Архів.zip
- SHA256 c6c14b927aaa4ebc831247d7a5157ad768ee3725c5bd134d96057065c8c2c403
Behavioral task
behavioral1
Sample
NjRat 0.7D Golden Edition - Rus.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
20 signatures
900 seconds
General
- Target Архів.zip
- Size 1.9MB
- Sample260405-2vs2nscs9q
- SHA256 c6c14b927aaa4ebc831247d7a5157ad768ee3725c5bd134d96057065c8c2c403
- MD5 4d20140e028894fd5998451cb9e8ab82
- SHA1 1396711a1351e5e90fb0ff8bce21ed6bdd1dcdb8
- SHA512 d25f0f6168d0acdd9f18c4c45e665b3e07c2631f45620dbaaafaa3d743162a2693ee7babd612557c5c7782c2df37b5c8b5f3192173e3219e46ae537c8f9be6a8
- SSDEEP 49152:a7CUNzSBOyQ0SzOlCmmESeqQioFQgunNSp/SDBX5A:a7jXyQ0KIzq9gQgsNSgHA
- TLSH T12995339824218C34CC43C0B279BB3758F1650A52FF16968D27BFEDD45BF74710A6AA8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
C2
-
:
Mutex
-
[RNVD]
Attributes
-
reg_key
[RNVD]
-
splitter
|Hassan|
Signatures
- Njrat family
- Unsigned PE 16 IoCs
Checks for missing Authenticode signature.
resource unpack001/InjectIcon.dll unpack001/Mono.Cecil.dll unpack001/NjRat 0.7D Golden Edition - Rus.exe unpack001/Plugin/AntiProcess.dll unpack001/Plugin/cam.dll unpack001/Plugin/ch.dll unpack001/Plugin/mic.dll unpack001/Plugin/plg.dll unpack001/Plugin/pw.dll unpack001/Plugin/sc2.dll unpack001/WinMM.Net.dll unpack001/stubs/Anti.bin unpack001/stubs/Stub.bin unpack001/stubs/dlentrypoint.bin unpack001/stubs/dlnormal.bin unpack001/stubs/mpress.exe
File Explorer
-
Архів.zip.zip 1.9MB
-
GeoIP.dat1.2MB
-
InjectIcon.dll.dll 13KB
-
Mono.Cecil.dll.dll 305KB
-
NjRat 0.7D Golden Edition - Rus.exe.exe 1.9MB
-
Plugin/AntiProcess.dll.exe 16KB
-
Plugin/cam.dll.dll 62KB
-
Plugin/ch.dll.dll 23KB
-
Plugin/mic.dll.dll 48KB
-
Plugin/plg.dll.dll 28KB
-
Plugin/pw.dll.dll 251KB
-
Plugin/sc2.dll.dll 12KB
-
README.md50B
-
WinMM.Net.dll.dll 43KB
-
stubs/Anti.bin.exe 12KB
-
stubs/Bsod.egg5B
-
stubs/Exe.egg11B
-
stubs/Hide.egg5B
-
stubs/Mpress.egg5B
-
stubs/ReGKey.egg45B
-
stubs/Sound/Sound.wav23KB
-
stubs/Stub.bin.exe 44KB
-
stubs/VN.egg6B
-
stubs/copy.egg5B
-
stubs/dir.egg6B
-
stubs/dlentrypoint.bin.exe 11KB
-
stubs/dlnormal.bin.exe 11KB
-
stubs/host.egg9B
-
stubs/mpress.exe.exe 101KB
-
stubs/regch.egg5B
-
stubs/regname.egg14B
-
stubs/startupch.egg5B
-
stubs/startupname.egg11B
-
stubs/task.egg5B
-
user.config93B
GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
InjectIcon.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 98348ffe70a68f69d934118a2d14b86b382d698601827a4c1d322d878d36bbdc
- MD5 83921e813f885ae1669aa0efa21f8695
- SHA1 130f59f513eb64018736c0173d45a2b524c282fc
- SHA512 f123ef9c5fd3157c6f51b1ac02d6103baa1ebd2a02e3c2d95355b15ce3730f241c0d61d1ffc07713b8d3af7600730d29049683c589c7007a9a4e7bb4707f58c3
- SSDEEP 192:OLCpu5eYPefzYTZVzunlYJL/eBvnaDNIDLTHqaf0+E+sQAE8UBscU:OL+1qe09prqNnq+LTGQY
- TLSH T1EB52D70693D6C332CE6E873A5C1377A45B31DE00DA52AB3F55A0B2676DB33440E93762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Dark\Desktop\InjectIcon\InjectIcon\obj\Release\InjectIcon.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
