vcl.zip
- SHA256 918819ac0847656e4e7cf09e6526a960affe6b43e7e7b1f87ec58929bee8a195
Overview
overview
10Static
static
3wtf - Copy (10).exe
windows10-2004-x64
10wtf - Copy (10).exe
windows10-ltsc_2021-x64
10wtf - Copy (10).exe
windows11-21h2-x64
10wtf - Copy (5).exe
windows10-2004-x64
10wtf - Copy (5).exe
windows10-ltsc_2021-x64
8wtf - Copy (5).exe
windows11-21h2-x64
10wtf - Copy (6).exe
windows10-2004-x64
10wtf - Copy (6).exe
windows10-ltsc_2021-x64
8wtf - Copy (6).exe
windows11-21h2-x64
10wtf - Copy (7).exe
windows10-2004-x64
8wtf - Copy (7).exe
windows10-ltsc_2021-x64
10wtf - Copy (7).exe
windows11-21h2-x64
10wtf - Copy (8).exe
windows10-2004-x64
10wtf - Copy (8).exe
windows10-ltsc_2021-x64
10wtf - Copy (8).exe
windows11-21h2-x64
10wtf - Copy (9).exe
windows10-2004-x64
10wtf - Copy (9).exe
windows10-ltsc_2021-x64
8wtf - Copy (9).exe
windows11-21h2-x64
10wtf - Copy.exe
windows10-2004-x64
8wtf - Copy.exe
windows10-ltsc_2021-x64
10wtf - Copy.exe
windows11-21h2-x64
10wtf.exe
windows10-2004-x64
10wtf.exe
windows10-ltsc_2021-x64
8wtf.exe
windows11-21h2-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
wtf - Copy (10).exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral2
Sample
wtf - Copy (10).exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
11 signatures
900 seconds
Behavioral task
behavioral3
Sample
wtf - Copy (10).exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
900 seconds
Behavioral task
behavioral4
Sample
wtf - Copy (5).exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral5
Sample
wtf - Copy (5).exe
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
7 signatures
900 seconds
Behavioral task
behavioral6
Sample
wtf - Copy (5).exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
900 seconds
Behavioral task
behavioral7
Sample
wtf - Copy (6).exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral8
Sample
wtf - Copy (6).exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
7 signatures
900 seconds
Behavioral task
behavioral9
Sample
wtf - Copy (6).exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
900 seconds
Behavioral task
behavioral10
Sample
wtf - Copy (7).exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral11
Sample
wtf - Copy (7).exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
11 signatures
900 seconds
Behavioral task
behavioral12
Sample
wtf - Copy (7).exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
900 seconds
Behavioral task
behavioral13
Sample
wtf - Copy (8).exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral14
Sample
wtf - Copy (8).exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
11 signatures
900 seconds
Behavioral task
behavioral15
Sample
wtf - Copy (8).exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
900 seconds
Behavioral task
behavioral16
Sample
wtf - Copy (9).exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral17
Sample
wtf - Copy (9).exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
7 signatures
900 seconds
