tesla encripto.rar
- SHA256 edd9298830d80aaeb7cb12729e2d77b49ba392c4428f32be87086f6d6b74b9d8
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tesla encripto.rar
Resource
win11-20251231-en
windows11-21h2-x64
22 signatures
900 seconds
General
- Target tesla encripto.rar
- Size 7.4MB
- Sample260121-s8gfcsct5e
- SHA256 edd9298830d80aaeb7cb12729e2d77b49ba392c4428f32be87086f6d6b74b9d8
- MD5 d199850f2498c48f2146f770fbd83c33
- SHA1 ce2132cd9995ffe344f03e7a81bb386f0f7d58cb
- SHA512 7a4ac267fa6b2e1fbc64ce5365b1d2dac6388a1a789608a525a71c0fefe2cd17d11ee668d23a1033f8d3db341f6ab5648b215c2bebc57141f35d97a04d8c6dad
- SSDEEP 196608:of9LnELDa/kPZswRMH3yY7AoWHkCzo7De7QU5fQWWgJGgfB:enEfasPZsY0zckCzAe71ZWgGg5
- TLSH T1AD76335088ED6B97C916BD6AFE71A4E6FCF6F3455E1DC1E0109A9E367A88113C0E034B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe unpack002/TeslaDecrypter.exe unpack002/msieve152.exe unpack002/pthreadGC2.dll
File Explorer
-
tesla encripto.rar.rar .zip 7.4MB
-
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe.exe 284KB
-
TeslaDecrypt.zip.zip 978KB
-
TeslaDecrypter.exe.exe 725KB
-
msieve152.exe.exe 1.3MB
-
pthreadGC2.dll.dll 117KB
-
readme.html.html 2KB
-
warranty_disclaimer.txt944B
-
esetteslacryptdecryptor.exe.exe 842KB
-
rakhnidecryptor (3).zip.zip 6.0MB
-
RakhniDecryptor.exe.exe 6.2MB
-
eula_en.txt14KB
-
legal_notices.txt10KB
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
- IMPHASH 41bde7e296ed20c37e477bd256a1b6dc
- SHA256 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
- MD5 209a288c68207d57e0ce6e60ebf60729
- SHA1 e654d39cd13414b5151e8cf0d8f5b166dddd45cb
- SHA512 ce4a7e42738154183fc53702f0841dfd4ad1eb0567b13cc1ff0909f1d330e9cd2fb994375efc6f02e7eddaaae1f465ff93458412143266afdaff1c6bf6477fc3
- SSDEEP 3072:rYXT8PUsMNL8V4tD2My/JAAbQoM29wlV58lbNnolY7VgsYiVTPtiTu/q:rowUsML8g2j0o9wb0bNoaKsYImui
- TLSH T1C3549D02B7EBC0F3E86744744666D3BB467E2D432739D2C7AB503E1AEA311D26638716
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
153505
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathFindFileNameW
psapi
EnumProcesses
GetProcessImageFileNameW
msimg32
GradientFill
kernel32
GetLogicalDriveStringsW
CreateProcessA
CreateThread
GetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
LocalAlloc
GetCurrentProcess
SetLastError
GetEnvironmentVariableW
lstrcatW
lstrcpyW
GetShortPathNameW
GetModuleFileNameW
lstrlenW
Sleep
TerminateProcess
OpenProcess
GetCurrentProcessId
GetModuleHandleW
CreateProcessW
CopyFileW
GetFullPathNameW
LoadLibraryW
AllocConsole
GetVersionExW
CreateMutexW
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
FreeLibrary
GetProcAddress
GetDriveTypeW
GetStringTypeW
GetStringTypeA
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryA
InitializeCriticalSection
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
MultiByteToWideChar
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
ExitThread
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
CreateFileW
GetFileSize
CloseHandle
ReadFile
SetFilePointer
WriteFile
MoveFileW
GetSystemTimeAsFileTime
GetLocalTime
CreateFileA
SetEndOfFile
GetLocaleInfoA
TlsAlloc
TlsGetValue
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
VirtualAlloc
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoW
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
GetProcessHeap
user32
CloseClipboard
PostMessageW
SetClipboardData
EmptyClipboard
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterClassExW
