA256 1b5859231201228a6637be367db4c59282b039349471e0eea10359de71608088
- MD5 d3082ea45536abc50d1e539a5ff28271
- SHA1 e9b3a0dabbdafba5c91f148fe024ba7e3cb1c20a
- SHA512 67db18bcf82081309620ce3709ea09c9c1c7fd8a0b2b54e145b684c7596287cff1f33bd4a90342c8929ed6c5155785c3e9e010b78e50b43ba3225d34ec1b104d
- MD5 SHA1 SHA512
Payload/Blocked.app/records.db
- SHA256 eb22c6b2210fb4ff14a8e7c016a879b2f10215bfde0dbe392d31e33817f6726f
- MD5 d486849a3ff7ca9337b2d988b43b5161
- SHA1 9dd719103115f53329695f4ced30032977726367
- SHA512 26d7d228acbfe743bbdf6a161032c3dc9708a230720613bf6511037abdd13623aaa82aacda09e4b2c57025d8fbd5c14f2f35b0c3e83b6fea70cae0dbb42b2782
- MD5 SHA1 SHA512
Payload/Blocked.app/records_schema.sql
- SHA256 fb40dc0423956bf05086835aa526e25289dc4e9bacccf6b679b31bea74a0925d
- MD5 0af9d332d7ef53c1171a2b33b8ccbf85
- SHA1 edbf98b8b750d7ee23f9e91e58f985bad6cec44c
- SHA512 60d438a9414dfd82d230a53b35836052ee367c2637665e1e17d873524edfb4d9f5df23028501fdc65a634305ed15e0a4bdeadac5b3cfff0d63a5cd75cb1a641b
- MD5 SHA1 SHA512
Payload/Blocked.app/replay_button.png
- SHA256 c55af18c6d179c4121da182f8c657f986ade40aa1e7d3e005ffa2fdb35a76a93
- MD5 84ee4f34dded8ec4bff3a85c59ac8b7d
- SHA1 0c51d0b31ef2c5a5bd2ccf59b9900f69ac46f9fc
- SHA512 5fcd17ed8663f3c04a8d0fb37de0f54167e7856d48f720e73f88e0b58be6f70e4e6817f09166a4400c9355e1278d624adc4fd65dbde31c171420b26b94233797
- MD5 SHA1 SHA512
Payload/Blocked.app/reset_button.png
- SHA256 a72dc88de8ed7034f9786546287530e3d1a236ad2a04f660ffc1d5a5130e1378
- MD5 b1300e85acc81516eb1c8115ce0ce086
- SHA1 3d8c2b9a3a8c001ce369f8b58a11a45bba0f0be2
- SHA512 a9a39559b483288bfe6e6d73ec06a7e61a0b05d65192fc10c260394f9382aa488398b2823af2fbfe7e264697e7e0abe40d5790609437e37a9dc917efced17f78
- MD5 SHA1 SHA512
Payload/Blocked.app/stamp.aif
- SHA256 e76885b8dde2dfd93dc4433cc3add2a9c06a9e73af1a857551024e87d68c5e61
- MD5 569e9786344a1f371c668970c89a9268
- SHA1 5698d71f2560c8996271fbe692ef153c1710f745
- SHA512 956c8067d814f0985afcd93341a1ba2af5aae069b34f489e7c3100d53eaae13c4bb3aef3e81df760cb5195fb6a7461349d6340c1da544ed88ac0d73cf0a96ae6
- SSDEEP 192:Ulr5JxKIlteMrwukeYgG1qGJwqXqzIqDC734d8AIh6ZvOJnptXfSxXqfKi/waYAT:UpPzJrIgZZq6zjDCLcZvCNyXqc/K
- MD5 SHA1 SHA512 SSDEEP
Payload/Blocked.app/undo_button.png
- SHA256 0ff46da18f83c1679922e65ae5c62034b98603430f6868186fdf4196ac800878
- MD5 c415569865c715ebb7ba8d049d27b1b1
- SHA1 a3d998b469d0da7c9da408ffd33c2332d975c19a
- SHA512 6963cd109a8264450e05eca4a5830fe992f7102ddda67d84b805b4ecbff982a3642e678f06d9ea8476efcd5aaa71ce7bb1905d3c423a74502c0f227d76bb704c
- MD5 SHA1 SHA512
iTunesArtwork
- SHA256 883fb3c4c8b76b836d2fa1595d0180eca3fca7ea2dcec5cbc7088f30ce74ce6a
- MD5 41e5940d3abb02534b984aa701d8b618
- SHA1 a5d5bdb66fda3cae7cf814a5c6691909844123d2
- SHA512 f2e24e286ab78d5b21597f5572b7a3117c08b6e0f16e0b6d2083fe880c3ac2d86adeb393bbcc48bf2a42317fb5c00fc995783c3b8f9cad59682696c45f529b0f
- SSDEEP 3072:T58DD3w61DIMwu2QysxVLnMxRe4kpcTfW1pGk2TeFAZrJOZPggjOmQ:T2DXDzwu2QysxhMxRe4kM9k2PcZPlOp
- MD5 SHA1 SHA512 SSDEEP
Malware-1-master/Download.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 de2274da8cf00dfc6e6e52db43f82210a1fb7fd30016ebdc81347fb2d1f248fa
- MD5 6a97f4f16e7879967a5c02d143d0bd46
- SHA1 0898ccf65770813f69bf339462a05a8c6e17be69
- SHA512 0bc14103518a2e234f4e3f4ddc46e91a1ed21c2885fd4eb27d3cf8cd088e4fa4fffcc221ddb404f52794c57d6693b2ce080e797bf33f2322490030e0fce0ac27
- SSDEEP 3072:ZV3bDzHY2weWeFoyUWfMRBsfpVZynzK4ChhO2IGmXf3Ur3CvZJnodCKJYsUH+Iun:ZBbDzHY0UsfPwUIvOd1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\VisualStudio\SmartPss\Update\obj\Release\Download.pdb
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
242KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Malware-1-master/GunMayhem1unblocked.swf
- SHA256 f85f970882bc6667749e219a13736c9ec21b8c9c24b8b72bfe272f33be4248f1
- MD5 bbbd8262dda1516961e2b9d936e20583
- SHA1 2dc9e8ec267747d75bf98779b95e606f64357944
- SHA512 047d4a3e730543180922e73aa392c78da9f14117589bb787cec97e171c42dc8111647541c495bd7844a650ad580e131bccc6a76da55acc51400306a3084eff0f
- SSDEEP 98304:LMcKfaqSDrXuv/jEC39YRofE8X0QC6x2aAN3+FDNYsCPnXLH+bB7kpV4r5N5RUBa:ocnre3YC31fpu6x2aSqDNYpXL+dwV4X/
- MD5 SHA1 SHA512 SSDEEP
Malware-1-master/Header
- SHA256 84ae93ce8327fd797ee289ed1bd97bb77f50ce1ed79a9257c19cc936b8927d30
- MD5 b7bfe4812a9088dc7ce85a4756d072f7
- SHA1 9f2859e66ba3d22385ddd61619bb9385c328a949
- SHA512 a68bd178f0ec9ac5dfadbf0942577bdb38290976577878db9d6dc301a9f9dc1bf465e6f51ba1dff463a6e1c8f316dc1ad1685ef3e6a6e4e81843c24ab334aca6
- MD5 SHA1 SHA512
Malware-1-master/Illuminati.exe
- SHA256 f99e4c9a4dd14d402b16e36988b72f3fe7f34b42157f756dbd14b39c70059336
- MD5 087b2505ac41831c753cf7d1e660c42c
- SHA1 dcae226923e062291f48de4d3416d38387815c67
- SHA512 10d5f6f7c9f1df66a7afd3dcd2e70288d89bb75a2f6fffa3621b4a4192c40b290eb7c76392b0b282d80925b81d2271c3d1e96a4f406d1f1c0d069a5f6f96c086
- SSDEEP 24576:qqvM7STjLT5MSLMDPS2X0xCyj8pk3tgqdtKkkoMJJck:VwMfTvcS2kjPgUGfJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3820768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=23, id=241, version=40116,
count=175, id=243, version=40116,
count=49, id=242, version=40116,
count=7, id=199, version=41118,
count=31, id=259, version=24123,
count=120, id=261, version=24123,
count=38, id=260, version=24123,
count=11, id=203, version=65501,
count=168, id=1, productName=Unmarked objects,
count=62, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=111, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=2, id=265, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Malware-1-master/LICENSE
- SHA256 2d01c78d3d992ae371c5d1db2b477f1abbb2365f3cb71eced098f33130b66221
- MD5 c8bcb45b8a786fcf1c258418805a80fa
- SHA1 e69313344ec36ae34ff47d9fcc17aee2bd0171fd
- SHA512 6dedde863e4c2d191d15b1cc71a27436df081e2e6b85958b386de67354d9cd8fe9d9e5cb1d71b70ebdd2464e7f95dd3a54778a5621a2c79674ce6cdc00a3b324
- MD5 SHA1 SHA512
Malware-1-master/MEMZ-Clean.bat
- SHA256 5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c
- MD5 bbae81b88416d8fba76dd3145a831d19
- SHA1 42fa0e1b90ad49f66d4ab96c8cca02f81248da8b
- SHA512 f03ac63bbb504cb53dc896c2bec8666257034b1c4a5827a4ad75c434af05f1cd631a814cc8689e60210e4ca757e61390db8d222f05bf9f3a0fa7026bdf8c4368
- SSDEEP 192:XBOTDzoOgdlf7MAdTyQuHq2b1vXei2SLca5icrLJlz3:ss/tDyQuHZddL5Jlz3
- MD5 SHA1 SHA512 SSDEEP
Malware-1-master/MEMZ-Clean.exe
- IMPHASH fa1a2f2198605213f450e3c9a78158a8
- SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
