Reserva.zip
- SHA256 9ebbfb0305d0850624c4c0569867b12f0147c0a832218b6574984d977d73b3d4
Overview
overview
8Static
static
3Reserva.zip
windows10-2004-x64
8Reserva.zip
windows11-21h2-x64
1Instalar_Cliente.cmd
windows10-2004-x64
8Instalar_Cliente.cmd
windows11-21h2-x64
8Reserva_Nuvem_160.exe
windows10-2004-x64
3Reserva_Nuvem_160.exe
windows11-21h2-x64
3dbexpint.dll
windows10-2004-x64
3dbexpint.dll
windows11-21h2-x64
3gds32.dll
windows10-2004-x64
3gds32.dll
windows11-21h2-x64
3midas.dll
windows10-2004-x64
3midas.dll
windows11-21h2-x64
3reserva.ini
windows10-2004-x64
1reserva.ini
windows11-21h2-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Reserva.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
Reserva.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Instalar_Cliente.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
Instalar_Cliente.cmd
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
Reserva_Nuvem_160.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Reserva_Nuvem_160.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
dbexpint.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
dbexpint.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
gds32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
gds32.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
midas.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
midas.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
reserva.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
reserva.ini
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Reserva.zip
- Size 3.8MB
- Sample260605-t4vmvsbs41
- SHA256 9ebbfb0305d0850624c4c0569867b12f0147c0a832218b6574984d977d73b3d4
- MD5 ddcb63f893e291fa1437ac3390501182
- SHA1 a02d252ec4c775583907e6e1db589bb591463849
- SHA512 b151eb173196c0d2b7ef7b920905f44db3e044770b67927eb6eae3d1d7bb61025f146ac0b2587989d90890c2b3909043b424c5b2860a10c6d353ffb221b5567a
- SSDEEP 98304:kcE3Vpv7ZlAwIxoSj9CY9+K6xqtRfTU0iOHpIzPO6KK:zE3VpjVIxv99rtRfT1JcPB
- TLSH T12516335CC44B3C54DB11F0BB425E89532AC54F87AB562ADF1A769BB1E3C8CB11633C8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Reserva_Nuvem_160.exe unpack001/dbexpint.dll unpack001/gds32.dll unpack001/midas.dll
File Explorer
-
Reserva.zip.zip 3.8MB
-
Instalar_Cliente.cmd.cmd .bat 1KB
-
Reserva_Nuvem_160.exe.exe 16.7MB
-
dbexpint.dll.dll 120KB
-
gds32.dll.dll 380KB
-
midas.dll.dll 289KB
-
reserva.ini498B
Instalar_Cliente.cmd
- SHA256 acc605c29cb56de7597ae6483a317b924512cf158cc4f38cbcdd24387f9beba7
- MD5 7fe92e496598d7b8210d19befcca803a
- SHA1 029252599587625cd38641e101ef27ec77bed523
- SHA512 356d37e5109e92374290e0645d0ae57d292085e8c1b5d54bec54838d35eda9b5f3307b4cde08c4fbb32fb31a3f3cfd7308a547f8dd2248c4c2ec677307369d81
- TLSH T139412559F708F50A58D57A04C1856909B82F19C90378DE6FFFE9618AF893E208EB1445
- MD5 SHA1 SHA512 TLSH
Reserva_Nuvem_160.exe
- SHA256 3ab54134459ab0cd4c61c5d3c3bfd71949310d5ac9cdb20532e5648bf9247f50
- MD5 096645bb6c298a126a963f84b5e99237
- SHA1 db285b0b0c0aeea4810a1be70e3caf5ec6b4d423
- SHA512 450cac35c8359f00974e0704ab89159e15ec65744906a4bff065b691bb536f8a65924e94a171834ae0fd90d4cfb6ac9aaffc47da59f0ab458aa1a02d084252ac
- SSDEEP 393216:x3QEYqNTD1QoNFFx5CAuK3m25kyORkXAwbmMnXBFuR:2E/4R
- TLSH T1320739163F49D813C06A4E74CE0BC6FC5666BE10FD6045ABF7E03F4EF675640A82A296
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5532612
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
14KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
112B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
369KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11.0MB
Virtual Size
11.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
dbexpint.dll