ShowWindow
PostQuitMessage
EnableWindow
DefWindowProcW
UpdateWindow
SendMessageW
PtInRect
SetCursor
DrawIconEx
OpenClipboard
EnableMenuItem
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
DialogBoxIndirectParamW
BeginPaint
EndPaint
DestroyWindow
EndDialog
GetWindowTextA
MessageBoxW
CreateWindowExW
GetDC
ReleaseDC
SystemParametersInfoW
GetClientRect
DrawTextW
GetSystemMenu
gdi32
RoundRect
GetDIBits
CreateCompatibleDC
SetBkMode
SetTextColor
DeleteDC
CreateFontW
SelectObject
GetStockObject
DeleteObject
CreateCompatibleBitmap
advapi32
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
shell32
SHGetFolderPathW
ShellExecuteW
ShellExecuteA
ShellExecuteExW
ole32
CoInitializeEx
CoCreateInstance
wininet
InternetCloseHandle
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetSetCookieW
InternetOpenA
Name
.text
Size
216KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=27, id=125, productName=VS2005 build 50727, version=50727,
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=204, id=1, productName=Unmarked objects,
count=23, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=65, id=110, productName=VS2005 build 50727, version=50727,
count=1, productName=Unmarked objects (old),
count=194, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
TeslaDecrypt.zip
- SHA256 333897ae2d63e44717485eefec1e055b95eb7c202d3bdbed28e7fe281506864d
- MD5 33848625e859e63d81a3c8443cfd5c26
- SHA1 5cc633366273cb689038857f4e3340773d7435ce
- SHA512 58ddea46c1c9da4f3a8d03c70f7fa2493b14ee4ea05ba667f6703e8e9dfc25ce18fdd6a4f74eccf278307c27bb2775215b8f5a8577c9a4357a5953ae7e44b810
- SSDEEP 24576:+RpTfD4QWr6+lTlarz9JHuKNk51+nHH370:+RpTfMVr6gxczvHuyS+nnr0
- TLSH T11C2533D35ABF93060B784BEFE825B485B1E7B720096145F4A84677E2D68CE06AC741CB
- MD5 SHA1 SHA512 SSDEEP TLSH
TeslaDecrypter.exe
- IMPHASH 10ca523498654da2bcbaa41f49835a39
- SHA256 9de2f2469f14931b1a825cf18b172aac675bb3afb860bf2d09cccda5fd45a38f
- MD5 cdf377ac7ae22beb045ddafbc141888f
- SHA1 88bd41a6519c748ab9773d9671781e4936b62112
- SHA512 30772e566effda37ab58ed6a5e701b401ba01067762f8cc1026c034c7238d3b61bf7c8badab9bb736c498bcf680a2b2288e19613bcc7ad1e0c86c548c0b6bc6c
- SSDEEP 12288:NPWf+M4uQHCE9Uocxk72ybn1UUcxvp/151xCZ5:NE+M4uQHCJxk7jn94515rq
- TLSH T1FCF48C13B6D2C4B6E5B2117921B7937A4937BE61473AD6C39BD028258E313E09E3D386
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
377165
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetLastError
SetFilePointer
OutputDebugStringW
FlushFileBuffers
FindFirstFileW
SetConsoleTextAttribute
GetStdHandle
FindClose
VirtualAlloc
VirtualFree
SetEndOfFile
FindNextFileW
GetFileAttributesW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
GetModuleHandleW
Sleep
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcess
OpenProcess
ReadProcessMemory
TerminateProcess
AllocConsole
SetConsoleTitleW
MultiByteToWideChar
GetCurrentThreadId
GetProcAddress
GetModuleHandleA
GetVersion
GetFileType
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
FreeLibrary
LoadLibraryA
FlushConsoleInputBuffer
GetEnvironmentStrings
FreeEnvironmentStringsA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
CreateProcessA
GetCommandLineW
WriteFile
MoveFileW
WaitForSingleObject
CreateProcessW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
CloseHandle
GetLocalTime
GetFileSize
ReadFile
Module32FirstW
CreateFileW
GetExitCodeProcess
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