123B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NjRat 0.7D Golden Edition - Rus.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c81d701c3a4d6b7bcaa40f9c92a1bcfdf2f829954cf1ca15556712fbdc792834
- MD5 8d540934a359a0480de188a748b3d573
- SHA1 556693330454d09e461b0cc16c2c8f69f7f3cd45
- SHA512 d2214389578a2928cc51b7fb098dd8d1ed4677f97a3f6bb18ec5494a3247866c400af7fe5d1a326cd25faf6090139849d3ef0fbb43c62075e5a436c0599d47b9
- SSDEEP 24576:S69t3fGD4IC7VS2s5G8xQ63UJzyS6P/qY7/:S6T3vs5txQ63OqP/P7
- TLSH T138950F03B302EE55E9B832F450058FA052697E4E9174C6B62A743A78E9F98D3FD913CD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1966382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/AntiProcess.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f643ab116e7bd8515032a502b8700afb5bdbfc08fc1caa08817b3061e98b763e
- MD5 b21947a28760750689f46e071d575d07
- SHA1 6008a9ff367e7a715422d2e2f96312f1a3231a9e
- SHA512 75fd467e4be5480e7dc4ce665a50cf5fcea3c4301f17674feec866d04e0f7036efaec0feffa35fc07ab19b70ff82d133c457c88d7c776f62160bff6cf13a2399
- SSDEEP 384:0sRt7Wow+KPUhkRf1jJXMgthizKN8dhct+1W7Lf45kNQfjO8pZ3TR:xRt7Wow+KPUhkRf1jJX4dhVI/mf
- TLSH T1F4720817A3E6873BCFED0EB48526150483F1C3069553FF2F9DC665768AA33404B9279A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\برامج\اختراق\سورسات كود برامج الاختراق\Anti\Anti\obj\x86\Release\Stub-Anti.pdb
mscoree
_CorExeMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
167B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f00cda5808e3fd126d452708308ddee6556cb83adaccd02efe83654a40fc641
- MD5 7eba4d9562bf7fc14f2c1bb142a1aa6f
- SHA1 7c0f49bd672100881e7340a480dc6674d5dfc862
- SHA512 5e7e9ee05674eb6a943b84437a46cd6c4dd7d63cd95bf308cd614026383eafc087590f6238a5282e275cf1875038aaa46ef843a5c6d322e3b7b1a63e2d454830
- SSDEEP 1536:CfGJpkk261SBIAPVQfiZba2epz5B7hzUzaQo:QGJt3MIAdZbLepz5BlzUz5
- TLSH T126534C6E6798541AC58D46BC94770F1053F0CA1EA337EB8E2B7891BCCDB23814A5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3bc2898da9cd9e202b7795b330fa3daff81a4b02ab4ecfe47fdd712c53252f12
- MD5 2490eda5b4450138ba79f39fcc90048a
- SHA1 f8af994fdeeb8afbf7d95e816da389a7eb09806e
- SHA512 4f96028666bcb0a80730e8429082c2ab839fe8662086ad9735641fe8e55d51f909171124b1500c1da4065f26a9d3118c8b6c24d1827d12c5c887cd1e358a2d58
- SSDEEP 384:B3RxTVz/Cn1CfWok/7+I98wxOaPlXfNIsGwPEvMnNKp9p:fxTVzK10N69XfNIUUpz
- TLSH T19EB2F81963E5C762CCFD07790862621167F2CD51DB13EF6F2ED870E92AB37048B4269A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d327985d7e4f83adffbdf831c1e999c68cb90238790b63260af19d24bfa66b8
- MD5 1607999c56366fc2096a27a8bd237b98
- SHA1 0e0a61c55c6a7e8fecaa2053afeaf816095374a2
- SHA512 d30a642f26307f16a88782de2635b6e7b852dcbc90975c3920d61468dde06ed921074d95bd9d3b3b058ce4ce54973254370830d68f94a0d56b5072e82b890b85
- SSDEEP 768:fI3iafm1WcNQtd53fddlGemdITB8l/zkgQM8QRyHQuhwWCTxqPbojlfB:H1WcGyem7QXMryHQvWCTxqPbojl
- TLSH T19D23D6407A981CBAC52F067D7CE71621F6B18D64A327E26B1CBD60F718877DE96006F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6f8770a35ec0845226a28dd57c8ae414dc8814a6871bd0bb818bb13ca3b82106
- MD5 04cb30a874ee349721b0398594de65fe
- SHA1 8f3272e318edd73c1f4194f3a90143e18f158e10
