ChessBotX(Mid_April_Update).rar
- SHA256 abb241f219e19a0226dbfc84d78e17a9a024996fcca32d7bbbeec39ce535ea2b
Password
2026
Overview
overview
10Static
static
5ChessBotX(...e).rar
windows10-2004-x64
1ChessBotX(...e).rar
windows11-21h2-x64
1ChessBotX.exe
windows10-2004-x64
10ChessBotX.exe
windows11-21h2-x64
10Installati...ns.txt
windows10-2004-x64
1Installati...ns.txt
windows11-21h2-x64
3License.txt
windows10-2004-x64
1License.txt
windows11-21h2-x64
3Readme.txt
windows10-2004-x64
1Readme.txt
windows11-21h2-x64
3Terms_Of_Use.txt
windows10-2004-x64
1Terms_Of_Use.txt
windows11-21h2-x64
3active_des...64.dll
windows10-2004-x64
8active_des...64.dll
windows11-21h2-x64
8lang/Language.txt
windows10-2004-x64
1lang/Language.txt
windows11-21h2-x64
3lang/chinese.dat
windows10-2004-x64
3lang/chinese.dat
windows11-21h2-x64
3lang/english.dat
windows10-2004-x64
3lang/english.dat
windows11-21h2-x64
3lang/german.dat
windows10-2004-x64
3lang/german.dat
windows11-21h2-x64
3lang/russian.dat
windows10-2004-x64
3lang/russian.dat
windows11-21h2-x64
3lang/spanish.dat
windows10-2004-x64
3lang/spanish.dat
windows11-21h2-x64
3Behavioral task
behavioral1
Sample
ChessBotX(Mid_April_Update).rar
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ChessBotX(Mid_April_Update).rar
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
ChessBotX.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
ChessBotX.exe
Resource
win11-20260130-en
windows11-21h2-x64
19 signatures
150 seconds
Behavioral task
behavioral5
Sample
Installation_Instructions.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Installation_Instructions.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
License.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
License.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
Readme.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Readme.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
Terms_Of_Use.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Terms_Of_Use.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
active_desktop_render_x64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral14
Sample
active_desktop_render_x64.dll
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral15
Sample
lang/Language.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
lang/Language.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
lang/chinese.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
lang/chinese.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
lang/english.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
lang/english.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
lang/german.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
lang/german.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
lang/russian.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
lang/russian.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
lang/spanish.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
lang/spanish.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target ChessBotX(Mid_April_Update).rar
