vm1[.]exe | Triage™

resource
vm1.exe
unpack001/001.exe
unpack001/0b02.exe
unpack001/0x07.exe
unpack001/1lh9zfg5gl.exe
unpack001/2 EURO.exe
unpack001/2,3,7,8-Tetrachlorodibenzodioxin-alpha.exe
unpack005/2,3,7,8-Tetrachlorodibenzodioxin-safety.exe
unpack005/2,3,7,8-Tetrachlorodibenzodioxin.exe
unpack006/2578.exe
unpack006/2578.safety.exe
unpack007/2MASS J07225830-2546030.exe
unpack007/2MASS J07225830-2546030.harmless.exe
unpack001/2XMM J083026+524133-beta.exe
unpack001/2XMM J083026+524133.3.exe
unpack001/2XMM J083026+524133.R.exe
unpack001/2XMM J083026+524133.exe
unpack008/362.exe
unpack009/3D Vista-11.exe
unpack009/3D.exe
unpack001/3c436gr7je-beta.exe
unpack001/3gp-alpha.exe
unpack001/3gp.exe
unpack001/41.exe
unpack001/4ply.exe
unpack001/69.exe
unpack001/6kals.exe
unpack001/9998.exe
unpack001/APM 08279+5255 2.0-beta.exe
unpack001/APM 08279+5255 2.0.exe
unpack001/APM 08279+5255-beta.exe
unpack001/APM 08279+5255-beta2.exe
unpack001/AdministratorGDI740.exe
unpack001/AiVDsDOsA.exe
unpack001/Albuquerque.exe
unpack001/Antivirus2021.exe
unpack001/Argon.exe
unpack001/Aung208.exe
unpack001/Aurum.exe
unpack001/AvIdOsAsIA.exe
unpack001/Azide.exe
unpack001/Bahhhh.exe
unpack001/Beryllium.R.exe
unpack001/BezierIcon.exe
unpack001/TÁß¬á.exe
unpack001/advokenop.exe
unpack001/amoxapine.exe
unpack001/astradestr.exe
unpack001/attomic.exe
unpack001/bad_apple.exe
unpack001/betterMEMZ.exe
unpack001/Ăü¦ĽËŐ+»ßżô¦ĆĂ-ß¬íÎśÍ-.exe

vm1.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 729888fcb020c55e3f152d253df200d2fa22e02973a3f50931fed95b5a20938c
MD5 660c3bbd508d31800e178ca5c6f147bf
SHA1 e7b0e2b9cf24fa492709e0e924cbb20e18c501f0
SHA512 73c32d4e889aa98b3aee856112b256ba4b9ecf6379db3388d35edb390185e553cb29b57f332e7e6bb32e00457fa4a01297bfa3d94ccb6026376aaf8bcb321708
SSDEEP 1572864:bdI1LpEsDuljV6ZyhKcxnS0AXv6a+a5hVYe9CYD9/2UQ:bdELpfcowhKOnSbX8aVYeAEgUQ
TLSH
T1ACF73369187C6B91DBC88D356C0209F987AFA8931F4ED04F8E91D135EC77431B226EAD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

000.zip

SHA256 d66c4c08833f9e8af486af44f879a0a5fb3113110874cc04bd53ee6351c92064
MD5 f5d73448dbe1ec4f9a8ec187f216d9e5
SHA1 6f76561bd09833c75ae8f0035dcb2bc87709e2e5
SHA512 edbdc1d3df9094c4e7c962f479bb06cdc23555641eeb816b17a8a5d3f4d98f4d1d10299fd2f9152d30e3fa9e5b12c881fd524e75612e934b287109492ee1520b
SSDEEP 3072:/msQvkoawLvldUo1OvAGczlPDloVCUfcU:C8oaiPOvA/zl7jUcU
TLSH
T16CC31266DF6CA4575E2DD8762364E6C41529FC8DDCAE20DDF220908EE883EC11DB3993
MD5 SHA1 SHA512 SSDEEP TLSH

000Terminated000.zip

SHA256 6f0c36e25c1169f7d8c34eec279fc218e2ca38d16803c816f80de773bbdebe50
MD5 3b57146367c22b7ec60fac8e9e802a33
SHA1 01c967d2bcdb40a935bc4b1a426c6943da03254e
SHA512 66b9f74934da7c498d741d30efbf45bb061c5badc087bbf576b3f64fa6d6c68ee0d1064978234b16c105b1b37e5595ee32adca6364c0c3a74070f04d6413f5d1
SSDEEP 3072:pDtPqOZxn9C1cZE+qQdPM6MTdoFQYIM0iF:phiixocpdM6MBomYIM0q
TLSH
T177A312D4DC6EA302394B10032F21DF929C44D2DDA79074E2A655E37AB46BE379DA3C18
MD5 SHA1 SHA512 SSDEEP TLSH

001.exe

IMPHASH 96feef5db192fccf32db40a0e8148f5b
SHA256 ec2ae1fb4b42a33ccc6180c03b11f038c715888c1d74d7d3df29521ff60c8d65
MD5 914fc1daaf606db6468828ae73f23475
SHA1 79c971f0db70211ec8cf5ca25347b11cab4e1e15
SHA512 5f4e4340d16984e780fd267925d0e4b6f182bd859e1e89526a85be0a3fb631284f166a9a618bc0500103b55e078a15f4e58efbf01a2a83c6bbc433100b231766
SSDEEP 12288:+fx/eZe3fjd4inis1fCPgrHqXYlN7h0o7rw:EMe373nzWgrHDb7h/I
TLSH
T1D4B4C016D25A550AE4016576B910B46E5CC78CFC03BFC2B3BBCC8D2F648E4614AFA6A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

478148

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

waveOutReset waveOutOpen waveOutUnprepareHeader waveOutWrite waveOutPrepareHeader

kernel32

DeleteFileW LoadLibraryW GetProcAddress CreateMutexW GetLastError ExitProcess HeapFree GetStartupInfoW GetTempPathW Wow64EnableWow64FsRedirection Sleep CreateThread HeapAlloc GetProcessHeap GetModuleHandleW FreeLibrary lstrcpyW IsWow64Process GetModuleFileNameW lstrlenW CopyFileW CreateFileW WriteFile IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime CloseHandle GetCurrentProcessId UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId QueryPerformanceCounter GetCurrentProcess

user32

SendMessageW CreateWindowExW SetWindowPos FindWindowExW DefWindowProcW EnumDisplayMonitors ExitWindowsEx SetWindowTextW EnumChildWindows GetWindowRect SetMenu UnhookWindowsHookEx RegisterClassExW FindWindowW LoadCursorW SetWindowsHookExW DrawTextW PostQuitMessage SystemParametersInfoW UpdateWindow ShowCursor MessageBoxW GetDC ReleaseDC UnionRect CallNextHookEx ShowWindow EnumWindows MoveWindow

gdi32

GetDIBColorTable SelectObject CreateSolidBrush DeleteObject SetBkMode CreateCompatibleDC DeleteDC SetTextColor CreateFontW StretchBlt CreateDIBSection CreateCompatibleBitmap BitBlt GetObjectW GetDIBits

advapi32

RegCloseKey RegSetValueExW RegCreateKeyExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW ShellExecuteW

vcruntime140

_except_handler4_common _CxxThrowException __std_exception_destroy __std_exception_copy memset memcpy

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit _seh_filter_exe _cexit _c_exit _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _initialize_narrow_environment _initterm _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit _controlfp_s terminate _set_app_type

api-ms-win-crt-math-l1-1-0

__libm_sse2_sinf __setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

0b02.exe

IMPHASH 74f2f2f3574bd337268d22f51e256497
SHA256 a3f87c63250416c75cfc0a82c40d5814f671cd0ddbc2634e71792f9c279af477
MD5 72ff5da0ee6b1ee2d84348f06686ed3d
SHA1 2cf197f23bb61e19cb620d489e34bd61a95d759b
SHA512 98ee925c50ec7b2c27a4bca5150db976fb20688754669f0366de0030d86ae42be37d24e8e5cd19a27a3d5afdb33c7aaf5ce77ec0245d189d97e782ec52a80ba9
SSDEEP 192:GdLd4sMjd4tZzmVFQnGy/BZS2Bubi/aVJgfJmbfWJ55tfCD/:GZ24nuKnGAjSi1fJu
TLSH
T12C922A05B3E8499EEA3B733889F2691DE3B1391217319ACF0351855B5F726C0983DB2E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ALAN\source\repos\0b02\x64\Release\0b02.pdb

kernel32

IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateThread TerminateThread Sleep TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW

user32

MessageBoxW GetSystemMetrics GetDC ReleaseDC InvalidateRect

gdi32

CreateSolidBrush BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC StretchBlt GetDeviceCaps DeleteDC SetStretchBltMode DeleteObject

winmm

waveOutClose waveOutUnprepareHeader waveOutWrite waveOutPrepareHeader waveOutOpen

vcruntime140

__current_exception __C_specific_handler __current_exception_context memset

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit exit _initterm_e _initterm _initialize_onexit_table _get_narrow_winmain_command_line _exit _cexit _configure_narrow_argv _register_thread_local_exe_atexit_callback terminate _set_app_type _seh_filter_exe _c_exit _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

0x07.exe

IMPHASH 60616d48898f60c598f751ddfa271d3d
SHA256 52d6d769eb474d4138ac31e05634a6ca7a4ebef5920f8356c1cd70d9fa42c2fb
MD5 733eb0ab951ae42a8d8cca413201e428
SHA1 640ffb3ee44eb86afaea92e6c5aa158a5d4aafd1
SHA512 c7cdf77aa881c5dbb2abf17913dbf645fe88e16fa11fa055392d36ccf936fc43050c48feb631e193fe044123a190f123d2d6ff12234c0ff7c8c7c6e290209d8f
SSDEEP 3072:xaWEHnqlm+0FEaJSq6+ouCpk2mpcWJ0r+QNTBfZnazJ9k3kxMC+89+aPyXiwQ9M1:cWCMm8aMldk1cWQRNTBhz3Yz/qc9M1
TLSH
T18944AF0273E144B6F5F3063208B6961A977EFE2557309DCBE38C294A5A726C05B363F6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10371

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Niko\Documents\Visual Studio 2013\Projects\0x07\Release\0x07.pdb

kernel32

SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW OutputDebugStringW LCMapStringW HeapReAlloc CloseHandle LoadLibraryA GetProcAddress CreateFileW GetConsoleWindow WriteFile Sleep GetCurrentProcess SetFilePointer ExitProcess GetCPInfo GetOEMCP GetSystemTimeAsFileTime EncodePointer DecodePointer GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent GetLastError GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte HeapSize SetLastError GetCurrentThreadId HeapFree HeapAlloc GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection LeaveCriticalSection LoadLibraryExW IsValidCodePage GetACP WriteConsoleW

user32

GetWindowRect GetWindowDC LoadIconA DrawIcon ExitWindowsEx GetDC MessageBoxA SetCursorPos ReleaseDC GetDesktopWindow BlockInput GetCursorPos ShowWindow GetSystemMetrics GetForegroundWindow

gdi32

LineTo StretchBlt SelectObject CreateCompatibleDC CreateCompatibleBitmap BitBlt

advapi32

LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges

shell32

ShellExecuteW

10rigel.zip

SHA256 2ba68b5e41749aab11f27cde478c57879969ff81547524752a7664fd14d4b6c8
MD5 e2633f7ceaec826651e36fbe791e09c3
SHA1 e1002baf544d039b161a878bac8535e62cdaac1b
SHA512 d8c89a37b6fc1add72b59f6ada2e37e19b20bc1933ab3472d871c5bc4889d8e4ae5e40e4172c7065a1cad86361d3175ca03f185b60a7cd5cf017f83435d87567
SSDEEP 768:bVbF5K/kc0jPQnPyYVqmh0NKTTIlWdS94VR5GR4VFgI4IIsZbtuVVCP:bVbF5K/ejZfmhmWpnaPI4sbm2
TLSH
T1CA13F1ADE927D0C36240B37FD2C92C89588F4C6E4F5BBA17C27074E15860EF5E9066C8
MD5 SHA1 SHA512 SSDEEP TLSH

1lh9zfg5gl.exe

IMPHASH 8b34bd8cebc6e765d79ccf96a54768ca
SHA256 de6edce77707da0b9da874b9a5e4775f2b91e2bc39db05ee90091ac03c0360a6
MD5 64500471b3d4b5775891950bf195679a
SHA1 d85f66f09313e4e86c7637cdda67b46b8d395813
SHA512 85608abc14050bf259f7c0e5a2af902b6ec7823eee95bebe3f793f2579cf4776248ad81fad9b5c65e16de99a76f92e2fa5f73fc47258e60e59337d613e718493
SSDEEP 1536:XFpbhDPsjyqmaHXRQMGeWk4NFNvtLAUvMFMQiNzR4QqZZfZVjfMr:VpbdsVQy4NFNvtLoiRzqZB70r
TLSH
T16CD31AC7BAA4DD97DD15433844E68319173EF7904B824B132D20BA391E23BD0BED768A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

936B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2 EURO.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 89c234a7920d7e3ef70803f66162876532772624917bb45d19e8d44a48b40831
MD5 736c48673b33da5d1a23858c095a1606
SHA1 68075f86d012b6fe48dbb313347db9e5c1e88e37
SHA512 c57385de87dbcf8d75ab48b19481cc68064c1e4b4333d56aac20bf89276ec0d24bca8ae03597065da210f242c3ce35676ca17310faa3936612ad9f9c123742e3
SSDEEP 393216:4WgNdVYN1O02pJoCVs4Xhf8Kr48byGEYUV0RAx+hTKm7WM5ye:UNHAcNJtRXJRr48byGF20RQiWWW6ye
TLSH
T1BE172363F5927608B4368732CEDD54543A8AF94D6C640B5FAA07CE90B133220FD7A7AD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18658942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\WIN\Desktop\2 EURO\2 EURO\obj\Debug\2 EURO.pdb

2,3,7,8-Tetrachlorodibenzodioxin-alpha.exe

IMPHASH 4bd98de2631c0252643411e798a5d840
SHA256 f729dd2a305fffb3cb6e0a49343a07c8f5360b70f389af5438c929065929f6b2
MD5 3d51fe3aa27bde9cf2fa5a34fa182383
SHA1 031afaac958547a9ff78114d87104de300d5966c
SHA512 1bd0ee53e6f052411fc6ae7dc459380263f32aaa13d0b512c034eaa32703b85dd31515c2351e2dfd5b11f3f837f3f82879b3cea89cdb083104a23d7bb5698902
SSDEEP 12288:7KVmtQ6LmL1KscF0Lflr2UploeQJtbOPPNzPnDgzlnZ2CyB:7KNcF29bmbbOP9gzlZn
TLSH
T1E1B408E3A4C133C1EC7184B6820795B19587BD36D6C16DFB10E9727E0B6F442866BE3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ACER\source\repos\2,3,7,8-Tetrachlorodibenzodioxin\Release\2,3,7,8-Tetrachlorodibenzodioxin.pdb

kernel32

CreateFileW DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode ExitProcess CreateThread CloseHandle TerminateThread Sleep GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW RaiseException

user32

ReleaseDC InvalidateRect GetSystemMetrics MessageBoxW GetDC

gdi32

CreateDIBSection CreateCompatibleDC StretchBlt DeleteDC SelectObject

winmm

waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite waveOutPrepareHeader

2,3,7,8-Tetrachlorodibenzodioxin.rar

SHA256 d3674f98f47b06e17f518e45a0069bf501440d41800e93be7f58e3caba6308ef
MD5 c127ecd7f38656c713f3c64a80488bf3
SHA1 7451a59b45a7f8fb47a4dfa71366801621f1e9eb
SHA512 cd86e4f987f89cb2b2ffbaa44ecf697ba03f1804d3a2fed4babf5e13779fe49337fa129f367c9a066fd40cc2f18ab631bef8fca240ffb502621761b1d84f9d04
SSDEEP 12288:TAVc4EsXhff0BadkBTyhvwCSEU8owM4MVSn2oJFwIPC:yc4ESff00dkBTAlPUC1MdwFBPC
TLSH
T1A8A423806FF3847BD3FB6E37F1529304B97676599A08C53A43D876A9C452E4333D8A82
MD5 SHA1 SHA512 SSDEEP TLSH

2,3,7,8-Tetrachlorodibenzodioxin-safety.exe

IMPHASH f91fe649a276fcad6df6f43a91358479
SHA256 3a0483c8caef931aa417ade2ead511a545560993fa4027e910208d2b8c0924f6
MD5 3fa63df955fc65521fcba2fcc55b6b6c
SHA1 60e01e8f13d321e229268a7c27985ef2c3f0dd5f
SHA512 90aa6834722e55c939ec58073820bb31febc94ca95d3397dfa7f25fdc1e295d2cd5ec072aab6117874b96768b68bd5196dbba9c3fcae952d48afb366d52e233d
SSDEEP 12288:4B8zmtQ6LmL1KscF0Lflr2UploeQJtbOPPNzPnDgzlnZ2Cyg:C8fcF29bmbbOP9gzlZn
TLSH
T145B409E3A4C133C1EC7184B6920795B19587BD36D6C16DFB10E9723F0A6F452826BE3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ACER\source\repos\2,3,7,8-Tetrachlorodibenzodioxin-safety\Release\2,3,7,8-Tetrachlorodibenzodioxin-safety.pdb

kernel32

GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer CreateFileW GetTickCount ExitProcess CreateThread CloseHandle TerminateThread Sleep VirtualAlloc GetFileType SetStdHandle LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