- SHA512 a69b3bc0e30ddaae10478626ac231b214864b722c9254d932a81ea1016f4f49cf04551d17cbe93819f9e1bd88f679fdc1f5446761c7065e2b0d30a8b7edf40ae
- SSDEEP 768:l78dTGdbp1AD8CYDMxelHpWuVP1eksWwnb9s7:+5hD8C2MxeSidBeb9s
- TLSH T162D2D70D2BA4C925C5BE57359D2223224FF346134817FF6E4CCF9AEC19A23884B56A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a1cc072effd8c38406a6fddf4d8f49c5366bb0e32071311d90db669940987ce
- MD5 872401528fc94c90f3de6658e776cc36
- SHA1 c58e22158774d16831350de79eb4e1711379e8a6
- SHA512 6da881fb968ba9d9200777a9f19d69220468482f3eaaf687c433790d512da520f5adb23441fdc8f3fd10785918eb2864ea3ef32ddb80d2f6665550ea455f4a2f
- SSDEEP 6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
- TLSH T16C44E02722CE3CA1E17E4A7033B353C2C3A9DD108612D51E29D83556AA7E1D37A42FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
250558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Super\Documents\visual studio 2013\Projects\pw plugin\WindowsApplication12\obj\Release\pw.pdb
mscoree
_CorDllMain
Name
.text
Size
237KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f97aadb4d1c59f4b3155a9ec57f91a05700aed38b0090096f8f1e0e7975b6561
- MD5 9c8b5c9ec7d24ef02c7df4e589dba366
- SHA1 6f939463f40343cf62afc072978c833ee864914f
- SHA512 a4bf281274c22b41b8faf0cbe7559c5a62bd7614bcc06cdc29f8f28419010bdadcb70a850886b4be9d7b6edb370fb34283a5f0991a1320edbaa12b5a194f8196
- SSDEEP 192:dUFqUAbp57yUnWcL90wG1YL7ANg5egmdOnB61f8a54qwynam0q61pLWnVG:dUcNWcL90wG10MNg5PTM1Ea54qwOaz2G
- TLSH T1A242F80D6F88C613E7AD0ABD26A3431593B6C1664312FB5B5ECE74F569AA7C202083D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
README.md
- SHA256 94472753f8a506fcfbb28d294af7b4f9ebbd878d274444d4fd588e2035f68533
- MD5 ec91841256a3a5e0e6d45793717436ad
- SHA1 3a22752cc744296a76fa9b9ddaa388c312b4939e
- SHA512 5ba66e653d7a861edd31f0cc217ae549712418f6d9ed095c26a149bb01eacfef8c9eb5c03e760818aba27bd26fcfe12090b875972d47176e7fe05eac6babb14c
- TLSH T1059002E796063B41814391164D41511D1430400599089518A52492716E1A1659672988
- MD5 SHA1 SHA512 TLSH
WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/Anti.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 01d0bedcc943e13e341578423a2fc6848d9f63f1c5800b9a16bd64f65a1fcdde
- MD5 2170473f4f2b81e9b909996b0f459d16
- SHA1 81be2df85521167bcffd449e22db1add18e7bc5c
- SHA512 f5d879a45dfa733e264018fc4a714421e8b5fef5f8f06f2293ac327bbc4f4d09fc123a38d271bbd1dbc6e0ca206ec618027a10bf5291d7bb804862cef4aeb416
- SSDEEP 192:J1o3yrrIXd2lBBVCfA+XZm7nloYk4kNIDLR7swYoxU5R09KxK:J1o2k6BBVIA+JT4g+LRwcCRCKx
- TLSH T11742291577A58374CFFD0F325C6356101BBAD706CA636B3F98D8427A99E32108663E32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\Desktop\Desktop\My Src\SRC - Coringa-RAT 0.3\Stub AntiProcess\obj\Debug\MemoryDiagnostic.pdb
mscoree
_CorExeMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
159B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/Bsod.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/Exe.egg
- SHA256 21a79c05c0f8307c51271987d8f78c2be7adc0ba1882cff03d9be82255e09dd5
- MD5 d81891c69f5b8e60db91a41be4249c8e
- SHA1 77b257e03fc069c535b42fe8c38bd5e9d8f21e86