- Size 38.0MB
- Sample260416-e9ndeafv2r
- SHA256 abb241f219e19a0226dbfc84d78e17a9a024996fcca32d7bbbeec39ce535ea2b
- MD5 d6c86efec2e5d7a1d8bd1b3c0c96e58f
- SHA1 fac441ea655f857ddc4567a0c5ce5d41520521dd
- SHA512 bde9bd7e22d15af0c69867022efc5515d9ff97260f5dc782fd39fabb4a47aaf60955f6b742aa76bd4d75d11fbe5cf19e34e5c776d2ad000c91bfd402cfa3fcdf
- SSDEEP 786432:sLgtKAnHdjni4HcackUWPsxwPhr0a6t65QpJ4q7i0J/s:YgtBnHdbp8a7Lz6t65C77JJ/s
- TLSH T1369733740455DB0BA693AAC5F61D83ACA7488488F86D0E0749FE290BDF5F36ADFC161C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/active_desktop_render_x64.dll -
resource yara_rule static1/unpack001/active_desktop_render_x64.dll upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/active_desktop_render_x64.dll
File Explorer
-
ChessBotX(Mid_April_Update).rar.rar 38.0MB
-
ChessBotX.exe.exe 100KB
-
Installation_Instructions.txt1KB
-
License.txt1KB
-
Readme.txt1KB
-
Terms_Of_Use.txt1KB
-
active_desktop_render_x64.dll.dll 7.9MB
-
lang/Language.txt1KB
-
lang/chinese.dat12.4MB
-
lang/english.dat5.2MB
-
lang/german.dat5.8MB
-
lang/russian.dat5.5MB
-
lang/spanish.dat5.1MB
ChessBotX.exe
- IMPHASH 1ad7d70d7b6c16d05f66818c394cb860
- SHA256 f712c2a8b4abf2e299a2b480020333deb0f43364e9686cda78b1243c62e4830d
- MD5 1ea7d59053d8bd45bea95355b3d8d499
- SHA1 de0c8fba8d7ac8f547c88b6e5f7f5cd422ec2903
- SHA512 6e978f16c2f7a8d5918f4ebc8f71fc4b796487aa1e3dbc02faeac35a2d4ec0cb0d35408297778fbbe0d77a4247b9f4e9a7733252fef4f575d17b33374c07bc40
- SSDEEP 1536:9LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6f7HxE7Qxa:xTzuyRFNN9N/wwjtHxvWuYsTRUf+5
- TLSH T1B5A37C9767E078F9E8638B34ACE14915E736F96706B0CB8E1394415A4F233C19E78B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
2026
Digest
83:09:6f:d6:db:8c:a2:55:22:f2:b3:ce:b9:26:47:e2:28:fe:a4:1e:d8:ae:e6:ea:3a:7e:d5:70:1d:b7:b5:36
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Apr 7, 2024
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
1d:df:0a:bf:39:d0:dd:d6:5f:f7:36:f4:57:15:00:64:19:7f:9d:ad
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Apr 7, 2024
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
03:38:82:1e:28:c9:9e:a3:9d:2e:a3:7c:fe:39:d1:06
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 13, 2023 - Dec 12, 2026
Minor OS version
2
Major OS version
5
Entry point
4616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\buildbot\build1\desktop_screen\build\bin\active_desktop_launcher_x64.pdb
active_desktop_render_x64
SetDesktopMonitorHook
ClearDesktopMonitorHook
kernel32
TlsAlloc
CreateFileW
CloseHandle
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
Name
.text
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=225, version=20806,
count=97, id=224, version=20806,
count=8, id=223, version=20806,
count=3, id=221, productName=VS2013 UPD5 build 40629, version=40629,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=79, id=1, productName=Unmarked objects,
count=1, id=229, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Installation_Instructions.txt