GetSystemMetrics GetCursorPos ReleaseDC InvalidateRect GetDesktopWindow GetWindowRect GetDC GetWindowDC MessageBoxW DrawIcon LoadIconW LoadCursorW

gdi32

CreateBitmap BitBlt CreateCompatibleBitmap CreateFontA SelectObject CreateDIBSection CreateCompatibleDC StretchBlt GetBitmapBits DeleteDC SetTextColor TextOutA SetBitmapBits SetBkMode Rectangle SelectClipRgn SetStretchBltMode DeleteObject CreateSolidBrush CreateEllipticRgn

winmm

waveOutPrepareHeader waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite

msimg32

AlphaBlend

2,3,7,8-Tetrachlorodibenzodioxin.exe

IMPHASH 9dfe00b67922562cb8c2632b721f2c71
SHA256 447b5760863694ffaa9e6a32eb365f8313573faa5bef285d7dac1ee805a02031
MD5 c348fc5bdc33f3dd46eadd224a424923
SHA1 a4707d6a73e9de26463cd8e39eaa156aadd4727b
SHA512 8b3ed1235e281db7981a332191bf6ac3ef7b6404345b97af00f3ef5009c24b393b4ebba5f7a25486304d36baf91d1e2cce91188ea8e740476e113d27d31d10cd
SSDEEP 12288:L0LN8WMCeEbmtQ6LmL1KscF0Lflr2UploeQJtbOPPNzPnDgzlnZ2CyZGW:C8WjXcF29bmbbOP9gzlZns
TLSH
T152C419F3A4C133D1EC7184B6820795B19587BD36D6C16DFB10E9727A0B6B443826BE3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ACER\source\repos\2,3,7,8-Tetrachlorodibenzodioxin\Release\2,3,7,8-Tetrachlorodibenzodioxin.pdb

kernel32

HeapSize GetStringTypeW GetFileType HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer GetTickCount ExitProcess GetProcAddress CreateThread LoadLibraryW CloseHandle TerminateThread Sleep CreateFileW VirtualAlloc GetProcessHeap WriteFile SetStdHandle LCMapStringW CompareStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesExW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA RaiseException

user32

GetSystemMetrics GetCursorPos ReleaseDC InvalidateRect GetDesktopWindow GetWindowRect GetDC GetWindowDC MessageBoxW DrawIcon LoadIconW LoadCursorW

gdi32

CreateCompatibleBitmap CreateFontA SelectObject CreateDIBSection CreateCompatibleDC StretchBlt GetBitmapBits DeleteDC SetTextColor TextOutA SetBitmapBits SetBkMode Rectangle SelectClipRgn SetStretchBltMode DeleteObject CreateSolidBrush CreateEllipticRgn CreateBitmap BitBlt

winmm

waveOutPrepareHeader waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite

msimg32

AlphaBlend

readme.txt

SHA256 c9c71be65d1837e9fd45fe842e6f975378f795aac64080065ca4320831f09544
MD5 bd5990d762b1f050250ce2ab8ce05cdb
SHA1 8577f9bca555fc47938d0851415bbf2abca82a5a
SHA512 03428e707989f9239b57b233c8ebe4a53c5341fc2b45ffd13b8c8d744d41974e0cdd576451449d48b351752f4379c9ab9bda2b5940597c13c5c7bce408905df7
SSDEEP 96:fD9F9//ZlhdpjI8etL5IJ9SMY/dszVITzVl+bibydwzV5zVKXXA2jDSFQjXR0oRX:fD9F9//Zlhdpj7eDGXEmbiS5rR0on1
TLSH
T1F1A1FC33A040733516AE4E6111F1FCAD63A628E6DA734500F5EEDAD0BF7AC24DD299C5
MD5 SHA1 SHA512 SSDEEP TLSH

2578.zip

SHA256 1281569ffa855eb713a4b2bf73766646a1c33cfc895b81dc8d541711e668d8ab
MD5 95cc640b3d989c1dd3997db47db6f203
SHA1 3603aaa7ef1362b6c7a21b7623fd88641cb0880f
SHA512 fefe4fc67173b81c6ba8dd98647a5f71dfbefc1abccfbb9ea6ef7e82d25267cfcedd704ea35df7982f326c8cb393067385573bffada6d10055e5397427e16c57
SSDEEP 3072:zGno0lFuBc1qTLZeCt6Jj0JMRRxAmMQwpxyr39Y7GtBJ8lrQ81XfU91Mx3z4:qfABc1+eCQpUyDN7FYatElri1M14
TLSH
T15E2423D185BC0CD3E678CE241BBA43C527D1C483ADBE0E6AD7E591D8EFE690286D2C54
MD5 SHA1 SHA512 SSDEEP TLSH

2578.exe

IMPHASH 87c64e06109b497fb479e23bfe5d2be9
SHA256 52d30f7d4a94e3d7a12518c27c345ad58d02f77b27bf3c2e788bd0a7f076fe40
MD5 a8cbd4422c5fc55a68e8dbf166745ed4
SHA1 ffefb18fabe374f78fd575a2a78754886ae5d89a
SHA512 8e17b99142849fef19f901faf0afe4d1bba01420df87b88e7cafdb3302048ce32c94cf9443b1bf5cbdc38ed5713d797ffd02e85a4491c7f5a140a9935db730ed
SSDEEP 3072:SwJ+cUtFiw4n/c2iJcqBPryVHhYGmx7ZqCCxpBZfh2j9un7oZVEb4Ho:pJ+ftFB4ohyisfxdfh2IocQo
TLSH
T1C534C362E2D4F8B4E45BC23214E3807395D26EEDD9D815EA63A8F55518B21C330AED3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

23109

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\HP Pavilion\source\repos\2578\Release\2578.pdb

kernel32

WriteFile CreateFileW SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW VirtualAlloc GetTickCount FreeLibrary ExitProcess GetProcAddress CreateThread LoadLibraryW CloseHandle LoadLibraryA TerminateThread Sleep GetCurrentThreadId GetCurrentProcess UnhandledExceptionFilter

user32

GetDC MessageBoxW GetIconInfo GetSystemMetrics ExitWindowsEx LoadIconW GetWindowRect GetDesktopWindow InvalidateRect GetCursorPos ReleaseDC DrawIconEx

gdi32

BitBlt CreateCompatibleBitmap Pie CreateFontA SelectObject CreateDIBSection CreateCompatibleDC StretchBlt PlgBlt GetBitmapBits DeleteDC SetTextColor TextOutA SetBitmapBits SetBkMode GetObjectW Polygon Ellipse SetStretchBltMode DeleteObject CreateSolidBrush CreateBitmap

advapi32

LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges

winmm

waveOutPrepareHeader waveOutWrite waveOutUnprepareHeader waveOutClose waveOutOpen

msimg32

AlphaBlend

vcruntime140

_except_handler4_common __current_exception_context __current_exception memset

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _controlfp_s terminate _cexit exit _initialize_onexit_table system _exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _c_exit

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

_libm_sse2_sin_precise __setusermatherr _libm_sse2_cos_precise _libm_sse2_sqrt_precise _CIfmod _libm_sse2_tan_precise

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

2578.safety.exe

IMPHASH ea01e72bbef7ecd22c4c7d5ebfb3b845
SHA256 4606a20fe316eece94d4af961bd32e8137c82cde18cb78fe3fb2380fd1888973
MD5 ed2fe91dbb5530469b4e9c9e20937915
SHA1 fd22d361c82699ad184b96c3a57306b2a2b4b608
SHA512 4b20556fefde10af67e9cfdf9df00783da9e678ed2d4fd6513f0ebd759d7a5f0028c725e8bc7301eace1041de1aa7aa6de13cdfc6d20a787b8d3d63cb1bdd2f6
SSDEEP 3072:m4Jc2lxuR4n/c2iJcqBPryVHhYGmx7ZqCCxpBZfh2j9un7oZVEb4HU:9Jc2lxA4ohyisfxdfh2IocQU
TLSH
T1C834C362F1D5F8B8E45BC23224E3807345D26EEDD9D805EA63A8F55518B21C334AED3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

22617

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\HP Pavilion\source\repos\2578\Release\2578.pdb

kernel32

GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess GetModuleHandleW VirtualAlloc GetTickCount FreeLibrary ExitProcess CreateThread LoadLibraryW CloseHandle TerminateThread Sleep GetCurrentThreadId SetUnhandledExceptionFilter UnhandledExceptionFilter

user32

GetIconInfo GetSystemMetrics LoadIconW DrawIconEx GetDC MessageBoxW GetWindowRect InvalidateRect GetCursorPos ReleaseDC GetDesktopWindow

gdi32

SetTextColor Pie CreateFontA SelectObject CreateDIBSection CreateCompatibleDC StretchBlt PlgBlt GetBitmapBits DeleteDC TextOutA SetBitmapBits SetBkMode GetObjectW Polygon Ellipse SetStretchBltMode DeleteObject CreateSolidBrush CreateBitmap BitBlt CreateCompatibleBitmap

winmm

waveOutUnprepareHeader waveOutClose waveOutOpen waveOutPrepareHeader waveOutWrite

msimg32

AlphaBlend

vcruntime140

memset __current_exception_context __current_exception _except_handler4_common

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _controlfp_s terminate _configure_narrow_argv _register_onexit_function _initterm _initterm_e _initialize_onexit_table _set_app_type _seh_filter_exe exit _exit _initialize_narrow_environment _cexit _register_thread_local_exe_atexit_callback _c_exit _get_narrow_winmain_command_line

api-ms-win-crt-math-l1-1-0

_libm_sse2_cos_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_tan_precise __setusermatherr _CIfmod

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

readme.txt

SHA256 3966cffa5885b276af3691a548f7171fb6f2548c3699fcf3e6129835ab1d80cc
MD5 e7f8b6691f0fb588ad724b23f231d52a
SHA1 a5567079e264a3ddc964cde6ed6f38fb1634e543
SHA512 3896ab5e72c7d76e3573321064199a50f185df2cc0736f59922b99233c5bfa2e72ec25a938aa3477481004b75c7a58ab8df1257a132946b5812e644e46d14041
TLSH
T1ACE0C2A6FA21C2467DBE30F1394FF62C5A953621D74689B03C2C8B6C67336C29202C83
MD5 SHA1 SHA512 TLSH

2MASS J07225830-2546030.zip

SHA256 db1d8bc3f4a02fb4e6cc5769cb9ee40bc8142800224772c367038d770305d4d9
MD5 b5b4e346b16e21dcf9b4ab57bea6d501
SHA1 2018293d5788915c7773b8cd791499f1769469f0
SHA512 4bdefed9995523b2e073810a0669b80ebe6607ad65bf0d1e43cdb4986fcecec6c13d2ad56be35b47af194a08381e640b382a412245430b11d1fd708924b9a644
SSDEEP 3072:rDjpfxbT3zoAlnWvDG40DEJbn+9jqqkJIa17n2N8S:rDjVxf3zoSnMZ0g+9WqmIa72+S
TLSH
T14ED3123010D70B798662B477FB92A9D9331C2DDDE2B3AB19511852DBE921E3943EBD0C
MD5 SHA1 SHA512 SSDEEP TLSH

2MASS J07225830-2546030 - read me.txt

SHA256 0ecdce91622307dcf0debc84d91d8bf5b138f35414ae99e8f478e5d191635e3e
MD5 85561bc20679c80a8eb6ddd207e4381c
SHA1 3bb76a82a5d7a191bd2bdad26ac6e6ff8666d6a2
SHA512 50ef749091d3fae64d48bfa53a545a2f428252cc081dde31e28fd6e343089ef949945e16fcc3af835e96c00bf3157f49bafa593cf8547328fa7c56820e0bc7b9
TLSH
T1A441A48D5EE673A0074E3131144BBE3C8DC32CE6CD1B48987C5D974CA67291352F498E
MD5 SHA1 SHA512 TLSH

2MASS J07225830-2546030.exe

IMPHASH d2b4cf705bd760a204d21230bc316c5e
SHA256 b2d5540346a4209f08972cea5a0c0544082290d5a97166d26dc28b01a820b93c
MD5 87a4e170d526e6e1cdae166ce62ebcfb
SHA1 13a9444a08183be3cf5ab4da703b125e062e03c9
SHA512 5dd1bed4e8bf7eb2fad7babf020ff6a41eaba1f8efb8d57e68fab4d8b1fbdd4330e25c867d7c37597bb2b420698f367f304ec390b182b8eba9f1fc03edf9187b
SSDEEP 3072:j8sF+hXWCOW4JYJ1uZseU0ESPMxyWP6JwX:3nW4JAUY4MxlP8wX
TLSH
T158F37D11B4D0D4B2E4B72930147CEBA28A3DF9301B6599BF37D4162F4E281D19D3AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

31468

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Senad\source\repos\2MASS J07225830-2546030\Release\2MASS J07225830-2546030.pdb

kernel32

GetStringTypeW SetStdHandle GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW GetTickCount ExitProcess GetProcAddress CreateThread LoadLibraryW CloseHandle TerminateThread Sleep CreateFileW VirtualAlloc GetFileType WriteFile SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesExW CompareStringW LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage DecodePointer

user32

GetSystemMetrics ReleaseDC SetCursorPos InvalidateRect GetDesktopWindow GetWindowRect GetDC DrawIconEx MessageBoxW DrawIcon LoadIconW LoadCursorW

gdi32

CreateCompatibleBitmap CreateFontA SelectObject CreateDIBSection CreateCompatibleDC SetPixel StretchBlt PlgBlt GetBitmapBits CreatePolygonRgn GetDIBits DeleteDC SetTextColor TextOutA SetBitmapBits SetBkMode SelectClipRgn SetDIBits DeleteObject CreateSolidBrush CreateBitmap BitBlt

winmm

waveOutPrepareHeader waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite

msimg32

AlphaBlend

2MASS J07225830-2546030.harmless.exe

IMPHASH 44dc833432425d9b36beb20831d04aa7
SHA256 c1ee8cda5453171d0cc998c3049454587838560d4d40f67be1502d49fc25dbb4
MD5 e096d907a4575723f9bab860d33d9ba3
SHA1 584f89ea0a23a352eeff17f7b61e331df9afae44
SHA512 156c86c9e4f33541fcdd7ba1f6a146ce1cfe425fef271fb18fe1e0301ba9f426c29c6940338e20cfb7e7bf4af55bc6cbf5877b785308580275104effd718ac5b
SSDEEP 3072:0xYyzL08MAqYmURGgRvdBgR/FYmP6f4XpRm:0308r/W9YmPkYRm
TLSH
T14EC35B10B0D199B2E4B2297024B5EFA14E6EF9744B699AEB33C4112F4E280D35D37E77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

31133

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Senad\source\repos\2MASS J07225830-2546030\Release\2MASS J07225830-2546030.pdb

kernel32

GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer GetTickCount ExitProcess CreateThread CloseHandle TerminateThread Sleep VirtualAlloc SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP CreateFileW

user32

GetSystemMetrics ReleaseDC SetCursorPos InvalidateRect GetDesktopWindow GetWindowRect GetDC DrawIconEx MessageBoxW DrawIcon LoadIconW LoadCursorW

gdi32

CreateSolidBrush BitBlt CreateCompatibleBitmap CreateFontA SelectObject CreateDIBSection CreateCompatibleDC SetPixel StretchBlt PlgBlt GetBitmapBits CreatePolygonRgn GetDIBits DeleteDC SetTextColor TextOutA SetBitmapBits SetBkMode SelectClipRgn SetDIBits DeleteObject CreateBitmap

winmm

waveOutPrepareHeader waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite

msimg32

AlphaBlend

2XMM J083026+524133-beta.exe

IMPHASH 6e9b5b3aca39c0157b8b37dfbe7f3a77
SHA256 56a07e44b5f7b108badeed51f3ce778a34081096eac1acffa575bfa2e3674760
MD5 eb9cfa19b42ae2e68ccc72ec024a3a6b
SHA1 2677e27954be853764fbcd1d6a26c9287d0b1e52
SHA512 8e5f4094f86b3dda9782926e1db177da707f3158eced18f5c8585b8bd35d8f71eb44a993839d04b4a8bb51b8e075d87464333691f264de6756c12fbef4ac6bc1
SSDEEP 3072:KF0GXK2yjFUAOABOpTYvPCRnlF13nauhFiTQO4hyWRzrfiizR:KK2K3jFUAt9vPCFbtnDNLR
TLSH
T110245CC77F90DDEFDB108A3825D69216137DBAB096C24F075D2475360B33AA07EA634A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

612B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

556B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2XMM J083026+524133.3.exe

IMPHASH 1fd26ad65782641622358d83de07245c
SHA256 f3635481d14d01760ad4666f13e901a4fd392cec649b30d1c62a779fc8689a2a
MD5 861f420b18d1657c7d9504278ccc33f7
SHA1 a19489cf4ba15be67e04faf6973da335ab2155ca
SHA512 04e22283a66a2b3122ead3571ca1b5b627d3ab805f80c323c8b6501965944b6d28d5f9d8d031a1a846bd24422f28894cbeea7e7d250067828cf7473f0a3aecad
SSDEEP 24576:O5gr0kxuU077gt0OMmGN2A9nSogVBCkicK+Ec0xMkU8JsU3Ao4d0MzxDbRF:Oar0kxuUCgt0OA2ANRMxpd0MzxDbRF
TLSH
T114A57383F6C68D97CBCE53B6D58362306374BDB2CA3A9B3BA604913129D36D16D46F10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreateFontA CreateSolidBrush DeleteDC DeleteObject PlgBlt Polygon SelectObject SetBkMode SetTextColor StretchBlt TextOutA

kernel32

AddAtomA CloseHandle CreateEventA CreateMutexA CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection FindAtomA GetAtomNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCriticalSectionSpinCount SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TerminateThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _ftime _initterm _lock _lseeki64 _onexit _read _setjmp _strnicmp _unlock _write _write abort calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free frexp fsetpos fwrite getc getenv getwc isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset printf putc putwc rand realloc setlocale setvbuf signal sprintf strcmp strcoll strerror strftime strlen strncmp strxfrm towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm

shell32

ShellExecuteA

user32

DrawIcon GetDC GetDesktopWindow GetSystemMetrics GetWindowRect InvalidateRect LoadIconA MessageBoxA MessageBoxW ReleaseDC

Name

.text

Size

462KB

Virtual Size

462KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

248KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2XMM J083026+524133.R.exe

IMPHASH d9b25b0e635b9e3961f1ee0af8ea4eec
SHA256 e5c6136ab08cb922976380eff155437fd79e3eb5fcfb20b3209b5956dc78ad50
MD5 1fc925b62737b7a130974515048fa6a5
SHA1 9379949572b5d4b82cba6d832c879db09a2fa413
SHA512 3ebbee20a124d5449f405955a00ee277801a4ff34406e5e11da075c77ca90cef4915acef1e55b4404b358bd7f0f48b61c9710e9a39a5b93a1d15cce7f9d2be90
SSDEEP 24576:fqo+5/FFvP/kQKBEmEHNNXLsK9Mhe+Ec0xMkU8JsU3Aord0MzyScfF:Co+5/FB/kQKB4NJoaM8d0MzyScfF
TLSH
T1B6950A83BAC74EE6CAC667B896D343356378FD518B1A5F2F6608C2312D536C5AD4BB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateSolidBrush DeleteDC DeleteObject PatBlt SelectObject StretchBlt

kernel32

AddAtomA CloseHandle CreateEventA CreateMutexA CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection FindAtomA GetAtomNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCriticalSectionSpinCount SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TerminateThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _ftime _initterm _lock _lseeki64 _onexit _read _setjmp _strnicmp _unlock _write _write abort calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset printf putc putwc rand realloc setlocale setvbuf signal sprintf strcmp strcoll strerror strftime strlen strncmp strxfrm tan towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm

user32

DrawIcon GetDC GetSystemMetrics InvalidateRect LoadCursorA MessageBoxA MessageBoxW ReleaseDC

