Freedom Spoofer.zip
- SHA256 1a8a18d9866e5c5ef877b4a787f843136165f2d463c129fdff1520bb251db002
Static task
static1
2 signatures
General
- Target Freedom Spoofer.zip
- Size 4.7MB
- Sample260502-z7mdjsf16w
- SHA256 1a8a18d9866e5c5ef877b4a787f843136165f2d463c129fdff1520bb251db002
- MD5 d70f19d3c3256b3b7d283d17a6e9815f
- SHA1 85c5afa96c0840eaede62b6338a50bae80e72d36
- SHA512 57029e55f50c5d61d351680ac741cd6947cb21c2c3ff8db268d46f403f6a7bb0689f6d9194254db554b915984bbe31248c0c4dfc0e99bb849815fc646f00da37
- SSDEEP 98304:o86tQy+5jDwHHC8uNONfqQHL+/U2ADWOxDU0VFiliNN/I9rciTip:zV2uNOswq/NADWafVFilinA9r3U
- TLSH T13136335EDECE5B87F04FD67CEB5B8C33E1E81495CEB5A165B8633052B0B60966A4003B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/version.dll - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/auth\Mwa0IqEuFb2T unpack001/version.dll
File Explorer
-
Freedom Spoofer.zip.zip 4.7MB
-
Setup.exe.exe 4.5MB
-
auth\Mwa0IqEuFb2T.exe 5.9MB
-
vcruntime140.dll.dll 116KB
-
version.dll.dll 121KB
Setup.exe
- IMPHASH 84da1a1e6e5b4e368d1238a8a636444b
- SHA256 66a1f6ccc9f869945bec8149f1af5ce5bb587d3d25c8008cfdc0bf3c0cebf9c2
- MD5 42fe4a56c232d4f65bfa7ad9eab99812
- SHA1 ff382fff460371f167ae09d2f2cf54d7d6264a0b
- SHA512 3694acd3980705493876209de679cd316f596f5255be2a0eb23971dbef18a8c54adb08f7dad42217ca855768910bba8d6f1d9d69f74429f2a64af9f9fc29c1c6
- SSDEEP 98304:+bwdaDFrhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1Y:+bUEFHGpELcoR1Y
- TLSH T131269DC6BF88F5E0C4A48834B916D5BDC6737C7A8A11468732D7FB1F2A37180552B92B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
85:28:2e:f8:01:e3:2e:56:88:71:6e:bd:ec:e0:16:8e:45:e5:12:aa:59:ad:1a:59:65:d5:a0:7b:2f:9e:52:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ba:2b:8e:e1:83:51:fe:29:1a:00:00:00:00:00:ba
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 29, 2025 - May 28, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
507856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
F:\dbs\sh\odct\0126_161408\client\onedrive\Product\UX\Exe\obj\amd64\OneDrive.pdb
kernel32
GetFileType
GetFinalPathNameByHandleW
GetVolumePathNameW
ReadFile
RemoveDirectoryW
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
GetCompressedFileSizeW
FindFirstFileNameW
IsDebuggerPresent
SetHandleInformation
CreatePipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeviceIoControl
OpenMutexW
IsWow64Process
LoadLibraryExW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
ReadDirectoryChangesW
CreateSymbolicLinkW
CompareStringOrdinal
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProcessIoCounters
GetPrivateProfileStringW
WritePrivateProfileStringW
CopyFileW
MoveFileExW
ReplaceFileW
GetComputerNameW
RegisterApplicationRestart
GetFileInformationByHandleEx
OpenFileById
GetModuleHandleW
GetDllDirectoryW
WriteConsoleW
ReadConsoleW
SetEndOfFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
SetStdHandle
SetEnvironmentVariableW
GetFileSizeEx
GetEnvironmentStringsW
GetCommandLineA
FindNextFileW
FindFirstFileExW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
CompareStringW
GetTimeFormatW
GetFileSize
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceExW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
CreateFileW
CreateDirectoryW
SetThreadInformation
GetSystemTimes
SetProcessShutdownParameters
GetExitCodeProcess
GetProcessTimes
WaitForMultipleObjects
CreateEventW
ReleaseMutex
GetLongPathNameW
SetLastError
VerifyVersionInfoW
GetProductInfo
VerSetConditionMask
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
K32GetModuleFileNameExW
GetUserDefaultLCID
GetUserGeoID
LCIDToLocaleName
SystemTimeToFileTime
MoveFileW
LocalAlloc
GetModuleFileNameW
GetVersionExW
GetSystemTimeAsFileTime
GetSystemTime
OpenProcess
TerminateProcess
GetCurrentProcess
CreateMutexW
WaitForSingleObject
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
FindFirstFileW
FindClose
DeleteFileW
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
CreateProcessW
InitializeCriticalSectionEx
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryW
SetDllDirectoryW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
WriteFile
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentThreadId
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
LocalFree