- SHA256 6a995dfe9d0af9ab8c4e78ad81de5c9589ecd2cdbde82818822547ad94f8bf49
- MD5 e6b406926017138ff37e9a83a8a5078e
- SHA1 782d290dd1d8759220d441c9542d705a64d87390
- SHA512 7149254b876f2eff8e06f9f905002115418c38c0d29f91b613ac365fed573ff7dcb6dd555a005167596cece5a2bae36a6c79f4eb108ad1dc4e3b8fd180c38bf4
- TLSH T1BB31035DB698A32927924F4776323D82D1425440E3454894BFAEE4C8DF3EF60CFB2B86
- MD5 SHA1 SHA512 TLSH
License.txt
- SHA256 4619d1e3ef029ea8810880955f39e9d9e6a29793f4acff91b44c70fa910bbf8a
- MD5 f5e79cbaefc8d354773d138c86220e5f
- SHA1 c2b54d24efe8e075916dd2e85b59bc270ea08d5e
- SHA512 b41f11f128d87bb1fb9762db3c04ba17091cb2ef4bb4ee09e96cb9b70db6228f983942e7612d9e329fc93692121dd476b3cdfc25c221dbb8794ca95146b5e742
- TLSH T1B73174747141531B4B410FEA69726EA2F21E9C20E22358F8797C50C81F7682BCFBA122
- MD5 SHA1 SHA512 TLSH
Readme.txt
- SHA256 72cab35a81b90d825c9875fea6ae6e5d2bd5c16b0d8ae0864eed81bbf6fa9b09
- MD5 bc1b28e828257f2af40705d99e72787e
- SHA1 aab50e7b0c52fad3719b6b736c7e9c4dc490cc91
- SHA512 0e6ed295bfd1b568a417d2d3ec33c75b0881e8b851b94e89fce60574335aa20d6361ceec2c4923cd7e980bcd3c2bf997d35e996b2a3a1ffe25c2da914b7c8c4b
- TLSH T11931F1AA79107B5D33168EC560332E075911F044D765185A371EA1CADFFBE11EF53320
- MD5 SHA1 SHA512 TLSH
Terms_Of_Use.txt
- SHA256 bc8ce49abf3581814edce5cc17a5c242bcd9ab38ff9dd705724a222be7687642
- MD5 c771656067b9add757a6c45fb3d97f7b
- SHA1 282cca1ca6f511147e2894311173124b2a43649e
- SHA512 e942d5a4c2a0d6d68b26aa4cbc88e86fd10b8d69a11bd8e55dc89960d0acabe41dfa9e91f608dc8c88c0064cdb05050bc986acf593da1dd3e8f2c2c28b10aaae
- TLSH T1AE31A2B9731157B626830E725A735FA1B36768F0F5105161705EC0C42F72A39CFBA59C
- MD5 SHA1 SHA512 TLSH
active_desktop_render_x64.dll
- SHA256 cc6920f5e93bf9faeb2ef179d8bd7bd074149211f5f038167bea1e5303a7a9e5
- MD5 dc4620ced97044d5c7d1098bf1ddc9e1
- SHA1 8e2edb1e1b2e4945c827638a42a8b6be12f0fb63
- SHA512 ea578d743a07ea37a5b79dcde15d9736b6726f487add52100bbd01d399e76ccfe4d7e4d0eda7803ee2bf3ffd836b9810cff81e8d1509c5ceeea70c02ec9cce71
- SSDEEP 98304:mV+froMl4BJrRpELtOzYIsGA37WpYw13TDIanf/tg:m8Vl4zHFsBCyaf/t
- TLSH T1C08633269BDDA4D3D3C7597841348A01B38A7053163FAD32B44C69624AFE18B36EDF27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4690352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
A2dhEbWMzaEzrco4RRHN
ApplyBspatch
ClearDesktopMonitorHook
CloseSpeakerVolumeInterface
DllRegisterServer
GetMuteState
HostMainLoop
IGSRoBS31LUkngOhn
Iroe6vT03kMPfDZz9vE1WipMCEQ
LS2qecNHl9wwuk82cUMKq
ModuleMain
ModuleMain2
OpenSpeakerVolumeInterface
PFwu389L4XU8jHWZh7Hkfv
PZ4q3tqi7jIvtKQDAld2qxTGaAVO9
SetDesktopMonitorHook
T8OTWLdhdvdLkQqkewLjuF8B
X0MOSZvoF5XvqASn
Zt6iPF9d7PAjXK2pg2trKaDBcbAbM
ez2s55AvHQ4wpdFxkMNeVRm5
f3QnLdZz2i
gV7sQmdUYRQ3uUDF
i32JYnS0KaR9
iUF41nlhnVVBooD39e
jmvweps0gKw
kkupZfzGPG2dsx9DR
oITwtYkNnPwMDJLE5ZeseT0bNsx1o
pp6PwrTm6fUnNT4FLto
u0GNHfJzfy
uUQKnbJ6kUo8hHH6j
usdWdDMaMk
y6Xv2Z3F0TIfc6bCENgaAgBH0T
Name
UPX0
Size
Virtual Size
712KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
171KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
lang/Language.txt