ReadConsoleInputA
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
GetStartupInfoW
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetCPInfo
SetHandleCount
GetStartupInfoA
GetFileAttributesA
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
GetProcessHeap
user32
GetUserObjectInformationW
MessageBoxW
wsprintfW
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
advapi32
ReportEventA
DeregisterEventSource
RegisterEventSourceA
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
483KB
Virtual Size
482KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
173KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=71, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=191, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=156, id=1, productName=Unmarked objects,
count=302, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
msieve152.exe
- IMPHASH a469345afcd0a476aec1de04a8a63d28
- SHA256 d003a1539658c4f830600792e7f2b0342d2d984996f264feac461b8aefc9717a
- MD5 f41ef94e346d9166aa24a666390ad577
- SHA1 269ad1cfab7acada1bac2de159ce5eb7eaf4b989
- SHA512 1be4a9792cd95111633c94ecf15639ab0461685ab4f11b790854353f1fa3c9606a3917296b27b269f5c72a1b0c400d227cc13144637cd84a62ec565c15c53f34
- SSDEEP 24576:VVYeYt28rG3/s/Ajtq+1rklJLfN2PUxpJccXQWtdZevzhuP+2l5AFQHf:VG6Ud+nUHJccQ0Z9mq/
- TLSH T16D552944FBDB84F5D91309708197F33F9B34AB458026CBA7EF58AE17ED33A522966204
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4716
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
kernel32
CloseHandle
CreateFileA
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FlushFileBuffers
FreeLibrary
GetCurrentProcess
GetCurrentThread
GetFileAttributesExA
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessTimes
GetSystemTime
GetSystemTimeAsFileTime
GetThreadTimes
GlobalMemoryStatus
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
ReadFile
SetFilePointerEx
SetPriorityClass
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile
msvcrt
_getpid
_strdup
_unlink
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_control87
_errno
_exit
_iob
_isctype
_onexit
_pctype
_setmode
_stat
abort
atan2
atexit
atof
atoi
atol
bsearch
calloc
ceil
cos
ctime
exit
exp
fclose
fflush
fgets
floor
fmod
fopen
fprintf
fputc
fputs
fread
free
fseek
fwrite
getenv
localeconv
log
malloc
memcpy
memmove
memset
perror
pow
printf
putchar
puts
qsort
raise
realloc
remove
rename
rewind
setlocale
signal
sin
sprintf
sqrt
sscanf
strchr
strcmp
strcpy
strlen
strncpy
strstr
strtod
strtol
strtoul
time
tolower
vfprintf
vsprintf
wcslen
pthreadgc2
pthread_cond_broadcast
pthread_cond_init
pthread_cond_wait
pthread_create
pthread_join
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
Name
.text
Size
908KB
Virtual Size
908KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/14
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/61
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/73
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/87
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/99
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/112
Size
512B
Virtual Size
498B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/123
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/134
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
pthreadGC2.dll
- IMPHASH 5d8cffde43880e6cd40099ce37d02499
- SHA256 3b159da9dad9afd4bd28b5b1a53dc502a2487068055ed8c30136a76cd6924890
- MD5 72c1ff7f3c7474850b11fc962ee1620c