- MD5 9c642c5b111ee85a6bccffc7af896a51
- SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
- SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
- SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4837
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
ExitProcess
FormatMessageW
GetCurrentThreadId
GlobalFree
GlobalAlloc
GetModuleHandleW
CreateThread
lstrlenW
GetCurrentProcessId
user32
AdjustWindowRect
MessageBoxA
GetWindowLongW
GetDesktopWindow
EnumWindows
GetWindowThreadProcessId
EndPaint
SendMessageTimeoutW
SendInput
DrawIcon
GetWindowDC
ReleaseDC
MessageBoxW
SetCursorPos
GetCursorPos
GetWindowRect
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
LoadIconW
BeginPaint
UpdateWindow
GetSystemMetrics
GetKeyState
ShowWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage
EnumChildWindows
RedrawWindow
GetMessageW
IsDialogMessageW
gdi32
CreateFontW
SelectObject
GetObjectW
TextOutW
BitBlt
StretchBlt
GetStockObject
advapi32
CryptAcquireContextW
CryptGenRandom
shell32
ShellExecuteA
winmm
PlaySoundA
comctl32
ord17
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=1, productName=Unmarked objects,
count=5, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Malware-1-master/MEMZ-Destructive.bat
- SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
- MD5 4e2a7f369378a76d1df4d8c448f712af
- SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
- SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
- SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
- MD5 SHA1 SHA512 SSDEEP
Malware-1-master/MEMZ-Destructive.exe
- IMPHASH 52753d226ff5a8a88caf9829928cd5d1
- SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
- MD5 19dbec50735b5f2a72d4199c4e184960
- SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
- SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
- SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4653
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WriteFile
CloseHandle
lstrcmpA
lstrcmpW
LoadLibraryA
GetModuleFileNameW
GetCommandLineW
Sleep
SetPriorityClass
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalAlloc
GlobalFree
lstrlenW
GetCurrentThreadId
CreateThread
ExitProcess
GetCurrentProcess
OpenProcess
LocalFree
LocalAlloc
CreateFileA
GetProcAddress
user32
GetWindowRect
MessageBoxW
SetCursorPos
GetCursorPos
GetDesktopWindow
EnumChildWindows
CallNextHookEx
LoadIconW
ReleaseDC
UnhookWindowsHookEx
MessageBoxA
GetSystemMetrics
CreateWindowExA
RegisterClassExA
DefWindowProcW
ExitWindowsEx
DispatchMessageW
TranslateMessage
GetWindowDC
DrawIcon
SendInput
SendMessageTimeoutW
GetMessageW
SetWindowsHookExW
gdi32
BitBlt
StretchBlt
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptAcquireContextW
CryptGenRandom
shell32
CommandLineToArgvW
ShellExecuteW
ShellExecuteA
ShellExecuteExW
winmm
PlaySoundA
psapi
GetProcessImageFileNameA
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
404B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
524B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=1, productName=Unmarked objects,
count=5, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Malware-1-master/Petya.exe
- IMPHASH 1a63922d5931d1bb8ca5188313f78eaa
- SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
- MD5 af2379cc4d607a45ac44d62135fb7015
- SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
- SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
- SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
94575
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
GoogleCrashHandler_unsigned.pdb
kernel32
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CreateSemaphoreW
FreeLibrary
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
LCMapStringW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
LocalFree
CreateDirectoryW
DeleteFileW
GetCurrentThread
WaitForMultipleObjects
LoadLibraryW
WaitForSingleObject
GetExitCodeProcess
DuplicateHandle
ReleaseMutex
GetEnvironmentVariableW
lstrcmpiW
VirtualQuery
GetTempPathW
GetLocalTime
OutputDebugStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcmpW
lstrlenW
SetFilePointer
CreateMutexW
InitializeCriticalSection
TryEnterCriticalSection
SetEvent
ResetEvent
GetFileAttributesExW
SetLastError
VerifyVersionInfoW
VerSetConditionMask
MoveFileExW
GetFileTime
ReadFile
DeviceIoControl
SetProcessWorkingSetSize
OpenProcess
CreateProcessW
ReadProcessMemory
lstrcpynW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CreateThread
DebugActiveProcess
GetThreadContext
DebugActiveProcessStop
VirtualQueryEx
GetProcessId
GetSystemInfo
ContinueDebugEvent
WaitForDebugEvent
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
GetCommandLineW
EncodePointer
LeaveCriticalSection
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
RtlCaptureContext
ReleaseSemaphore
EnterCriticalSection
OutputDebugStringW
DeleteCriticalSection
DecodePointer
HeapSize
GetProcAddress
GetLastError
RaiseException
HeapDestroy
InitializeCriticalSectionAndSpinCount
GetProcessHeap
GetModuleHandleW
HeapFree
IsDebuggerPresent
GetUserDefaultLangID
GetSystemDefaultLangID
GetComputerNameExW
GetOverlappedResult
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
UnregisterWait
GetProcessTimes
UnregisterWaitEx
RegisterWaitForSingleObject
VirtualProtect
VirtualAlloc
HeapAlloc
RemoveDirectoryW
HeapReAlloc
user32
SetClipboardData
EmptyClipboard
OpenClipboard
GetProcessWindowStation
CloseDesktop
CloseClipboard
CharUpperW
CharLowerW
PostThreadMessageW
DispatchMessageW
GetMessageW
PeekMessageW
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
SetThreadDesktop
CreateWindowStationW
CloseWindowStation
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
wvsprintfW
wsprintfW
MessageBoxW
advapi32
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorDacl
AddAce
InitializeAcl
GetAclInformation
InitializeSecurityDescriptor
MakeAbsoluteSD
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetAce
MakeSelfRelativeSD
GetSecurityDescriptorLength
EqualSid
SetNamedSecurityInfoW
ConvertStringSidToSidW
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
ConvertSidToStringSidW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SetSecurityDescriptorSacl
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
SetTokenInformation
ole32
CoCreateGuid
StringFromGUID2
shell32
SHGetFolderPathW
netapi32
NetApiBufferFree
NetWkstaGetInfo
rpcrt4
UuidCreate
shlwapi
PathRemoveExtensionW
PathRemoveFileSpecW