Name

.text

Size

459KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

133KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2XMM J083026+524133.exe

IMPHASH 302bc05368988d159eee10fd7b61913a
SHA256 4057c25845950eec6165d388f32314b5a9e3453916a731954aab01ac3125fe3e
MD5 2e87cf963e33f9e001d3aff248f5561f
SHA1 56c4587cfb1cb46583f1d6695ff54bb58d1d60db
SHA512 b4dcc9976d2c1bc64dcc1a673b1b471b501447dba79a7be524acbfaddfeb29cef4b98ef73dcc9a35838cff93a0fcc997d17da345b84f6063b2078ab39a8aea8e
SSDEEP 3072:MXSlFfLNI0yjFUAOABOpTYvPCRnlF13AmUi87DEKc5OjRhkR+EwA:TWFjFUAt9vPCFbtDGElwA
TLSH
T14D446BC37B91DDDFD6108A3921D69226137DFAB05A824F075D2466360F33E90BFE264A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateBitmap CreateCompatibleDC CreateDIBSection CreateFontA DeleteDC DeleteObject GetBitmapBits SelectObject SetBitmapBits SetBkMode SetTextColor StretchBlt TextOutA

kernel32

CloseHandle CreateThread DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetStartupInfoA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsGetValue UnhandledExceptionFilter VirtualAlloc VirtualProtect VirtualQuery

msvcrt

__C_specific_handler __dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _initterm _lock _onexit _unlock abort calloc exit fprintf free frexp fwrite malloc memcpy rand signal strlen strncmp vfprintf

user32

DrawIconEx GetDC GetSystemMetrics InvalidateRect LoadIconA MessageBoxA ReleaseDC

Name

.text

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

780B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

362.zip

SHA256 c078b19fd24943abc4e1e595cd7a4aad1058f88d8451a30c26e15ac0630e2599
MD5 540cf85824cd0302725a0400ce61b549
SHA1 78d493aee81c73dd13631c30032aa4bca8376528
SHA512 ac93d91b11d73f56eb8168e9c5db56e70e41aa860bee4797cea5aa20c43128bc691bf7cb0f84915019f3d9df84625339a06e122660ca3224e413a5d23457aa2c
SSDEEP 1536:rtTMqi3OrwHQP+a/+KrWFvHDKfYABoA8CchXPpdfKxnV3VOlzZXydthKtZO:r56+qam3vHOAACAfcNLfqVw7ig0
TLSH
T1639302315B5C4A64DB27027B83D5A60F792EDAFC0A32C1350BE87D10EC5B7806BA29B5
MD5 SHA1 SHA512 SSDEEP TLSH

362.exe

IMPHASH 27c84543d4f67b913247ea33084c556b
SHA256 14143bb1cb5bb3385e136ea75a84d2255300c6ae581354766229660501067de2
MD5 11181cc16195926fc19106846a86617e
SHA1 4eb57a01a1a63a5c45738c658bf8e712afa71b6f
SHA512 3701b15cfecd2652f9bce4345d2751ca1f621b9fae4650fd359876823234b0d7c79008f1219a6a5974e0d2b9a204252d62eee21bf0ac54eda15818e8bdeade25
SSDEEP 6144:gZ0vQKK+OlEvSd05W1+Va52YaykXCuMS2mxa1ZTD3iifyd:gWvHuESa0MEEYdTyNQTriQa
TLSH
T1CC6418A4F686FEF6F8458B7D14F1530D439EA291EB1DD7337860FE28010AA5885B364E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

223KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ReadMe.txt

SHA256 5623aad660d111055f3f870306884251c792be2bf7d9dde857a73b9f94cddb12
MD5 230956db1293e189c1e73db04537733a
SHA1 d2a2e5715916dd8d6c5b660cbc982a5fe0fcfa7c
SHA512 daabe4b11c7878c3ebb5ef56f52ff974c95b50743db20dfc371957182ff7b2ff83eed24cd573bef963c931489579c319f77d93b054e94151199090dbc187c63d
TLSH
T19CF079F226620000593331FB3863FB6F7EA6102DDED989E13B4C95AFD71F4882A148A5
MD5 SHA1 SHA512 TLSH

3D.zip

SHA256 5fb476ce0e85c96b3de36c6e0ef19411375ecde7a1a0842216d0ca06f60461a3
MD5 3435fab6584cf49086fdcd7ecb0d7f50
SHA1 46a5cbaa6acfcfcf1a735f7b3f3e1be7df508e66
SHA512 a6db7ba6d4afd617361cb5b3c7356ce7f1ee73939dfc7aa7e3582fd49d3be270adbc61dd686b44a18805defcfc7947000ee3de6c86295546f976dc19d5dae636
SSDEEP 24576:7itmpAZPoMM6l+FwWBG/YJxV4JuPBUTVfhV8Z:wmpAloMMlFwW4wJ/4JuO5Ve
TLSH
T1D91523FCD39E924E03A679023B1CCF60BF97C42A62CCEE6166576857E6D17E5AF00412
MD5 SHA1 SHA512 SSDEEP TLSH

3D Vista-11.exe

IMPHASH e3635567c5476adeacd59cdac9eeb179
SHA256 dac2a3a6507c8e8bb8aafc8afd978d1685df063acd95baabf1b843de4db7a93b
MD5 3933e25c181845f8e41aab480af72a97
SHA1 98fefa1f5b08dd3bb60e7cf59fc6d9aaa356d7be
SHA512 e971735f8efd83ca168734f07cb2b488f4ba03babf5870e57b77a3e031924c4e36f95d2762f5b7db2c9140e76076593374c1fda09edaa5ba247ff41daa626c83
SSDEEP 24576:/2pkXJPI47390/SDomR6p7tq3rYUt5WVQK+Ec0xMkU8JsU3AoOd0Mz1SxHF:HXJPI4h0/SDapEcVVGd0Mz1SxHF
TLSH
T1ED95E883BAC74EE7CEC667B496D343356378FD518B1A5F2F6A08C23169536C4AD4AB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreatePen CreateSolidBrush DeleteDC DeleteObject Ellipse PolyBezier Polyline SelectObject StretchBlt

kernel32

AddAtomA Beep CloseHandle CreateEventA CreateMutexA CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FindAtomA GetAtomNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCriticalSectionSpinCount SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TerminateThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _ftime _initterm _lock _lseeki64 _onexit _read _setjmp _strnicmp _unlock _write _write abort calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset printf putc putwc rand realloc setlocale setvbuf signal sprintf strcmp strcoll strerror strftime strlen strncmp strxfrm tan towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm

user32

GetDC GetSystemMetrics InvalidateRect MessageBoxW ReleaseDC

Name

.text

Size

462KB

Virtual Size

461KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

3D.exe

IMPHASH 54adfffc74ad6c94c061f4c27f9a4fe1
SHA256 1762f6f1c1135e932ed2e8c11989010004a2c22a663e419577ee9e05549056bd
MD5 1adcb528d478491fc682c44975659c77
SHA1 4427bf90dc6165a6e0d977d924557c0bc999498c
SHA512 9ce869a7d3589435f236308c5195660e6c8d6591dcfa1cd792855ddd604be4ad27debc9003d055b33b198c0b1d2d0b7d1f14dc3a989010ca09eb6a34375ebb8b
SSDEEP 24576:WT+HYNpR33jkwC7m8DT+hoYUt58k+Ec0xMkU8JsU3AoOd0Mz9S9HF:6+HYNpNjkwCpTwQ8Fd0Mz9S9HF
TLSH
T17D95F983BAC74EE6CAC667B896D343316378FD518B1A5F2F6608C2316D536C5AD4BB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreatePen CreateSolidBrush DeleteDC DeleteObject Ellipse PolyBezier Polyline SelectObject StretchBlt

kernel32

AddAtomA Beep CloseHandle CreateEventA CreateMutexA CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FindAtomA GetAtomNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetVersionExA InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCriticalSectionSpinCount SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TerminateThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _ftime _initterm _lock _lseeki64 _onexit _read _setjmp _strnicmp _unlock _write _write abort calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset printf putc putwc rand realloc setlocale setvbuf signal sprintf strcmp strcoll strerror strftime strlen strncmp strxfrm tan towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm

user32

GetDC GetSystemMetrics InvalidateRect MessageBoxA MessageBoxW ReleaseDC

Name

.text

Size

462KB

Virtual Size

461KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

3c436gr7je-beta.exe

IMPHASH f204a7e713adcf9eed5fe2fc23d35db0
SHA256 5fa9c92490a20355242b360360e9861db0cf7548070fe170d452184a259ec270
MD5 85b06b86364ee32f42da585cc27ea74b
SHA1 7b6f4de113b0396e20911610c0298adc1d35b0ad
SHA512 23448635ed74c851413e3734ca832a3df111c31b391832e75cee2ecff3d71e42ef82b34e946d95b1f426d5fd29a4be8758aa6a9dae13adeebf48a65ecf2a1a40
SSDEEP 1536:7l4wZbYvwRw0C8YvkOL7DeLyAGjYWRvYHwJ8n7Qgj/QJV9sWq1cd6gwcHxI5TUHt:N1/2FO2rjYWn8DwQE6hcHxI5TUi8uL8
TLSH
T19C1449B4A7819B79E4630B303464D5F0052BAD60BA344E6632F4EE1FFAB50D35D21DAE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ACER\source\repos\3c436gr7je\Release\3c436gr7je.pdb

kernel32

FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer CreateFileW GetTickCount ExitProcess CreateThread CloseHandle TerminateThread Sleep VirtualAlloc HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GetFileType SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW RaiseException

user32

GetDC ReleaseDC InvalidateRect GetDesktopWindow GetSystemMetrics MessageBoxW GetWindowRect

gdi32

CreateBitmap BitBlt SelectObject CreateDIBSection CreateCompatibleDC StretchBlt GetBitmapBits DeleteDC SetBitmapBits CreatePen SelectClipRgn Polygon DeleteObject CreateSolidBrush CreateEllipticRgn

winmm

waveOutPrepareHeader waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite

msimg32

AlphaBlend

3c436gr7je.zip

SHA256 8c1c784d6ebcfd7e161cb1001dc911b4ae0ecf5a7685ed7a85dd7d76e0fb4348
MD5 2037f1a4757aa1c55ad35a45d117a8e9
SHA1 81f8c30c094f497986ae6915d1ce78df99b61279
SHA512 922b5984ccd43ad79b40402fcfe2d93ab534d06c2c33b3c72f7cf5e4fdb90ee1c10c82c6db000170c426b3298710651f3347562171409b08bf6ebba3da43cc28
SSDEEP 3072:8rQIQP+rGv52OSU1Rtjft5bFbW41KoMj937En0p/M52Q:8sIQGuLjfbgXPj9MyE52Q
TLSH
T1F2D32263BC7A0B61AA6746F9BA543031C837CAB7B4A8E81513A48D0E275DC4CEFF7505
MD5 SHA1 SHA512 SSDEEP TLSH

3c436gr7je1.01.zip

SHA256 0ca1a0ca06a653d16d807f25af25784ce702c030130cfa975c127a56414a552f
MD5 50376f47067ee198709b3e5d153ea5e4
SHA1 ee77297c9800cab7655761ab8edc6dbea1584f8a
SHA512 ab5e952ab2b012a7283239c3efc19c21a6e7b9dc7e3150f33c8df9247f8d1bc2a10e7e9316e8b9195bff45c5b37abe549ce2dbb3c52881d66f2765d59c2b2116
SSDEEP 3072:+V4+lfamDX2wII9JFeYHfnCsT318erH6lxsmWJYNesDrTj0+AU/PPH6c/kcWgP3n:+SOCmT79JF7Hqau/smy8HQU/n+bgP3n
TLSH
T1D214238853C11471CE9633FDBA2FF3A1A12624469B3373143918B4B91AA7FA16CF7D94
MD5 SHA1 SHA512 SSDEEP TLSH

3d Cube.zip

SHA256 109d23a42d97d21932b242a59da7d7ccd5997867e9cb763882f6bd4195c2355c
MD5 c646991fe8b9aff4ee0db376ca5b94e6
SHA1 e30384556383776c087ea5d26729dcaa6a225251
SHA512 908716212a4b41e903ae15897d88444c31bfc69ebb3d4fd541d89b3999cef1502915daebcebe93558cbc63117641b07d16fc8a3f893410615801ecccf14913aa
SSDEEP 6144:1Tucgtnw+sWyYidfkriiH94Hxja4xjz2AmgVblDWz3ep:16cG/skidfmii6hxX2AblDWzOp
TLSH
T11424239A4432ACDF8C2D2455215B0CF3382CC3D961E6581D8EDF9EF0B67CA8C87A5676
MD5 SHA1 SHA512 SSDEEP TLSH

3gp-alpha.exe

IMPHASH 3888f7c29238dcbe0741ce0260518029
SHA256 e21083e2d8e2139d8a64d13ec47447604c16037dd01dca0e1bdb54efb69cf2d2
MD5 a3a604a1d875b5fa4214d5e00fc17077
SHA1 3b31951db4808043efae84b19210ba6886be8a9a
SHA512 ad787cfe00882d0dcc28c5c0d0a86730de70eb35e603df95d16c17d2f8c5488fcadb7be0ca630edbc99b810300506850f118543134cdc88d1f4cf670cb1127eb
SSDEEP 1536:+0sze6fpRVfyl3tfu8ZCnOtV8UFaeZbV/ELQJZIsWxfNcdWSPE4vlV:i3yp1u8EO78U/Z+LwufcWSPE4v7
TLSH
T1BF734A17B5C19472E4B349352874C9A19A3FF9210F64CEBB7389132E4F281D1993AE7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9173

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\MSI\source\repos\3gp\Release\3gp.pdb

kernel32

WriteConsoleW DecodePointer GetConsoleMode GetConsoleCP FlushFileBuffers CreateFileW ExitProcess CreateThread CloseHandle TerminateThread SetFilePointerEx Sleep HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GetFileType SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW RaiseException

user32

MessageBoxW ReleaseDC InvalidateRect GetSystemMetrics GetDC

gdi32

SelectObject CreateDIBSection CreateCompatibleDC StretchBlt DeleteDC TextOutA BitBlt

winmm

waveOutPrepareHeader waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite

msimg32

AlphaBlend

3gp.exe

IMPHASH 3888f7c29238dcbe0741ce0260518029
SHA256 110d8292b06ebf03151726f7a942fb0a5528251fdc9334883424e08428d0005e
MD5 40c59023aa70aa3335e8fc32fe397016
SHA1 e403aa164f78e8863092d4cb5f7ac1d79f51eefb
SHA512 a2c98ab9229d4c6d0f621f413da195526c2dce46a308d22bbe0c0420f1c964122f05c792315f4b4c3fa1deb65d48c2b5283165913b7aab30fa910b81cc2cad88
SSDEEP 1536:8U0He6COfVv6ufhfu8hCc+tq8Uy6psrn0iQJZIsWxfNcd2OPE+XlV:ad6gJu88Ps8U5pliwufc2OPE+X7
TLSH
T156734A17B4C19472E8B30D356874D9A15A3FF9210F64CEAB3789133A4F281D29936E7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\MSI\source\repos\3gp\Release\3gp.pdb

kernel32

WriteConsoleW DecodePointer GetConsoleMode GetConsoleCP FlushFileBuffers CreateFileW ExitProcess CreateThread CloseHandle TerminateThread SetFilePointerEx Sleep HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GetFileType SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW RaiseException

user32

MessageBoxW ReleaseDC InvalidateRect GetSystemMetrics GetDC

gdi32

SelectObject CreateDIBSection CreateCompatibleDC StretchBlt DeleteDC TextOutA BitBlt

winmm

waveOutPrepareHeader waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite

msimg32

AlphaBlend

41.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a6f894e461676a02f0a9a3261ab85c22e0053538c6e08c1ffe2263afb1147c4c
MD5 7a786e222b0788081f1dfeb5e120732a
SHA1 524716bf6c8e6d7ecfbf6f86c91763b0f76a8cf5
SHA512 95adcd22e78a30fc3c1ef6f4b424a24faa2b42c5c76d1faff66b3802779c62512291588c8e01c1696169eb734bd5074d9a2893223f184bd68c57988bf6f15537
SSDEEP 192:yf1Hi+GG2GI2080AA/glt1eV25MUyKn30lSx5UVCTl+IT4tBQz/VeD+Vih0x:SmGtUrbi7MVK3px+VE+IT4tBq/Ve+ihq
TLSH
T1AF425C09FB944631F9BE063264739B010731D96A6E27DB9F13C8903BAE7334D9B22712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

16350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hp\Desktop\41\41\obj\Debug\41.pdb

4ply.exe

IMPHASH e6af589ed755b90ccbb1587c988635f5
SHA256 0d4f83d4868920f5c9166b293a00a7e73bfed3c02afc1a321b420ff25e20105a
MD5 353cb44875e78f64c1a193fe64efdd25
SHA1 3b0cbe2058cfafc8a7fa8ec4f9543997035ff1e0
SHA512 2a31f32b7af137b31b9c50b5a48ba3d645770d8582da54ecb3f4a26d68eb03a9442f9911a6748279adff376c48d6ccb5abd835d7c834fbca20d8206cea8158cf
SSDEEP 6144:o6mHUp4xLv3sdsMygPwrWJ0/EHspfFMCsdgGmELPSP8br4a70D:o6FIv3hS4hcRXPy8brV70D
TLSH
T13384C1971BEB6C4EC4112E7C485202B26379D23086D7BB6329759D3F4B1B6C0ADC6397
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

261KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

512bytes.zip

SHA256 cc3f19eec84a075a9679e9260fd8b4873df6b3581afd4533d0751efd39283aef
MD5 5e5d6906de1a3c282bbd112937604fc2
SHA1 78e3d4d98a53206b58e89718dc2b8d346340a8df
SHA512 8c81ee98087c00f1ffcecf4de10f495fc29ce0243a5a47dba6e86875abcd89cd06803ef9bb1e7032ca345b3b1f2a42f180be1d19c7646f5983e6c31b848053e1
SSDEEP 98304:VC6zV9c51XHzFGZYm9dg08awR7OGVNx6p5bNjUtK4Ke4aRq3:Vr9oXpGSm9dgvRyGVNx61jUce+3
TLSH
T1D92633267929D6B7EE435D661044DBE31E07B8B237890E7EBE311B02BBE5C52B407D18
MD5 SHA1 SHA512 SSDEEP TLSH