DeleteCriticalSection
DecodePointer
GetLastError
FreeEnvironmentStringsW
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCPInfo
CompareStringEx
LCMapStringEx
EncodePointer
GetLocaleInfoEx
QueryPerformanceCounter
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
RaiseException
OutputDebugStringW
user32
PostMessageW
EnumWindows
GetClassNameW
GetWindowThreadProcessId
SystemParametersInfoW
SendMessageTimeoutW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
RegisterSuspendResumeNotification
SetClipboardData
RegisterClipboardFormatW
CloseClipboard
OpenClipboard
UnregisterSuspendResumeNotification
RegisterClassW
CreateWindowExW
DestroyWindow
ShowWindow
advapi32
SetNamedSecurityInfoW
AdjustTokenPrivileges
CreateProcessWithTokenW
GetUserNameW
SetFileSecurityW
ConvertSidToStringSidW
GetNamedSecurityInfoW
SetEntriesInAclW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegDeleteTreeW
RegUnLoadKeyW
RegNotifyChangeKeyValue
RegLoadKeyW
RegEnumKeyW
RegDeleteKeyExW
RegCreateKeyTransactedW
GetAclInformation
FreeSid
DuplicateTokenEx
CreateWellKnownSid
AllocateAndInitializeSid
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegGetValueW
RegSetKeyValueW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
shell32
SHSetKnownFolderPath
ord526
SHFileOperationW
SHGetSpecialFolderPathW
SHGetKnownFolderPath
SHChangeNotify
SHParseDisplayName
ShellExecuteExW
SHCreateItemFromParsingName
SHGetFolderPathW
SHGetPropertyStoreFromParsingName
SHAssocEnumHandlers
SHCreateDirectoryExW
SHGetFolderPathAndSubDirW
CommandLineToArgvW
ole32
CoInitialize
CoInitializeSecurity
CoUninitialize
StringFromCLSID
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CreateBindCtx
CoCreateGuid
CoInitializeEx
CoSetProxyBlanket
CreateItemMoniker
GetRunningObjectTable
oleaut32
LoadTypeLi
LoadRegTypeLi
GetRecordInfoFromTypeInfo
crypt32
CertFindExtension
CryptStringToBinaryW
CryptBinaryToStringW
rpcrt4
RpcBindingFree
RpcBindingFromStringBindingW
RpcBindingVectorFree
RpcStringBindingComposeW
RpcStringFreeW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcServerUseProtseqW
RpcBindingSetAuthInfoExW
RpcEpRegisterW
RpcEpUnregister
RpcServerInqCallAttributesW
UuidCreate
secur32
GetUserNameExW
shlwapi
PathIsDirectoryW
PathFileExistsW
SHRegGetValueW
SHRegGetBoolUSValueW
PathStripPathW
SHRegGetUSValueW
PathIsPrefixW
SHDeleteKeyW
SHDeleteValueW
SHGetValueA
SHSetValueW
SHRegGetPathW
PathIsDirectoryEmptyW
SHGetValueW
PathRemoveFileSpecW
StrStrIW
SHCreateStreamOnFileW
AssocQueryStringW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
wininet
InternetCheckConnectionW
InternetCanonicalizeUrlW
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW
userenv
GetDefaultUserProfileDirectoryW
CreateEnvironmentBlock
Name
.text
Size
674KB
Virtual Size
674KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
195KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=172, id=261, version=30795,
count=8, id=259, version=34321,
count=17, id=260, version=34321,
count=92, id=261, version=34321,
count=7, id=259, version=30795,
count=22, id=260, version=30795,
count=1, id=262, version=30795,
count=29, id=257, version=30795,
count=382, id=1, productName=Unmarked objects,
count=44, id=261, version=34436,
count=5, id=265, version=34436,
count=1, id=255, version=34436,
count=1, id=258, version=34436,
auth\Mwa0IqEuFb2T
- IMPHASH 30a8794d59e76399343b9177f5ddaf7b
- SHA256 16a8634954fe0238b4352d9bfac2aa0033fb22f12dc4838fcf7072ae1fbb408e
- MD5 5099251ed2497075d2f14badb2ae60ef
- SHA1 1e32f0663d92369f180974d5780ea6fccfa5edfb
- SHA512 15f7a90f0e18c1dd0299aa91d3f17ad65f5825e5787948c4a8d04027d2630355f429346a156d9737f58a8ed9a37ed95177e59217067f92af12a8bfd2157aa993
- SSDEEP 49152:GVPX0VjK/jzoN3Jn4PSNrOdzrIsGtaZD7lCVD1A+AKfvGm56ov2TdWxfxulyNIMD:tiGV4qqiyavV6MsWHq
- TLSH T19A56CF1AB7A401ECC0A7D9B8CA175D13EAB2784913369BEB17E089555F23AF05F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1863928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winhttp
WinHttpReceiveResponse
WinHttpWebSocketCompleteUpgrade
WinHttpWebSocketClose
WinHttpOpen
WinHttpWebSocketSend
WinHttpConnect
WinHttpCrackUrl
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpWebSocketReceive
WinHttpSendRequest
WinHttpQueryDataAvailable
crypt32
CryptStringToBinaryA