- SHA1 b94f73a1ce848d18b38274c96e863df0636f48a7
- SHA512 1ed4b3c34dd0033ec2aa05bdacaa45041d9cd5880fdb5530ca033308ab349c09d4811bb276bbdf51a3040b7a337f9a5d33796924550962a56058203799c5bd53
- SSDEEP 1536:8S+qy+D0wdemoU13StS8WVChdiH/pViXJN7fJ/Vs0TReDPD:R+5c0nmJyS8W+iH/p+JNDXs0TRef
- TLSH T1ADC30B88F74B6897DE272B7445DBE277633BF0408513DF02EB1483362D73E92A985A25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4184
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetSystemDirectoryA
GetThreadContext
GetThreadPriority
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
OpenProcess
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__dllonexit
_beginthreadex
_endthreadex
_errno
_ftime
_iob
_setjmp
abort
calloc
exit
fflush
free
fwrite
longjmp
malloc
strncat
vfprintf
pthreadCancelableTimedWait
pthreadCancelableWait
pthread_attr_destroy
pthread_attr_getdetachstate
pthread_attr_getinheritsched
pthread_attr_getschedparam
pthread_attr_getschedpolicy
pthread_attr_getscope
pthread_attr_getstackaddr
pthread_attr_getstacksize
pthread_attr_init
pthread_attr_setdetachstate
pthread_attr_setinheritsched
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_attr_setscope
pthread_attr_setstackaddr
pthread_attr_setstacksize
pthread_barrier_destroy
pthread_barrier_init
pthread_barrier_wait
pthread_barrierattr_destroy
pthread_barrierattr_getpshared
pthread_barrierattr_init
pthread_barrierattr_setpshared
pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
pthread_condattr_destroy
pthread_condattr_getpshared
pthread_condattr_init
pthread_condattr_setpshared
pthread_create
pthread_delay_np
pthread_detach
pthread_equal
pthread_exit
pthread_getconcurrency
pthread_getschedparam
pthread_getspecific
pthread_getunique_np
pthread_getw32threadhandle_np
pthread_getw32threadid_np
pthread_join
pthread_key_create
pthread_key_delete
pthread_kill
pthread_mutex_consistent
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_timedlock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_getkind_np
pthread_mutexattr_getpshared
pthread_mutexattr_getrobust
pthread_mutexattr_gettype
pthread_mutexattr_init
pthread_mutexattr_setkind_np
pthread_mutexattr_setpshared
pthread_mutexattr_setrobust
pthread_mutexattr_settype
pthread_num_processors_np
pthread_once
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_timedrdlock
pthread_rwlock_timedwrlock
pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared
pthread_rwlockattr_init
pthread_rwlockattr_setpshared
pthread_self
pthread_setcancelstate
pthread_setcanceltype
pthread_setconcurrency
pthread_setschedparam
pthread_setspecific
pthread_spin_destroy
pthread_spin_init
pthread_spin_lock
pthread_spin_trylock
pthread_spin_unlock
pthread_testcancel
pthread_timechange_handler_np
pthread_win32_process_attach_np
pthread_win32_process_detach_np
pthread_win32_test_features_np
pthread_win32_thread_attach_np
pthread_win32_thread_detach_np
ptw32_get_exception_services_code
ptw32_pop_cleanup
ptw32_push_cleanup
sched_get_priority_max
sched_get_priority_min
sched_getscheduler
sched_setscheduler
sched_yield
sem_close
sem_destroy
sem_getvalue
sem_init
sem_open
sem_post
sem_post_multiple
sem_timedwait
sem_trywait
sem_unlink
sem_wait
Name
.text
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
1024B
Virtual Size
679B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
1024B
Virtual Size
963B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/61