Behavioral task
behavioral18
Sample
wtf - Copy (9).exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
900 seconds
Behavioral task
behavioral19
Sample
wtf - Copy.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral20
Sample
wtf - Copy.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
11 signatures
900 seconds
Behavioral task
behavioral21
Sample
wtf - Copy.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
900 seconds
Behavioral task
behavioral22
Sample
wtf.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral23
Sample
wtf.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
7 signatures
900 seconds
General
- Target vcl.zip
- Size 661KB
- Sample260502-e367yacz5m
- SHA256 918819ac0847656e4e7cf09e6526a960affe6b43e7e7b1f87ec58929bee8a195
- MD5 d991680600ac355c4ab1cc6e12232bc6
- SHA1 ad73341bef49c0d40c573e182e312668fcd7a728
- SHA512 2c8450d17d594b60336956d6fbb421a578f918b19c2929e715893444f842a1754372831c45d2bf1d30dc4374b0faa98f9a14b8ab3457ff7f4939110eb316dd87
- SSDEEP 12288:rvmATGXJnvmATGXJSvmATGXJVvmATGXJQvmATGXJLvmATGXJcvmATGXJ9vmATGXb:SZGZRZIZ7ZyZ/ZQZt
- TLSH T1F4E4123242BF4F786C52D9B9318AC1B82E7C4E5BC6C120DD9E828750C949B7669CBA47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/wtf - Copy (10).exe unpack001/wtf - Copy (5).exe unpack001/wtf - Copy (6).exe unpack001/wtf - Copy (7).exe unpack001/wtf - Copy (8).exe unpack001/wtf - Copy (9).exe unpack001/wtf - Copy.exe unpack001/wtf.exe
File Explorer
-
vcl.zip.zip 661KB
-
wtf - Copy (10).exe.exe 235KB
-
wtf - Copy (5).exe.exe 235KB
-
wtf - Copy (6).exe.exe 235KB
-
wtf - Copy (7).exe.exe 235KB
-
wtf - Copy (8).exe.exe 235KB
-
wtf - Copy (9).exe.exe 235KB
-
wtf - Copy.exe.exe 235KB
-
wtf.exe.exe 235KB
wtf - Copy (10).exe
- IMPHASH dc0f61aee001ba10e3a7e0d44c90131c
- SHA256 7bd1f50b832af076880678fb70cada1061c911992aa7339b5693a0c194e3b5e5
- MD5 1e15ea75a1f635a6aca9d987764a13e9
- SHA1 c1ff6fbc8106bdc9714a7ec5ce85a422a369ca29
- SHA512 b2a798a8d68e8096a61f73bc04e95a4b6e42e9e4a5153d16feaefd726558caa98749c52d76146e261cbf01d4cc1e9e70c020f7bc9ad20943c29cb9b5983c6d1a
- SSDEEP 3072:DbeVX+RLL4ypDYsPGLwLvVWRMiW95BQ2Of5QUNtWhoev:eQRLLbpYS95BQ2QQUNtWPv
- TLSH T16034F83BA7635CBCC29781B5A686CBF1B832FC150320BD5F0695C7327E6AC544F99898
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_onexit
_read
_setjmp
_strdup
_vscprintf
_vsnprintf
_vsnwprintf
abort
calloc
exit
fgetwc
fprintf
fputc
fputs
free
fwrite
getc
getenv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
strchr
strcmp
strerror
strlen
strncmp
strtoul
vfprintf
wcslen
shell32
ShellExecuteExW
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
wtf - Copy (5).exe
- IMPHASH dc0f61aee001ba10e3a7e0d44c90131c
- SHA256 7bd1f50b832af076880678fb70cada1061c911992aa7339b5693a0c194e3b5e5
- MD5 1e15ea75a1f635a6aca9d987764a13e9
- SHA1 c1ff6fbc8106bdc9714a7ec5ce85a422a369ca29
- SHA512 b2a798a8d68e8096a61f73bc04e95a4b6e42e9e4a5153d16feaefd726558caa98749c52d76146e261cbf01d4cc1e9e70c020f7bc9ad20943c29cb9b5983c6d1a