PathStripPathW
PathCanonicalizeW
PathIsRelativeW
SHQueryValueExW
PathAppendW
userenv
UnloadUserProfile
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
Name
.text
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=73, id=225, productName=VS2013 build 21005, version=21005,
count=30, id=223, productName=VS2013 build 21005, version=21005,
count=201, id=224, productName=VS2013 build 21005, version=21005,
count=2, id=225, version=20806,
count=4, id=206, version=65501,
count=33, id=203, version=65501,
count=468, id=1, productName=Unmarked objects,
count=101, id=229, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,
Malware-1-master/README.md
- SHA256 fb39bb4709cdc96c648555b44956551859f4196be099b477e90046197005f1de
- MD5 cb8fa03ac09f49a98bbd4a44a99b0f06
- SHA1 6e15df00c743d477b88fe3949130c03b2f79d4ce
- SHA512 f73d51525739041f0ebf056299823c53b1506bc861db0d3c051fcc07771b65813242b0ad55cfc704c081f9fe181be98f0ba54b89fafacbbd5bd3194d474fb82e
- MD5 SHA1 SHA512
Malware-1-master/S28667145.tk.txt
- SHA256 eacf0311faf049e7ac12260b8279f9eef00435339d2ae196f04e3e09e9b56f08
- MD5 4c6a6fd26b20898b169e16c8b23386ac
- SHA1 c87bb754250e02c2386c28c5870aa57aa8aa28b9
- SHA512 b85e7fd8e33bd538246a2c302c44fbd2013bdceef8d866d5476bf727f1a467e159e028b7e9cc69836ba6c57eca99766bf2f2009f843a0ffb9ab6390183893d60
- MD5 SHA1 SHA512
Malware-1-master/SSL Comodo
- SHA256 127487ed1c8bb2172937267e288a138facd8ceeae797cb4a899a76a53016ba0d
- MD5 761a4b4a4a9eda0f5173bfa9ec9abcad
- SHA1 08c50cd315addd3df16452768d0c8f0f510f3116
- SHA512 7fb46d06ea6fe5ff78ed70b875db3f6bcbdc429ff69619a89da712e1fc26ce3e047788fea6b533ff5a287e5b9019d74cacd8e6c29020b5e6851248f7052c3470
- MD5 SHA1 SHA512
Malware-1-master/Software.exe
- IMPHASH 7f2222d75bcebeb591b7d884c5b9299b
- SHA256 e7f04e85236f0caafe518bd96369313021969077dba1c4a6d42e694498dab04f
- MD5 db056b8fa628b67e11bd626192939d6b
- SHA1 248ca50f39de6b6180265d19fb6eedc68bf25afc
- SHA512 bca1856b4bb8342c0f6d5ee19edcb420c70e6b272f087d3f8f73daa00842fa00037840a5eb5655e1445af8d578d304874323b2889f75b27136df9366df596336
- SSDEEP 24576:ytb20pkaCqT5TBWgNQ7ayEYyM63uUOyok0ceJZwd/w9mML9eu4MaMUp46A:/Vg5tQ7ayExZO9k0waPLR4Ma25
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
155508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
recv
send
setsockopt
ntohs
recvfrom
select
WSAStartup
htons
accept
listen
bind
closesocket
connect
WSACleanup
ioctlsocket
sendto
WSAGetLastError
inet_addr
gethostbyname
gethostname
socket
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetConnectW
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetCurrentThread
FindNextFileW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
CloseHandle
GetLastError
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
RaiseException
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateThread
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
DrawMenuBar
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
CopyImage
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
UnregisterHotKey
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
DeleteMenu
PeekMessageW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
CharLowerBuffW
GetWindowTextW
gdi32
SetPixel
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
GetDeviceCaps
CloseFigure
LineTo
AngleArc
CreateCompatibleBitmap
CreateCompatibleDC
MoveToEx
Ellipse
PolyDraw
BeginPath
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
EndPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAclInformation
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
InitiateSystemShutdownExW
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAce
GetAce
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
UnRegisterTypeLi
SafeArrayCreateVector
SysAllocString
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
VariantCopy
VariantClear
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
VariantChangeType
SafeArrayAllocDescriptorEx
VariantInit
Name
.text
Size
557KB
Virtual Size
557KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
799KB
Virtual Size
798KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Malware-1-master/TX3_ojTHxaEidvzTZOAvBPqzTUsyZYJYhArok5hFTyw
- SHA256 05a2b68c52dcc91875f3ec3855a0a8c230651b41c11e38d49e528bc366cbf3e1
- MD5 81cb1000925451233a8af5095365b70b
- SHA1 0bdee5fa3f5fb81a61f1f295b95d9c66f958ab14
- SHA512 d284915f40d0b40ca7b7a1253daf92621eb61cac6ee772ca8349b41d025065e7aa5f2a9103e6037e2db51fc57e1c21f6554f34714d51b1b749df48bbb1bd64fe
- MD5 SHA1 SHA512
Malware-1-master/Us4XR_D8S5RQ7SdaFWEiR3sqgAz2IBsgrlxJCfNCEYA
- SHA256 8ae3918136c395ce209de715113b5842b8cf3a6a580b1b7839cc9f598aa4a4dd
- MD5 e793221c4478e7146f0e691f2b0543de
- SHA1 e77b72fc0d3befacc7bdd315ad5772a520d5bb2b
- SHA512 0f8806791659e83edd5b94e8452837fc53e82f3b899fac80ec89529cad18f60ba353061fba0b3d29fbe67c9942a639551de23ce87653eafbff939296f9d10051
- MD5 SHA1 SHA512
Malware-1-master/WannaCry.EXE
- IMPHASH 68f013d7437aa653a8a98a05807afeb1
- SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
- MD5 84c82835a5d21bbcf75a61706d8ab549
- SHA1 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
- SHA512 90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
- SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetFileAttributesW
GetFileSizeEx
CreateFileA
InitializeCriticalSection
DeleteCriticalSection
ReadFile
GetFileSize
WriteFile
LeaveCriticalSection
EnterCriticalSection
SetFileAttributesW
SetCurrentDirectoryW
CreateDirectoryW
GetTempPathW
GetWindowsDirectoryW
GetFileAttributesA
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
Sleep
OpenMutexA
GetFullPathNameA
CopyFileA
GetModuleFileNameA
VirtualAlloc
VirtualFree
FreeLibrary
HeapAlloc
GetProcessHeap
GetModuleHandleA
SetLastError
VirtualProtect
IsBadReadPtr
HeapFree
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryA
GetStartupInfoA
SetFilePointer
SetFileTime
GetComputerNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
GlobalAlloc
LoadLibraryA
GetProcAddress
GlobalFree
CreateProcessA
CloseHandle
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
FindResourceA
user32
wsprintfA
advapi32
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle
CryptReleaseContext
RegCreateKeyW
RegSetValueExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
msvcrt
realloc
fclose
fwrite
fread
fopen
sprintf
rand
srand
strcpy
memset
strlen
wcscat
wcslen
__CxxFrameHandler
??3@YAXPAX@Z
memcmp
_except_handler3
_local_unwind2