- SHA512 55b1a8117193331375444324b81c488a738c88b8b0e53d72cfd7fd088677db0f7fb7f01af26930db816f2080bcc9bbb5847fd5cb8034f5971361c8bc71905a49
- MD5 SHA1 SHA512
stubs/Hide.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/Mpress.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/ReGKey.egg
- SHA256 b8fa5aa5af1c96f87c35e32117364155dfab8f913fcd098b71f59888e0609154
- MD5 c7e93739b6dec45a71cce1da31ccdcd8
- SHA1 7b65dd11ab20361e4c4d9dad4a1c5d0389d0af2b
- SHA512 016f6e6bfe36567430870da31d1bebc134f07e68ab7574e2bd22e17f80aad19e9036c9c97322ada577fdd6cb67056fc528b1351086d02eae69bbe62dd475d2c7
- MD5 SHA1 SHA512
stubs/Sound/Sound.wav
- SHA256 a76aa44b4924a960d020cc82c0e29e840f46fd81ec05c91ddbf4f42169ade4db
- MD5 ff8b7adc4209146b4ec595a986fd6384
- SHA1 1630cfd169baad76ba47fc725f296bd4fbd26bbd
- SHA512 f6e6ef9dd841d8265f6d6f0f26965c467c8db6d60b81eaf6bc8aa85c2b77ad5e9cb939a30ef37349f7ed666480847e0dd0d26e61fb0a5b12bac1d58045d6f510
- SSDEEP 384:2fNSnOOUe9RcnAEtrNEAl0Zcp1+XKnRPXnIbMUjwu8SKZelRGSQMQRWFV:W4nB1OnXLPlmcL+XKRPvUEu8elRosFV
- TLSH T132B26B9384E1B0425E0FC6B9FE1BC9A8F14AD8DDCDCDD75A5114E63690F6232C29F982
- MD5 SHA1 SHA512 SSDEEP TLSH
stubs/Stub.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f9901a131548492470fab93c1d607be4d5cfa174f5b2efe2a592fddfa3af9fdd
- MD5 2ca8aa52af999240dddb9790a1f474bc
- SHA1 599fa5e9ce3f7a634543595f73dd92bd5e406d8e
- SHA512 5bad1d2bfdd6259456b8beba60a93341a6f3dab3d673bfdc6003891357e3bf1344059849c8941f532f46791d25ddd29040c5a4549ae676a80cd545471658a9e9
- SSDEEP 384:7F7RVdzu0ohd1vwyxEsvgvRpkhcaE1EgRqmVldNCJ9yko5lwWHWqb4Zz8ujoLT3m:BMDzBd7vAcIqAdQJ9O5GWHW6UkA
- TLSH T13F23A64DB2508574E6EF4BF1B8A162D806719057A946A10FC9F2B5E94FB3EC08710FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\Desktop\Stub1\Stub1\obj\x86\Release\Stub.pdb
mscoree
_CorExeMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
111B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/VN.egg
- SHA256 417dacf7bc522f756571e33110ad80a23a17a16abea66fa1c004e91b5535140b
- MD5 8746d62c81bb0c573a0a1086f9955c7b
- SHA1 80ee75364815abf7c4ac88639279d2137bd8668c
- SHA512 a3d26b5cb548f85a567fbcae79f5769f99f1164e2d44ed3594c220f52d63d5996e3c9cbcb972f129a54937857facdb0b82763e782f68bb27cafa419ccd956e49
- MD5 SHA1 SHA512
stubs/copy.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/dir.egg
- SHA256 07f8b1a4dba9ee295d9af001e6859fd115c69f452d287fc6e6c0ec6ac49cafdd
- MD5 2fbcfac1e2d2302c87300af0d4f592a5
- SHA1 c73400d24e0b5332a354df36b33f90a0e980d619
- SHA512 000f85bdda6558866153c7c2a7fc0de0eb9e36218f3e4748af0909c7a74caff707b8f46a51949ed63454d4c1d8045382136d9338c7fff492737fe12169df75af
- MD5 SHA1 SHA512
stubs/dlentrypoint.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c8294263bb4e447f53eeb9e639dba6ec24d735d80a7d05894e8b88bd115f2970
- MD5 4a7b5a4da67c17c762cb538e6fec9ed1
- SHA1 65945d34c9484151c67f9a780c488186db4aece7
- SHA512 fcea20011c5cfc91b1f523bafe7df96a1723bab7a7bf182ba14caddd76eb658faae9a8840b9095a8f30d6ea8665e163b014649dc32dc3c0f781a435f4be11c2b
- SSDEEP 192:RFXnc1L11AvlszLq65grqZmGnloYk4KNIDLT7pnElS+Fs:RFs1LnAvlszeILy4a+LT7pElf
- TLSH T11B32082653858776CF3F0B72082375404BB6C306D296AB7E9DD466AA8FD72460BB3371
