d.rar
- SHA256 8dc815716c48eb974f6f82f4827cd002460a48d57fa3f18bd9ad27eb5950b6c9
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
kdmapper_Release.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
nogibogi.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
rename.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
General
- Target d.rar
- Size 725KB
- Sample260622-ln1vyabt21
- SHA256 8dc815716c48eb974f6f82f4827cd002460a48d57fa3f18bd9ad27eb5950b6c9
- MD5 e6423baf1f235978b259132343bf5557
- SHA1 ddf065594eb4770c238da0fdf6418a92eca1d51c
- SHA512 3e86cec825c33db6c43978e69909654e625d8e004d80349efee44de59e2e98c2914ac838ed8f529c76a57841083a174953ad730c33a3f8b499cd5ecbdd554f62
- SSDEEP 12288:5aEDl58MmfJixbPOib5ybqzvhIOoF/30nQF0OEXJJMAGNl/O5pt4keC4d:5tJ52Jixb2i9IqzmRFhDEZJMTNlM4d
- TLSH T176F43344378E8E6593360DCBA66C9F76F86493E077E88B74D42D7CEE1979280483D238
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/kdmapper_Release.exe unpack001/nogibogi.exe unpack001/rename.sys
File Explorer
-
d.rar.rar 725KB
-
kdmapper_Release.exe.exe 248KB
-
nogibogi.exe.exe 1.2MB
-
rename.sys.sys 25KB
kdmapper_Release.exe
- IMPHASH fe1529edef766e6c0d25b8ae1722ece5
- SHA256 6db07f2aaf82b5b58614619141f7b534d626a4a22e77b075db3e5b3896278dd6
- MD5 e2f1e41f5c95d31b080b614b11a13d6c
- SHA1 8d87004f40566160f4cca92be1e1a8d18a3e14ad
- SHA512 055f3a25a2ebe0f697c69a0f34675f65bf41b8777266a2ee87157a4bc5a2b866233cfe992d9790c52cef028d1ce6e8b4019b6997b3a059355e7a6c345af3ae8c
- SSDEEP 3072:byDruZr7MXuXxnDkVEVIkwPMmJTQSaMm5/6dQL3jdY83+KU296TRn:n9YXaxDkuRiXWlqKdY83+r296Tl
- TLSH T1AF444A5787A9106DE1B7D6B9CAB24941EB727C450B70A6CF135048BA0F727D0BE3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
172032
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseHandle
GetProcAddress
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetModuleHandleA
GetTempPathW
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
CreateFileW
VirtualAlloc
DeviceIoControl
SetUnhandledExceptionFilter
VirtualFree
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
user32
GetShellWindow
GetWindowThreadProcessId
advapi32
RegCloseKey
RegDeleteTreeW
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
ntdll
NtLoadDriver
NtUnloadDriver
NtQuerySystemInformation
RtlAdjustPrivilege
RtlInitUnicodeString
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memcmp
_CxxThrowException
__std_terminate
wcsstr
__std_exception_copy
__std_exception_destroy
memset
__current_exception_context
__current_exception
__C_specific_handler
memmove
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fread
fsetpos
ungetc
_get_stream_buffer_pointers
fputc
setvbuf
fgetpos
fwrite
_set_fmode
__p__commode
fgetc
fflush
fclose
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
_invoke_watson
__p___wargv
_get_initial_wide_environment
_initterm
_configure_wide_argv
terminate
_c_exit
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
__p___argc
abort
_register_thread_local_exe_atexit_callback
_initterm_e
_exit
exit
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_wremove
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
_stricmp
_wcsicmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rcd003
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=35, id=261, version=35207,
count=6, id=257, version=35207,
count=9, id=257, version=33145,
count=235, id=1, productName=Unmarked objects,
count=7, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
nogibogi.exe
- IMPHASH 8c7b09a06c554194547006768e8890a6
- SHA256 44ddd284cf9098f6583531a69276f0489e4f4ab2f59157b1f5d6585635b74380
- MD5 1a77ab34e283683cc56f0ae56a067966
- SHA1 080adffec7cf65f03f5554120fddbbc846f2a5f5
- SHA512 74444c9fb7015ce6b7189a64c34a79fc4df45d81f3432f47a879d488649482d11cadd7d4ba8226108be1606e0a57ab3e64a9e286c4b07563def8dcd865aa9108
- SSDEEP 24576:jNTajgaAx8JRD9CTx9M1KHlyjxnl7Uqicn338Eu/xPHEatpm:plIN9CTx9GFFccn8Er
- TLSH T14D458E92F3EC5855E02774384781690FE2327438031097E7BF9A495DABBE9E0CB7AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
489744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\z\Desktop\free\free\Thisishusky Retrac SRC\x64\Release\nogibogi.pdb
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
TerminateProcess
CreateJobObjectW