- IMPHASH dbe90fc9a3a8cf38bff64c28a7f2cd26
- SHA256 603a15f62647bb39e8bab3508f2a3fef25417185c4fc1281001cfb4f0a3ff5e8
- MD5 d32d73583ec44fbabbce9466ab3dbbca
- SHA1 17c8945b8499375c9e77cb18c025b851d3987753
- SHA512 6176a51183af0e7f8b1e8bce25d6b190b8ca3731ed58fe317ca8461d4eff973436557fdb7f7c0f2903ed53b1507885157388bbcde327b3a3b6c1e2b23c3fe2aa
- SSDEEP 3072:hqJFfEx0HmP3Ix/YBQCYmiWplq/o02mkM7N5buR:hZIpYBjYmix/UmTN5
- TLSH T1FBC37C12FAC0C178E55141724D783776667EFE860B1A63EB23C9B8B91DF1260BF06297
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30100
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
FreeLibrary
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
InitializeCriticalSection
LCMapStringA
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
RaiseException
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WideCharToMultiByte
WriteFile
user32
EnumThreadWindows
MessageBoxA
wsprintfA
___CPPdebugHook
getSQLDriverINTERBASE
Name
.text
Size
86KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
gds32.dll
- IMPHASH cd29071834d48aa947374fc2dc5def55
- SHA256 2a7c59d3b8c45814f6d7b5c2d9334ca0433135b4609a9cc8761aad22c19d1b08
- MD5 1abd772ece0cc871696a867d1f2076d8
- SHA1 7e37a4d4e0eaf2b5bf1cd8c8d4c0c4bfe41acd4e
- SHA512 e886b7d8d9da73f29dbd757bc7624e0a0944701571d5e432909f3dee6a84acdbdec8cb50d9af5782f45c45d012e6aa69ffc0c1f6764e88d6f3cb52d769d7ab81
- SSDEEP 6144:g7bUmSOyjFlmhwxgDmBY9bqWcUg7cOG6xfA/0wdB:g/UmajFlDa9bU93qB
- TLSH T11D848D92F791D070D54A06B93D395B6F7775F688077AC2C3A3C41E6A4832AF12E39293
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
243002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
m:\fb2\dev\fb2R2_0_0\firebird2\temp\release\fbclient\fbclient.pdb
ws2_32
gethostname
recv
gethostbyname
htons
WSAStartup
getsockname
listen
accept
socket
getsockopt
getservbyname
bind
connect
getpeername
setsockopt
send
htonl
ntohl
select
WSAGetLastError
__WSAFDIsSet
inet_addr
WSACleanup
shutdown
closesocket
mpr
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
WNetGetUniversalNameA
kernel32
ExitProcess
GetEnvironmentVariableA
FindNextFileA
LoadLibraryA
GetProcAddress
InitializeCriticalSection
GetSystemTimeAsFileTime
GetTickCount
OpenMutexA
OpenFileMappingA
CreateNamedPipeA
ConnectNamedPipe
WaitNamedPipeA
ReadFile
InterlockedExchangeAdd
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
TlsAlloc
GetLastError
TlsGetValue
TlsSetValue
TlsFree
VirtualAlloc
VirtualFree
GetModuleFileNameA
CloseHandle
GetTempPathA
ReleaseMutex
WriteFile
SetFilePointer
CreateFileA
WaitForSingleObject
GetCurrentProcessId
FormatMessageA
GetUserDefaultLangID
CreateMutexA
OpenProcess
QueryPerformanceCounter
GetCurrentProcess
GetCurrentThread
GetVersionExA
GetFullPathNameA
GetDriveTypeA
FindClose
FindFirstFileA
SetEvent
ResetEvent
WaitForMultipleObjects
OpenEventA
CreateEventA
SetEndOfFile
UnmapViewOfFile
FlushViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
ResumeThread
SuspendThread
SleepEx
GetCurrentThreadId
SetThreadPriority
InterlockedIncrement
InterlockedDecrement
CreateSemaphoreA
ReleaseSemaphore
CreateProcessA
DuplicateHandle
GetCommandLineA
Sleep
DisconnectNamedPipe
FlushFileBuffers
GetComputerNameA
advapi32
AllocateAndInitializeSid
GetUserNameA
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenThreadToken
OpenProcessToken
GetTokenInformation
EqualSid
FreeSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
msvcr71
_adjust_fdiv
__CppXcptFilter
_close
_read
_initterm
_strdup
_fdopen
_umask
_lseek
_strnicmp
_getpid
_strlwr
_unlink
_stat
_mktemp
_open
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
abort
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??1exception@@UAE@XZ
memmove
fprintf
fclose