666.zip

SHA256 cbe9f0a15c89c735ba26eac10c32b6ea1d7d7e08d7ce11d8534f422244c654cf
MD5 8619b89cfab0ce7d37464a74439e7b75
SHA1 72497e4604384e0e4c51b632af1d082a70cd1048
SHA512 59fb5a54594346b955507f2372c75aa65b88d696d1a020fb1eb754b33bae47c71d5220bc2ab62fef01fa10f1fc2a4b81d78721950153eb89686ef104884f574d
SSDEEP 49152:cSay+J0PX7BOY/WUDE7blmKU6uMLZH8Jh/iko8IfgE:rajiLBWUa5mwSJE8IIE
TLSH
T1968533B3F55046A1A99F47CB9430466C59335B96E7DEB7C436BC10747922FBA2C2B302
MD5 SHA1 SHA512 SSDEEP TLSH

69.exe

IMPHASH 99ee65c2db82c04251a5c24f214c8892
SHA256 6606052fe50484563254b45f679dcbb9d42fff8ede7e8dba609e2760a5e0b3b7
MD5 165b9d15346eed1bd8da9780eb7ab4bf
SHA1 a9895dca7b49cd345634809d03baa51d5078c639
SHA512 b70d1ca87b71b2d0b9611e51e0a26e27b7d1a75072113965cbced770e3f46d9b7147225cb566ec06cac2921f8e4860faf882f96d2a866b2408dfacd4aaeecbf7
SSDEEP 49152:GpUlRhMQfcBROIbrGTPmbpzyLdKDfWLDooV9VwwzuDDFDdexGQw:GpUlBcjnpkwfkkS9V/YTAGj
TLSH
T12BC512037F94B0F2D67354F24AE472514B39ACF02A718ADB53B06F3C5A745C2E626B62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

157136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

kernel32

LocalFree GetLastError SetLastError FormatMessageW GetCurrentProcess DeviceIoControl SetFileTime CloseHandle RemoveDirectoryW CreateFileW DeleteFileW CreateHardLinkW GetShortPathNameW GetLongPathNameW MoveFileW GetFileType GetStdHandle WriteFile ReadFile FlushFileBuffers SetEndOfFile SetFilePointer GetCurrentProcessId CreateDirectoryW SetFileAttributesW GetFileAttributesW FindClose FindFirstFileW FindNextFileW InterlockedDecrement GetVersionExW GetModuleFileNameW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW FoldStringW GetModuleHandleW FindResourceW FreeLibrary GetProcAddress ExpandEnvironmentStringsW ExitProcess SetThreadExecutionState Sleep LoadLibraryW GetSystemDirectoryW CompareStringW AllocConsole FreeConsole AttachConsole WriteConsoleW GetProcessAffinityMask CreateThread SetThreadPriority InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte GlobalAlloc LockResource GlobalLock GlobalUnlock GlobalFree GlobalMemoryStatusEx LoadResource SizeofResource GetTimeFormatW GetDateFormatW GetExitCodeProcess GetLocalTime GetTickCount MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetCommandLineW SetEnvironmentVariableW GetTempPathW MoveFileExW GetLocaleInfoW GetNumberFormatW DecodePointer SetFilePointerEx GetConsoleMode GetConsoleCP HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW QueryPerformanceFrequency GetModuleHandleExW GetModuleFileNameA GetACP HeapFree HeapAlloc GetStringTypeW HeapReAlloc LCMapStringW FindFirstFileExA FindNextFileA

oleaut32

SysAllocString SysFreeString VariantClear

gdiplus

GdipAlloc GdipDisposeImage GdipCloneImage GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreateHBITMAPFromBitmap GdiplusStartup GdiplusShutdown GdipFree

Name

.text

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

6969.zip

SHA256 6d311f87b068565a2c1e0dd9eb0b5497e596330668887278ddd80faa4453d5ad
MD5 5dbaeef1ba275f846752afde6b621ee0
SHA1 fc9dc503056cc4694d88857b10a05909ff90d598
SHA512 b588439c9ae8174889e6e8955c3cce77a6776c59c395c838bce2263499f229ad7f4ba54ccdb4dfd1f41528e40d205c2a0d67a59f3659f41ef4b187804fe23b56
SSDEEP 196608:vwzHvrK/h3cDEiDDmY4UPYBu67T8HFyR/DRJs:YzPEeDgKYBu6jDRG
TLSH
T1C06633D05D840532AFFFE676A0A7CEECE2BD8E4D826B5763B15CD8EE691670385021C4
MD5 SHA1 SHA512 SSDEEP TLSH

6kals.exe

IMPHASH b1326a6afaf271bdd45d3c6bb561fefd
SHA256 c7fe6ea269fd0f1e57dbcce88bf8c11b7d00946aacb744ac8cca2632341d531e
MD5 608a36d5e9c26eec500dd83131fc45ec
SHA1 696e7dbe0ab10c3be23e5047dfe25760271df6e9
SHA512 2ee80e03d3c884a17ab25cf07bff9cab451324c13fa611e27efea0719f6cf4c022ad7063e3b8b516b1cee3f902b04e26f460fc14fd23b03d3a379e072977a226
SSDEEP 3072:mQcJZiUswA3UyM3o9J4k8ZVcryaH9AfA1D:MJZywwMuOvXlq
TLSH
T12F640882B742EE57E813073948E5E3B40629AFC05686CB1399F1BD377173E926ED82C5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

BitBlt CreateBitmap CreateCompatibleDC CreateDIBSection CreateEllipticRgn CreateFontA CreatePolygonRgn CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetBitmapBits PatBlt Pie PlgBlt SelectClipRgn SelectObject SetBitmapBits SetBkMode SetTextColor StretchBlt TextOutA

kernel32

CloseHandle CreateThread DeleteCriticalSection EnterCriticalSection ExitProcess GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetStartupInfoA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsGetValue UnhandledExceptionFilter VirtualAlloc VirtualProtect VirtualQuery

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _initterm _iob _lock _onexit _unlock abort calloc exit fprintf free fwrite malloc memcpy memset rand signal strlen strncmp system vfprintf

user32

GetDC GetDesktopWindow GetSystemMetrics GetWindowRect InvalidateRect MessageBoxW ReleaseDC

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

190KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

754B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

8Jplothine.zip

SHA256 6fe72c8ab747560031389f4a827b5b54b47287211ced985e596e8e1d0ed24b5c
MD5 8605051f540f3ed8abb0b55120c30d3d
SHA1 4bb6f5e9d14e26ba71e53d39fcfa1801651e711b
SHA512 f7832110ee326c378faff684e81efc31b2691a64f216e0d8c15ad0a3cec594832f5d9e288b00f7796f339fbf0c5dafc38d1169d81827965ed4766612c568b10d
SSDEEP 384:Y4hBI4JsCt8ggwV6kAbl64D8yMHnSgQWccqNc7UaavBYHacfBmKzBUP58pglRqtg:Y3CtXRaJZ16S3WtyceCZvUh8af107uCo
TLSH
T17AA2D191D4E686A4D12D3D7CF8332C09D407497B788FB2E7A675ACE12476523B31231A
MD5 SHA1 SHA512 SSDEEP TLSH

9998.exe

IMPHASH d134f6e1780a34f6085d6d69f86e030e
SHA256 50d011ed5e7a16c3274acc809c1811d816f227596f59c27d0c41eb097901cf46
MD5 8b7780825f6c61c6350dac7964af2cdd
SHA1 6e728dc5a8d8fdedb8e95325afc090e1ccdce7a3
SHA512 0694aac1a9d85b57b1c076d08962f3eb050a41a6791b13a80e6683816741647877fb7ec15038a8803af8ec00e4b2908705502f288e77bb686095595c75da3e9f
SSDEEP 96:TUp+1K7xoZKqPJUVcZgt21JK/1DcR1wsPnspyxbzMNFPH9rzri9XkLmD755tfMss:8doY7Vtth1D9Q+F/VO9Xf55tfVDi1b
TLSH
T19E422B97B6560CE9D63982F444730A08E7F6B43207225FCF53B550672EA63C1787A6CE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ALAN\source\repos\9998\x64\Release\9998.pdb

kernel32

GetStartupInfoW TerminateThread InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsDebuggerPresent CreateThread Sleep GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW

user32

GetDC ReleaseDC GetSystemMetrics

gdi32

BitBlt

winmm

waveOutUnprepareHeader waveOutClose waveOutOpen waveOutWrite waveOutPrepareHeader

vcruntime140

__current_exception __current_exception_context __C_specific_handler memset

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _exit exit _initterm_e _register_onexit_function _c_exit _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _initialize_onexit_table _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

@_u.rar

SHA256 1e2bf07f4c56b026eb9a035edb528825c8bb3f33f24fb5ab21cb4b63c4741801
MD5 3c5b4daab72923e28be0827ad67453dd
SHA1 926050c0651113052b6be79c94866aa45bb3136b
SHA512 4ea18205b7f49bc7895d923dfe2d134e3a8d2aa391969f9497add125234f098e8022ab27583af879de1eb07be83afbe855947f3c256b7ca96383f7ab4d395817
SSDEEP 24576:trHwRIQbe34hUr63dzcrAVVvLmah8M1YoNgSYmGfJUq6IRtpK2Gb6JkOlzApoPYv:tMRO4er63d0MLmeUoKS825b0cpFuFevv
TLSH
T116853340FDCEA863D5046E799CCAAF61866EBC5487B10114DD7032B27C9FDE2C5AC1AE
MD5 SHA1 SHA512 SSDEEP TLSH

ADs_TFA1206.zip

SHA256 cf50471e31e3886b463369b6a33f99b179deb6ab9220a1c7c35cc9bc2fe6b90c
MD5 86a614870d9a2175b99f951573e55795
SHA1 d19b318544ca78ddeb3fe1f6b45f74a177c6f64f
SHA512 240e8fd9a3b7ef78490a6d091359a3e88de5f93c98ab8fd6e1416b5eda22831d411d30dbd6c3aa50dfd6dd163774f13b5f5227af41ff584892a347e9d6015b9b
SSDEEP 3072:C0JoAWyFamH25O9MWGWk6OCgl9mArtGYFg78wTtNRg6JuOJqCiA:C0JtWcamH2yLGWk67gl9VrtGp7Ztv1lf
TLSH
T196F3131C660FDCB9D4552EB8E7D5A2131331D0A460E3EEA6EEAC831CA4664D06DF1CF6
MD5 SHA1 SHA512 SSDEEP TLSH

AMARTYA JHA 1.2.7z

SHA256 b2b14a3337d69d788c542d204c4c5646c7a4e4acb9607d77d333fe55354d3a0b
MD5 2fcf9630f012911111acad9a62706a61
SHA1 0ddb42374436baab786595b4aa70e36faea89ed9
SHA512 99dfc87fedab88cd0e0fa67e9175da6956ad21cec91c6e1934b54adca4e4901880d53dd7e4cce947ccbbee8dd101577d5cc0a926f34df5ba2954bd2a10331622
SSDEEP 24576:aM/fk5W5p6C/fFJn64S2/bkPusVhFnooh5XHpmqU6UWdR7lJ0jKJz3Hm9:a6kw5J/S2/b4usrhooh5XHps6UWr00zA
TLSH
T1746533BA217084CE5948CC471B7201B3E42F0D6AF2A96D46BBC9B897F16B4673076773
MD5 SHA1 SHA512 SSDEEP TLSH

AMARTYA JHA.zip

SHA256 2fce656d8c034a74dcc65abbbb0263112e320fa2f949ca32d5d68553e58e2ece
MD5 88260ff56c8711fa8eacfa07cebc8400
SHA1 a22f2cfb9105a2c3893520fb3a7b4498825f0652
SHA512 ee1e28707ffd8a75677a27a20cde9ecfe1d06a711e4f83d158026fc05dd92723c7f809957a9ca86130f3bceb25c0dd31ed90490bfd47cc2e5cb01d334cb280cf
SSDEEP 1536:vQFUZ+DBwajyXrsS4PzwVuIUn5u7WNnyHc10xs3f+M6CVcmDW:vEDuajy7snrwMznaS0xsb6s9S
TLSH
T1A3630244A27E9757E08C4F2C39612C67C4DAF4895A2618AB480FBB5D3533FACF9702D9
MD5 SHA1 SHA512 SSDEEP TLSH

APM 08279+5255 2.0-beta.exe

IMPHASH aeac57970c3cf3d95f19a11633d87404
SHA256 d5f045d0ac928eaca5ec1690cc312a441f6c9b653a080120b837e6f07cf3a8c0
MD5 99ad40c57ec742efa035f6c07c3b37a8
SHA1 848699872448b46c6316c965dc2c3d976ae8fefd
SHA512 b7a6cc519caa5f58249b038b0f73920c2dfbd83b56ab8af1a9be6e25f646e8e633e9ee79da7ff1c0f09bb5318a5764cc61d809567ec70a1f7b594bd2b2cdf683
SSDEEP 24576:W3GbkKsszsVZes3bmi6Ei10ErMy9dIXDy3i3m5niCLh0s+Ec0xMkU8JsU3Ao2d0d:2GwKssMZes3iESgyDI+Xwd0MNZ5i3F
TLSH
T1A7A50A93BACB4EE7CAC267B896D343306778FD518B1A5F2F6608C2316D536C4AD46B10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontA CreateSolidBrush DeleteDC DeleteObject Ellipse GetStockObject PatBlt Polyline SelectObject SetBkMode SetTextColor StretchBlt TextOutA

kernel32

AddAtomA CloseHandle CreateEventA CreateMutexA CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FindAtomA GetAtomNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCriticalSectionSpinCount SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TerminateThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msimg32

AlphaBlend

msvcrt

__C_specific_handler ___lc_codepage_func __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _ftime _initterm _lock _lseeki64 _onexit _read _setjmp _strnicmp _unlock _write _write abort calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free frexp fsetpos fwrite getc getenv getwc isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset printf putc putwc rand realloc setlocale setvbuf signal sprintf strcmp strcoll strerror strftime strlen strncmp strxfrm towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm

user32

DrawIcon GetCursorPos GetDC GetSystemMetrics InvalidateRect LoadIconA MessageBoxA MessageBoxW ReleaseDC

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

Name

.text

Size

468KB

Virtual Size

468KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

227KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

APM 08279+5255 2.0.exe

IMPHASH 84a4f7c15e7a70a592768068446c2080
SHA256 0f476489b695ec1d41e8338204b799465c3b7fd8a50c05f80c5c0d6730f28e12
MD5 eb72ed0bba9c638bc67887eb918a66b7
SHA1 431ff8eda24a08441458abd342361dc36f65ea83
SHA512 b99598cc827d80b305391acf8b495369f4c63f0268c157cc3d3790bbf330b9ddb7f526d088872e776dbbd23e5bc34c0ba0fcfb0a7f82eb9cb9dd1044e685f020
SSDEEP 3072:LjK3Pyy35HWArqel4Ry9gQJ8w9PBRUbYiBs/p7sQklnWNQCRUSeJEyf:na52AHiyj5ybYiBs3bcJEyf
TLSH
T1D2A46BA676E2DC8FD511833C52D6C235127DFE805E938F072A117A352E37E913FA261A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateEllipticRgn CreateFontA CreatePen CreateSolidBrush DeleteDC DeleteObject Ellipse GetBitmapBits GetObjectA LineTo PatBlt PlgBlt Polygon Polyline SelectClipRgn SelectObject SetBitmapBits SetBkColor SetBkMode SetStretchBltMode SetTextColor StretchBlt TextOutA

kernel32

CloseHandle CreateThread DeleteCriticalSection EnterCriticalSection ExitProcess FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetStartupInfoA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsGetValue UnhandledExceptionFilter VirtualAlloc VirtualProtect VirtualQuery

msimg32

AlphaBlend

msvcrt

__C_specific_handler __dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _initterm _lock _onexit _unlock abort calloc exit fprintf free frexp fwrite malloc memcpy memset rand signal strlen strncmp tan vfprintf

user32

DrawIcon DrawIconEx GetCursorPos GetDC GetDesktopWindow GetIconInfo GetSystemMetrics InvalidateRect LoadCursorA LoadIconA MessageBoxW ReleaseDC SetCursorPos

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

Name

.text

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

APM 08279+5255-beta.exe

IMPHASH 7bc0bcf86f9f43ab17347dda5ee9facb
SHA256 1e11512689fcc12c6b49f97f2303fa520d7f73b1bbf608dcdb00246102c106f0
MD5 11fcae70898e5707ab10528d394411e2
SHA1 e29276fb1f9f298b92f80df11a81b7c741ebc0c4
SHA512 19d6c600053e9d45778c3e034619fa99b89dae1ffd0721e2a3dd8b343080843ad76e133c4c963cf50945de2af035fbb8cb0ac9d58958ed3061d0c938011bb657
SSDEEP 3072:nZwoth1W8iSrhvH/zwkLmZ8/+R4oe9R+R6ox3BzEfQ:ntKWfmi+Rk9RAHBoY
TLSH
T1BD2409007FC560E2E0A7FD393C60857DC528AA210F2659972276FF3B3A351D95863E6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\MSI\source\repos\APM 08279+5255\Release\APM 08279+5255.pdb

kernel32

HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW GetTickCount ExitProcess GetProcAddress CreateThread LoadLibraryW CloseHandle LoadLibraryA TerminateThread Sleep CreateFileW VirtualAlloc WriteFile GetCurrentProcess HeapSize GetProcessHeap GetStringTypeW GetFileType SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetLastError SetLastError RtlUnwind RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW DecodePointer

user32

GetDC InvalidateRect GetSystemMetrics MessageBoxW ReleaseDC

gdi32

BitBlt CreateCompatibleBitmap CreateFontA SelectObject CreateDIBSection CreateCompatibleDC StretchBlt GetBitmapBits DeleteDC SetTextColor TextOutA SetBitmapBits SetBkMode DeleteObject CreateBitmap

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

winmm

waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite waveOutPrepareHeader

msimg32

AlphaBlend

APM 08279+5255-beta2.exe

IMPHASH ed93370e335b381b05ee581c68e56514
SHA256 a691cc09d0cda16ddacf4cd337f61eaf67703c4b559d8f3d916d23461639a8d9
MD5 fa180a6318f04ac4b7932b1955685adf
SHA1 cbb5568de63a07a7cce7f7b9a50d3020057fb3f9
SHA512 aaaaf39e57d6a78bbab5588b80d1d41156fabc82f46d1657260911dab8a4b1c4a9ae0416547085770f6dee49c487de734db848d3eca513c9ec2c772cf4b3f76a
SSDEEP 3072:QqPuSRrhI+kp33X2Yx16kqwsD9qzQPZR4oe9R+R6ox3BzNao:QmnI+k49ZRk9RAHB5x
TLSH
T17F24F701BFC9A0E2D4A7FD383C50957DC524AA310F2655972272EF3B7A351D91863E2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\MSI\source\repos\APM 08279+5255\Release\APM 08279+5255.pdb

kernel32

HeapSize HeapReAlloc GetProcessHeap Sleep FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW GetTickCount FreeLibrary ExitProcess GetProcAddress CreateThread LoadLibraryW CloseHandle LoadLibraryA TerminateThread CreateFileW VirtualAlloc WriteFile GetCurrentProcess GetStringTypeW GetFileType SetStdHandle LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetLastError SetLastError RtlUnwind RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW DecodePointer

user32

MessageBoxW ReleaseDC InvalidateRect DrawIconEx LoadIconW GetSystemMetrics GetDC GetIconInfo

gdi32

CreateBitmap BitBlt CreateCompatibleBitmap CreateFontA SelectObject CreateDIBSection CreateCompatibleDC StretchBlt GetBitmapBits DeleteDC SetTextColor TextOutA SetBitmapBits SetBkMode GetObjectW DeleteObject