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\AppData\Local\Temporary Projects\class\obj\x86\Release\class.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
131B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/dlnormal.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0e36c6fbbc68953d2702c3d5f84eeb35912ce9a53aadf467f8df60faf51a7f5e
- MD5 2b53e572879a63aaa6ab032221a24d99
- SHA1 cecfb4dad0d128bc78369aba53839828af223ff1
- SHA512 327d26775f38f29f462c8a3a9d921ab0d89cf80527acb2ddd539d0842988f93c2cbf335a865cea893ab2a81915a95683cdfd8033f9a357aacbf0b8d3360e8188
- SSDEEP 192:3d3WKytoFQldQKDFdzG1nvlldKXZmGnloYk46NIDLRKQVuYvpxGBA:N3Wuy7FBGJvl7KJy4q+LRK6lx8A
- TLSH T1CB320829A7918770CFBE0BB2086775800BB6D30AC7936F3FCCD4695696E311947B2626
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\Stub Downloader\ClassLibrary2\ClassLibrary2\obj\Debug\Class.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
119B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/host.egg
- SHA256 12ca17b49af2289436f303e0166030a21e525d266e209267433801a8fd4071a0
- MD5 f528764d624db129b32c21fbca0cb8d6
- SHA1 4b84b15bff6ee5796152495a230e45e3d7e947d9
- SHA512 2f8748abdbb42c16f5d62251f8adea1f65443b6ed0ec063b49be332a6c8cc200892828deee3bbc44bffff040677446dfe0fe5d9dc5a2150d342dd93456b54e22
- MD5 SHA1 SHA512
stubs/mpress.exe
- IMPHASH 51e7ef6b1d43d0d05d7109dee9789560
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- TLSH T125A3F1A1B140A61DF98F4E39CCC7B38994D2EC21953352466573FA8F84B27E43F12B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225455
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
imagehlp
CheckSumMappedFile
Name
.MPRESS1
Size
88KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
1024B
Virtual Size
862B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
stubs/regch.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/regname.egg
- SHA256 d9bf5215fd3470cebfaa8f90e670edd92e2192d7561f0fb0563d54fcfa6efdbe
- MD5 99c7315e03761ceafc2e151ae808f267
- SHA1 799d0cb439a58d27b92cdf4a8f177aa3fa49d4af
- SHA512 5132ccf17ff8726c7bb338df203e45b639adbd5665dd57a9f5b8e4e4f80f916abb74f4c96fffd017f2b5bf9a84208a211225f3d8ef8337b4aa0442e6303b070b
- MD5 SHA1 SHA512
stubs/startupch.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/startupname.egg
- SHA256 46237cbc19353167743677a80ab15a202877d968d907ecd4341ecae2cea2d3db
- MD5 7797cd8b4621ffc45f229516be6ecdbc
- SHA1 6ee10b56197f3d7732c93c35229af02373466caa
- SHA512 f993de6f1494d6fdeb3f489e6baf83a5c307c9bea1bbac2e7ab838439be445350e53a13f125d03a7208ecd84617ebcbee49022b2f8ac814d9ce73d2a2edef63d
- MD5 SHA1 SHA512
stubs/task.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
user.config
- SHA256 4b811ec98b3799a6fa3ac12796768b8ca04a3acd26f8d78a3e6e159a346fd697
- MD5 ad052788878c1d604567873934e7f010
- SHA1 b667670af3db27405aa79819182a298e947e4b1b
- SHA512 d278a23c9fe1c6235b0e4a8bfc253f18cad99fdcce6305ec25ea389d9323cf24d78ca9378004557a6ef4f54eaaf047bd90e59136a620aabff1c14743ff10aebc
- TLSH T15BB002C494508D754F9D0521DC0351214D94174CCC713570F7301723C40007003D0151
- MD5 SHA1 SHA512 TLSH