fopen
__CxxFrameHandler
strchr
strncpy
sprintf
_purecall
fflush
fputc
fputs
_iob
printf
_stricmp
strtok
_fullpath
_errno
_sopen
_ftime
time
vfprintf
ctime
strerror
isalpha
signal
clock
getenv
_beginthreadex
atoi
fgetc
system
exit
atol
_snprintf
_getcwd
malloc
strncat
??0exception@@QAE@XZ
?name@type_info@@QBEPBDXZ
__RTDynamicCast
??8type_info@@QBEHABV0@@Z
__RTtypeid
_vsnprintf
getc
_access
localtime
strstr
??1type_info@@UAE@XZ
__security_error_handler
_except_handler3
__dllonexit
_onexit
?terminate@@YAXXZ
free
user32
MessageBoxA
CharLowerBuffA
CharUpperBuffA
BLOB_close
BLOB_display
BLOB_dump
BLOB_edit
BLOB_get
BLOB_load
BLOB_open
BLOB_put
BLOB_text_dump
BLOB_text_load
Bopen
CVT_move
KEYWORD_getTokens
KEYWORD_stringIsAToken
_isc_event_block
_isc_expand_dpb
_isc_start_transaction
fb_interpret
gds__alloc
gds__alloc_debug
gds__attach_database
gds__blob_info
gds__blob_size
gds__cancel_blob
gds__cancel_events
gds__close
gds__close_blob
gds__commit_retaining
gds__commit_transaction
gds__compile_request
gds__compile_request2
gds__create_blob
gds__create_blob2
gds__create_database
gds__database_cleanup
gds__database_info
gds__ddl
gds__declare
gds__decode
gds__decode_date
gds__default_printer
gds__describe
gds__describe_bind
gds__detach_database
gds__disable_subsystem
gds__dsql_finish
gds__edit
gds__enable_subsystem
gds__encode
gds__encode_date
gds__event_block
gds__event_counts
gds__event_wait
gds__execute
gds__execute_immediate
gds__fetch
gds__free
gds__ftof
gds__get_prefix
gds__get_segment
gds__get_slice
gds__interprete
gds__log
gds__log_status
gds__map_blobs
gds__msg_close
gds__msg_format
gds__msg_lookup
gds__msg_open
gds__msg_put
gds__open
gds__open_blob
gds__open_blob2
gds__parse_bpb
gds__prefix
gds__prefix_lock
gds__prefix_msg
gds__prepare
gds__prepare_transaction
gds__prepare_transaction2
gds__print_blr
gds__print_status
gds__put_error
gds__put_segment
gds__put_slice
gds__qtoq
gds__que_events
gds__receive
gds__reconnect_transaction
gds__register_cleanup
gds__release_request
gds__request_info
gds__rollback_transaction
gds__seek_blob
gds__send
gds__set_debug
gds__sqlcode
gds__start_and_send
gds__start_multiple
gds__start_request
gds__start_transaction
gds__temp_dir
gds__temp_file
gds__thread_enable
gds__thread_enter
gds__thread_exit
gds__thread_start
gds__to_sqlda
gds__transaction_cleanup
gds__transaction_info
gds__unregister_cleanup
gds__unwind_request
gds__validate_lib_path
gds__vax_integer
gds__version
gds__vtof
gds__vtov
gds_alloc_flag_unfreed
gds_alloc_report
isc_add_user
isc_array_gen_sdl
isc_array_get_slice
isc_array_lookup_bounds
isc_array_lookup_desc
isc_array_put_slice
isc_array_set_desc
isc_attach_database
isc_blob_default_desc
isc_blob_gen_bpb
isc_blob_info
isc_blob_lookup_desc
isc_blob_set_desc
isc_cancel_blob
isc_cancel_events
isc_close
isc_close_blob
isc_commit_retaining
isc_commit_transaction
isc_compile_request
isc_compile_request2
isc_create_blob
isc_create_blob2
isc_create_database
isc_database_info
isc_ddl
isc_declare
isc_decode_date
isc_decode_sql_date
isc_decode_sql_time
isc_decode_timestamp
isc_delete_user
isc_describe
isc_describe_bind
isc_detach_database
isc_drop_database
isc_dsql_alloc_statement2
isc_dsql_allocate_statement
isc_dsql_describe
isc_dsql_describe_bind
isc_dsql_exec_immed2
isc_dsql_exec_immed2_m
isc_dsql_exec_immed3_m
isc_dsql_execute
isc_dsql_execute2
isc_dsql_execute2_m
isc_dsql_execute_immediate
isc_dsql_execute_immediate_m
isc_dsql_execute_m
isc_dsql_fetch
isc_dsql_fetch_a
isc_dsql_fetch_m
isc_dsql_finish
isc_dsql_free_statement
isc_dsql_insert
isc_dsql_insert_m
isc_dsql_prepare
isc_dsql_prepare_m
isc_dsql_release
isc_dsql_set_cursor_name
isc_dsql_sql_info