SetThreadPriority
CreateFileW
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetConsoleMode
GetTempPathA
GetLastError
Process32NextW
K32GetModuleBaseNameW
GetCurrentThread
Process32FirstW
CloseHandle
Module32FirstW
GetThreadContext
ReadProcessMemory
GetCurrentProcessId
CreateProcessW
Module32NextW
K32EnumProcessModules
GetTickCount
GetProcessTimes
IsDebuggerPresent
VirtualQueryEx
CheckRemoteDebuggerPresent
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
SetConsoleTitleA
DeviceIoControl
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
WakeAllConditionVariable
GetCurrentThreadId
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
GetModuleHandleW
AreFileApisANSI
CreateFile2
GetFileAttributesExW
FindFirstFileW
FindClose
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
SetPriorityClass
SetInformationJobObject
AssignProcessToJobObject
SetConsoleMode
GetStdHandle
GetCurrentProcess
InitializeSListHead
QueryPerformanceCounter
user32
GetClipboardData
GetKeyState
ScreenToClient
GetSystemMetrics
ClientToScreen
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCursor
GetWindowLongPtrW
ShowWindow
GetKeyNameTextA
SetClipboardData
GetWindowThreadProcessId
GetWindow
DestroyWindow
SetWindowPos
CloseClipboard
DispatchMessageW
OpenClipboard
PeekMessageW
MapVirtualKeyA
MessageBoxA
SetMenu
EnumWindows
SetLayeredWindowAttributes
SetPropW
TranslateMessage
GetClassNameW
RemovePropW
mouse_event
GetAsyncKeyState
GetClientRect
SetWindowLongPtrW
SetCursorPos
GetPropW
MessageBoxW
UpdateWindow
ShowCursor
GetCursorPos
GetWindowTextW
EmptyClipboard
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
_Thrd_yield
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Id_cnt@id@locale@std@@0HA
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
_Mtx_unlock
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
imm32
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
__std_exception_destroy
__std_exception_copy
memcpy
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
memset
__std_terminate
memmove
strstr
memcmp
api-ms-win-crt-runtime-l1-1-0
__p___argv
_c_exit
__p___argc
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
abort
terminate
system
_beginthreadex
exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
ungetc
__p__commode
_set_fmode
__stdio_common_vsscanf
_wfopen
__stdio_common_vsprintf_s
fseek
__acrt_iob_func
ftell
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
fflush
setvbuf
fgetpos
__stdio_common_vsprintf
fputc
fwrite
fgetc
fclose
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
_set_new_mode
realloc
api-ms-win-crt-string-l1-1-0
strcmp
_wcsicmp
towlower
wcscpy
strcpy
strlen
strncmp
strncpy
wcslen
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
asinf
__setusermatherr
atan2f
atanf
ceilf
cos
cosf
sqrtf
fmodf
sinf
ldexp
pow
powf
tanf
acosf
sqrt
sin
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
Name
.text
Size
485KB
Virtual Size
485KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
314KB
Virtual Size
313KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
418KB
Virtual Size
419KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=34, id=261, version=35721,
count=6, id=257, version=35721,
count=17, id=257, version=33145,
count=385, id=1, productName=Unmarked objects,
count=10, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
rename.sys
- SHA256 35677b90f6e212bf3e953b7acf43b8f4696d940f2bc2713b75da228b8bef5fa8
- MD5 275ad0abae8300c4bcfeed9cf83e2b13
- SHA1 fbaac0ef36d27566554ec75102cba726a1e9b5d5
- SHA512 9217686b76b3e5f45608f15e0595dd8537b01dff991e288873211a051d980407ebd4782cafb7050a64b716f6c76bdd90bc7459fd369d0df230a01834f9bba597
- SSDEEP 384:wfhJqtCT9eOvwIM3hDeJDWsY/ouGQApg2xX/KA4IrNCWuAsuJVCMzwl0/g5rNocO:yMtCTnyxKC/oumxXyA4GCWu9eYSc6M2
- TLSH T117C22A2A6181A6FFFB67603A8373D2CFF9257041232698DF09B8DD1F234A9C52138D65
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
17988
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\dark\Desktop\nigctl\x64\Release\nigctl.pdb
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33140,
count=1, id=1, productName=Unmarked objects,
count=2, id=259, version=33140,
count=1, id=260, version=33140,
count=1, id=261, version=35213,
count=1, id=258, version=35213,