CryptBinaryToStringA
CryptUnprotectData
bcrypt
BCryptEncrypt
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptDecrypt
BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
gdiplus
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipSaveImageToStream
GdipFree
GdipSetCompositingQuality
GdipDisposeImage
GdipDrawImageRectI
GdipGetImageEncodersSize
kernel32
GetStdHandle
IsProcessorFeaturePresent
GetModuleHandleExW
FreeLibraryAndExitThread
FlsFree
FlsSetValue
RtlCaptureContext
FlsAlloc
SetLastError
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
FlsGetValue
RtlVirtualUnwind
IsDebuggerPresent
GetLastError
ExitProcess
MultiByteToWideChar
SetThreadAffinityMask
GetSystemFirmwareTable
GetPhysicallyInstalledSystemMemory
TerminateProcess
LocalAlloc
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32NextW
QueryPerformanceFrequency
Process32FirstW
CloseHandle
GetNativeSystemInfo
LocalFree
GetModuleHandleW
WideCharToMultiByte
SleepEx
BuildCommDCBAndTimeoutsA
EnumSystemFirmwareTables
QueryPerformanceCounter
VirtualQuery
GetComputerNameA
SizeofResource
GetModuleFileNameW
EnumResourceNamesW
SetFileAttributesW
GetLogicalDriveStringsW
EndUpdateResourceW
LockResource
LoadResource
FindResourceW
UpdateResourceW
FreeLibrary
BeginUpdateResourceW
QueryFullProcessImageNameW
GetDriveTypeW
LoadLibraryExW
ReadFile
FindFirstFileW
FindNextFileW
WriteFile
CreateNamedPipeW
PeekNamedPipe
GetTempPathW
FindClose
GetCurrentThreadId
GetCurrentProcessId
CreateProcessW
GetTickCount
ConnectNamedPipe
FlushFileBuffers
GetVolumeInformationW
UnhandledExceptionFilter
SetFilePointer
CreateFileW
DeleteFileW
MoveFileExW
GlobalMemoryStatusEx
GetFileAttributesExW
GetSystemTime
CreateMutexW
GetVersionExW
ExitThread
GetTickCount64
GetFileSize
SetUnhandledExceptionFilter
GetTimeZoneInformation
GetSystemInfo
CreateDirectoryW
QueryDosDeviceW
GetCurrentProcess
RemoveDirectoryW
GetEnvironmentVariableW
WaitForSingleObject
TerminateThread
CreateThread
GetLocalTime
CopyFileW
GetFileAttributesW
LoadLibraryW
GetProcAddress
SetDllDirectoryW
GetLogicalDrives
GetDriveTypeA
CreatePipe
SetErrorMode
FileTimeToSystemTime
SetFilePointerEx
CreateProcessA
GetDiskFreeSpaceExA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapReAlloc
RaiseException
HeapAlloc
HeapCompact
HeapDestroy
RtlUnwind
CreateFileMappingA
LockFileEx
DeleteCriticalSection
GetProcessHeap
SystemTimeToFileTime
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetFileType
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
IsValidCodePage
GetConsoleOutputCP
GetConsoleMode
VirtualProtect
CompareStringW
GetComputerNameW
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
GetFileSizeEx
UnlockFile
user32
EnumDisplayMonitors
GetMonitorInfoW
ReleaseDC
SendInput
GetSystemMetrics
EnumDisplayDevicesW
GetDC
gdi32
CreateCompatibleBitmap
DeleteObject
GetDeviceCaps
BitBlt
CreateCompatibleDC
SelectObject
DeleteDC
advapi32
OpenProcessToken
RegGetValueW
GetTokenInformation
CryptAcquireContextW
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegEnumKeyExW
RegQueryValueExA
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
GetUserNameW
RegSetValueExW
CryptAcquireContextA
RegOpenKeyExW
shell32
ShellExecuteW
ShellExecuteExW
ole32
CreateStreamOnHGlobal
CoTaskMemFree
setupapi
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDevicePropertyW
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
api-ms-win-core-realtime-l1-1-1
QueryInterruptTime
iphlpapi
GetAdaptersInfo
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetExitCodeThread
api-ms-win-core-sysinfo-l1-1-0
GetLogicalProcessorInformationEx
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
api-ms-win-core-file-l1-1-0
GetFinalPathNameByHandleW
SetFileInformationByHandle
FindFirstFileExW
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
GetCPInfo
LCMapStringEx
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
api-ms-win-core-string-l1-1-0
GetStringTypeW
CompareStringEx
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
wevtapi
EvtRender
EvtClose
EvtQuery
EvtNext
EvtCreateRenderContext
shlwapi
PathFileExistsW
ntdll
RtlInitUnicodeString
d3d11
D3D11CreateDevice
dxgi
CreateDXGIFactory1
mf
MFEnumDeviceSources
mfplat
MFShutdown
MFCreateMediaType
MFCreateAttributes
MFStartup