isc_embed_dsql_close
isc_embed_dsql_declare
isc_embed_dsql_describe
isc_embed_dsql_describe_bind
isc_embed_dsql_exec_immed2
isc_embed_dsql_execute
isc_embed_dsql_execute2
isc_embed_dsql_execute_immed
isc_embed_dsql_fetch
isc_embed_dsql_fetch_a
isc_embed_dsql_insert
isc_embed_dsql_open
isc_embed_dsql_open2
isc_embed_dsql_prepare
isc_embed_dsql_release
isc_encode_date
isc_encode_sql_date
isc_encode_sql_time
isc_encode_timestamp
isc_event_block
isc_event_counts
isc_execute
isc_execute_immediate
isc_expand_dpb
isc_fetch
isc_fetch_a
isc_free
isc_ftof
isc_get_client_major_version
isc_get_client_minor_version
isc_get_client_version
isc_get_segment
isc_get_slice
isc_interprete
isc_modify_dpb
isc_modify_user
isc_open
isc_open_blob
isc_open_blob2
isc_portable_integer
isc_prepare
isc_prepare_transaction
isc_prepare_transaction2
isc_print_blr
isc_print_sqlerror
isc_print_status
isc_put_segment
isc_put_slice
isc_qtoq
isc_que_events
isc_receive
isc_reconnect_transaction
isc_release_request
isc_request_info
isc_reset_fpe
isc_rollback_retaining
isc_rollback_transaction
isc_seek_blob
isc_send
isc_service_attach
isc_service_detach
isc_service_query
isc_service_start
isc_set_debug
isc_sql_interprete
isc_sqlcode
isc_start_and_send
isc_start_multiple
isc_start_request
isc_start_transaction
isc_to_sqlda
isc_transact_request
isc_transaction_info
isc_unwind_request
isc_vax_integer
isc_version
isc_vtof
isc_vtov
isc_wait_for_event
perf_format
perf_get_info
perf_report
Name
.text
Size
240KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=105, version=2067,
count=2, id=93, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=198, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=56, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
midas.dll
- IMPHASH eddb7e47f4231b6f1d4357541f93cb6f
- SHA256 0b0edf7067ecb7a9554ffe5743fb65ba6e25c6407c137cb3657f7b8dd046138e
- MD5 a82285dda6f4778e5504fdf463f263e8
- SHA1 7d49097c362234e0bd991a8ab216733e98c70414
- SHA512 fcd6fa22906974ba0c87ae1dc8a04f29fa96cd8fd61d8d65029305c654dbbd67d553b0dca73bbaa816ca2bd36dec607d9a8f60f8c7aaae29fdac2a10f4fdd77f
- SSDEEP 6144:BeIZ5FcoGNQM4+hmwRtheDV2dyYjD9hYkn95myuj:BeKcofM4kAEx2
- TLSH T137546D11FC90C271C05101F05D39FB31797EAE656B2DA2873399B9AC9FB2360AB4275B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
kernel32
CloseHandle
CompareStringA
CreateFileA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLangID
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalMemoryStatus
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
OutputDebugStringA
RaiseException
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetLastError
SetThreadLocale
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WideCharToMultiByte
WriteFile
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
user32
CharLowerA
CharUpperA
EnumThreadWindows
LoadStringA
MessageBoxA
wsprintfA
ole32
StringFromGUID2
oleaut32
LoadTypeLi
RegisterTypeLi
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayDestroyDescriptor
SafeArrayRedim
SafeArrayUnaccessData
UnRegisterTypeLi
@WEP$qqsi
DllCanUnloadNow
DllGetClassObject
DllGetDataSnapClassObject
DllRegisterServer
DllUnregisterServer
ExitAlchemy
InitAlchemy
___CPPdebugHook
Name
.text
Size
232KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
reserva.ini
- SHA256 24a51aab453ffd1f9b8aa339a09e5782a67ba2cc084e9c926c0edabba04b6e75
- MD5 7f26e0cf391fde7c777b39c6f9238e99
- SHA1 eee2368387a9bb0b0382745b7e0b7a9c2de91796
- SHA512 1ec7880d70ff898a57a877bf7901f297ae0912394fc9ee3f42641a76af0179649bdd7f6e5608e0a4285816d1cf424a812a091d2ac195c62ca37bc9b1ca984221
- TLSH T1C2F0E090D843A0410F07B56706243799634B158EF4F6021195D59C2B9E4E5015BD7FD3
- MD5 SHA1 SHA512 TLSH