wcsrchr
swprintf
??2@YAPAXI@Z
memcpy
strcmp
strrchr
__p___argv
__p___argc
_stricmp
free
malloc
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_CxxThrowException
calloc
strcat
_mbsstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
Name
.text
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=1, id=11, version=8047,
count=4, id=14, version=7299,
count=11, id=10, version=8047,
count=4, id=4, version=8047,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=7, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Malware-1-master/Win32.EvilClusterFuck.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c9b98408ca67d08e1986d1855c4d99944caad5580533d18496cd8de86dd0885f
- MD5 2e84f71165225ba0f7f8187c0b2f0f37
- SHA1 3c9bf036163ede4b7f9152d04d1a83b7253dd029
- SHA512 82c39aaef6103877c8472a55eab6270d57f4d7c46830aedf5fbb5661d7e3fd7aee2e172cdc830cba22cd9034f37784a8cc34f70a5918491bccf148ee923db389
- SSDEEP 768:S5ohpPUa2T1VZj4jkVQu7MKquVspXKCxiJrFnMWDmLfe9NZ+OAhaptX/71tXHHi4:tcd1Pl7ZVsw3rFiLfe9NZmAP5ZC6N+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Michael B\Documents\Visual Studio 2015\Projects\File Overwriter [EvilClusterFuck]\Infection\obj\x86\Release\Win32.EvilClusterFuck.pdb
mscoree
_CorExeMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Malware-1-master/apache.exe
- SHA256 1117f585985ca4ddd03695876522f80951c919cb41db5854f013923f62285c09
- MD5 8e747a4c115ac090e54dfa899c287129
- SHA1 a1c523ad0a2fa1b533fb752a25aa48ff1cd4e1e3
- SHA512 049fae2cccf4e1afc79d9e72e016f27d7714ad8b747c28ec3ad520bc25ff319f12aced97d16dbbe863aaab11514a9e90477656983fd67939c0e6d2ddb93558b3
- SSDEEP 6144:ZcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQc:ZcWkbgTYWnYnt/IDYhPn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
743568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
247KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Malware-1-master/butterflyondesktop.exe
- SHA256 4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
- MD5 1535aa21451192109b86be9bcc7c4345
- SHA1 1af211c686c4d4bf0239ed6620358a19691cf88c
- SHA512 1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
- SSDEEP 49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Minor OS version
0
Major OS version
1
Entry point
40000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Malware-1-master/crb.exe
- IMPHASH 34fc9f1d705d6f6d4e6c04b364ef13e0
- SHA256 4b5fe7497864d07f78af15fa3e1aa3702b303b89f9644624871d83dd0f484749
- MD5 24275604649ac0abafe99b981b914fbc
- SHA1 818b0e3018ad27be9887e9e5f4ef1971f422652c
- SHA512 008ef045724963d6ae3b845a6c3de8ebb6682b0f4b8ea77c2d35e2193596b78f0092183de0a88a34f7dde4e71abbc129b2f0f00fd8469801fff66f1b8390b6c8
- SSDEEP 1536:JLMVCWvZ8URtqOz3d+1Qs6H9Mk2e3E2avMWC3yMgYxf6+okbdWsWjcdpKCaIxWzX:VM9ntZ3s1QJdnU2SQdf64ZZ8CaIxWec
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
25129
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
OpenMutexW
GetSystemInfo
WaitForMultipleObjects
lstrcmpiW
GetUserDefaultUILanguage
DeleteCriticalSection
GetShortPathNameW
GetWindowsDirectoryW
GetVolumeInformationW
CreateThread
lstrcpyA
ExpandEnvironmentStringsW
GetTickCount
lstrcmpiA
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
VirtualLock
FindFirstFileW
MoveFileExW
FindFirstFileExW
WideCharToMultiByte
lstrcmpW
FindClose
FindNextFileW
GetSystemTime
GetNativeSystemInfo
GetDriveTypeW
GetDiskFreeSpaceW
VirtualUnlock
VerSetConditionMask
VerifyVersionInfoW
SetLastError
LoadLibraryA
LocalAlloc
GetModuleHandleA
LocalFree
GlobalAlloc
MulDiv
GetTempPathW
GlobalFree
ConnectNamedPipe
CreateNamedPipeW
CreateEventW
GetCurrentProcessId
GetFullPathNameW
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
OutputDebugStringW
HeapAlloc
RtlUnwind
ExitThread
GetModuleFileNameW
VirtualAlloc
TerminateProcess
OpenProcess
InitializeCriticalSection
GetDriveTypeA
GetCommandLineA
GetProcessHeap
GetComputerNameW
WaitForSingleObject
SetErrorMode
GetSystemDefaultUILanguage
CreateMutexW
ExitProcess
lstrcpyW
lstrcatW
GetProcAddress
GetLastError
LoadLibraryW
GetSystemDirectoryW
GetModuleHandleW
GetCurrentProcess
LoadLibraryExW
VirtualQuery
MultiByteToWideChar
VirtualFree
lstrlenA
lstrlenW
CloseHandle
CreateFileW
ReadFile
Sleep
WriteFile
UnlockFile
SetFilePointerEx
GetStdHandle
LCMapStringW
IsDebuggerPresent
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
HeapFree
GetModuleHandleExW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
EncodePointer
DecodePointer
WriteConsoleW
user32
SystemParametersInfoW
ReleaseDC
GetDC
wsprintfA
wsprintfW
CreateWindowStationW
SetProcessWindowStation
DrawTextA
DrawTextW
FillRect
GetForegroundWindow
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetPixel
GetStockObject
SetBitmapBits
CreateBitmap
GetBitmapBits
advapi32
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetUserNameW
CryptDestroyKey
CryptGenKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CryptExportKey
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
shell32
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
ole32
CoInitialize
CoCreateInstance
CoUninitialize
mpr
WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW
wininet
InternetOpenW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoA
InternetCloseHandle
InternetConnectW
rpcrt4
NdrClientCall2
Name
.text
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=225, version=20806,
count=16, id=223, version=20806,
count=97, id=224, version=20806,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=198, id=1, productName=Unmarked objects,
count=30, id=229, version=21005,
count=3, id=223, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
Malware-1-master/eternalblue.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7f5f447fe870449a8245e7abc19b9f4071095e02813d5f42c622add56da15b8b
- MD5 981aaac4782bb076aa737901910f2556
- SHA1 a552a4dac03b584cbb7d461fd48b01ddaa85af5d
- SHA512 334d096f72d46adc522f21834d116968a7cb5f05dc21c60e094ac4ccff69412a2c108aeb5c54861ac717ebf884c632edd0291a3d832e4ab7dcc7903e7f965934
- SSDEEP 12288:96fny4wDTzvE/XICULcJ48j406qbgg6RaAD9bSoGGHgm3Ihr6k:96fny4wbkHJ4I40vggPWSoGWv3c
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
867014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Omerez\Projects\Eternal Blues\EternalBlueScanner\obj\Release\EternalBlues.pdb
mscoree
_CorExeMain
Name
.text
Size
839KB
Virtual Size
839KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Malware-1-master/fear.png.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 101678f77a65b5b5830a128e4c737b2aaaea5be95327ec68213ebb92e4251170
- MD5 60ffde3dd3003cd24feeba26e47e6571
- SHA1 e6c57a55ca93b1f6ebccb8c5fe9757fd0801eea3
- SHA512 0a448886296c1f67760f2e09cbc226955c5abd833b6e7b2ce146cc673ddacca7bfbc59f2fa3f3a83381e7d67a0a677c487fc343833e3834dce84e00a6d286ca5
- SSDEEP 768:AQyHrxwRjWjPc/u1SDSepzEtYcF6HKc6K:AJHrOWjPcmSDSepz46Kcl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Malware-1-master/getr3kt.bat
- SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
- MD5 4e2a7f369378a76d1df4d8c448f712af
- SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
- SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
- SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
- MD5 SHA1 SHA512 SSDEEP
Malware-1-master/iimo3.exe
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 5ac017285572c24fc8b77324a52ca484e83c3622c61bea80a74a6850f0a16061
- MD5 4f8767983d865a5e706ae3c6aa5ab6c5
- SHA1 535bc0a1cf7140176fd6e6a205f3394d146c2ba3
- SHA512 a88e5fd993d2fdde869ef32a5271d5bbd222f2174217bf4e2c4cea6fad624d237b3528478b70ab1ec5011bd031fc93319865f5877e06fb3efcc53cc5c7e786a3
- SSDEEP 49152:ZgTJ84RvagaNgNu5W05jvIAo69PnaLgnMu4x:ZgmmygtNfCvjf58
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4755456
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
Name
Size
104KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
bneqjlfj
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
venxxuza
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=5, id=150, version=20413,
count=30, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=157, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=109, productName=VS2005 build 50727, version=50727,
count=29, id=123, productName=VS2005 build 50727, version=50727,
count=560, id=1, productName=Unmarked objects,
count=151, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Malware-1-master/jey.exe
- IMPHASH 016d8460b9f2ab7f2380c4103e242b0e
- SHA256 97cd04af9acddab58cffa58c677d7645f5d894769d76539f44380b9175a67bd4
- MD5 5a38a223e632a4754f6ec51cbe31215a
- SHA1 008cfd9a4345ff5307daa5d2662db2e185fc3014
- SHA512 e42691b8fda725865b1f379ad8fb56e333ab0c588989ae2890c074679fc59f392b475c57dc472998f00b4a3cad7456810e83886f4f7dd57a8492266ea4eeb189
- SSDEEP 12288:Sss9czpqdx1S3DcWayzZPnpdVYke81SmUJqwCW+:uczp4Y3DN5VYkN1ShFCW+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaEnd
ord697
_adj_fdiv_m64
ord513
_adj_fprem1
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
ord709
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
ord562
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaFileOpen
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaStrToAnsi
_CIatan
__vbaCastObj
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
Name
.text
Size
668KB
Virtual Size
665KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
68KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=12, id=9, version=8783,
count=1, id=13, version=9782,
Malware-1-master/m.exe
- IMPHASH 16d0da010adcbed32b3269206de04512
- SHA256 9ca85dc8b2ff574f775ddc92a45e48a74323c79e8fb2458413decd53cdf47aa6
- MD5 cb53694f76bda870730f964f84f754a5
- SHA1 bc1e6f81d8c54a5fb2e14f9f1ecce980eacb8844
- SHA512 676c46b803b489afd780b4a0f58297578c9a1bec14b1e43a703664c3beda290dd6c88b6175afa59007d491924f217e623a831026aa2cec77a1c86305865eadf6
- SSDEEP 24576:CYt5D+J+TLTSdZRFNR8aBNBweeS2ifqpAp7xGFyN/nd+7dQ5fUMkl:CYt5++T/SdbjBNOeeJiSp87Eu/dUd2UN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
20784
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_SYSTEM
PDB paths
kernel32
GetProcessWorkingSetSize
SetProcessWorkingSetSize
GetCurrentProcess
GetCurrentProcessId
ExitProcess
TerminateProcess
FatalExit
TerminateThread
SetLastError
GetStdHandle
SetHandleInformation
GetCommConfig
GetProcessIoCounters
SetCommMask
GetTickCount
GetMailslotInfo
lstrcpyA
WriteFileGather
LoadLibraryW
AddAtomW
SetComputerNameExA
SetConsoleTextAttribute
CloseHandle
WriteConsoleW
LocalAlloc
GetCommTimeouts
GetProcAddress
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
OutputDebugStringW
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineA
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsDebuggerPresent
GetCurrentThreadId
GetProcessHeap
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
CreateFileW
user32
DrawIcon
advapi32
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
shell32
SHGetDiskFreeSpaceExW
msimg32
TransparentBlt
winhttp
WinHttpQueryDataAvailable
WinHttpWriteData
Name
.text
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.version
Size
512B
Virtual Size
1B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.version
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=223, productName=VS2013 build 21005, version=21005,
count=113, id=224, productName=VS2013 build 21005, version=21005,
count=40, id=225, productName=VS2013 build 21005, version=21005,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=100, id=1, productName=Unmarked objects,
count=1, id=30977, version=25408,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=32874, version=35237,
Malware-1-master/mo3.exe
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 ff4e859d5fa6d8dea84aba8c9c0ccbc58f86be198e4a569f19f60c7844dd4edd
- MD5 9d7166176660b51398b82a2793d9e9ab
- SHA1 b8511b36463a9b64b1a383805f16c99d4cf9ab30
- SHA512 938b5c274cb2d3218465f6f9eac21fb37de419e7f5e1a1383a5620d2a5b4cf50f4e730d4de45a67dca9b00373e8fd7c096d1cece1ffdb8a16be85e92f394b587
- SSDEEP 49152:h6EMvW2D6H+CFkDSMMRTw+0PRzgUfyMzKmWSfg:h6EChD6HPeDFpHGUfy4rlY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
5316608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
Name
Size
231KB
Virtual Size
532KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
grjmapwo
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
xwzujeqd
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=150, version=20413,
count=28, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=152, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=130, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=109, productName=VS2005 build 50727, version=50727,
count=29, id=123, productName=VS2005 build 50727, version=50727,
count=529, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Malware-1-master/mo332.exe
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 f5d20a2ef757dd374b1651a955a80113b33b87578e3484fd3589565d296d55cc
