All.ElectroRAT.zip
- SHA256 dda14413450a11f336a8305cf274943d614905c3429d4f0efeffe6bf4b8b7bdc
Password
infected
Overview
overview
10Static
static
10All.ElectroRAT.zip
windows10-2004-x64
3All.ElectroRAT.zip
windows11-21h2-x64
10468127a19...1f.exe
windows10-2004-x64
30468127a19...1f.exe
windows11-21h2-x64
32a3b92f618...6b.exe
windows10-2004-x64
102a3b92f618...6b.exe
windows11-21h2-x64
10b154ac015c...cf.exe
windows10-2004-x64
8b154ac015c...cf.exe
windows11-21h2-x64
8b96bd6bbf0...69.exe
windows10-2004-x64
10b96bd6bbf0...69.exe
windows11-21h2-x64
10bb8e52face...3e.dll
windows10-2004-x64
8bb8e52face...3e.dll
windows11-21h2-x64
8ca467e3323...a4.dll
windows10-2004-x64
10ca467e3323...a4.dll
windows11-21h2-x64
8e93d6f4ce3...ad.exe
windows10-2004-x64
10e93d6f4ce3...ad.exe
windows11-21h2-x64
10fa5390bbcc...f6.exe
windows10-2004-x64
10fa5390bbcc...f6.exe
windows11-21h2-x64
10Behavioral task
behavioral1
Sample
All.ElectroRAT.zip
Resource
win10v2004-20251016-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
All.ElectroRAT.zip
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
0468127a19daf4c7bc41015c5640fe1f.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
0468127a19daf4c7bc41015c5640fe1f.exe
Resource
win11-20250619-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
2a3b92f6180367306d750e59c9b6446b.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
2a3b92f6180367306d750e59c9b6446b.exe
Resource
win11-20251015-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
b154ac015c0d1d6250032f63c749f9cf.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
b154ac015c0d1d6250032f63c749f9cf.exe
Resource
win11-20251015-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
b96bd6bbf0e3f4f98b606a2ab5db4a69.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral10
Sample
b96bd6bbf0e3f4f98b606a2ab5db4a69.exe
Resource
win11-20251015-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral11
Sample
bb8e52face5b076cc890bbfaaf4bb73e.dll
Resource
win10v2004-20251016-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
bb8e52face5b076cc890bbfaaf4bb73e.dll
Resource
win11-20250619-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
ca467e332368cbae652245faa4978aa4.dll
Resource
win10v2004-20251016-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral14
Sample
ca467e332368cbae652245faa4978aa4.dll
Resource
win11-20251015-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral15
Sample
e93d6f4ce34d4f594d7aed76cfde0fad.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral16
Sample
e93d6f4ce34d4f594d7aed76cfde0fad.exe
Resource
win11-20251015-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral17
Sample
fa5390bbcc4ab768dd81f31eac0950f6.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target All.ElectroRAT.zip
- Size 881KB
- Sample251130-dedp2sek3x
- SHA256 dda14413450a11f336a8305cf274943d614905c3429d4f0efeffe6bf4b8b7bdc
- MD5 7ff8d31ad43f62f1c6876b725a1ebb1f
- SHA1 e23baf502bf5b2eb81fea0a2e570e7ade8998bee
- SHA512 b1afbd5ed92933ffa1a1add1b5b8cc581c7361d8106fed20a8aee1493af7a0279b27e4220515d39e4f5640df43309aa40073750f9e232438cc5f7a561273a9c6
- SSDEEP 12288:yykcN4NEaT6082MQxzgoOnAlUiQNd83MBBPXyyg1/UgGc3G4af3ENPNBAIhH6oRt:vkckET92MAs8oNvLKBU5l4iCsWvVbGo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
amadey
Version
-
2.03
Botnet
-
044a28
Attributes
-
install_dir
3101f8f780
-
install_file
gbudn.exe
-
strings_key
98efc0765f4c223e79368db4c8650353
-
url_paths
/hfv23svj2/index.php
rc4.plain
Signatures
- Amadey family
-
resource yara_rule static1/unpack001/ca467e332368cbae652245faa4978aa4 amadey_cred_module - Detects Amadey x86-bit Payload 1 IoCs
resource yara_rule static1/unpack001/2a3b92f6180367306d750e59c9b6446b family_amadey_v2 - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/0468127a19daf4c7bc41015c5640fe1f - Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/2a3b92f6180367306d750e59c9b6446b unpack001/b154ac015c0d1d6250032f63c749f9cf unpack001/b96bd6bbf0e3f4f98b606a2ab5db4a69 unpack001/bb8e52face5b076cc890bbfaaf4bb73e unpack001/ca467e332368cbae652245faa4978aa4 unpack001/e93d6f4ce34d4f594d7aed76cfde0fad unpack001/fa5390bbcc4ab768dd81f31eac0950f6