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

winmm

waveOutPrepareHeader waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite

msimg32

AlphaBlend

APM 08279+5255.zip

SHA256 5828eee45623e44ef00126ee127c0039700cdfaf4ddb75dc8e3996d2f43e1c1a
MD5 67253f1a72521681d124e6b3c42e65dd
SHA1 2e9f3a077c5b367bca8f05390c5b3716772105f3
SHA512 2f8812263289eeb86d076df08f41ec875084f86b7b8e2d4eae8c0828a402b9358c47680b25246ee11d78867af5fa7cc9e08b8e802926a9534747b38d9e1596db
SSDEEP 6144:HNXL1oex1Zpi02yqmv37EG/tW6bU/+BsFB3KgKIdWJu/hA9aQliSZp2dRqhdcqWC:Hd1oi1u03VTJbU+iBrKCAu/y95XZwdsX
TLSH
T1FC74239A056644E648B67B82F102493F522B1C9FDBBC83C460F3CBCC54FEA797284979
MD5 SHA1 SHA512 SSDEEP TLSH

ASiANoiAndRO.zip

SHA256 37e4c4e328ab15c801dd92cd9cb3a94f05bf58832467680e7f7a3180fbbd28d6
MD5 92197ddae6f350448c363aa8b35815b1
SHA1 0db60c3d1fc6981dd92e4dfdd328dd7e7aabf4b1
SHA512 31d4511eadb84056085c35cc8860e06a806d4f4afa8f406b67777e2a33d7f8ec868d5b19bacf741a5fc781a738fc1c928ee2040bdc78a5348318626e848b92fc
SSDEEP 1536:DqFYnKYv+dvBcbYCbCmtWqTS/tV3iaG9C5:DivwQvoYQNIq2VVya8e
TLSH
T1443302EC727BD5ACE7A00631833CF9D87272D39E9216E5A43AF0460E7108443A64E79E
MD5 SHA1 SHA512 SSDEEP TLSH

AVSecutity2022.zip

SHA256 0f84b336a012dc1added8d2dce235c0701e19918dba26e97731bc1d7c17b3c65
MD5 29cdccd25ed96fb2c988cfe30cc75798
SHA1 298e377e8a0208d4dd983b385603369acb472f14
SHA512 0436c6c982a4d63e3047a3819ab423a40bf41e92dc83e873e9ed371911b4ff02cc030d57e5f9a1805b9ccdbbcc9efd6c981d21014b2fd45f9cfad6c0bf8cfb0b
SSDEEP 6144:eJgGNecQlf8Vv5FL5L/MWJ7aEgIsfZlN94L4RIcMkRqFW8usKj:e+GNRQfWv5F4IsxlE5czRqI8u7j
TLSH
T18F3423498E5806549ECA6B92A50F2DD1555FFC7E7E42713F310EB750C0E2344B22BE6B
MD5 SHA1 SHA512 SSDEEP TLSH

AZreium.zip

SHA256 afb6818ba3db2cdd085ee103a0ab3238ac6706d79391c726ae5123ceb41e9c1e
MD5 cf2e0d4e779f13ab34cedc1b868909c2
SHA1 242d1cd1f858580b3b24bba4393746689a4b84b7
SHA512 854ecbde1dccbc13d1c82f8dc182ecaa0492ab7ae33d4cc89623b88548f7c8808a388bae7c1236412dcd845ff2d2462d240593f6027fa4f550894e6109c505b8
SSDEEP 192:WRq+QycprQoPmCvh3Oc9BxA5srwq0G4l4pF89gAyiUPB0FCwmrdfhnnP:Wvwr7mCvFO2MsrJ4l4paS7qCwmBJP
TLSH
T14902AF70F2424741F45C5FF58E43FA56CDC969206A0633A75E21AA13C3C8C94BE9E28E
MD5 SHA1 SHA512 SSDEEP TLSH

Abrakadabrium.zip

SHA256 80c1473a337a015a0cd2717b7f1ab309815ee3ff7e30e9da8864a8a663e2e950
MD5 6774438328f51bfa686a3bf9f811c9a2
SHA1 f42067ec0351c974b0c9f82620bebe67e974dcd2
SHA512 69c59bc2010aecbf768e7168c4eba2be50b5d06bc563fad009abdff08c623d26103eca89c0fe0a0d68c6feccddb955593ca0a66bc45d91e7b110ea80dea1216f
SSDEEP 384:wjjxqlKt5dv1gdcWu23cWKY5fGiSRnXq1Dd0VvZOxy4GmCkzr/T+mdEOQXg:yYI2dzu2cWKsfGiScP269Gmlzr/TL6Q
TLSH
T13472D159F4CCA934CB117375DF59FE21E794208BE9EA358B90B8F1C04797D522310A36
MD5 SHA1 SHA512 SSDEEP TLSH

Actinium.zip

SHA256 2eeff5b4fd9ae4f22c2967cbd6ea971058ecd7bc002df9945e7a1c40bb803a96
MD5 b60d0b8b463d8596798fd0bab1a3d5fe
SHA1 51bacbb3f9935fafa64b1a892231f62fea92ad2f
SHA512 9ac6a120004f221249469fcbe033db2fd47daf0ca9b4599b47a679368a2ee7d66c4dc1f02e8e0f4f2bdfbd782556be00a0312cb986fbe966bb34b4b78dfe24f8
SSDEEP 768:s04dsomfYVqJ22AZHKMM6YeSqM6H6Wp3rYjFJuKh:s0oocD2CKH3XqJrmnh
TLSH
T118D2F15865B06461DD332D7FDBBBFA699E8550313037DF09A821E20C3EE17ED5D2882A
MD5 SHA1 SHA512 SSDEEP TLSH

AdministratorGDI740.exe

IMPHASH b7ed8c660e4ca1446e9ef00b1e8f91c3
SHA256 a70bcccd1b3ea877104fe288ca44b5c7c1dfcf8601b0cad878d63e42ae42f65c
MD5 954c3ad3d8a13ba68447aea2f8a750d1
SHA1 381f626c4ebb778cae44f3a222481c1fdd28c5da
SHA512 12ba40b824b386ea50235978a22e4a50a9e7d187940e93d47b32cabfd399b510e16947e7d7bf9e537537e4bbbf8c3f64c9407d5f0007671bc38d1618d18126a8
SSDEEP 12288:ptgy900GjbOgD0/2gJxoLKuDjABu8Bm+UjilCLcA6bflKfgmPqKcg:oyAHOgo/1jebUBlUOl49ImPqKcg
TLSH
T1BDE41291B7E44533E8B6037198FE13971E35BCB3A77882A7234768CA1C73690A57532B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

6

Entry point

26918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

OpenProcessToken GetTokenInformation RegSetValueExA EqualSid RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA AllocateAndInitializeSid FreeSid AdjustTokenPrivileges RegCloseKey

kernel32

GetPrivateProfileIntA GetFileAttributesA IsDBCSLeadByte GetSystemDirectoryA GlobalUnlock GetShortPathNameA CreateDirectoryA FindFirstFileA GetLastError GetProcAddress RemoveDirectoryA SetFileAttributesA GlobalFree FindClose GetPrivateProfileStringA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetModuleFileNameA FindNextFileA CompareStringA _lopen CloseHandle LocalFree DeleteFileA ExitProcess DosDateTimeToFileTime CreateFileA FindResourceA GlobalAlloc ExpandEnvironmentStringsA LoadResource WaitForSingleObject SetEvent GetModuleHandleW FormatMessageA SetFileTime WriteFile GetDriveTypeA GetVolumeInformationA TerminateThread SizeofResource CreateEventA GetExitCodeProcess CreateProcessA ReadFile _llseek GetTempFileNameA ResetEvent LockResource GetSystemInfo LoadLibraryExA CreateMutexA GetCurrentDirectoryA GetVersionExA GetVersion GetTempPathA CreateThread LocalFileTimeToFileTime SetFilePointer GetWindowsDirectoryA lstrcmpA _lclose GlobalLock GetCurrentProcess FreeResource FreeLibrary Sleep InterlockedExchange InterlockedCompareExchange GetStartupInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess OutputDebugStringA RtlUnwind GetModuleHandleA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount EnumResourceLanguagesA MulDiv GetDiskFreeSpaceA SetCurrentDirectoryA

gdi32

GetDeviceCaps

user32

SetForegroundWindow MsgWaitForMultipleObjects SendDlgItemMessageA GetWindowRect GetDC SetWindowLongA MessageBoxA GetWindowLongA PeekMessageA ReleaseDC GetDlgItem SetWindowPos ShowWindow DispatchMessageA SetWindowTextA EnableWindow CallWindowProcA DialogBoxIndirectParamA GetDlgItemTextA LoadStringA MessageBeep CharUpperA CharNextA ExitWindowsEx CharPrevA EndDialog GetDesktopWindow SetDlgItemTextA SendMessageA GetSystemMetrics

msvcrt

?terminate@@YAXXZ _controlfp _initterm __setusermatherr _ismbblead __p__fmode _cexit _exit exit memset memcpy __set_app_type __getmainargs _amsg_exit __p__commode _XcptFilter _errno _vsnprintf _acmdln

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Aethos.7z

SHA256 fad807282086dd317d23a162f732dbd756d3cd62bfcac0c92f1ed3c55921f820
MD5 cb7d0da7dfc9e377484bd9327bf315b0
SHA1 eb01d83deb0edde373cbea18ca0471ab27542e58
SHA512 66306b52644857f68a750b7b1edfa7c7795b963b2d23968bda9045db46b1105d0511c58e0412673876bc3b325c8f74c270e9376cbd22f16124b1328c23ce6009
SSDEEP 12288:O0TDMFLriNGnJ/1OysLHnuIyJdJOh4TN5tbqnlnMk/:O0TDGLbn95kQQuXtbqJMa
TLSH
T11DA4236BA51B2516015EC62A5CD039D2D76B09C33C789EDC6DB63D6C22F8070B918ECF
MD5 SHA1 SHA512 SSDEEP TLSH

AiVDsDOsA.exe

IMPHASH 2fcaf380a5e12cc8cfb4d0a72f5a9cbf
SHA256 88c90b565a20ef30865a70f8ff02dd39e5958cfb409bac81559ef2cd6b9aa900
MD5 2248fcda8954257069894700b0548195
SHA1 11b9e0e33d86d3d1777387f189176367a02696f5
SHA512 a1b60fc16722bc0d07fa21530d6756b09db935c9572b4fd5ce9c85f730f50dde4048e74fde4b737e7a2b9e0a2a0012d10b28caa59d35334bcfa8664993bdb794
SSDEEP 384:O49nzAQLeqCoHtVWS5v3wlaKIRLFSR75haB:O4yQLXVNQSp9K2LFSpa
TLSH
T121B26C87F75205ECE6BA817584E20A07C8B0B95227A25BCF47C0551E2E75BD0E93E71F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15500

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\DanX\source\repos\Phanterium\x64\Release\Phanterium.pdb

kernel32

GetThreadId ExitProcess GetModuleHandleW InitializeSListHead GetSystemTimeAsFileTime GetProcAddress GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess CreateThread CloseHandle LoadLibraryA TerminateThread Sleep CreateFileW WriteFile GetStartupInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsDebuggerPresent

user32

GetDC InvalidateRect LoadIconW DrawIcon GetSystemMetrics GetCursorPos

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC SetPixel StretchBlt CreateSolidBrush BitBlt

winmm

waveOutWrite waveOutPrepareHeader waveOutOpen waveOutClose waveOutUnprepareHeader

vcruntime140

memset __current_exception_context __current_exception __C_specific_handler

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _initialize_narrow_environment terminate _get_narrow_winmain_command_line _crt_atexit _register_onexit_function _initialize_onexit_table _initterm _register_thread_local_exe_atexit_callback _c_exit _cexit _initterm_e _exit exit _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

sin cos ceil __setusermatherr tanf tan

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Albuquerque.exe

IMPHASH 1a3786769d995c9ce9eefdbd8db0b659
SHA256 13a646d991544257d417835e43a9d1e298ced4ef10e027aa9209f80f89746af5
MD5 553f988b58dd7e16827acb0810767b2e
SHA1 9d192fe842d279e2a03d1eb617ea2db437b636ff
SHA512 7ec10f3b7ca277715fd0dfb5b4f985d4702a13d92a60392749dbb282418d6ca6d01e4d9e983b38babd1d0c9a45399ef46768fee69d8167af52fab8faf2ee4a09
SSDEEP 24576:Su4PgeO4riWLnMoRmoBgzKTcs3RSw+Ec0xMkf8JsU3Ao3d0MCH5+5F:D4PgeOPWLnMopgAKd0MCH5+5F
TLSH
T15FA52B43BBC74DE6C9D267B5A6C343316378FD518B1E6F2B6604E6316963AC0BE46B00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontA CreateSolidBrush DeleteDC DeleteObject GetBitmapBits Polygon Polyline SelectObject SetBitmapBits SetBkMode SetTextColor StretchBlt TextOutA

kernel32

AddAtomA CloseHandle CreateEventA CreateMutexA CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FindAtomA GetAtomNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCriticalSectionSpinCount SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TerminateThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualAlloc VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msimg32

AlphaBlend

msvcrt

__C_specific_handler ___lc_codepage_func __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _ftime _initterm _lock _lseeki64 _onexit _read _setjmp _strnicmp _unlock _write _write abort calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset printf putc putwc rand realloc setlocale setvbuf signal sprintf strcmp strcoll strerror strftime strlen strncmp strxfrm towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm

user32

DrawIcon GetDC GetSystemMetrics InvalidateRect LoadIconA MessageBoxW ReleaseDC SetCursorPos

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

Name

.text

Size

466KB

Virtual Size

466KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AliumV1.zip

SHA256 2c63bc30a6f1a03fccd65fda97d3433fe2adb763da1002ec6ce1aa02f8b56c23
MD5 a401f50bf00d30ae4a2f94f789304fea
SHA1 26c345ebd7caa81f4f6676c0654b4dbfd24afe4c
SHA512 47d29e65ff7c116d4b9e49e296121e9fde82725c9215f1878f115d06c5ba914bb89c10b7aaefd386abbe852f467e5f9be6e491b1fa6d1f4c976b650f2c4c1d38
SSDEEP 192:t5T5xV3jMHiSq+viamby06C0OKt3T7A7r22NzjlH8Ho61AdS1MPy0OJb0mJMVHxU:t5NjMHiS4ajUso/bzBWo6L65AnOg6mPf
TLSH
T12B42C0293E550425D263257993367A74CD311F13AC23677CE7BBA11AC580BDB6C422C4
MD5 SHA1 SHA512 SSDEEP TLSH

Almium.zip

SHA256 592bfe83d82ccdff5782b9606c4dad3cc47af514838d5c928d4fb3f3412372f1
MD5 d57ece07ccf7ea4817e4415a2656bf56
SHA1 731d3976d30de19716215d002e7c73befba6d23c
SHA512 5b8637f9e9b86badfa0e01e81a7514d7265de484e772ae6d6dcc642a91e5e146e16dae91f4b16ce3d141ff7457c48c477a6177b5ff176e4a21c7007556c47148
SSDEEP 12288:9diUP47p9i/5GZ3GYhpLvRT28yzAAk1gJb+iuA5l7Lczz3jaFkku+FocuIon:jiUPC97JGGpVTDyzAAfJzJ5lczTjRkub
TLSH
T161F423F54C5F7283DF944C142EAA14ACA38968D76E877B4ACB1390068B433B9B397477
MD5 SHA1 SHA512 SSDEEP TLSH

Aluminium.zip

SHA256 248169583ffc3d6d2998dab5360494dc15992fbdbc6e70a1d515edc7ceeabea2
MD5 40f07aa0ab7e47abd800f285f79b5074
SHA1 74ff9c7b280aecc9b5752fcf81b67e2cb749e23c
SHA512 ce7c961c41b25a3842c19490e0496c182c407c304ebbe4bf3840c48ae8ce21757987753b167f212dcbbd41634cbe9e58698613d893af7cff3c1384bc9a8727df
SSDEEP 768:pekg6UtdsIFJlWUYodtgBxc4f8yV17cZbeaan5ruFlSA3Ijvebumn8AoI:pe/3j8oduj1EyVian56Boebum8dI
TLSH
T1FD13F1F713F5CB86C9BB0433C801E705A3A905E7FF94B94124E94B66E9E7ED19215312
MD5 SHA1 SHA512 SSDEEP TLSH

Americium.zip

SHA256 c70262023d43c77572fc40464cc99e78124b87f5b9136bfcfff0c9f6f45f3463
MD5 23266e7d8a7dc610d817ad1468343315
SHA1 a264429ec75e8dc9c94d6dc03145beb3655242fb
SHA512 6571cfaced022ba16eecafdef40bf7d8b3faf8c711ae6ac2326e6bb4a890f3eb9038188b43226a197f55edd15859e1496b302999df71d843611e3b8511f6e75a
SSDEEP 6144:gP+1qfxtNULOrMhLlC0lcB5FRocrgtbULO5khnlC0Yh1owiha:g21qfnNU6raLs3B5FiVbU65yns1/i0
TLSH
T1DB24125A0532CDBD222B0C6B0BF85E1F7C79826986EC59444D6D7188B753336F2AF05E
MD5 SHA1 SHA512 SSDEEP TLSH

Amnesia.zip

SHA256 1042a8c1106b092fe057272dd5948bd018eed0eb3b29cd670f1db8c6cb3188de
MD5 384f32443299be60ae004edf7d784cbe
SHA1 83ff88729fb57e67ef36221616bbeacec5755d46
SHA512 f878fcaeca160c436f29cb770bc66ca1ab8fb7f53f45f0297477894459fa517095e2172c9da54b0f892a4581a17cf4711675c42b6c36aae66f32f7c901a632e3
SSDEEP 98304:IkBPEFjyHDJ+1kg94h4P8U3Qry+uv6gWFLrWZCx:Ik1E9ytUcZO+o6gWdrz
TLSH
T1122633B608F86E124231C0717341562669B7225E2F8BE467C6BEDC25F8EF50F0976E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Andromeda.zip