- MD5 552326e3f16df1857e7918a569dcca50
- SHA1 3a3fd7027c65c75b3e8930535b27e29b4681814c
- SHA512 a3d00cc28de8131484ebe29d1addfc9e27c9e782a6ec07bee2a19c88ee3afe0f867f8c0c933b6a83946266d46606483d87c8d57b5679cafeeae09eeae1ba41f3
- SSDEEP 196608:OSfbf3vp28hgy4ohRID4CUAq52Zdm4nKJJmbmChthPtbSttLPSwYJQ:ffT3XhgQRI8C82ZP+MblGttLSpJQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
17575936
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
Name
Size
111KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12.2MB
Virtual Size
12.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
azbwdwxu
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
mkstcdho
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=5, id=150, version=20413,
count=29, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=161, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=109, productName=VS2005 build 50727, version=50727,
count=27, id=123, productName=VS2005 build 50727, version=50727,
count=574, id=1, productName=Unmarked objects,
count=6, id=138, version=30729,
count=148, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Malware-1-master/mysqlconf.exe
- SHA256 cc02e9684f8e78227a2ec631172d32fbb48a4fc2a60fd91d160d2ef5e11c587b
- MD5 fac6ab167e1b02c2e1465ae88fb8fcdc
- SHA1 fe4fff9c4681c3f146c3ea31961d0a2933f07098
- SHA512 82a912a914ca01b533e97ece88550c25d3ba8095c71110fce55e38805ead66807c05b154adff0a457c6d8c98c96f6204503f158ba9dd38928ef86c8d3e0d089c
- SSDEEP 6144:jcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQCO:jcWkbgTYWnYnt/IDYhPs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
743568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
247KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Malware-1-master/o.exe
- IMPHASH 3d0e5bb0bad44a5e58b77f8275e99ee0
- SHA256 47b306c80cf27a773d252757397fe9ec0a9571666044276166ede5b5958489ff
- MD5 73f0230c31eaca0f8cb20c88b4bd6599
- SHA1 79d4ceaa753437e14f4baae45c4675a302f4d383
- SHA512 afb59f13e5485e6815ac38a82b68cdf93bc2a8b01f818e88570fd8a50a6debafa2dcdb61ca4812700a0a223b44f60466333114375075b2c76e7a59c73a72bf01
- SSDEEP 768:YY+RphoNSQhwS2BGmhn6MxRhUeADEe+NBgNK:XkY+pzn6shAgeqB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
5622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C: db
wininet
InternetCloseHandle
InternetOpenUrlW
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetOpenW
msvcrt
_exit
_XcptFilter
exit
_acmdln
fclose
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
memset
_except_handler3
_controlfp
srand
rand
_wfopen
_snwprintf
__getmainargs
__set_app_type
shlwapi
PathFileExistsW
kernel32
Sleep
GetStartupInfoA
GetModuleHandleA
ExpandEnvironmentStringsW
SetFileAttributesW
DeleteFileW
GetTickCount
CreateProcessW
CreateFileW
CloseHandle
WriteFile
shell32
ShellExecuteW
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
60B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
316B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=40, id=1, productName=Unmarked objects,
count=1, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Malware-1-master/qOA7iZJcoB8.exe
- IMPHASH 8ae4a04773f3882a8567173e07a659c6
- SHA256 6b111be3c180de78849b4f1c2d39ee0045695e22d339b50879a769351b1e6b31
- MD5 7a58e7f8cd91b372af614ffe5db58eca
- SHA1 8e341ffcfcb4b60b93700996b037c35f0221ec39
- SHA512 c89d62ddcc79d0e1a42dc090b3a149483e91f61c9aa9aaa489535dc32462d55d6accc2f55a255c42579c89a78afdd62f271dbcb4aab6c075b8cb70f6a143b5bf
- SSDEEP 3072:bQgo+/qo6aiN3HKwkRF9kl+BHpQB8ID0msCJhp4Swm5WXDtVL3d0:2+/qo6f9kRFyl+BJM8ID0pCr/wm5S
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
353607
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
setupapi
SetupDiSetDeviceRegistryPropertyW
SetupDiCancelDriverInfoSearch
ole32
CoInvalidateRemoteMachineBindings
CoGetCallerTID
winscard
SCardGetProviderIdA
kernel32
GetStringScripts
EnumSystemGeoID
GetTimeZoneInformation
GetNamedPipeClientProcessId
GetModuleHandleW
SetDefaultCommConfigA
SetConsoleCP
DeleteFileA
rasapi32
RasEnumConnectionsW
RasFreeEapUserIdentityW
oleaut32
VarDateFromI4
VarR4FromR8
user32
GetClassNameA
DdeConnect
GetClipboardOwner
GetMenuItemID
MapVirtualKeyA
gdi32
GetFontLanguageInfo
ws2_32
select
rpcrt4
NdrSimpleStructMarshall
RpcServerUnregisterIfEx
mprapi
MprConfigInterfaceCreate
Name
.text
Size
348KB
Virtual Size
347KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=27, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
Malware-1-master/readme.md
- SHA256 778853b036941d503d6f279777eeb14130c24c318e5c2ea2c6eadabca331693b
- MD5 663c882a0d419faf6e2f5248475af539
- SHA1 16aa09ad953d6c1f9b119db699518cefac07a937
- SHA512 97a0db4705846772765d497f59200dc47f96c167aba886e61292eaa19d2c798923022572a1da755a926ebe4832530e870714f31281329d0f76833569415f111e
- MD5 SHA1 SHA512
Malware-1-master/rig.exe
- IMPHASH 223b09ffa68a15c012f9161fa06d7e09
- SHA256 ba52bd426e17cf8902ae05eb8caea7e0510d668db97dedd2cabcd1dc5a06063f
- MD5 570a9cc9fd20159e92707abe69676299
- SHA1 864cb610c0c80cf8ff00fd4aaae9b05fa63fd990
- SHA512 ba11d2e1888f736d1934e78db6397ae04ea49422beb7392575422ea51cd459ac9b0c8a274397ab828792728364d145c16fc2390242a17a56a8ad02fa4c580f92
- SSDEEP 49152:BfOqHErn3OFIJDOmxFVIdtKfBDhqGDZdB4hYk/0AK0uOkJA79OB8OITieIr:fcne+9Omb+dtKfBD3rZOkJA79OBkbI
- MD5 SHA1 SHA512 SSDEEP
-
XMRig Miner payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3839947
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
htons
kernel32
GetVersionExW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
CharUpperBuffW
advapi32
CryptAcquireContextA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
winhttp
WinHttpCloseHandle
wtsapi32
WTSSendMessageW
Name
.text
Size
Virtual Size
935KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=259, version=24610,
count=176, id=261, version=24610,
count=23, id=260, version=24610,
count=6, id=199, version=41118,
count=27, id=259, version=25305,
count=120, id=261, version=25305,
count=38, id=260, version=25305,
count=17, id=257, version=24610,
count=285, id=1, productName=Unmarked objects,
count=75, id=265, version=25547,
count=1, id=255, productName=VS2017 v15.4.5 build 25547, version=25547,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.4.5 build 25547, version=25547,
Malware-1-master/sserv.jpg
- IMPHASH a93bc10227d5a9999fd6f439e1ba7461
- SHA256 ea06a7494932ab6c092151d25da6161eaf724f04881ff07f2f30cfc622eec33e
- MD5 c90cf61a0eaa05c312f7b77a09127bc9