File Explorer
-
All.ElectroRAT.zip.zip 881KB
-
0468127a19daf4c7bc41015c5640fe1f.exe 121KB
-
2a3b92f6180367306d750e59c9b6446b.exe 178KB
-
b154ac015c0d1d6250032f63c749f9cf.exe 457KB
-
b96bd6bbf0e3f4f98b606a2ab5db4a69.exe 330KB
-
bb8e52face5b076cc890bbfaaf4bb73e.dll 222KB
-
ca467e332368cbae652245faa4978aa4.dll 124KB
-
e93d6f4ce34d4f594d7aed76cfde0fad.exe 1024KB
-
fa5390bbcc4ab768dd81f31eac0950f6.exe 598KB
0468127a19daf4c7bc41015c5640fe1f
- IMPHASH 8b847a7b9c8a22909cec12c67eb79951
- SHA256 dd1792bcdf560ebaa633f72de4037e78fe1ada5c8694b9d4879554aedc323ac9
- MD5 0468127a19daf4c7bc41015c5640fe1f
- SHA1 133877dd043578a2e9cbe1a4bf60259894288afa
- SHA512 39cec4cdc9e2b02923513a3f1bc3ac086b0598df77c7029493a810dfbe40c946fa62905d1dcb80aba87c9e74677aac893108faa94e027c261aff7d388bbdcdfc
- SSDEEP 3072:5HYBf8YzKw/MHfBTU3eiu0B/qIbmuvFT8whrQnFW:5HY70Bou0B/q6IOrQnFW
- MD5 SHA1 SHA512 SSDEEP
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
e2:e6:c7:62:64:fb:ef:42:6c:71:1b:a1:1b:c5:1a:da:5c:ee:e0:1c
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c2072656c656173652b636572746966696361746573406d6f7a696c6c612e636f6d
Chains
Mar 9, 2020
CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c2072656c656173652b636572746966696361746573406d6f7a696c6c612e636f6d
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c2072656c656173652b636572746966696361746573406d6f7a696c6c612e636f6d
Serial Number
0b:1f:8c:d5:9e:64:74:6b:ea:e1:53:ec:ca:21:06:6b
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 31, 2019 - Jun 4, 2020
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Minor OS version
0
Major OS version
6
Entry point
7717
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
CloseHandle
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleA
IsValidCodePage
GetLastError
ExitProcess
GetModuleHandleW
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetModuleHandleExW
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
DecodePointer
user32
GetMessageW
TranslateMessage
DispatchMessageW
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=140, id=261, version=26213,
count=18, id=260, version=26213,
count=37, id=261, version=28427,
count=17, id=260, version=28427,
count=17, id=259, version=28427,
count=5, id=257, version=26213,
count=97, id=1, productName=Unmarked objects,
count=2, id=265, version=28612,
count=1, id=255, productName=VS2019 v16.5.2 build 28612, version=28612,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.5.2 build 28612, version=28612,
2a3b92f6180367306d750e59c9b6446b
- IMPHASH 37feaa2c735711635bed71303ba0b945
- SHA256 18fd6b193be1d5416a3188f5d9e4047cca719fa067d7d0169cf2df5c7fed54c0
- MD5 2a3b92f6180367306d750e59c9b6446b
- SHA1 95fb90137086c731b84db0a1ce3f0d74d6931534
- SHA512 c87cda81a0133db40be68e0dd94e39f986f3a32faa54d4a1420e071407c94fffdfef6d6ec8f3fdb893115d84ae12824436cf5785fdb2c77dafb96be858b3b5d0
- SSDEEP 3072:GK0YqBB9mUQ13o2vM2tD81JI0MBkuomh87I3pBSpvVFLm:GnrB9mUWdk26DIquom2dN
- MD5 SHA1 SHA512 SSDEEP
-
Detects Amadey x86-bit Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
60058
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Mktmp\NL1\Release\NL1.pdb
kernel32
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetVersionExW
SuspendThread
GetComputerNameExW
ResumeThread
GetModuleHandleA
Sleep
GetLastError
GetFileAttributesA
CreateFileA
CloseHandle
GetSystemInfo
LoadLibraryW
GetModuleFileNameW
HeapAlloc
GetThreadContext
GetProcAddress
VirtualAllocEx
LocalFree
ReadProcessMemory
GetComputerNameW
GetProcessHeap
GetModuleHandleW
FreeLibrary
CreateProcessA
CreateDirectoryA
SetThreadContext
WriteConsoleW
SetEndOfFile
HeapReAlloc
VirtualAlloc
WriteFile
VirtualFree
HeapFree
WriteProcessMemory
CreateThread
GetModuleFileNameA
HeapSize
GetTimeZoneInformation
FlushFileBuffers
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
CompareStringW
LCMapStringW