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/73
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/87
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/99
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/112
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/123
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/134
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
readme.html
- SHA256 ce58f4fd5c5c792b6d2aea8cae4a903edbd4ebe3716d142ee74556d73aa0fd86
- MD5 6de42c7b2e9e9f4c7ed7d3c7d8d946a9
- SHA1 8ebef3784a29b1c3ca75bdf168862ef525907b9e
- SHA512 77aa36248e66eb9d7a72cfb04a64b8ac84740a4a60e5eba857e2039e9cd5b298466e9ad9bfd7e0b1795aa830e914cdc861f2c0d8aceee91cd146e75799e1b47a
- TLSH T1295154F79D8931964341106B3F5ED2A6EF1AD21C8AEC0A57A145429F3C41090CBFB739
- MD5 SHA1 SHA512 TLSH
warranty_disclaimer.txt
- SHA256 3b616dbd793d50e00f143a26ec7ccf2e5cc4bdf3da20b938b7d74d7828c08195
- MD5 77e995e0afeca4140d593ef8c496087c
- SHA1 4ff758f60c531b258df86891f0027740ba483394
- SHA512 ed6d12977e307199a5c648fa78d33017885c5ffecc2aab1f4e84eed3edcb2f1f8e4b69ca8ba3f67d76e4c0f6ecbff72fdf73026fe0b1551cff99ef0911e1a691
- TLSH T19811B1E6B1A29E89C2545F216951DCD070DEA2776935B74B0838B3455F72B0D54FFC10
- MD5 SHA1 SHA512 TLSH
esetteslacryptdecryptor.exe
- IMPHASH f417fbcd0e8d19d9948e4ed247312933
- SHA256 f28d4d4f89cbcc79e7b71f43e1111251546b0ae01d4443d4ecccd6dac4cb40d0
- MD5 5edc171a1dcb0437d3aa6f3babb1a2ea
- SHA1 67d949aea683c389e4d855d1c64b438a31cee1cb
- SHA512 11cd6adc21347a32376b3661874adf6a76f0ee7880e1e7690f6b0e3728042469b1ca9a9e4ae288ae1bf9e8f93543cc4862e2aaee2c76f3e54360f77514056e92
- SSDEEP 24576:tcDy7Ie1urs/+uXMw4Nmm+t6eRHXNlb8so5pZxV:tcVIozlNm7XN18so5pZxV
- TLSH T193059E13B7819573E4F3013956BB57BE8836FE20572985C3A7C4391E8A756E02F3A782
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ee:f3:a3:36:6e:b5:c1:4d:55:d2:09:8f:db:d7:eb:32:a8:0a:b7:bc:e5:3c:67:5f:1f:f2:85:5c:ae:d9:45:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=31 333 532,CN=ESET\, spol. s r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ESET\, spol. s r.o.,L=Bratislava,ST=Slovakia,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b
Chains
May 20, 2016
SERIALNUMBER=31 333 532,CN=ESET\, spol. s r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ESET\, spol. s r.o.,L=Bratislava,ST=Slovakia,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
2f:71:84:9c:2d:57:21:22:e4:60:90:af:8e:76:b8:5f:ea:e8:2e:a9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=ESET\, spol. s r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ESET\, spol. s r.o.,L=Bratislava,ST=Slovakia,C=SK
Chains
May 20, 2016
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=ESET\, spol. s r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ESET\, spol. s r.o.,L=Bratislava,ST=Slovakia,C=SK
Serial Number
1f:e3:de:40:01:9f:83:3a:ff:5d:55:b9:98:d7:12:a8
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 7, 2013 - Jul 5, 2016
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2014 - Mar 3, 2024
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
SERIALNUMBER=31 333 532,CN=ESET\, spol. s r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ESET\, spol. s r.o.,L=Bratislava,ST=Slovakia,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b
Serial Number
1c:12:97:c1:e5:e5:ce:c1:64:32:5a:0d:1d:9e:ce:a2
Issuer
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 24, 2015 - Jun 23, 2018
Subject
CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US
Serial Number
2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 11, 2015 - Dec 29, 2020
Subject
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Serial Number
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Timespan
Jan 1, 1997 - Dec 31, 2020
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Minor OS version
1
Major OS version
5
Entry point
442946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
GetTimeZoneInformation
GetProcAddress
OpenProcess
WideCharToMultiByte
MultiByteToWideChar
lstrcmpW
FindResourceW
LoadResource
WriteConsoleOutputW
ScrollConsoleScreenBufferW
FlushConsoleInputBuffer
GetConsoleMode
SetConsoleMode
SetConsoleCursorPosition
GetStdHandle
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
FillConsoleOutputAttribute
ReadConsoleInputW
GetLocalTime
lstrcmpiW
CreateMutexW
GetSystemDirectoryW
GetFileType
GetCurrentThreadId
QueryPerformanceCounter
GlobalMemoryStatus
LoadLibraryA
GetStringTypeW
HeapFree
HeapAlloc
HeapReAlloc
IsProcessorFeaturePresent
GetCommandLineW
ExitProcess
AreFileApisANSI
SetConsoleCtrlHandler
RaiseException
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
HeapSize
GetProcessHeap
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleCP
ReadConsoleW
SetStdHandle
OutputDebugStringW
WriteConsoleW
SetEnvironmentVariableA
DeleteFileW
FlushFileBuffers
ReadFile
GetFileAttributesW
WriteFile
SetEndOfFile
SetFilePointer
GetFileSize
FindNextFileW
FindClose
Sleep
GetCurrentProcessId
GetLastError
MoveFileExW
FindFirstFileW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
ReadConsoleInputA
SetFileAttributesW
GetCurrentProcess
GetModuleHandleA
InitializeCriticalSection
GetTickCount
GetModuleHandleW
SetLastError
user32
SetFocus
SendMessageW
EndDialog
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
DialogBoxParamW
GetDlgItem
LoadIconW
SetWindowTextW
ws2_32
gethostbyname
getservbyname
htons
WSAGetLastError
htonl
inet_addr
inet_ntoa
advapi32
ReportEventA
RegisterEventSourceA
DeregisterEventSource
Name
.text
Size
527KB
Virtual Size
527KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
190KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=59, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=71, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=237, id=1, productName=Unmarked objects,
count=33, id=223, version=20806,
count=83, id=225, version=20806,
count=232, id=224, version=20806,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=300, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=41, id=229, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=2, id=151,
count=1, id=222, productName=VS2013 build 21005, version=21005,
rakhnidecryptor (3).zip
- SHA256 b38732c67c47957439e482edeea70154ad8e6f933b24ff6ebe2abc27c1c7a3dd
- MD5 a547f7319494df9a02c0d149659a00e3
- SHA1 79189d7a69a318b3ca25ddd22a1a57b29ef1a038
- SHA512 bb6752f9d8b59a4cfe4da5f6258fa76ab5aa5796c5dcf4c6ed8c5d5fab45395e5fff8220f5610d5b45bd9a776a92a10c51fd52c2a98b1afaff8d1532545fa3a5
- SSDEEP 196608:a/kPZswRMH3yY7AoWHkCzo7De7QU5fQWWgJGgf3:asPZsY0zckCzAe71ZWgGgv
- TLSH T1BC563360C8DCAF97C8177D59FF7259E2ECB5F2869E5D81C010DA9E3A3A48217C0E135A
- MD5 SHA1 SHA512 SSDEEP TLSH
RakhniDecryptor.exe
- IMPHASH b96380b654c6213a0c6024c997065ca2
- SHA256 0d63b4ca991eac91808d0d09ab28cf9e3aafd0fa0216016991e5936574db0dd1
- MD5 59985561684928d46cbcea2cc1e99ca9
- SHA1 a17db1a2a4158e34d29b2e778609d245d60d1c59