- SHA1 cb63424ccc3f5606ba789cf69b57356c35e89f15
- SHA512 9db8e3533122e8f0cdd3b097dc56236d27bee5daf42f8d5eb912db52293e4a4b2357a6c97816e527caab791f920538b133b3432dbcb65331d5bf2b197733a937
- SSDEEP 24576:bSyLtIBYWFkfV0hfPnZBdWGktI7ie8ydTF4EWCA:fKBlNfPjd1ktOie8y1FzA
- MD5 SHA1 SHA512 SSDEEP
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
c8:aa:a6:7f:ba:43:b7:e2:33:c8:65:70:95:9e:f1:f8:7f:3f:cb:7a:cc:ac:8b:67:ac:49:23:92:db:f2:f1:c9
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
MulDiv
LeaveCriticalSection
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSection
GetModuleHandleW
GetCurrentThreadId
FreeLibrary
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleA
VirtualAllocEx
user32
CallNextHookEx
CallWindowProcW
CharNextW
CharPrevW
ClientToScreen
CloseClipboard
CopyRect
CreateDialogParamW
CreateMenu
CreateWindowExW
DefDlgProcW
DefWindowProcW
DeleteMenu
DialogBoxParamW
DispatchMessageW
DrawEdge
DrawFocusRect
DrawIcon
DrawMenuBar
EnableMenuItem
EnableWindow
EndDialog
EndPaint
FillRect
FindWindowA
GetActiveWindow
GetAsyncKeyState
GetClientRect
GetClipboardData
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetFocus
GetKeyState
GetMenu
GetMenuStringW
GetMessageW
GetParent
GetPropW
GetSubMenu
BeginPaint
GetSystemMetrics
GetWindow
GetWindowLongW
GetWindowRect
GetWindowTextW
InflateRect
InsertMenuW
InvalidateRect
IsClipboardFormatAvailable
IsDialogMessageW
IsWindow
IsWindowEnabled
KillTimer
LoadAcceleratorsW
LoadCursorW
LoadIconW
LoadStringW
MapWindowPoints
MessageBeep
MessageBoxExW
MessageBoxW
ModifyMenuW
MoveWindow
OpenClipboard
PeekMessageW
PostMessageW
PostQuitMessage
RedrawWindow
RegisterClassW
RegisterClipboardFormatW
RegisterWindowMessageW
ReleaseDC
RemoveMenu
RemovePropW
ScreenToClient
SendMessageW
SetActiveWindow
SetClassLongW
SetCursor
SetDlgItemTextW
SetFocus
SetForegroundWindow
SetPropW
SetRect
SetTimer
SetWindowLongW
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowWindow
TranslateAcceleratorW
TranslateMessage
UnhookWindowsHookEx
UpdateWindow
WinHelpW
wsprintfW
wvsprintfW
CharLowerA
IsIconic
DestroyCursor
IsWindowVisible
WindowFromDC
ReleaseCapture
GetWindowContextHelpId
GetClipboardOwner
CloseDesktop
GetSysColorBrush
GetWindowTextLengthA
DestroyMenu
CopyIcon
IsCharAlphaA
DestroyWindow
GetSysColor
gdi32
SetMetaRgn
GetEnhMetaFileA
GetDCPenColor
DeleteEnhMetaFile
GdiGetBatchLimit
GetEnhMetaFileW
AddFontResourceA
SwapBuffers
GetStockObject
CreateSolidBrush
CreateCompatibleDC
GetDCBrushColor
advapi32
RegQueryValueExA
RegOpenKeyExW
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
744KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=145, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 build 21022, version=21022,
count=4, productName=Unmarked objects (old),
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Malware-1-master/stak.exe
- IMPHASH 291991da8bbbc1b37483031156a68b46
- SHA256 c080a88916fe7cb7aac5ae0266b140fc286a1b3e77f0648bd2b211ce98fc1f15
- MD5 ffe2ce6ba8577fc06f29758bc97d7dd8
- SHA1 cb763099d27d406507f114992f25a9249cb71e10
- SHA512 b9c2de363ad0965c59ca6004f73ebd1d99ca9a19d0e836822433c73db02f6fca139641910ee2fa637d29e57a6c1db2707b05db4387146c6774f36bdf524813ba
- SSDEEP 98304:myMIT9f/E/QW/meVFPCCLow8kJhZ53Uft:JV9oQufMC0I/S
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6217137
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
Process32Next
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
CharUpperBuffW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
msvcp140
_Cnd_wait
winhttp
WinHttpConnect
vcruntime140
strchr
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-environment-l1-1-0
getenv_s
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wsock32
setsockopt
ws2_32
getaddrinfo
api-ms-win-crt-convert-l1-1-0
strtoul
wtsapi32
WTSSendMessageW
Name
.text
Size
Virtual Size
793KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp0
Size
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=25305,
count=13, id=260, version=25305,
count=4, id=257, version=25305,
count=31, id=261, version=25305,
count=1, id=259, productName=VS2017 v15.4.5 build 25547, version=25547,
count=5, id=260, productName=VS2017 v15.4.5 build 25547, version=25547,
count=15, id=257, version=24610,
count=305, id=1, productName=Unmarked objects,
count=15, id=264, version=25547,
count=17, id=261, productName=VS2017 v15.4.5 build 25547, version=25547,
count=1, id=255, productName=VS2017 v15.4.5 build 25547, version=25547,
count=1, id=258, productName=VS2017 v15.4.5 build 25547, version=25547,
Malware-1-master/sysm.exe
- IMPHASH bdd68345193c3efc98d647d425b4f677
- SHA256 6cccd484309dec754cbed83d20747928b7e2e0b81afc2222135c4fc08bfc9709
- MD5 11af285c2cc20603ef79889bbf6c6ac3
- SHA1 35433420a2468a0b90fb36eae99c7e16865aabb3
- SHA512 57d2cc77b8b742b9d0e490bd2433171c82fb86580145a7ec026051342bee8e2d291d5de83e6438e1479a4cc46136fcc6e6695c748f0653171b1d3dc3228c595d
- SSDEEP 1536:DyXJDBO9C0h7mhLN2+kOngP5Q8gCec2X4LBvm8BSqxfbkPuWmZ0jOoHHSEPUoHPP:DyXyfp9P5BhLBvFXNkGH0jOoTHKFa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
23975
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_SYSTEM
PDB paths
kernel32
AddAtomA
EnumTimeFormatsA
FindAtomA
CloseHandle
ExitProcess
GetTickCount
GetSystemTime
GetModuleHandleW
GetCommProperties
GetThreadSelectorEntry
GetCPInfo
GetSystemTimes
GetProcAddress
WriteConsoleOutputCharacterW
FindFirstChangeNotificationA
TerminateThread
SetLastError
FindFirstChangeNotificationW
GetProcessHeap
SetEndOfFile
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetLastError
GetCurrentDirectoryA
GlobalAlloc
LocalFree
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapAlloc
GetCommandLineA
GetStartupInfoA
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
Sleep
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
MultiByteToWideChar
ReadFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
user32
BeginPaint
GetRawInputDeviceInfoA
PeekMessageA
CreateWindowExA
LoadIconW
GetNextDlgTabItem
GetMonitorInfoW
GetParent
SetThreadDesktop
ScrollWindowEx
gdi32
BitBlt
advapi32
ReportEventW
shell32
DragQueryPoint
msimg32
TransparentBlt
Name
.text
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
128KB
Virtual Size
288KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mysec
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.mysec2
Size
512B
Virtual Size