- SSDEEP 3072:DbeVX+RLL4ypDYsPGLwLvVWRMiW95BQ2Of5QUNtWhoev:eQRLLbpYS95BQ2QQUNtWPv
- TLSH T16034F83BA7635CBCC29781B5A686CBF1B832FC150320BD5F0695C7327E6AC544F99898
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_onexit
_read
_setjmp
_strdup
_vscprintf
_vsnprintf
_vsnwprintf
abort
calloc
exit
fgetwc
fprintf
fputc
fputs
free
fwrite
getc
getenv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
strchr
strcmp
strerror
strlen
strncmp
strtoul
vfprintf
wcslen
shell32
ShellExecuteExW
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
wtf - Copy (6).exe
- IMPHASH dc0f61aee001ba10e3a7e0d44c90131c
- SHA256 7bd1f50b832af076880678fb70cada1061c911992aa7339b5693a0c194e3b5e5
- MD5 1e15ea75a1f635a6aca9d987764a13e9
- SHA1 c1ff6fbc8106bdc9714a7ec5ce85a422a369ca29
- SHA512 b2a798a8d68e8096a61f73bc04e95a4b6e42e9e4a5153d16feaefd726558caa98749c52d76146e261cbf01d4cc1e9e70c020f7bc9ad20943c29cb9b5983c6d1a
- SSDEEP 3072:DbeVX+RLL4ypDYsPGLwLvVWRMiW95BQ2Of5QUNtWhoev:eQRLLbpYS95BQ2QQUNtWPv
- TLSH T16034F83BA7635CBCC29781B5A686CBF1B832FC150320BD5F0695C7327E6AC544F99898
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_onexit
_read
_setjmp
_strdup
_vscprintf
_vsnprintf
_vsnwprintf
abort
calloc
exit
fgetwc
fprintf
fputc
fputs
free
fwrite
getc
getenv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
strchr
strcmp
strerror
strlen
strncmp
strtoul
vfprintf
wcslen
shell32
ShellExecuteExW
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
wtf - Copy (7).exe
- IMPHASH dc0f61aee001ba10e3a7e0d44c90131c
- SHA256 7bd1f50b832af076880678fb70cada1061c911992aa7339b5693a0c194e3b5e5
- MD5 1e15ea75a1f635a6aca9d987764a13e9
- SHA1 c1ff6fbc8106bdc9714a7ec5ce85a422a369ca29
- SHA512 b2a798a8d68e8096a61f73bc04e95a4b6e42e9e4a5153d16feaefd726558caa98749c52d76146e261cbf01d4cc1e9e70c020f7bc9ad20943c29cb9b5983c6d1a
- SSDEEP 3072:DbeVX+RLL4ypDYsPGLwLvVWRMiW95BQ2Of5QUNtWhoev:eQRLLbpYS95BQ2QQUNtWPv
- TLSH T16034F83BA7635CBCC29781B5A686CBF1B832FC150320BD5F0695C7327E6AC544F99898
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_onexit
_read
_setjmp
_strdup
_vscprintf
_vsnprintf
_vsnwprintf
abort
calloc
exit
fgetwc
fprintf
fputc
fputs
free
fwrite
getc
getenv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
strchr
strcmp
strerror
strlen
strncmp
strtoul
vfprintf
wcslen
shell32
ShellExecuteExW
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
wtf - Copy (8).exe
- IMPHASH dc0f61aee001ba10e3a7e0d44c90131c
- SHA256 7bd1f50b832af076880678fb70cada1061c911992aa7339b5693a0c194e3b5e5
- MD5 1e15ea75a1f635a6aca9d987764a13e9
- SHA1 c1ff6fbc8106bdc9714a7ec5ce85a422a369ca29
- SHA512 b2a798a8d68e8096a61f73bc04e95a4b6e42e9e4a5153d16feaefd726558caa98749c52d76146e261cbf01d4cc1e9e70c020f7bc9ad20943c29cb9b5983c6d1a
- SSDEEP 3072:DbeVX+RLL4ypDYsPGLwLvVWRMiW95BQ2Of5QUNtWhoev:eQRLLbpYS95BQ2QQUNtWPv
- TLSH T16034F83BA7635CBCC29781B5A686CBF1B832FC150320BD5F0695C7327E6AC544F99898
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_onexit
_read
_setjmp
_strdup
_vscprintf
_vsnprintf