SHA256 080f17363a35a8cdb7b1a9c59e8e90203af9ce0ec597650204c2fa54d890b490
MD5 e92f92ad4fa5905397338b6cefcb035b
SHA1 332a91e3e7af1d7c0fdab92603081096efa63566
SHA512 174085bb56d69afbf5dfc57ebe7d072e7e70cde620b86389e78f4e0841477891ad6c5ac2379be63f1bedebfac4adf64775327c92165c23cbdcbe54b02949e16b
SSDEEP 3072:9l//Fb8SoxzPW6YVoUCMh+JE8gQPYx10iUb208oT2tiZ+iu4HQ:/FGUCMl85k1r08+pu4HQ
TLSH
T1B6F312E123B21B1CB491C3DD68330685E125EF16D4E6F9AF1E158DBE8A7164BF31212E
MD5 SHA1 SHA512 SSDEEP TLSH

Annoying.zip

SHA256 278014b9db834916dab74935f27a9ea478ed5016edde05359a98aaad178ff267
MD5 b4efc060b5382d1f7790eee6e99213cd
SHA1 a78d5f3d6f16a8a20034f837fd560ff6533191eb
SHA512 d385b3b5ae68982fb57a06c6b4923adc8c947a67d1340bda7ab32adec3d24aa47f9e5154d000021157fc1418db55c455d3480a62940fb014ecba5febd23d4ef8
SSDEEP 12288:h7ZuRicofZ3XOwt/cb7sLp/fDTC8YzoGk9MJrQeGQ7l3LUzq3rqRkkE:h7ZvcyuC/q70pzTvYzoGfJJB7lQzkrxP
TLSH
T184D423B91C1EF310DF44A821681418DCD7A13D558AC33687EE23E11BC7A7BB5737A4AA
MD5 SHA1 SHA512 SSDEEP TLSH

Antipain.zip

SHA256 d08d75a86b5dded0257a0eb7394b73353003bcee48c096792994537a4fba0bf7
MD5 bd73c7b5bbbf1f0a7266eb36b8d6b6a9
SHA1 e8ff6fae13fddb94e28ad4356f36cdf5a3a7fb9b
SHA512 ff31d9489607ab284d7001f977ddfeaf6069a6f8596fd9c52cff81817fb1390319e6530af58a0fbaa846616008cbddc0529c7999b8767c2b8cf9be3e73ac0122
SSDEEP 384:ouQOObbZ5SJsoQlMgafgL1QD+pTFhmA5DhaqyRvFizw38YBx3KoU:oTbbZ5poQD8s1QCpTrDAqEFd3dBxu
TLSH
T1E0A2E1F483111655D503E73A309F066439D63A71482AAFEE2B591431F84AFB7FEC88C9
MD5 SHA1 SHA512 SSDEEP TLSH

Antivirus2021.exe

IMPHASH ae9f6a32bb8b03dce37903edbc855ba1
SHA256 16837f396802d446e72fb4d02c68a2e07b5657e3e1d3d738b79a2c8992ad1ad0
MD5 a9781403e2e0f3539b81dbbc4ba52f07
SHA1 cba433e3c7690c1628bc620a43912f06db331065
SHA512 6c985a47a7bed1e150cbed5da08cb2528fdf8e5d80a482610ad7fb14d079cb19756872453b23ace8dade982b4979ff885de7b41e798b3d4ccdc957f2564836c5
SSDEEP 12288:NEcVL8O4jrAi7T+t3U063lVljgk4J5fDNTEf8RaIYP+e:hLlgAiCGlVljgk4J5fDByn
TLSH
T189D4F121BAC08172D5725D791AFDAB70AA3D7C201B244BDF93E46B1D5E301C0EA35BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

80992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb

kernel32

GetLastError SetLastError FormatMessageW GetFileType GetStdHandle WriteFile ReadFile FlushFileBuffers SetEndOfFile SetFilePointer SetFileTime CloseHandle CreateFileW CreateDirectoryW SetFileAttributesW GetFileAttributesW DeleteFileW MoveFileW FindClose FindFirstFileW FindNextFileW GetVersionExW GetCurrentDirectoryW GetFullPathNameW FoldStringW GetModuleFileNameW GetModuleHandleW FindResourceW FreeLibrary GetProcAddress GetCurrentProcessId ExitProcess SetThreadExecutionState Sleep LoadLibraryW GetSystemDirectoryW CompareStringW AllocConsole FreeConsole AttachConsole WriteConsoleW TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte GlobalAlloc LockResource GlobalLock GlobalUnlock GlobalFree LoadResource SizeofResource SetCurrentDirectoryW GetExitCodeProcess WaitForSingleObject GetLocalTime GetTickCount MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetCommandLineW SetEnvironmentVariableW ExpandEnvironmentStringsW GetTempPathW MoveFileExW GetLocaleInfoW GetTimeFormatW GetDateFormatW GetNumberFormatW SetFilePointerEx GetConsoleMode GetConsoleCP HeapSize SetStdHandle GetProcessHeap RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwind EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW QueryPerformanceFrequency GetModuleHandleExW GetModuleFileNameA GetACP HeapFree HeapAlloc HeapReAlloc GetStringTypeW LCMapStringW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW DecodePointer

gdiplus

GdiplusShutdown GdiplusStartup GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipFree GdipAlloc

Name

.text

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Argon.exe

IMPHASH 8e0b2e37e5251134581f19bbb2996719
SHA256 f0af1229f9204e3b4edd5874155853b958d9278ecc8861fa2e1e7b82525a3f77
MD5 b78e66727969e35c139d1b317c9df755
SHA1 0bd1528df01682124cd52a7193c48e780f849bce
SHA512 d4acbe65aa8166d702d3810d93e92e487a75193fafc338585fd71376adf6f624d4ab82328fb50ffbf12bdd7f098b98cec554449313e89a0f37d20a593125656b
SSDEEP 6144:t6bGLKKoOlSvSd05W1+Fab2zfyk5CuzSKmx41ZTf3iifYY2:kbGukWSa0M0KzqV3hKTPiQc
TLSH
T18E94E864FA89FCB4E4059B7918F2C33813599D91EBA8EA232AC0FE3F5135B84557610F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Astatine.7z

SHA256 3974b54d3529e7b9915d23430e028c5a68f26a386f05acf8a08b7c7f1f021ade
MD5 ca2809b824be2a77922bc05abd6a62f2
SHA1 235984a215cb72b3d4d0b5d9211e83a39fb806cb
SHA512 29f3ecddb0ea4c76b1da413eb6ea625dc20fe96b7be6a5e26985c0b0a67742b05661af6b0a3f9b93a5cfff9d7de64fa918d1df434c9f71bd45ce998cef85aa91
SSDEEP 1536:83D2L8vaeIHSsKibnQtSLeffcxye4wMx8qv4q7bqa1GuWEhSHXq7pVccmwMMwfDl:ED6O6ScxViDZ1GuWEYX20oMxfB
TLSH
T18A9302B41E2C31BB5969A9FD0BB80F887F294C196FFE025F3FE41700D82498456BDA59
MD5 SHA1 SHA512 SSDEEP TLSH

Astranizer.rar

SHA256 0861665dd6bfc71c180b57c69795b03544685487904cd39f54fe75d4731e1902
MD5 2521aec86375f82cd4c4d96fe17634da
SHA1 41475dff91ecc7de2947bdf0253cf7b17873b21a
SHA512 915ec951c3dc72bb2f0c08faaa9b4d4c0a0c32943aa829b1a2eb3091b497afd98ce4f8a5c2baa574333c1cf6e453a800c5f1fb1b69e0d26121f2f969580d66b9
SSDEEP 6144:I9srX/VbdtTLRklkNhFt+QoHjoBrIDlsnpb0Hrkf+kvy/qTL:ZrLppcDhDenB0HOLvy/y
TLSH
T1C644232FA2FE6C04A22FE1DFF963F1742B07C9D706651E784DCAD3619E160A548A0953
MD5 SHA1 SHA512 SSDEEP TLSH

AthenCrypt.7z

SHA256 008d1bf35d004de10284174f7e6655a349edf2d8f1fc5312ef0bc087d4dec2e8
MD5 c73a2051d491bd48de79835685105551
SHA1 b4df5df9904216b2c34af41f3a41446cf95a8dcc
SHA512 e0c85f91308d1e79a0686f06ed47bd377122343c32b954d24b972cfd708aac56150ca0357dd0cedca34336776d738616a0b245647880dee8e66bd58a6dfb0f6b
SSDEEP 1536:VJC/PoQyg4+RP4IVOv4eBXjlGQ/wwydjKEuDl8cxI7SV/:VYMuP4IVOHBRtj4+lubSp
TLSH
T1C95302A07928C1463EC97448BD2783FCFD35E2775BE4039DD3AAA606C56B06844FD876
MD5 SHA1 SHA512 SSDEEP TLSH

Aung208.exe

IMPHASH 614c4dbba68d10a44342656f6e4674fe
SHA256 10914f9bd8257b86fd619698c548fb5302aac57cd96cd9dd7b02a9aabf8609f7
MD5 785fffe39464b60401d652836363c5a2
SHA1 f03126ee7c9c78a0f86b326e452ef3d6de105cac
SHA512 fd931d47ec4e95c82337efdc55ed1c425e3e801576760dc41e79b5ff752c2b51cc3a5d73c572258c8756b2e87153e3513c5db1f3747e390ef3c3b9ffdf85905e
SSDEEP 1536:Z1HPRJxwyh21Y5sMy4maEXR+UceWI4vykaRySUvMFMQiN5RTOOL9FbdOGgx:ZAyh21Y/Y+Y4vykaR5gRCOL9qLx
TLSH
T163E308DBBBA5DC97D911433C05DA832A233EF6908BC24B131D24A6355B13BD07FD629A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateBitmap CreateCompatibleDC CreatePen CreateSolidBrush DeleteObject Ellipse GetBitmapBits PatBlt PlgBlt SelectObject SetBitmapBits

kernel32

CloseHandle CreateThread DeleteCriticalSection EnterCriticalSection ExitProcess GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetStartupInfoA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsGetValue UnhandledExceptionFilter VirtualAlloc VirtualProtect VirtualQuery

msvcrt

__C_specific_handler __dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _initterm _lock _onexit _unlock abort calloc exit fprintf free fwrite malloc memcpy rand signal strlen strncmp vfprintf

user32

GetDC GetDesktopWindow GetSystemMetrics GetWindowRect InvalidateRect MessageBoxW ReleaseDC

Name

.text

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

684B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Aurum.exe

IMPHASH 4ab0f1c7a6275ebb7578f7d212aa6602
SHA256 bc0fce056a6629a242460866f22c2edba942110ff3af3ee326d2b5d276f11bfb
MD5 fbb82eb2f114e424ee1c2716f39f9a66
SHA1 ad5dd2c1100c0c53fddc8e16f1c85dcd13032568
SHA512 20f6300c673291a076d0747bac3809039ef1c598e0378ec4a356b06ab8e51f621655712ecfdcafa492426ee5408f43d666bc3e3c01fd19cd127edd0e80ff9104
SSDEEP 1536:PDyZpOCdstYVqbwoehWV+EUEoDSnAo/LbsISAM:PDyZpOPtiC+ESDShLbsISA
TLSH
T17C831852BF136CB4FCDCC9B1B786913B415BFD3588E4584AB6DC68152032AE218F9A3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1024B

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

AvIdOsAsIA.exe

IMPHASH 9969a9fe3bce55968499102972682c15
SHA256 3737576e5b133bdac37dc91721360dbae90fe513ee0b460f94309b0923674821
MD5 2fb69781f018b59770657cec77852b42
SHA1 fe07a9219b28f639626f196d8bc0b97728a76902
SHA512 954a81472cde7e6ec617a4f783e288d59e1896c643935ac0aa6ea254bd8297a79d72406312eec7f0a366bf3574d0bc7698f7698d30234474579b967ffa9af9d7
SSDEEP 384:XnyXnynnyUmg5wJGilJilgsleZgOwJtELWwt7GG:3oMJmGwJx0llOwrELX7GG
TLSH
T1DA62187BBEDA6F63C8788DB42472DA5A906EB4716F081497B3D21457892D8CB4C3CD0E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10676

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\KWINDA\source\repos\ConsoleApplication1\Release\ConsoleApplication1.pdb

kernel32

IsDebuggerPresent IsProcessorFeaturePresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId ExitProcess CreateThread FreeConsole CloseHandle Sleep TerminateThread TerminateProcess GetModuleHandleW GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter QueryPerformanceCounter

user32

GetDesktopWindow GetWindowDC GetSystemMetrics MessageBoxW GetDC ReleaseDC

gdi32

Pie BitBlt SelectObject CreateDIBSection CreateCompatibleDC PatBlt DeleteDC Ellipse DeleteObject CreateSolidBrush

winmm

waveOutPrepareHeader waveOutClose waveOutOpen waveOutUnprepareHeader waveOutWrite

vcruntime140

memset _except_handler4_common

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _controlfp_s terminate _seh_filter_exe _set_app_type _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _initterm _exit exit _initterm_e _get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

_CIfmod __setusermatherr _libm_sse2_sin_precise _libm_sse2_cos_precise

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Azide.exe

IMPHASH cebbdc48e7d696b5ce1a22bc874a622e
SHA256 246c049e63b7bfd3a7c99cdf2c4f93c44a075667f3cd900752ba15aa3eb14a23
MD5 87ea7d8f5e60914c353678efdf9ba738
SHA1 bc0751256aee9cc63eec0079b0a695f9ab051276
SHA512 2238c0fec17117f4a25416d562a1c57ad0ad11fe2d81be8a79f044ef28a4cb07830563b8ca0476c3d4ac9563fb19687ef959f4ba05bb0efe1f2921fe110f93c2
SSDEEP 768:O7TWF4kM/q8WdrWe9HSD9Xr3OqTCPl3rtX6wQkSKxN3vTj:CTWF4kdjlRBCr3OAyhXZQmj
TLSH
T1E123BFC17BD504C4E466937087AA620ACAB0B890AB719FEF05D6E0561F117D6B93EB0F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ALAN\source\repos\Azide\x64\Release\Azide.pdb

kernel32

IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId TerminateProcess InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlCaptureContext SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetProcAddress CreateThread CloseHandle LoadLibraryA TerminateThread CreateFileW Sleep WriteFile GetSystemTimeAsFileTime GetCurrentProcess

user32

GetWindowRect ReleaseDC FindWindowA GetDesktopWindow GetSystemMetrics GetDC GetWindowDC LoadIconW GetForegroundWindow ExitWindowsEx GetCursorInfo ShowWindow DrawIcon MessageBoxW

gdi32

SelectObject PatBlt StretchBlt PlgBlt GetDeviceCaps DeleteDC DeleteObject CreateSolidBrush BitBlt

advapi32

LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges

shell32

ShellExecuteA ord680

msvcp140

?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutWrite waveOutUnprepareHeader

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler memset __current_exception_context __current_exception __std_terminate

api-ms-win-crt-runtime-l1-1-0

terminate exit _seh_filter_exe _crt_atexit _set_app_type _register_onexit_function _initialize_onexit_table _c_exit _cexit _exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

sin __setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

BAT.KillMBR.zip

SHA256 64be90e8aede4c40791ec0a42b834d08907d9058f11e056880750866b33624cc
MD5 9b44e443c57bf92357260112c2a82801
SHA1 be883bb85a1b04aad226f3972d75032e1754c5e4
SHA512 300708fadbf63fd1399f190bbef9dca411a5d873695c1fab0a45cb475e34c4b3745a430be8e22dea03894cebc39cae8f0cab628c2f69fa83abfad7837af70a33
SSDEEP 3072:GeaqR1XKWkeEIzPW3yH9189PzkUWL5xVKV/KTiwYii:G5fFeZzP5H4PzkL5fKVy2+i
TLSH
T19CE313AB11E97382E6181CE1860B43C0DF50E1772FAA808DD1EF6FD379D59BD132156A
MD5 SHA1 SHA512 SSDEEP TLSH

Bahhhh.exe

IMPHASH c429f3950e45c5cfd0e3a7dc3a0fd7c9
SHA256 0738c33d4cbdef4bd1c216248a0a7a20ee7254e63d526fc113e827938aff2520
MD5 27095b6e72d783c7ad7114f91b87e640
SHA1 15ef79e042f4befb60783b1d7931bfd916972096
SHA512 9852bc26220c0ca60921425f7a089c4b5356624be41cf1d0e5b04eb36f47b840e2e1235d115927a6d3d69c6f3e60dfef484c67c59ade9edbf4e407b2c02c02ce
SSDEEP 6144:Mo5JgzDWJhhfG68LQ1ccRsvFM6aUQ47Lil85c:MQgzDWH0LtJav4nHK
TLSH
T1DD34AEB64E95EC6DD2A048BE07FEC566ACF8C44007EA4B128F594CEFDDA5AD47D080C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7754

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\s-sch\source\repos\WindowsProject1\Release\WindowsProject1.pdb

kernel32

GetSystemTimeAsFileTime GetCurrentThreadId InitializeSListHead QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess IsDebuggerPresent GetStartupInfoW ExitProcess CreateThread CloseHandle TerminateThread GetCurrentProcessId Sleep GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW

user32

InvalidateRect GetDesktopWindow GetSystemMetrics MessageBoxW ReleaseDC GetWindowRect GetDC

gdi32

SelectObject PlgBlt PaintRgn CreatePolygonRgn DeleteObject CreateSolidBrush BitBlt

winmm

waveOutClose waveOutOpen waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader

vcruntime140

_except_handler4_common __current_exception __current_exception_context memset

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit exit _register_thread_local_exe_atexit_callback terminate _initterm_e _initterm _get_narrow_winmain_command_line _c_exit _configure_narrow_argv _exit _set_app_type _seh_filter_exe _controlfp_s _cexit _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

BaldiTrojan.zip

SHA256 78996363bc7cddc776c3555076c8d41ed09477d6d15a7714ca7a77118a4a7c2c
MD5 b82cbd460c0ab6ca22a6184ad55bb57c
SHA1 66f732cd54644b6d41edb738c4ae1b13c032e9f3
SHA512 4150d08a35c579da6693f89a7b812b130832f9c247b566961a729f74677485d093f0e60594d70a9fe5278101573133c0be9d53e5b2b49e458dc60a0a1be6fc52
SSDEEP 196608:U/cqC+YwWeNY1PwsYqdTaQrVSyg7JxaFaghCLgakkOqc:U/u+YwYLnw0e7Vkk5c
TLSH
T13486330D92F3BFEA225D8BF262C52D53B12EC4FBE21C4849A99370C4B5C16E35E551E2
MD5 SHA1 SHA512 SSDEEP TLSH