DeleteFileW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
DecodePointer
user32
GetSystemMetrics
advapi32
ConvertSidToStringSidW
GetUserNameW
LookupAccountNameW
shell32
ShellExecuteA
ShellExecuteExW
wininet
InternetConnectW
HttpSendRequestW
InternetCloseHandle
InternetOpenW
InternetReadFile
InternetOpenUrlW
HttpOpenRequestW
Name
.text
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26715,
count=159, id=261, version=26715,
count=18, id=260, version=26715,
count=18, id=260, version=28117,
count=18, id=259, version=28117,
count=41, id=261, version=28117,
count=11, id=257, version=26715,
count=133, id=1, productName=Unmarked objects,
count=1, id=265, version=28315,
count=1, id=255, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=258, productName=VS2019 v16.4.3 build 28315, version=28315,
b154ac015c0d1d6250032f63c749f9cf
- IMPHASH db984d50afe43b86386f77062f219561
- SHA256 f33c78cddcf99dd999b065644a17dcbac1b222a7f3342b3fe3293ddb6ecf0060
- MD5 b154ac015c0d1d6250032f63c749f9cf
- SHA1 c96eab62367bd9efb5e124621d8dc2be7c5a61be
- SHA512 dec37485f6e9e9109fa954d5e024223f555af7c2b12f5c9855aa77b43e97d5e54f4cdc651331eee2c7fcaf0a3fa58bb41222cdb3ce16c84b444ef564e7ce6eeb
- SSDEEP 12288:vw4bw/3KjP7bHnREf60JDQJ1MFrhi9PFBVoI+kA3dz+YsM9jMw9pMQH/Nxct+fbN:I4bw/3KjP7bHnREf60JDQJ1MFrhi9PFE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9444
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
TerminateProcess
GetLastError
GetProcAddress
LoadLibraryA
SetLocaleInfoW
HeapAlloc
CloseHandle
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetModuleHandleW
RtlUnwind
Sleep
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetCurrentProcess
HeapSize
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
HeapCreate
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
HeapReAlloc
user32
EndPaint
PostQuitMessage
GetClientRect
BeginPaint
GetDC
ReleaseDC
DefWindowProcW
GetMessageW
LoadCursorW
TranslateMessage
LoadIconW
ShowWindow
CreateWindowExW
RegisterClassW
UpdateWindow
DispatchMessageW
gdi32
LineTo
GetStockObject
MoveToEx
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=171, productName=VS2010 build 30319, version=30319,
count=9, id=158, productName=VS2010 build 30319, version=30319,
count=56, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=103, id=1, productName=Unmarked objects,
count=3, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
b96bd6bbf0e3f4f98b606a2ab5db4a69
- IMPHASH 703ac4d1b72c1ccdd10c79b1648fa904
- SHA256 2f83e130e52cb13944899e81f4ecf49decf52e3949f6d41b45e8b1a19a658ed6
- MD5 b96bd6bbf0e3f4f98b606a2ab5db4a69
- SHA1 b1d370efd0accfc0850237d9d54b19c5c1bf071d
- SHA512 b15e3928fdce6193233c9bf06d979ba5c707144c68abd7a25b976f581f33eaca903f44f564d2d05481915d050e74385196cc61629b8bc5be393ae4c89acd6525
- SSDEEP 6144:PEFgPWJh7yd23476SjW2h6al/k5MyF/zq2aqo:sFVJqoQk5FFrWL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7503
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleA
CloseHandle
HeapAlloc
GetProcAddress
GetProcessHeap
lstrcpyW
VirtualProtect
VirtualFree
VirtualAlloc
IsValidCodePage
GetLastError
LoadLibraryA
ExitProcess
IsValidLocale
GetModuleHandleW
DecodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
SetStdHandle
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateFileW
user32
DefWindowProcW
DestroyWindow
CreateWindowExW
RegisterClassExW
ShowWindow
GetMessageW
TranslateAcceleratorW
TranslateMessage
LoadCursorW
PostQuitMessage
UpdateWindow
BeginPaint
EndPaint
DispatchMessageW
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
255KB
Virtual Size
255KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=122, id=243, version=40116,
count=24, id=242, version=40116,
count=36, id=261, version=26706,
count=17, id=260, version=26706,
count=18, id=259, version=26706,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=109, id=1, productName=Unmarked objects,
count=2, id=265, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,
bb8e52face5b076cc890bbfaaf4bb73e