- SHA512 8cad4c519ae69c495be4fed33579c9b600deb14f5916b02d4376852e44c387598287c8161c19250218d519eea12f127977b9d02c36934eef6b1a6a8afd033d0c
- SSDEEP 196608:LcF75ym3o9dc+zkuWt+fy1147GaJFgEswhgDu:IF74CADa+fy47fJsygK
- TLSH T1E0563355F6D0C973C5664A309DF289E39D3AF9805FB4C5D330CD9A2E2E302A192747AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1c:07:4b:b8:3b:05:22:00:bd:c9:dc:10:e6:5c:fa:6c:79:50:03:d5:b4:70:4a:d6:8c:b2:87:bc:9c:bc:72:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=1027739867473,CN=AO Kaspersky Lab,O=AO Kaspersky Lab,STREET=sh Leningradskoye\, 39A / str 2,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jul 24, 2024
SERIALNUMBER=1027739867473,CN=AO Kaspersky Lab,O=AO Kaspersky Lab,STREET=sh Leningradskoye\, 39A / str 2,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=1027739867473,CN=AO Kaspersky Lab,O=AO Kaspersky Lab,STREET=sh Leningradskoye\, 39A / str 2,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
12:ec:1d:79:45:83:1a:2a:59:69:f4:68
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2023 - Aug 22, 2026
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
12016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Perforce\All\virlab\anti_rootkit\research\KlDropper\Release\KlDropper.pdb
rpcrt4
UuidCreate
kernel32
GetModuleHandleA
Sleep
LockResource
DeleteFileW
CloseHandle
CreateFileW
FindResourceW
GetProcAddress
MoveFileExW
CreateProcessW
WaitForSingleObject
GetTempPathW
RemoveDirectoryW
WriteFile
GetCurrentProcess
SizeofResource
CreateDirectoryW
DecodePointer
LoadResource
TlsGetValue
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
EncodePointer
RaiseException
GetLastError
SetLastError
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
WriteConsoleW
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
advapi32
CreateWellKnownSid
SetSecurityDescriptorSacl
OpenProcessToken
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
GetTokenInformation
SetSecurityDescriptorDacl
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6.0MB
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=121, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=259, version=24123,
count=18, id=260, version=24123,
count=37, id=261, version=24123,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=1, productName=Unmarked objects,
count=1, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
eula_en.txt
- SHA256 374a4956a389e00edc8f01194e08628a5946b62a7bb9e03856bcee27bfa55756
- MD5 bb22b80f758babc6ff389659c7d9db27
- SHA1 3c899a7a484d16cb4ce26bb7fcfa58f101871eb8
- SHA512 94cb0d11fcfda4ec635c130e248ae3e8a2609b410f21c95679933f0f15c6561d7bb655af69deb77aa3105a4b1312398bc796de93e04c3327125d7893d2a61dd1
- SSDEEP 384:rPgGcw8/8h7CBcDk4q2U7ZslsRPXhDsauW99Yl:rPgGcw8/8h+GFW7ZgO+l
- TLSH T19252E8AE7312133106E10357260E5DD6E31F8138B7779694A868C11D3722DB9A3FF6EA
- MD5 SHA1 SHA512 SSDEEP TLSH
legal_notices.txt
- SHA256 2f367bbd8be521f372edb290495440097bc7f0668f497ecb98ece08013a4585b
- MD5 16b4c9bdb79669a4727b298a1ff36933
- SHA1 656d0b376eeb53eab2d6711d31d3efe5cd412a8f
- SHA512 07dfafbdabc8d2745e84d4e6b9e4e3ef74260e503102bff5545eed3232a1f29ceccd971c59be47b9abbcaf94d8bd147879dc4a1f0ac13ddf09e245a23c8af74c
- SSDEEP 192:dxrsMrs/9W3x3di0+xrsXrsy/QZ93OWZ762ROrsMrsSe13C3didCB3rs9rsx5gM0:HrsMrsFIhdOrsXrsyilHo5rsMrsxdsdA
- TLSH T14722B5476E8447A306F1C6647A199AC0F51DA12D3B27590D3C2CA24C6F6BB3ED2BFD84
- MD5 SHA1 SHA512 SSDEEP TLSH