BatchPower1.zip

SHA256 faea6babea50b6750ba48f40b4e1743dc4425f785c5d6570677585180ea2e866
MD5 b99edf4cb49a75207195b8d6c2cedb0a
SHA1 a5c3ec0eb259fde2526cf864937b921af9446041
SHA512 0b68706782c15b9a3238abda2e1117643a01321070202d8f9f0c67d0a027dcf44f8fdeb7b8bd720a267293af379cac03f73ed9863b3f4f86f37e49f7a300d9cb
SSDEEP 98304:l9Ut6Pl/kNAv5ZKyRrqABR2CGaZ0mwkd7B9dyM2Jp7yQLtOyFq1u1pTtRi2r:FpkNo5Ay9qQZ0mxJ32JUQLtX+u1NtRBr
TLSH
T1A736333FC86A1772B7EE47D8A5211F24ABEACD658720D4DA0DF944B9CD7706B8940F02
MD5 SHA1 SHA512 SSDEEP TLSH

Benzene.zip

SHA256 ace66d3e263cce4012bb0ba789cbca2dd244130d96cecbc6660c94b5cb53cd55
MD5 3d4adc74fbddc7338240e8ec5e7f47fa
SHA1 ede24092f64551585c667975a9c200f311852b39
SHA512 e4da1081442659f4b05cd8c6f60c9b501a1864feb65eb31f24926cad5e91a0fcbbb96dbe04460554b0c37edca03976be807dc6e273cae2c4ed953e97deba09a7
SSDEEP 12288:D4ldUkmOmkl9dpcJeed4GFNy6f4aJnfii5K2J+4dbMADirgDwGEKVl1fEMR+ymYH:D4gkK+9dpru4MNjf9R+4dbM3r2wil1np
TLSH
T1A4F423689018BF44AC48DB7761BF07CB5AF0E853A033434A964553628EE7FDECA4D19E
MD5 SHA1 SHA512 SSDEEP TLSH

Berkelium.zip

SHA256 1566b5c4d7aa7a4328adc774c472972162cb6c7bc36101cbd34c3c9d6a50dd7e
MD5 7946abf402f67b6072169120f57e7822
SHA1 247a3c3fdd048a2c8b1b6b0c300b53099efa6898
SHA512 0061acf3b37836eb6492411b20edcb291ea15c6c4bf2f89879d83c99959dd4bc513a7412aa5fa2bc05aeff844d0b0b303b6428590a74a0e998a4f4c10549a9bb
SSDEEP 768:neUreHUOoIk0zSRdeH2rBDIheEkWjQj0O4R4MbxOnU4E13JpU0gDNpYN6t27ym1K:neUS0guRdeH21e8R0O4OS4U44NgxpYIN
TLSH
T1A013F1A81756C2D3D7B53A3E76B25187E4D2472D0A49E840AA366AD31C7F8C52D907C8
MD5 SHA1 SHA512 SSDEEP TLSH

Beryllium.R.exe

IMPHASH 56aea67bb57e082b691496c6e136dc64
SHA256 a1750f2f214d2122d96902ce2e2807be7e80a98c5b0d56d1c46975d269c5bc6a
MD5 d3185f228bd300dc1f4e7f43da157622
SHA1 0ad78246bd947b0eee0c6ff2b407cc73db1fedc5
SHA512 06979f1105d9b36e972a725c76544c67c11f88ef9133ae729abe19e3f887ea1cd8eebf9647695416783e7a1eea55cc2b1220cb47984d6341280a22916f373389
SSDEEP 1536:wYP+vDL5izZDcCYfy/FOHu3yUyJCb0NZ070ADK/2BSs:AvYdDc7y/GrXy1
TLSH
T145C318C7FE86ACA3F925033D89F6C229173DF6C04A828F171D71593A1753AA27EC5246
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

BitBlt CreateBitmap CreateCompatibleDC CreateEllipticRgn CreateFontA CreateSolidBrush DeleteObject GetBitmapBits PlgBlt SelectClipRgn SelectObject SetBitmapBits SetBkMode SetTextColor TextOutA

kernel32

CloseHandle CreateThread DeleteCriticalSection EnterCriticalSection ExitProcess GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetStartupInfoA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsGetValue UnhandledExceptionFilter VirtualAlloc VirtualProtect VirtualQuery

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _initterm _iob _lock _onexit _unlock abort calloc exit fprintf free fwrite malloc memcpy memset rand signal strlen strncmp vfprintf

user32

GetDC GetDesktopWindow GetSystemMetrics GetWindowRect InvalidateRect MessageBoxW ReleaseDC

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

Name

.text

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

1024B

Virtual Size

728B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

754B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Beryllium.zip

SHA256 1d8decb5ebf9ed36b15a896aefc4876a98e32c894f828c95d8812f9b593e826d
MD5 6922e44f9760ae9d4ae761a1ff6cb0a1
SHA1 13b3b8673f2f4a981da99361956d8d59eb31df29
SHA512 d3608b4d4d7d67e75d4ee56592942727c12c558855edd41972417c0c355b329147a36fe71541fec0be8d2339a0fbaa8bbd14b2057c9cf374b55989cb76cb7761
SSDEEP 1536:chie4s19tWPA47F2AYqD8KkNlHTqKpBlNYmP:cb4MGA474AYA8h1NHl2mP
TLSH
T16123F123244D08B4E452B73F63D8E8DFEB54C69E293C86904599C3FEB888560E61A678
MD5 SHA1 SHA512 SSDEEP TLSH

BezierIcon.exe

IMPHASH 3e3573a63e80cae35f7795981d9bb382
SHA256 c6fb560368dfd12f5cfe2c9d14c52c4994856f70064a020b2921783dce5cae7e
MD5 c6e782c88a4c087e0afb409a7a492354
SHA1 1a04c6a0cb96e4e61e6faea5ef484eb7dc7fd5de
SHA512 08abc14bcdc266ddc30617b5a62b1cdcb146bc8c16ea314264f15527b996da6d2a8385d221ada4d085338c8d94a1474f575b1026d144884ea060cc75bc00d664
SSDEEP 6144:X70SejbSXj2UACuaGZJH87Zf18e2k6SV4s68dTcEgDAIpiWe97TzGux0siC6pEO/:XgStdGZJHYqXmsFFqG
TLSH
T1C6945B8376D59CF7DA16433945E7D332233AFA9043129F2B2920EB360E17AD06FC6656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject SelectObject

kernel32

AddAtomA CloseHandle CreateEventA CreateMutexA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FindAtomA FreeLibrary GetAtomNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA QueryPerformanceCounter RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCriticalSectionSpinCount SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

msvcrt

__C_specific_handler __dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _fmode _ftime _initterm _lock _onexit _setjmp _unlock _write abort calloc exit fprintf fputc fputs free fwrite longjmp malloc memcmp memcpy memmove memset printf realloc signal sprintf strcmp strlen strncmp vfprintf

user32

DrawIcon GetDC GetSystemMetrics LoadIconA MessageBoxA RedrawWindow ReleaseDC

Name

.text

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Biscuit.zip

SHA256 ceaae9bcde2073cdd9e0e17b16318d2f2d6df4188c06340b97553dba17adbf66
MD5 fd0d4f002d1c80346e5d0a0e1d6720a9
SHA1 47b879eb5f4333d410b97d4fb809e7e52e62c2d9
SHA512 46a72a797289a43b2c08e2257d560a70baaffcdd5221eb28f597b4706a6282bb0fa16ba0e5d408e02e7db9a15b233fc78aa54e69703e2a17faf74ab9ba7a4b3c
SSDEEP 768:1+AGMxKKDUOiwdcTHatIsxTWiex6YTiZ633933L8qPu:qM1kkKHOIsxTWiegYTY633933L8Ou
TLSH
T1E203E0AED8D20341DEE61E30A110A79ABBA095DDC020C6C45691D09E2FD75FEE487F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Bismuth.zip

SHA256 c38a0b570662f8a811c4944398c03144ed38be3dbe830e21a754cfd8b37395e0
MD5 16f5e19dfbd35229a7dd107a755c1976
SHA1 6acd483d35667559ccb8cbcd67c0fa817f551d98
SHA512 32edb9f88a39f408fac6854aa72f0324464de887890e26282b2f4304d5c8c16e140ded1a9991d1b7b1467f1af2e5e28bbb2568d73cab815a0779443370e151b4
SSDEEP 3072:uAyyA3AvyCiE+Uu3vmMnaaz9gTIjOdBiilLk3gHjLU9K:HvA3Au3vznnR+5k3gHjLyK
TLSH
T189D312D72C7F92BCFDAC422066430269CB16243581D9BFAC3D726A7B5980E56CC8537D
MD5 SHA1 SHA512 SSDEEP TLSH

Bitmap2.zip

SHA256 ff52c5044f1b1c5bdcdecb3cdc96aa903683102df5189773fb689470e9b0bfa3
MD5 babe0d9f55b76f6b19d14290dd21eb6b
SHA1 4a35abf479b81c2d41b0986701091d0280e0c2dd
SHA512 26813d9ab8c4520d9b89cb1ab1b3230935c548e4ad1eba056ee240127a567f0098429e7946c72247a867ab59fb6808530c40ca1fa67711884c8a83fc3e271097
SSDEEP 6144:BLvMAdi5WaHjdlH3aHH2g5F4YzTRYOo1VctRjL:BLvMAdojDHqh7ow3L
TLSH
T1BF1412F9BCEE57190C39D7F3481A2B03402590AAFC5A8A19AE9B7F71B0D913707C9C95
MD5 SHA1 SHA512 SSDEEP TLSH

Blue Skull.zip

SHA256 eeed500de292535f5658e1f66251ecbd97b3d2a50da27498f64ece6d5efe545d
MD5 4c4df5908d08490d9e941ccfe887948b
SHA1 6c2227527e829791254ca928a3e7d9e2f384608f
SHA512 915570fa7cbfa4d81b82ecc0e00b8d2144e3a2f62f3f8201e6b832ba84cfcf688cd4b9ab3b2347ef52a024c47d904dda02d664837fb5718564d23376d6c9bea2
SSDEEP 1536:PYfQf4wsMH0kKOWKqgAc08V1ylbSGELIdaxMT8GIcQCC+x8mOqGgdx3GI91i:uQftvUwQgAc0tELsHx8mOsx3Zs
TLSH
T13B73127AEEF9D568C7E0C1D86878E724F3220F84A961B2DF202537B61724675EE34C61
MD5 SHA1 SHA512 SSDEEP TLSH

Blue.zip

SHA256 b5fd8c7f25860ebcef50dfe421ef42e4d1c459995dcfbe131a278d1e04686d89
MD5 031821afa9a170042836ab6cfac37fc4
SHA1 ba0e166336e96a5e51594c304477a9fc8fe89d23
SHA512 723945fcc9a8d265bd5f0017ebc8b18c6305cf19ceaf4fb4ff3d7675bfe62c7f953f7a715d9dc67942bf122fef9f79f826deaa3f170b88f967398fb190807574
SSDEEP 12288:TpbPXgCWxccqLsUCr7BETBJwlSfK0boVSSlnEu:ThITxoLsUCr72XfK0boVSSl1
TLSH
T1FEB423BC8949177CBB2DC650D8CFA756C8F2ABB54C2D772A106E493C2A0CBD9160B25D
MD5 SHA1 SHA512 SSDEEP TLSH

BlueLogon.zip

SHA256 a23461e8d2f871b64732173679a0a18a6ca800fad1a35cfd4f6c0a96d5d6d878
MD5 e5f31c5899dfcbac0e626d6a5beaae42
SHA1 e5dac9ea380069280d1831e311b6d9fc820acd85
SHA512 fd410d67c20dd631f82a5bafff631cd433203a4eb2037d7853d395d712bc65a3b5374635929599dc4397aa4b45bd3f259009fdf6b2321e120c2cf559e2a2a656
TLSH
T11C310B1A5B27025EE07561FE920D65ABE422095B45E1A24F63731050EB2FEF04300F12
MD5 SHA1 SHA512 TLSH

TÁß¬á.exe

IMPHASH 2ed5f5f5c33e4db98706487e23b05489
SHA256 668b8c0c2ac4f9fffbc240f4c5ebbec54e2b8cd980ee4bea878c440b97377acc
MD5 e44c88fccdbbf196f6790ef9d6f03d9c
SHA1 73d907f2f60051dfb90b5545d2d408e394308543
SHA512 4ce50dff86c76f4dd5049e102190500be7c21fa9921ab37b8918e333530d6b9abf93b812d79a3fdb6eb1650a2c8caa41c0496d263c0906842b824ed467b3edfa
SSDEEP 1536:Qmi9hQevpsZhS8GSc8ed8k8PRIg6ZO3CmSZ74wHPKg0sWf9cdjKmdnoqZqfNCgI7:QmMpsC81PyN43CT4ILRjX8fNIRT9
TLSH
T116B3170078C5C431DA211439EC75FAF8112AFD516AD06DAB239A7F6FFA303D0992DA97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\thesh\source\repos\Ỡ\Release\µỠ.pdb

kernel32

GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GetConsoleMode SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA SetFilePointerEx WriteConsoleW CloseHandle Sleep CreateFileW WriteFile FreeLibrary GetProcAddress CreateThread GetFileType LoadLibraryW GetCPInfo GetOEMCP IsValidCodePage FindNextFileA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException ExitProcess GetModuleHandleExW GetStdHandle GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetACP CompareStringW LCMapStringW HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesExW HeapAlloc FindClose FindFirstFileExA DecodePointer

user32

GetDesktopWindow GetWindowDC LoadIconW GetForegroundWindow RedrawWindow EnumDisplayMonitors UnionRect DispatchMessageW SetTimer PeekMessageW TranslateMessage GetWindowRect GetDC MessageBoxW GetSystemMetrics DrawIcon

gdi32

BitBlt SelectObject CreateDIBSection CreateCompatibleDC PatBlt StretchBlt PlgBlt TextOutW SetTextColor CreateSolidBrush

winmm

waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite waveOutPrepareHeader

a.zip

SHA256 c75b249f6d79679244bd600be0a0118bccf9362bc0d550f7e1a56ef5957ce187
MD5 d18964d4ab4b557071688b458013e443
SHA1 5c1c880e241c771be54205fbb92e599a65e1d2fb
SHA512 4daf656f92568416a67287093242cec389f0f84ee8e8dd005fa24fa19ee659dd721c1937e48a5a93772f11b4703a8ca94161f1e69238d90d605b6d63ee3e6b83
SSDEEP 96:c963UiUU1daKPmCuyyPw7w+pKVoUNWH1oxLev+jbURfNPQwYd1qVD50oIMH:0U1oK79p7wIPU8P+jb+vYdG0PMH
TLSH
T1AAE1B07402C4A1F63023DC75EE41698E7942D8841A0DF26C2D70E9FF2566801DBD5CAE
MD5 SHA1 SHA512 SSDEEP TLSH

a2.zip

SHA256 ad9c13bc68f34cd5ab0e8a5bd6a6deb33c07510d862b85cf2995dd0a452517c6
MD5 b05fc41c1c199004a704ecc1dcf031fb
SHA1 5673eff7f92eaadb8c3e7629ffadb54439b1cc42
SHA512 b34ac2f4c053caf0fdfaccadc83c2f50d7c5a2b6be554f9ba1401118f7c0409c6812f544f1818d4bdb3940fd5499efc15a69432e2fa14b5b99e3b9edca81dfc1
SSDEEP 192:1VkPwm1OH1bbKl+fO/lMITukrcGKDFWRTbucUytkieinXmI:1VTHR94Ld9fRv5TtkieXI
TLSH
T10922BF43759D93B8E107E276D18D8711E5A95982B4907EFBD235DBC5CB600FC292D038
MD5 SHA1 SHA512 SSDEEP TLSH

advokenop.exe

IMPHASH 90e6ddab5b13d114824f14815edebe7b
SHA256 e21b1dedf57627d68be7cf7c895cb234b58192f475f76714704e37d782b8214e
MD5 6a0840560d53561aea1f279f2812fe6f
SHA1 40b5d9f291769f27d83b49df2abbc98f4b00c05a
SHA512 269f08799019ad99a0a63eb68f77b58c2061eeaed6c0d6a890c85b0e7c7ca5a580807167e3e81560feeb8fcdab3fdffe6711e783fd114c140aceddc6534d4605
SSDEEP 96:GDbqaqiq14vtUu8riNMwYAMYiYJj962x/:GHqaqiq1EViAMwdMYi8R6Y
TLSH
T197C1188B5E585AA3EADC01799D17E12513BC51335372C2EB390635D6DFE29C3B871483
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

amoxapine.exe

IMPHASH 5877688b4859ffd051f6be3b8e0cd533
SHA256 b8acd85e2bb315e5a7e3d7aa42a0e3becd9dcfc0eb01f198fe402f89a8ad1986
MD5 ce3178d481a680c95844a00bfd362ed0
SHA1 be74670b1ee06c7a5a6796e80dee7e069021729a
SHA512 5b53b97fe8f8a8202749b595710f26c2a21fd64fe17b8acec80a7770793f74df73949085c46510fcf4bba0b8997dd0affd2dc98d777746cf61896bbb1ef1d30a
SSDEEP 12288:Ycv0NTmgsXi2nArH9zVDcuMR8K0MvxCruu:YcvkTmgsX+rHzYVR8yZKB
TLSH
T1E1E47B3CB810D4BCE0A999F3E80141B16F69A9EDAFC444A2169FFA36E9D071C475907F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc

kernel32

GetModuleHandleW HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetNativeSystemInfo GetShortPathNameW GetWindowsDirectoryW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep GetProcAddress GetVersionExW WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject

user32

CharUpperW CharLowerW MessageBoxW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos

gdi32

GetStockObject

comctl32

InitCommonControlsEx

shell32

ShellExecuteExW SHGetFolderLocation SHGetPathFromIDListW

winmm

timeBeginPeriod

ole32

CoInitialize CoTaskMemFree

shlwapi

PathAddBackslashW PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW

aramaware.zip

SHA256 15ace9ee4960df94622e24e88433e6952dec4739fc0a461e48a8bf9a390d5387
MD5 841a11c78e408293610c427ab20b06a2
SHA1 7f4a37141c583369230aaa0d688e62b51d7ef735
SHA512 01b7076459dadd98e224bd685a797eea44a470593aacf0719d36f3d0f468be76c178bc4d50b5606b8dc852084bf9ed2153e38635f2062cda64020fcdcbe63970
SSDEEP 3072:rdgXqaPikkmHbSszJqPKvKocpXPvi09vWeXfMiKxhKVxL9QN4CLhs:qhkX+qPKaBv/lvMFhKvL9ys
TLSH
T1A504232559CBA5D48A8C096D35F90CFC8272D9178CA68B9D703C1A2FBDB7620425DEBC
MD5 SHA1 SHA512 SSDEEP TLSH

arsenic.zip

SHA256 8bd9ae3a89e8d035c4da72ec7bd4cd7294bc07189ecf5a3f14fc21ec0d4f67ef
MD5 53c4da548fd77687323e00ced84a0f35
SHA1 485cbe4cea48bbef610e6d83f77e6488a7d812b9
SHA512 5f24d8686d631a214c9a0efaa08b8720149e6301684edfb0da59cabbd6f8988e21690e12be9c41e8cdc3395a3bbbcc6bd6ecde11b417a86ca5deb8acf3249be7
SSDEEP 3072:rLYhV7V+mgAckfO6MVn2yHTNTbeKtIpjlJFLaT0JEIvsbo:rLGV5BEkfXuTFyKM1LaTx0
TLSH
T19FD3121EA4A97200454B087AD4CB4A9ADF8E1D6D3C70803E73DC02B975DDF78E1766AB
MD5 SHA1 SHA512 SSDEEP TLSH

astradestr.exe

IMPHASH c2c8e11bc6a23ce74765256149a9b035
SHA256 e02ca6eb253b5e3c8850febf43a50bf204f35480b53eaabf672e34013eaa3808
MD5 3e468b148b7f4714e199c057ff46dac9
SHA1 f4b7625e91cca33db17b1d5db66fe9c2ae5d1bd5
SHA512 c8054092f3010e6cfbc6860d0f75ea175feb1208b1ec0f2ac2fdb1d324fbc0ce8df4716a157ea0df9eb973dae3f5d8a89b1a5680fd66517afdd6beb0401c9b3d
SSDEEP 384:2RgjthV2GDOprJvjiHCZbm92pBg5v0JHQmZ2NiLRd199Sjvb99Sjv:2YhV1OprJtb82pBg5shQLYLD9Sbh9Sb
TLSH
T191B393539AEC3DC7C03867B033BB93D5D72EDDA5A5A2C00EA6D00296D4BD41779227D8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\dxxea\source\repos\astradestr\Release\astradestr.pdb

kernel32

IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcess GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId ExitProcess CreateThread CloseHandle TerminateThread TerminateProcess Sleep GetCurrentProcessId SetUnhandledExceptionFilter UnhandledExceptionFilter

user32

InvalidateRect ReleaseDC GetSystemMetrics MessageBoxW GetDC DrawIcon LoadIconW LoadCursorW