- SHA256 5545f31c832c8bde6cf7563cdc0f4a4b9b15416480e14f15420b1691444c376d
- MD5 bb8e52face5b076cc890bbfaaf4bb73e
- SHA1 df430358a2c7eaf3e328a00a6f961ded9428e491
- SHA512 f465c12bf336e659608c3a4f1e8e14b0876d28f0ad1a75ffb60c674da9a3535493a7e9357ef6b55f78666418ef9c4f7795aa2840aac0f41d6b53131e353b1a59
- SSDEEP 6144:qJ+WK/pvT7arfwKFzDTsv5oaTh45CjBscX9TEGgO:RJpb7Y7vf5i5X9TcO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
203052
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Main
Name
CODE
Size
194KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
63B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ca467e332368cbae652245faa4978aa4
- SHA256 279524f17f8dd8753f57c2e3e91d21ad84db10316dfbf925cc19556cef55b99d
- MD5 ca467e332368cbae652245faa4978aa4
- SHA1 b6477944050fb4014c747c793378792b268ac06b
- SHA512 ce514859dd29aab68cc10acf7b2571a4f505b4ae4028f2bb9f733078d1eef6856581df42aa854861d8e7a8c61b01b9c67fd1f5774dd0c388a4ae960530d7f3af
- SSDEEP 3072:OeZmogDk+MPedGpqpm2pSBwkXWEfIvgNL2oA29:OeZkgXPppvhfvNS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
107648
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Main
Name
CODE
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
e93d6f4ce34d4f594d7aed76cfde0fad
- IMPHASH 7e7cdb2d3b22f798dfcef9c5a8c303bd
- SHA256 adeba13b358ea8be691fd7f4d025a6ea27b9b120d97d312ea875d6067434d77e
- MD5 e93d6f4ce34d4f594d7aed76cfde0fad
- SHA1 786273ccee50c19e5d6f92aac58dbf617c79ec06
- SHA512 f4ed1270e447fe7406f33a0f1580f4789a799e1f1bfbd8303f2e93d7868dc40b9971f13f88513e48340fa90c91cb86d56d998e0d9cfda65ba150add638ebf0c7
- SSDEEP 1536:WVieJrIbvUMqCgBKrLDd0GqlMm2+Na4NMRJMZkWKaH6kY+1WrwHNzx7hb3xMc:kie1AUztxKaakY+ksHNl3Mc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7740
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapAlloc
GetProcAddress
GetModuleHandleA
CloseHandle
lstrcpyW
ExitProcess
GetModuleHandleW
GetLastError
IsValidCodePage
MultiByteToWideChar
LCMapStringW
IsProcessorFeaturePresent
HeapReAlloc
HeapSize
WideCharToMultiByte
RtlUnwind
GetOEMCP
GetACP
GetCPInfo
Sleep
LoadLibraryW
HeapFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
user32
GetMessageW
TranslateMessage
ShowWindow
CreateWindowExW
UpdateWindow
DispatchMessageW
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
622KB
Virtual Size
621KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=171, productName=VS2010 build 30319, version=30319,
count=8, id=158, productName=VS2010 build 30319, version=30319,
count=55, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=2, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
fa5390bbcc4ab768dd81f31eac0950f6
- IMPHASH 8b847a7b9c8a22909cec12c67eb79951
- SHA256 587a4463673093554cd75b5c9ccb6c254a9d6e8769b1e45ea0390eb2b9d57bff
- MD5 fa5390bbcc4ab768dd81f31eac0950f6
- SHA1 c7d6151d7831d8b75ae6760c3006de58ae2d05e5
- SHA512 867ddbba9144685aafaf90e8dc1b30ea47c8e9bb7eb1b57d8902d15e6cd632f85437e92371bf5f601a00bdf976b4c90739b027ebb48d2a9f8da8b174d618022e
- SSDEEP 6144:HHY70Bou0B/q6IwThbCgcGA/siicMSwbSxwepXJRHCQn:H47Bu0B/LIUzBMKQn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7717
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
CloseHandle
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleA
IsValidCodePage
GetLastError
ExitProcess
GetModuleHandleW
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetModuleHandleExW
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
DecodePointer
user32
GetMessageW
TranslateMessage
DispatchMessageW
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
520KB
Virtual Size
520KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=140, id=261, version=26213,
count=18, id=260, version=26213,
count=37, id=261, version=28427,
count=17, id=260, version=28427,
count=17, id=259, version=28427,
count=5, id=257, version=26213,
count=97, id=1, productName=Unmarked objects,
count=2, id=265, version=28612,
count=1, id=255, productName=VS2019 v16.5.2 build 28612, version=28612,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.5.2 build 28612, version=28612,