mfreadwrite
MFCreateSourceReaderFromMediaSource
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=33145,
count=181, id=261, version=33145,
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=259, version=35403,
count=18, id=260, version=35403,
count=97, id=261, version=35403,
count=21, id=260, version=33145,
count=1, id=263, version=33145,
count=39, id=257, version=33145,
count=330, id=1, productName=Unmarked objects,
count=27, id=265, version=35727,
count=1, id=259, version=35727,
count=1, id=255, version=35727,
count=1, id=258, version=35727,
vcruntime140.dll
- IMPHASH 7f07fd94e5bb907093556781cc464017
- SHA256 f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
- MD5 699dd61122d91e80abdfcc396ce0ec10
- SHA1 7b23a6562e78e1d4be2a16fc7044bdcea724855e
- SHA512 2517e52f7f03580afd8f928c767d264033a191e831a78eed454ea35c9514c0f0df127f49a306088d766908af7880f713f5009c31ce6b0b1e4d0b67e49447bfff
- SSDEEP 1536:KqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbsecbWcmpCGa3QFzFtjXzp:KqvQFDUXqWn7CkRG7YecbWb9a3kDX9
- TLSH T16AC37C4573A802B7D62EC274C1E25E46EB75B5418770ABCF03B589AA0F13BE1AE3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e7:1b:05:a2:b2:f0:a6:12:61:97:88:cb:ee:0e:ee:3a:79:f9:ca:91:b1:c4:cc:82:09:1d:a1:88:ba:51:d8:d0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 26, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
e7:1b:05:a2:b2:f0:a6:12:61:97:88:cb:ee:0e:ee:3a:79:f9:ca:91:b1:c4:cc:82:09:1d:a1:88:ba:51:d8:d0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 26, 2023
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 2, 2023 - Jan 31, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d6:27:69:ff:72:2d:56:c8:ae:00:01:00:00:01:d6
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
67072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
abort
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
api-ms-win-crt-string-l1-1-0
strcpy_s
strncmp
wcsncmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsprintf_s
api-ms-win-crt-convert-l1-1-0
atol
kernel32
GetLastError
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlUnwindEx
GetModuleHandleW
GetModuleFileNameW
RtlUnwind
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetProcAddress
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
_CreateFrameInfo
_CxxThrowException
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__C_specific_handler_noexcept
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__intrinsic_setjmpex
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_get_purecall_handler
_get_unexpected
_is_exception_typeof
_local_unwind
_purecall
_set_purecall_handler
_set_se_translator
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
732B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=29395,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=21, id=259, version=33030,
count=16, id=260, version=33030,
count=31, id=261, version=33030,
count=1, id=256, version=33030,
count=1, id=255, version=33030,
count=1, id=258, version=33030,
version.dll
- IMPHASH 693da15e37f3d198ca3f808426521e2a
- SHA256 5153689556f3186743c047877ccd6d23ff57a60013c0dadd99d56c6effd2fe0f
- MD5 fab6d333f12b384ebef5a5f9b0309bf1
- SHA1 a7a143a78df851b80e7ee3d1896fc9a512ac7bcd
- SHA512 fabf54e8762ba0c2f0f8535c118751b536ba6794223abc6881d7505fbf0cb4536747ed2f19bd47af365cad2f389c83e8fd8824ed1868eb6c93a4ececcdd295e5
- SSDEEP 3072:uV75m+nhkQ7GNea6rah58td27sPtckVPxIiTlI2uoNO:u22hkAG6raHk2EJu0O
- TLSH T173C35C1BAAA6507FD26A8938C4534905DF727C924BA0BFDF17500AE70E637D09E3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
14652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
FindFirstFileA
FindNextFileA
FindClose
WriteConsoleW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
LoadLibraryExW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
Name
.text
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=138, id=261, version=33145,
count=12, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35403,
count=14, id=260, version=35403,
count=37, id=261, version=35403,
count=3, id=257, version=33145,
count=93, id=1, productName=Unmarked objects,
count=2, id=265, version=35725,
count=1, id=259, version=35725,
count=1, id=256, version=35725,
count=1, id=258, version=35725,