- SHA256 8ae0d4824e48db6019655a9e15c859440efdcf74cef80ed48837bf5eb6285b73
- MD5 a20e84771c8c630ad26ea0a9d64f860c
- SHA1 de87277749d684160369ff807f2208c3bf2031e0
- SHA512 1a291567ada010ab6b1a7accb00c4913fde5498bfda9ea4163778d587faca1842f93717c1b1940ea61b5aed70a98d9af059b280edef457d93413ccb1a788727d
- TLSH T1DF311125700027A822160D82303A1E749B8540A8D3318D3E372D85DEAFF3D18DEB93A2
- MD5 SHA1 SHA512 TLSH
lang/chinese.dat
- SHA256 c6bb79b70464fb4eaab3b6c3d0af660feef4b2412d6c98bb0af4f39fd612bef5
- MD5 95767ff0b851ae2845aaf67316e43362
- SHA1 ff7ef624c9c2e7492ee1c9560bc64ec5ed761f9f
- SHA512 df212cf7e02993c34945bc6522b33f54e03ceca6e0d64165daac74a28aafc39199850713f8e69af5de2a29b71e36dea885d8a7b48a52c8d8623791eeca71f35a
- SSDEEP 196608:IOWBZQ6B0kDBQ4KPVvgBmp6LHr+Glr9OE/G+Uw4myi9b7+WGoyyT4N4cFBGs:JWn0kDrKtURQ+ii9b7GyrS
- TLSH T1DCD63349915157532232B8688E7E17E0B6ECABD20DDD2D9D0128C026C66FFF9CA7CC76
- MD5 SHA1 SHA512 SSDEEP TLSH
lang/english.dat
- SHA256 0db4bdb72ab911d42ef9a6ed75e6f3ef2240daf0fefd8dd2ee141497a8dbaef8
- MD5 3dca73e463fa49645517a08503d9edce
- SHA1 5f74b42b9959d108653f9665d47b8d321efb3440
- SHA512 5c273a98181a5f7af5813c1ca86c7dfe703c76933449848355009be19f96ff26de57f77de477abe02aa6e8d04bf8538ce05c701c25419ee2dab3470cadbf984d
- SSDEEP 98304:50/lAp2JnUIvKBTo5Lv+ic5cvNJRo5Q8dUoUeX+DhzZw2eadNdM/7WTZmJ:2TqISa5Lq5YNJRo5vU+ODhzZyihZmJ
- TLSH T17A4633AC7CC0B8EB120AE43D906A653253BFF0F54FC57583236AB95F411A92C5CE9879
- MD5 SHA1 SHA512 SSDEEP TLSH
lang/german.dat
- SHA256 63e579a1ffed5874cc0fc89fd32e5c69eb4d521ed74457251d1e37223b169dc0
- MD5 c4a04e818589ad459565ffda25d7e2d4
- SHA1 300f19f4dae4d9160b1ce8e6db13322a4755254a
- SHA512 6996c334bdbdc19aa27cd7d03d73381ec2bfd5f6830690c5f66203f3a368f4eed54219ddb018a3c93101712021ed1810e2ce3d2e5385d441ef534be9e47f9b4d
- SSDEEP 98304:4E6Nlnl2/D6FIvtXTIv7L1M+v+Ygvh4t73nXGkGvZjcimIL3:p6NlID+IvtXMTRMpYlZ3XUvZjcoT
- TLSH T1B656330C9E215C908331D5BCF57592BC9F4ED41A4E9386EABBE36168C9B73008DB396D
- MD5 SHA1 SHA512 SSDEEP TLSH
lang/russian.dat
- SHA256 d9433bda1cadad8a309717fa5b697acc007a53e62973e97eaedfb88ca56e36ba
- MD5 dfb69427b631c3827e0ea4f280068cdc
- SHA1 4638606153cc68237123c0441e10b935e7387cbc
- SHA512 c6e3c929623d0517f8374b9b289a5e9983b64d9a0f60a862bc5e1d7cebd7574e3fd0bc40520569bc009d4dd53906f9665b9c1802108d4c48b0f20bee549712ec
- SSDEEP 98304:eNFkfOjud004IOXyTv+sE5QTa2pIjaC05OGPeN1JroZHhKj9M33C7hm2H0+Pk+:ikmjuq3yTv3EyTaIUxGPeLJrWwj9Mi7P
- TLSH T12646334BA624A6783DEFA6822D61FC8CB250F64F0973F44D8EDCD82BDD7427521A3119
- MD5 SHA1 SHA512 SSDEEP TLSH
lang/spanish.dat
- SHA256 d279caac3d68e66825f2c2c0c79115263e78edc6d91e21295cb04128d7ff172d
- MD5 f355e4abe31bbb30953542ba2c2b563b
- SHA1 d15211f22ea98c83ed3a10dd373f14d345b03303
- SHA512 ae3a07af55739cc63f6a1918457eb8236a61fbce59a7043ad5841d12efcc0f7ae4ce8d7cfa400673c9481fe09713b9fe16156cda71436139ce345288d0accb15
- SSDEEP 98304:1Tk6d3jiTizrXp1Si5iF7fGSERk50SVg5Ua05EDh/Q/a87BOPoO:1I6tjiTSjS8ANEE9Vva05EDh/buB8oO
- TLSH T1113633B19F56F64113629F286B6D41B2E2370056AFC6F91C11E386D8B32B71CBA603F5
- MD5 SHA1 SHA512 SSDEEP TLSH