_vsnwprintf
abort
calloc
exit
fgetwc
fprintf
fputc
fputs
free
fwrite
getc
getenv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
strchr
strcmp
strerror
strlen
strncmp
strtoul
vfprintf
wcslen
shell32
ShellExecuteExW
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
wtf - Copy (9).exe
- IMPHASH dc0f61aee001ba10e3a7e0d44c90131c
- SHA256 7bd1f50b832af076880678fb70cada1061c911992aa7339b5693a0c194e3b5e5
- MD5 1e15ea75a1f635a6aca9d987764a13e9
- SHA1 c1ff6fbc8106bdc9714a7ec5ce85a422a369ca29
- SHA512 b2a798a8d68e8096a61f73bc04e95a4b6e42e9e4a5153d16feaefd726558caa98749c52d76146e261cbf01d4cc1e9e70c020f7bc9ad20943c29cb9b5983c6d1a
- SSDEEP 3072:DbeVX+RLL4ypDYsPGLwLvVWRMiW95BQ2Of5QUNtWhoev:eQRLLbpYS95BQ2QQUNtWPv
- TLSH T16034F83BA7635CBCC29781B5A686CBF1B832FC150320BD5F0695C7327E6AC544F99898
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_onexit
_read
_setjmp
_strdup
_vscprintf
_vsnprintf
_vsnwprintf
abort
calloc
exit
fgetwc
fprintf
fputc
fputs
free
fwrite
getc
getenv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
strchr
strcmp
strerror
strlen
strncmp
strtoul
vfprintf
wcslen
shell32
ShellExecuteExW
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
wtf - Copy.exe
- IMPHASH dc0f61aee001ba10e3a7e0d44c90131c
- SHA256 7bd1f50b832af076880678fb70cada1061c911992aa7339b5693a0c194e3b5e5
- MD5 1e15ea75a1f635a6aca9d987764a13e9
- SHA1 c1ff6fbc8106bdc9714a7ec5ce85a422a369ca29
- SHA512 b2a798a8d68e8096a61f73bc04e95a4b6e42e9e4a5153d16feaefd726558caa98749c52d76146e261cbf01d4cc1e9e70c020f7bc9ad20943c29cb9b5983c6d1a
- SSDEEP 3072:DbeVX+RLL4ypDYsPGLwLvVWRMiW95BQ2Of5QUNtWhoev:eQRLLbpYS95BQ2QQUNtWPv
- TLSH T16034F83BA7635CBCC29781B5A686CBF1B832FC150320BD5F0695C7327E6AC544F99898
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_onexit
_read
_setjmp
_strdup
_vscprintf
_vsnprintf
_vsnwprintf
abort
calloc
exit
fgetwc
fprintf
fputc
fputs
free
fwrite
getc
getenv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
strchr
strcmp
strerror
strlen
strncmp
strtoul
vfprintf
wcslen
shell32
ShellExecuteExW
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
wtf.exe
- IMPHASH dc0f61aee001ba10e3a7e0d44c90131c
- SHA256 7bd1f50b832af076880678fb70cada1061c911992aa7339b5693a0c194e3b5e5
- MD5 1e15ea75a1f635a6aca9d987764a13e9
- SHA1 c1ff6fbc8106bdc9714a7ec5ce85a422a369ca29
- SHA512 b2a798a8d68e8096a61f73bc04e95a4b6e42e9e4a5153d16feaefd726558caa98749c52d76146e261cbf01d4cc1e9e70c020f7bc9ad20943c29cb9b5983c6d1a
- SSDEEP 3072:DbeVX+RLL4ypDYsPGLwLvVWRMiW95BQ2Of5QUNtWhoev:eQRLLbpYS95BQ2QQUNtWPv
- TLSH T16034F83BA7635CBCC29781B5A686CBF1B832FC150320BD5F0695C7327E6AC544F99898
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_onexit
_read
_setjmp
_strdup
_vscprintf
_vsnprintf
_vsnwprintf
abort
calloc
exit
fgetwc
fprintf
fputc
fputs
free
fwrite
getc
getenv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
strchr
strcmp
strerror
strlen
strncmp
strtoul
vfprintf
wcslen
shell32
ShellExecuteExW
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