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC SetPixel StretchBlt Polyline DeleteDC DeleteObject CreateSolidBrush

winmm

waveOutClose waveOutWrite waveOutUnprepareHeader waveOutOpen waveOutPrepareHeader

msimg32

TransparentBlt AlphaBlend

vcruntime140

_except_handler4_common memset

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

_libm_sse2_sin_precise round _libm_sse2_sqrt_precise __setusermatherr _libm_sse2_cos_precise _CIfmod _libm_sse2_tan_precise

api-ms-win-crt-runtime-l1-1-0

terminate _seh_filter_exe _controlfp_s _set_app_type _configure_narrow_argv _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _register_thread_local_exe_atexit_callback _c_exit _cexit _get_narrow_winmain_command_line _exit exit _initterm_e _initterm _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

attomic.exe

IMPHASH e9a3a9dcb8836bdf33a4705c7eda79e5
SHA256 b5f69635e613a6cd2f9c4adf3107388a9b793648b753d553cdface2fb5c64b79
MD5 f111aaf21ead0ce03356a4a64c02f894
SHA1 c506303807398864cd154f4ff6e85180c5406144
SHA512 e3a0a3ea4813ff39bc308243c1c2dbaffe818c5e99094ab0467c1dc682219ffb15fa71c5114410ffc25856c5827916dba05415046db7f872f117088048e36877
SSDEEP 192:EPeXAIK7sgsPzQDXKmIvZ2UCDocon/LjOhv3P+4NJ5pz6j/6dXkTM9:EPeXAV7IbEXxIvf8ocs/Ljc+4Nx0TM
TLSH
T110523A0FFBC49813CBE002382177DAA5DBBF77301F25AD536BA898160E36455E82E14E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Lucas\source\repos\AtomicTrojanWin32\Release\attomic.pdb

kernel32

IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW Beep CreateThread CloseHandle TerminateThread Sleep CreateFileW VirtualAlloc WriteFile TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW

user32

LoadIconA MessageBoxA RedrawWindow DrawIcon GetDC GetSystemMetrics

gdi32

FillRgn BitBlt SelectObject CreateCompatibleDC PatBlt CreateHatchBrush GetBitmapBits SetTextColor TextOutA SetBitmapBits SetBkColor DeleteObject CreateSolidBrush CreateEllipticRgn CreateBitmap

vcruntime140

memset __current_exception __current_exception_context _except_handler4_common

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-time-l1-1-0

_time32

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _initialize_onexit_table _register_onexit_function _c_exit _crt_atexit _controlfp_s terminate _set_app_type _configure_narrow_argv _initialize_narrow_environment _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _cexit _initterm _exit exit _initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

avast.zip

SHA256 da3191a7de92732556336e1a034d158ff27ca767fa0b7a1daf7d2c8ae0f7909a
MD5 aac1cd87b3314b55b3cdce8e121a6f16
SHA1 b969720c5eec49a324220c5f706fa107d8d463c1
SHA512 4cf133897be1bb03b4ad538abf035ccbb9761d913606306f9774ec8b43efc8504a6a799cab3ea666852b8b227e6308d896cb2ec1df6ade8e9a0ee6ed443a2bd9
TLSH
T13EE0CD1CC3FD9122C0490BF9161F4043BE35737A3E9A7A03A158FD610F5732A1F14615
MD5 SHA1 SHA512 TLSH

avi.zip

SHA256 0ef1386eb5ec4737babeea004f4bf3b5f64c6dfae749d5f00415fee9ddc7ffe2
MD5 eaa4393bf4ac5bfc51debade75e8bf27
SHA1 2ba33cedd5dfcf79e9a4e45a04e4d4e0922c24e0
SHA512 91c1812b5ece1179af5bd3412a3116d1c886d3e3752349091979ebd8740f56e06c44a15d3b4110aa32ac38dde3704ec4baca9f1c56a2a546a88c99b63b2f184d
SSDEEP 3072:7N6ZN1tQXBhWfMCUh2xcM2bDscqBUZagW8H4mX3Bc7MIE4:74ZN10XWoGcM2fwcWM4mB2E4
TLSH
T195C31263917DE313E4048AB9C7A8CDBE3CB11DC3969670F8283249D50C68A9F977D99C
MD5 SHA1 SHA512 SSDEEP TLSH

avif.7z

SHA256 c2056302bb115353ecc7fb77cbdd5238401b70672f1a9c5124b8848dd3819d50
MD5 bee3a6afe4af77f1226f08049fcfd128
SHA1 323e50991c749c242bb1ae93e10f093ce567e57a
SHA512 bb299dfc013fc685c9d74f672eaf854ef24ca85621d98ebc18c1a435c50a652356b9a04da86d43c5ada1510a63ede3fa9e98045906302121480798b52fbfba0e
SSDEEP 6144:59esVe0LH64Ghgelfb+QA+GihemMqwbowsI:59esbH6Lg0j9wKhwbowJ
TLSH
T14B44235872A48E0E73ED03569773BE1DC05B750A473E6A34216B4278DF445B04A4FFEA
MD5 SHA1 SHA512 SSDEEP TLSH

avif1.01.7z

SHA256 b91665dd83eebf4f71e184331a07ee6a32796ef309a6647ab44b38f1c7615f8c
MD5 a5f14dabc41a17103d5245b096453f32
SHA1 2daa92f6f8aafd58ae1c0ba727c9cbeab0a0ea3c
SHA512 f82d0d4bc59b7fc55e7b8321bf1c5202614a428e6ad0ff1cd27b8e837141bf5fb721d6557c1da261950bb886329c2434868d2b2c714e576a9d1f96d2d4e0e16e
SSDEEP 768:5kbm1IyCL7dkIoiNYXDvdDmY7EEXwKox8lO6X8e5N2KKII:5CpkIfCBDmYIn9wOs8ANSn
TLSH
T177F2F272E1913B541848597F604CDBAFED28A7DFFEB430663043F1DA3E449B41A90E68
MD5 SHA1 SHA512 SSDEEP TLSH

avif1.3.7z

SHA256 a988222b1ff4bc97ec08d84d56648f242674306d79ffa83d0f622682f12ffd95
MD5 c8ba1a1de5c210ca98da0cc8203fa946
SHA1 06dc485ab780bffc7c3e572671f4e2608c84109d
SHA512 b1cf0a71cf1715b2743d8fb8a286c1baa76464ffb1795ce7065e0df69ef8911433689578540fd68ed49bf64c7ed82dc863fbbf6ea46bb319934099e358de4b18
SSDEEP 768:bxdwRCp/Yaa+k7OKSJyi5PMXQds8geV1VvJ5hj5T7VCGViUz4Mmsxr5L+Cl67g:bxdwRCpwaGPSJyi43aFvJztVHV73msDv
TLSH
T19DF2F143B13886AC61885F853F460EE899A188FB7D3753CFE0B59D58A9900D5B7D7A10
MD5 SHA1 SHA512 SSDEEP TLSH

az.zip

SHA256 edfeabcadb03a579384c04ee92cc77adde26d4978bb050a36a8b137fac80c978
MD5 a8248c37e8f18d06a7dd53c8b72912f6
SHA1 d56c1631be04f5d425a500d88c28bb289eae0068
SHA512 8adc86b27c0ad70311e72023dfc4eb402c983bfdb4289c8ee9ea8d461a42c1bd1667779e77e17e5608e23d0335d417068f6752970afcdbe439cbde705b0b0a0a
SSDEEP 6144:dLb8Tt00lDWb6D8T7Nj4rMa2REjHcMBOT72mz6U8TS/wAj6:dUxxDWjXNjGeGZQX2mk2/wn
TLSH
T1D64412FC127B4D26ABAA03DED7F0EE8CD7129B54E6B21C0168026774A1619F70F5690B
MD5 SHA1 SHA512 SSDEEP TLSH

bad_apple.exe

IMPHASH 30f731cca9cc3ab87b86f180728ab4b5
SHA256 6927cb7245652a3b66f1a4517189c7cd08056875e09e267a29fe13f1d3bd4d1d
MD5 6a022e937a774f6da038da4634b0fc40
SHA1 f204d69f3a78629a85f10bd7d2768b6fc3cbd7db
SHA512 752643d0bc50dd82d7cb82dd8e7acea72859a1f57eff9635fcac0950e73bc2fda1228e8e1405a6cc92ea364f8026e24f4fb88d55f5e92bfe82214dffbe76ca4d
SSDEEP 98304:a8/kJbJDGSdmWaeGzkbqrR7uO3kHQHgHCPfF72yt+7o7W9XXn7z8:a8/k3DGc6QqrZHgHC3LtvS9Hn7
TLSH
T153361243E28519FCD0BEC078479B6533F679BC4C4721B6DB4EE059212E2ABE06F29746
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

450688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReleaseSRWLockShared RtlCaptureContext ReleaseMutex FreeLibrary GetCurrentProcess CreateMutexA LoadLibraryA CreateThread AcquireSRWLockShared IsProcessorFeaturePresent WaitForSingleObjectEx SetLastError GetCurrentDirectoryW WriteConsoleW MultiByteToWideChar GetConsoleMode QueryPerformanceFrequency TryAcquireSRWLockExclusive GetCurrentThread GetProcAddress FormatMessageW WaitForMultipleObjectsEx WaitForSingleObject SetEvent CreateEventA ReleaseSRWLockExclusive SwitchToThread AcquireSRWLockExclusive GetModuleHandleW HeapReAlloc HeapFree GetProcessHeap HeapAlloc SetThreadStackGuarantee AddVectoredExceptionHandler GetLastError GetStdHandle GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlVirtualUnwind CloseHandle QueryPerformanceCounter IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetEnvironmentVariableW GetModuleHandleA AttachConsole RtlLookupFunctionEntry Sleep

user32

EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DispatchMessageA DefWindowProcA PeekMessageA SetTimer SystemParametersInfoA CreateWindowExA RegisterClassA LoadIconW TranslateMessage

gdi32

CreateSolidBrush

ole32

CoCreateInstance CoTaskMemFree PropVariantClear CoUninitialize CoInitializeEx

ntdll

NtWriteFile RtlNtStatusToDosError

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

oleaut32

GetErrorInfo SysFreeString SysStringLen

vcruntime140

memcmp __current_exception_context memcpy memset memmove __CxxFrameHandler3 __C_specific_handler __current_exception

api-ms-win-crt-math-l1-1-0

powf expf floorf sin floor atan cos log2 cosf log10 pow round __setusermatherr exp2

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc _crt_atexit _register_thread_local_exe_atexit_callback __p___argv terminate _initialize_onexit_table _register_onexit_function _c_exit _cexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

bcdef.zip

SHA256 97ded6004306e9593d226466e79bad3b13a250002045ab006054a280827ef7cc
MD5 41a09cfd8e22a629896ea3dac635b3d1
SHA1 892ad26ff2fcb597ed443efb9e9a56f549ba2643
SHA512 d2306abcc6a6ac084288f8d6a1f5661a189c8e0555965d94db10d672ec00764b0d85c6394869df15f27cd20dcc296bcb30cc4282a7b315dbee641af1f5e3e42f
SSDEEP 12288:i+puUP47p9i/5GZ3GYhpLvRT28yzAAk1gJb+iuA5l7Lczz3jaFkku+FocuIoT:YUPC97JGGpVTDyzAAfJzJ5lczTjRkuge
TLSH
T126F433F54C1F3292DF904C246EAA14DCE38C69D36A8A7B86CB13A016CA573B4B357437
MD5 SHA1 SHA512 SSDEEP TLSH

betterMEMZ.exe

IMPHASH 560c22dfadeb3c548587bb8f5dee9041
SHA256 96b4ebef645e1016f40748d5b09f72c0205efbd946ea5e7da6ad02225a83943d
MD5 5f4262b74546e4720805f60e8e1da707
SHA1 a4056d31396f8f7254d7641a5248dbaae3e67f43
SHA512 ccb1892d77147642dbe308fc232a8dd90624a0eeeb736c2f7508006144333e1169258d6b6388b1bc2e028e68ef603dbfff6aa00891e27065ec9693448084f760
SSDEEP 24576:KDlnAMXb58smpHm38TnzQe7wUNjXkAyKLtzPS:KKML58smgqxwUd0Pb
TLSH
T185754A01BB905018FCF716FA59FE217C953CB9E0076890C752C42AEEAA65AF1BC31B57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

549109

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\repos\bettermemz - Copy\Debug\bettermemz.pdb

kernel32

Process32FirstW Process32NextW GetCurrentThreadId SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation ReadConsoleW SetFilePointerEx CreateToolhelp32Snapshot ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers HeapQueryInformation HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW SetConsoleCtrlHandler WriteConsoleW WideCharToMultiByte GetModuleHandleW GetModuleFileNameW CreateProcessW CreateThread TerminateThread ExitProcess Sleep CloseHandle WriteFile CreateFileW GetFileSizeEx GetCommandLineW OutputDebugStringW GetFileType GetFileAttributesExW GetExitCodeProcess WaitForSingleObject GetCurrentThread GetStdHandle GetSystemInfo FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW HeapValidate SetStdHandle

user32

DispatchMessageW TranslateMessage GetMessageW DefWindowProcW GetCursorInfo DrawIconEx LoadIconW EnumChildWindows GetDesktopWindow GetCursorPos SetCursorPos GetDC GetSystemMetrics SendInput mouse_event SetWindowPos SendMessageTimeoutW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW MessageBoxA RedrawWindow UpdateWindow GetAsyncKeyState ShowWindow CreateWindowExW CreateWindowExA RegisterClassW PostQuitMessage

gdi32

PatBlt PlgBlt CreateSolidBrush BitBlt SelectObject

advapi32

CryptAcquireContextW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey CryptGenRandom

shell32

CommandLineToArgvW ShellExecuteA

winmm

PlaySoundA

ntdll

NtRaiseHardError RtlAdjustPrivilege

Name

.textbss

Size

Virtual Size

528KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

241KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

581B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

265B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Ăü¦ĽËŐ+»ßżô¦ĆĂ-ß¬íÎśÍ-.exe

IMPHASH 5877688b4859ffd051f6be3b8e0cd533
SHA256 72eae37517eaed332bc583a116070f191452f38f8ad4dc5d04f79632b4e119c5
MD5 b070e830a6863a4c19a4f86b7d67ccff
SHA1 fb5e98a9beffb68d2d2a3a3a4ed523830e1f8718
SHA512 af990dc6da9512b58ff68d346eb283c9b5cac528c496ca110afcd07eaef266ac9a586677046045319a953c77e4964ec24d90a4fbe32304a925f3aa56899a78f6
SSDEEP 1536:z7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfixQBgO:vq6+ouCpk2mpcWJ0r+QNTBfivO
TLSH
T1DC937D45F3E241F7E9F10A3100A6722FA73666249724E8DBC34C3D829953AD49A7D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc

kernel32

GetModuleHandleW HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetNativeSystemInfo GetShortPathNameW GetWindowsDirectoryW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep GetProcAddress GetVersionExW WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject

user32

CharUpperW CharLowerW MessageBoxW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos

gdi32

GetStockObject

comctl32

InitCommonControlsEx

shell32

ShellExecuteExW SHGetFolderLocation SHGetPathFromIDListW

winmm

timeBeginPeriod

ole32

CoInitialize CoTaskMemFree

shlwapi

PathAddBackslashW PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW

Sharing

General

Malware Config

Signatures

File Explorer

vm1.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

000.zip

000Terminated000.zip

001.exe

winmm

kernel32

user32

gdi32

advapi32

shell32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

0b02.exe

kernel32

user32

gdi32

winmm

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

0x07.exe

kernel32

user32

gdi32

advapi32

shell32

generic

10rigel.zip

1lh9zfg5gl.exe

kernel32

msvcrt

user32

generic

2 EURO.exe

mscoree

dotnet

2,3,7,8-Tetrachlorodibenzodioxin-alpha.exe

kernel32

user32

gdi32

winmm

generic

2,3,7,8-Tetrachlorodibenzodioxin.rar

2,3,7,8-Tetrachlorodibenzodioxin-safety.exe

kernel32

user32

gdi32

winmm

msimg32

generic

2,3,7,8-Tetrachlorodibenzodioxin.exe

kernel32

user32

gdi32

winmm

msimg32