2B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=114, id=131, productName=VS2008 build 21022, version=21022,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=115, id=1, productName=Unmarked objects,
count=45, id=14245, version=28510,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=65311, version=23896,
Malware-1-master/wannakey-master.zip
- SHA256 941eb0ade566d9b13faafcbc9b94961fede92f01d28bec4e3b70d11f74d0549d
- MD5 3e124e1aef07a9ec3085bcf8c6234e1c
- SHA1 1765ae5f7097d18f63a4f7dfcebdf78617bf6eb0
- SHA512 20892d03aaab0ac22c653be27af9be1afadc1bd3b4b746683a5c381805eed20f3ec00c90b335c19337777549d9f4d296d8c2af03bc54824cd10420822404d78f
- SSDEEP 49152:G4lcggNwl3edhRpi7RhXt2oYe+8Yk5Ddk6KGuKcC7LXYrQb6sw4J6YR6g:G4kdCRvce+pk5q6OKtIarY3g
- MD5 SHA1 SHA512 SSDEEP
Malware-1-master/wintonic.exe
- IMPHASH eb97e4fc5518ac300a92a11673825e0b
- SHA256 a0375c241cebcf6c4a0293f45a5dc0ce1150fe8169ea410c818af67e6f487b4c
- MD5 c7cc7175fa6a305036ecd68cfb4c970c
- SHA1 c440e7653a4811935222651dfe61e56a70e5b92a
- SHA512 0fe4873d7cf6be5fcae7cefd545205ea58a977679b2183ec5caabd47920e3b66813e31e6e545d585f15d3a17d21846b042cd40a507d662c19a2bc58fbfbe4fff
- SSDEEP 49152:+h+ZkldoPK8YakOvfcrEb8XCOEU5fwr9K:X2cPK83vkrEb8XCfU5AM
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
PE Signature issue
Digest
00:21:b9:23:d4:27:34:1f:6c:5a:d3:2f:6a:21:4d:4a:86:49:c4:75:85:fc:e8:76:b9:70:42:05:4b:69:6b:b0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=PC Tonics Inc,OU=PC Tonics Inc,O=PC Tonics Inc,POSTALCODE=302020,STREET=48/94\, Rajat Path\, Mansarover,L=Jaipur,ST=Rajasthan,C=IN,2.5.4.18=#1306333032303230
Chains
Nov 21, 2025
Digest
ab:57:b4:6c:bc:9c:b4:4b:29:9e:3e:6d:a1:60:25:a9:64:92:8c:2f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=PC Tonics Inc,OU=PC Tonics Inc,O=PC Tonics Inc,POSTALCODE=302020,STREET=48/94\, Rajat Path\, Mansarover,L=Jaipur,ST=Rajasthan,C=IN,2.5.4.18=#1306333032303230
Chains
Jun 18, 2018
CN=PC Tonics Inc,OU=PC Tonics Inc,O=PC Tonics Inc,POSTALCODE=302020,STREET=48/94\, Rajat Path\, Mansarover,L=Jaipur,ST=Rajasthan,C=IN,2.5.4.18=#1306333032303230
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=PC Tonics Inc,OU=PC Tonics Inc,O=PC Tonics Inc,POSTALCODE=302020,STREET=48/94\, Rajat Path\, Mansarover,L=Jaipur,ST=Rajasthan,C=IN,2.5.4.18=#1306333032303230
Serial Number
a9:13:43:0b:f1:ec:0d:e8:90:f4:b8:73:bf:ae:54:02
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 27, 2018 - Mar 27, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=PC Tonics Inc,OU=PC Tonics Inc,O=PC Tonics Inc,POSTALCODE=302020,STREET=48/94\, Rajat Path\, Mansarover,L=Jaipur,ST=Rajasthan,C=IN,2.5.4.18=#1306333032303230
Serial Number
a9:13:43:0b:f1:ec:0d:e8:90:f4:b8:73:bf:ae:54:02
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 27, 2018 - Mar 27, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
5
Entry point
163850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSACleanup
socket
inet_ntoa
setsockopt
ntohs
recvfrom
ioctlsocket
htons
WSAStartup
__WSAFDIsSet
select
accept
listen
bind
closesocket
WSAGetLastError
recv
sendto
send
inet_addr
gethostbyname
gethostname
connect
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetQueryDataAvailable
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetConnectW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
SetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
DeleteFileW
FindNextFileW
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
LoadLibraryW
VirtualAlloc
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentThread
CloseHandle
GetFullPathNameW
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
FindClose
SetEnvironmentVariableA
user32
AdjustWindowRectEx
CopyImage
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
SetRect
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
MonitorFromRect
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
PeekMessageW
UnregisterHotKey
CheckMenuRadioItem
CharLowerBuffW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
LoadImageW
GetClassNameW
gdi32
StrokePath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
GetDeviceCaps
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
DeleteDC
GetPixel
CreateDCW
GetStockObject
GetTextFaceW
CreateFontW
SetTextColor
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
StrokeAndFillPath
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
RegCreateKeyExW
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
AddAce
SetSecurityDescriptorDacl
GetUserNameW
InitiateSystemShutdownExW
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoSetProxyBlanket
CoCreateInstanceEx
CoInitializeSecurity
oleaut32
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
RegisterTypeLi
CreateStdDispatch
DispCallFunc
VariantChangeType
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
VariantCopy
VariantClear
OleLoadPicture
QueryPathOfRegTypeLi
RegisterTypeLibForUser
UnRegisterTypeLibForUser
UnRegisterTypeLi
CreateDispTypeInfo
SysAllocString
VariantInit
Name
.text
Size
568KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
844KB
Virtual Size
844KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Malware-1-master/youwin.exe
- IMPHASH d4ede8ca47995be40bff4de0f2cede9c
- SHA256 dfe2c886d9a6e9b26cdddba621fda00832a59def9813177863723e33c8011b0c
- MD5 c3f3773a596db65c6491b578db621c45
- SHA1 ba5529fe2d6648ebfa93c17145f5570f448e1111
- SHA512 8d7fab47b741c2e64533c30400cc6b8c20750948f9a9ad4382463ea920021d875eb9dd4d424d182cf25ffdfa96ae2088e89ae8220dd10e161fd9cbb37e213061
- SSDEEP 6144:dVH5X7dPd2cUnZF+ZXsFv+g11ZebOzWl4QFUTUPYeOEH9yyIKC0ywAHTWZ:dVH5X7dPd2zcO+8ebRJlQeOEH9ytfvw4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
CryptAcquireContextA
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
kernel32
AddAtomA
CloseHandle
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
FindAtomA
FindResourceA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
LoadResource
LockResource
MultiByteToWideChar
QueryPerformanceCounter
ReleaseMutex
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
_write
__dllonexit
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_fmode
_initterm
_iob
_lock
_onexit
_unlock
abort
atoi
calloc
exit
fputc
fputs
free
fwrite
getenv
localeconv
malloc
memcmp
memcpy
memset
realloc
setlocale
signal
sprintf
strchr
strcmp
strerror
strlen
strncmp
wcslen
Name
.text
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
276KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE