8.zip
- SHA256 a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24
Password
infected
Overview
overview
8Static
static
38.zip
windows10-2004-x64
18.zip
windows11-ltsc_2024-x64
1Dump/dump1.exe
windows10-2004-x64
3Dump/dump1.exe
windows11-ltsc_2024-x64
3Original/9...6f.exe
windows10-2004-x64
7Original/9...6f.exe
windows11-ltsc_2024-x64
8Original/D...12.scr
windows10-2004-x64
7Original/D...12.scr
windows11-ltsc_2024-x64
7Original/b...12.exe
windows10-2004-x64
7Original/b...12.exe
windows11-ltsc_2024-x64
7Original/chqpl.exe
windows10-2004-x64
7Original/chqpl.exe
windows11-ltsc_2024-x64
8Original/d...4a.exe
windows10-2004-x64
7Original/d...4a.exe
windows11-ltsc_2024-x64
7Original/f...14.exe
windows10-2004-x64
7Original/f...14.exe
windows11-ltsc_2024-x64
8Original/l...25.exe
windows10-2004-x64
3Original/l...25.exe
windows11-ltsc_2024-x64
3Original/p...b9.dll
windows10-2004-x64
8Original/p...b9.dll
windows11-ltsc_2024-x64
3Unpacked/D...ed.exe
windows10-2004-x64
7Unpacked/D...ed.exe
windows11-ltsc_2024-x64
8Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
8.zip
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
Dump/dump1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
Dump/dump1.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral5
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral6
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
19 signatures
900 seconds
Behavioral task
behavioral7
Sample
Original/Document-772976_829712.scr
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
900 seconds
Behavioral task
behavioral8
Sample
Original/Document-772976_829712.scr
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
900 seconds
Behavioral task
behavioral9
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral10
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
8 signatures
900 seconds
Behavioral task
behavioral11
Sample
Original/chqpl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
900 seconds
Behavioral task
behavioral12
Sample
Original/chqpl.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
21 signatures
900 seconds
Behavioral task
behavioral13
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral14
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
8 signatures
900 seconds
Behavioral task
behavioral15
Sample
Original/fax_390392029_072514.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral16
Sample
Original/fax_390392029_072514.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
22 signatures
900 seconds
Behavioral task
behavioral17
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral18
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral19
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral20
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral21
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
900 seconds
Behavioral task
behavioral22
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
21 signatures
900 seconds
General
- Target 8.zip
- Size 2.2MB
- Sample260701-x2kawsds2m
- SHA256 a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24
- MD5 6d1f649d90313b7e3624c0e86563b5dd
- SHA1 2ab93a242511c38ff7661eb84107ca2ce380d135
- SHA512 7313603db16057f68eb3d7db53d7611c9681c57c906fa3e234f1fc6507344aedfab85b755f373f211a34c961914c25ac9d078a75d0619f3245d96db0d184229d
- SSDEEP 49152:7lzO5MCEcRPOmqeWozDQvPFq1IYRJRyYkUCJrWVnrxjSYdl:wNEcRPDPq8IYrRyY/CJsnr9SYdl
- TLSH T100A533BAAD8240E6FA6CA566A28480DDDE76A716F0DC3DD0E40D3E42439180FD7D1F63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/Dump/dump1.exe unpack001/Original/999bc5e16312db6abff5f6c9e54c546f.bin unpack001/Original/Document-772976_829712.scr unpack001/Original/b44634d90a9ff2ed8a9d0304c11bf612.bin unpack001/Original/chqpl.file unpack001/Original/dd207384b31d118745ebc83203a4b04a.bin unpack001/Original/fax_390392029_072514.exe unpack001/Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25 unpack001/Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9 unpack001/Unpacked/Dyre_Unpacked.file
File Explorer
-
8.zip.zip 2.2MB
-
Dump/dump1.exe.exe 268KB
-
Original/999bc5e16312db6abff5f6c9e54c546f.bin.exe 573KB
-
Original/Document-772976_829712.scr.exe 241KB
-
Original/b44634d90a9ff2ed8a9d0304c11bf612.bin.exe 480KB
-
Original/chqpl.file.exe 255KB
-
Original/dd207384b31d118745ebc83203a4b04a.bin.exe 538KB
-
Original/fax_390392029_072514.exe.exe 276KB
-
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe 313KB
-
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll 123KB
-
Unpacked/Dyre_Unpacked.file.exe 1.0MB
Dump/dump1.exe
- IMPHASH 22dbb276300404135258818b9af1f7bc
- SHA256 db8c0fc8427546ed54664fba24bdc7aa335eedb34b21c0d9a030dbc4f2bd7aef
- MD5 4ef5f0a660c9ae3e32eb109e1e7bfa30
- SHA1 b02b7fde30930161726fdd7e872da43b271f2c3b
- SHA512 6a49b7d2c46e072f329f75b0ab74e011aee16cd35ba9a83734294fcbb3ad73539a8545f27695d58aa9d9150114c8f344a3b193b2e6005edb3085eba0906e9a81
- SSDEEP 6144:uj7pn+5J7GRQtr3XMxJR2O5jRQtr3Xxw+:uj47mor3XMxJL5dor3X5
- TLSH T1AD448C06A18181F9E6A35078DA795F17D2BEB521132287CF23925ED51FB3AD2FA3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9072
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrStrIW
kernel32
GetModuleHandleW
VirtualFree
WriteFile
SizeofResource
ReadFile
CreateFileW
lstrlenW
GetLastError
GetProcAddress
VirtualAlloc
OpenThread
LockResource
lstrcmpiW
CreateToolhelp32Snapshot
GetCurrentProcess
CloseHandle
HeapAlloc
HeapCreate
OutputDebugStringW
ExitProcess
GetCommandLineW
MapViewOfFile
OpenProcess
LoadLibraryW
Sleep
GetModuleFileNameW
lstrcmpW
OpenMutexW
Process32FirstW
GetProcessId
IsWow64Process
CreateFileMappingW
Process32NextW
lstrcatW
DeleteFileW
lstrcpyW
CreateProcessW
LoadResource
FindResourceW
lstrlenA
SetFilePointer
GetFileSize
HeapFree
user32
wsprintfW
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
shell32
SHGetFolderPathW
Name
.text
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
259KB
Virtual Size
259KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Original/999bc5e16312db6abff5f6c9e54c546f.bin
- IMPHASH 486eda0988c03bbb173c5b351c4e5c49
- SHA256 dc276b0113694ecc62913311e2580857754aa890173dfaa9d95afad6396bb741
- MD5 999bc5e16312db6abff5f6c9e54c546f
- SHA1 c19761497efcdf156f50c014e7520fdae40822e7
- SHA512 37d8403df63db243ec631267abb167da67acc257a45c775a8e646467e9c121820ce420bc15b920afdd386f2c5edcabe8d310ecd3074405c31ee37f348ec4c78d
- SSDEEP 12288:wZ2BkVm1YvrIm9/nefmiM+Si2BiYRdAugT:GVm2rvJgmX+n2oYRdvA
- TLSH T128C4E6F509372C0CDD8B1436F6B7F989BED1A898096DCD944932F1EB2F51025A4E2EC9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
314268
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
CreateWindowExW
GetClientRect
SetWindowTextW
DefWindowProcW
LoadIconW
SendMessageW
PostQuitMessage
LoadCursorW
RegisterClassExW
LoadStringW
ShowWindow
GetMessageW
TranslateMessage
DispatchMessageW
LoadBitmapW
MoveWindow
SetWindowPos
DrawTextW
InvalidateRect
GetKeyboardState
EnableWindow
GetParent
GetClassNameW
GetWindowPlacement
LoadAcceleratorsW
UpdateWindow
GetMenuItemID
EndDeferWindowPos
EnableMenuItem
DeferWindowPos
SetWindowLongW
GetMenu
GetWindowLongW
GetActiveWindow
FrameRect
IsChild
GetScrollRange
DestroyWindow
GetScrollInfo
kernel32
GetModuleFileNameW
GetProcessHeap
HeapAlloc
lstrcatW
SetCurrentDirectoryW
CreateFileW
Sleep
LoadLibraryW
GetCommandLineW
GetProcAddress
GetFileSize
CloseHandle
lstrlenW
GetStartupInfoA
ReadFile
lstrcpyW
GetModuleHandleA
shfolder
SHGetFolderPathW
crtdll
_local_unwind2
_global_unwind2
_fmode_dll
_commode_dll
__GetMainArgs
_initterm
_acmdln_dll
exit
_XcptFilter
_exit
Name
.text
Size
360KB
Virtual Size
360KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
37KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=66, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=634, id=1, productName=Unmarked objects,
count=127, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Original/Document-772976_829712.scr
- IMPHASH 8bcca895cc1aad9a2d2d4e9ba64a1eda
- SHA256 523b9e8057ef0905e2c7d51b742d4be9374cf2eee5a810f05d987604847c549d
- MD5 c2d73485095efdbd7ab625e469affb11
- SHA1 a0a7b943b46979cc593474b94f14f2451b8ac3c0
- SHA512 ceafd283a2ce95ae5288871fe1732f97b600a4e08981b044fda925e15cfed120a37015c633de4daabfccdd3716dc9e0f4865468f647d8bd627339815d5bcf131
- SSDEEP 6144:/GpBEWJvXcs5eyOfevIUdy/ZV6u2nf0+8aq:/GkEEJy3IUdy/ZVrifqaq
- TLSH T14934266BE7BC3AE6D41945FD088D20E2213FE6A52BF0ECDA590463C730D46694CE6E1D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
SendMessageA
EnableWindow
UpdateWindow
kernel32
GetModuleHandleA
GetStartupInfoA
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_setmbcp
mfc42
ord2535
ord3262
ord5260
ord560
ord4273
ord1945
ord4613
ord4614
ord4823
ord652
ord338
ord4426
ord4623
ord6175
ord6080
ord3198
ord3454
ord4387
ord2399
ord4858
ord4953
ord4242
ord2575
ord4396
ord5241
ord5261
ord3402
ord4424
ord3574
ord2583
ord4589
ord4588
ord4899
ord4370
ord4892
ord4532
ord5076
ord4341
ord4349
ord4723
ord4890
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4964
ord4961
ord4108
ord4078
ord4403
ord5240
ord5290
ord4441
ord3748
ord1726
ord5253
ord3371
ord4432
ord3641
ord2723
ord2390
ord3059
ord5100
ord5103
ord4467
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord6055
ord4077
ord1776
ord4407
ord5237
ord2385
ord5163
ord6374
ord4353
ord5282
ord2649
ord1665
ord3798
ord4837
ord4436
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5252
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord1576
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4427
ord3623
ord609
ord674
ord303
ord567
ord366
ord813
ord800
ord3996
ord2100
ord4457
ord4615
ord4612
ord4610
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2582
ord4402
ord3370
ord3640
ord1168
ord6215
ord2092
ord4159
ord2621
ord5265
ord4376
ord4853
ord4998
ord4710
ord2514
ord6052
ord1775
ord5280
ord4425
ord3597
ord324
ord641
ord4234
ord693
ord1825
ord4238
ord4696
ord3058
ord3065
ord6336
ord2510
ord2542
ord5243
ord5740
ord1746
ord5577
ord3172
ord5653
ord4420
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=2, id=37, version=8755,
count=2, id=28, version=9178,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=14, version=7299,
count=4, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=507, id=1, productName=Unmarked objects,
count=19, id=25, version=9210,
count=41, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
Original/b44634d90a9ff2ed8a9d0304c11bf612.bin
- IMPHASH f0821047715b8965d331eb551d6e64d1
- SHA256 27d3378f41d3bd82d84544f7331856001a5fca259b6ef9001c15cdc43207c73e
- MD5 b44634d90a9ff2ed8a9d0304c11bf612
- SHA1 8f72e02dcbd87a4c1b880d349e34e0deb8e7bdd4
- SHA512 7e48e19817a132c8c29f56c271865ad7ef375291229e9b844c3d3c7ff8927b23fe4eb87494ef89f3dae0e1795648ae910e576ca0c42c231c15aaca60bb619239
- SSDEEP 6144:iWWPaCGkGGCBJKeNm1VbeuJCeU2HM7R+mzZUxrKkhhcghPrQANJRjiP6EQ6a9k7v:ReGkGJN8VyUxrvoZgJRjJ6a9TgS
- TLSH T1F0A4D068C1E61E12E70ACBBE51FA4A51563C6E72D9FB44F0940EF23C36F55B02291F86
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5852
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
GetModuleHandleA
GetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
CreateEventA
PulseEvent
TerminateProcess
VirtualAlloc
CreateFileA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
CloseHandle
SetStdHandle
GetStringTypeW
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapReAlloc
HeapAlloc
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
FlushFileBuffers
SetFilePointer
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
user32
SendMessageW
DestroyWindow
winmm
auxSetVolume
winscard
SCardForgetCardTypeW
ws2_32
select
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
412KB
Virtual Size
411KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=11, id=14, version=7299,
count=50, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=11, id=19, version=8034,
count=60, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
Original/chqpl.file
- IMPHASH 9a862710bb9677a8f1301763fc289105
- SHA256 0e2706d24d9aaf93a2c9181a892367bb6094cf658c97b237d336f0651f35ff5b
- MD5 c6315a09e06e2ba775e5be0979d23755
- SHA1 68abb2c430eebcad865157b4ef3e25f23ec5daca
- SHA512 6895a0dd192ce95a4a9c2ce51cc7e0cfcdcc5a024e6e83e39528f10b835b7eb329deebc72b258c25968291f4c06f27e1a7d06007ee785f684ba920d097e7cb5a
- SSDEEP 6144:E9kZ+d0Wm7M5MyYzWteHu4HCRdfKgvaY:E9OnWm7S26eAf5iY
- TLSH T1434439EFEB3C29EDD989263E4CF01AC9045B58DA9280DEFEDAC4550EB0E9749CDC1464
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
212140
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
PostQuitMessage
EndPaint
GetClientRect
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassExA
LoadCursorA
LoadIconA
UpdateWindow
ShowWindow
CreateWindowExA
DefWindowProcA
SendMessageA
DestroyWindow
DrawTextA
FillRect
kernel32
CreateFileA
HeapCreate
GetCommandLineA
HeapAlloc
GetModuleHandleA
CloseHandle
GetCurrentDirectoryA
GetFileSize
lstrlenA
lstrcatA
GetStartupInfoA
ReadFile
lstrcpynA
comctl32
ord17
msvcrt
atof
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
atoi
Name
.text
Size
206KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=8, id=125, productName=VS2005 build 50727, version=50727,
count=73, id=109, productName=VS2005 build 50727, version=50727,
count=38, id=110, productName=VS2005 build 50727, version=50727,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=87, id=1, productName=Unmarked objects,
count=3, id=114, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Original/dd207384b31d118745ebc83203a4b04a.bin
- IMPHASH fb7abd0d6772c1e271d7aae752cbb5da
- SHA256 a4bc61a4b1b5cbfa25ae56d0fcf94424893a60abcb68aad2c0321f99e5d7b520
- MD5 dd207384b31d118745ebc83203a4b04a
- SHA1 72dbfa32bc3a099833f3d2190371e3478d3324fc
- SHA512 60e6a0467d42171cfb07c33349789f3e679f498df483c7901ad04c3171c0bc324dc86c6b897928cf622873e20ac4e17a87ea88ecac8b555812b16d91f1fe954a
- SSDEEP 12288:uEQTUs9+7tGwu0BubanwRfiHX3XVQtCJJaHPJGLhT:Tq+ebanwR6HXVQtg4HPA
- TLSH T18AC4D5F19937150ECC6D4131FA939FC83C9AD8C84A4DA4288630E59B5F9A2B5C6F3ED1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
280047
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
LoadStringA
RegisterClassExA
LoadCursorA
LoadIconA
UpdateWindow
ShowWindow
CreateWindowExA
LoadAcceleratorsA
SetWindowTextA
DefWindowProcA
DialogBoxParamA
SendMessageA
PostQuitMessage
EndDialog
GetMessageA
TranslateMessage
DispatchMessageA
LoadBitmapA
MoveWindow
SetWindowPos
DrawTextW
InvalidateRect
GetKeyboardState
EnableWindow
GetParent
GetClassNameW
GetWindowPlacement
GetMenuItemID
EndDeferWindowPos
EnableMenuItem
DeferWindowPos
GetMenu
GetActiveWindow
IsChild
GetScrollRange
SetWindowLongA
GetClientRect
GetWindowLongA
kernel32
GetCurrentDirectoryA
CreateFileA
LoadLibraryA
GetProcAddress
lstrcpyA
GetFileSize
CloseHandle
lstrlenA
GetStartupInfoA
ReadFile
GetModuleHandleA
crtdll
_local_unwind2
_global_unwind2
_fmode_dll
_commode_dll
__GetMainArgs
_initterm
_acmdln_dll
exit
_XcptFilter
_exit
Name
.text
Size
282KB
Virtual Size
282KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
211KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=11, version=8047,
count=26, id=10, version=8047,
count=12, id=14, version=7299,
count=39, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=2, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Original/fax_390392029_072514.exe
- IMPHASH 000c0cc51cebb7ae0df3751e56dc52b2
- SHA256 10745182ac1b738e4a363166f650069d16b81873b3bbb1990e7d07cb652495e8
- MD5 4ba43f0b82f86efed437c8523f7a4dee
- SHA1 356b21b749c8bc5e2295a3db62ea03c47cb4c1cf
- SHA512 b0d36313226069688e1710be561f6bb75e232ee35212d41b50e12800ef54c48fbe29b1e97d8d08add642714887a10d598a06cfd2b8a609556242689496ad82a0
- SSDEEP 6144:NYIPjoJyR6dNNdUvw9IbxQi2qJ+4DhYxrtaDi:NY/eP9j2LvxaDi
- TLSH T19054C413E3BC44FEEAE7857F5A085DDBB217E0F16B95E6C2C8D9929888D358D5ED0080
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
257184
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
SendMessageA
EnableWindow
UpdateWindow
kernel32
GetStartupInfoA
GetModuleHandleA
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p__acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_setmbcp
mfc42
ord4234
ord2648
ord641
ord324
ord3597
ord4425
ord5280
ord1775
ord6052
ord2514
ord4710
ord4998
ord4853
ord4376
ord5265
ord2621
ord4159
ord296
ord5214
ord2092
ord1168
ord4242
ord2575
ord4396
ord5241
ord5261
ord3402
ord4424
ord3574
ord2583
ord4589
ord4588
ord4899
ord4370
ord4892
ord4532
ord5076
ord4341
ord4349
ord4723
ord4890
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4964
ord4961
ord4108
ord4078
ord4403
ord5240
ord5290
ord4441
ord3748
ord1726
ord5253
ord3371
ord4432
ord3641
ord2723
ord2390
ord3059
ord5100
ord5103
ord4467
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord6055
ord4077
ord1776
ord4407
ord5237
ord2385
ord5163
ord6374
ord4353
ord5282
ord2649
ord1665
ord3798
ord4837
ord4436
ord1576
ord2055
ord6376
ord3749
ord5065
ord1727
ord5252
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4427
ord3623
ord609
ord674
ord303
ord567
ord366
ord813
ord800
ord2582
ord4402
ord3370
ord3640
ord2078
ord3996
ord4224
ord2100
ord4457
ord693
ord4615
ord4612
ord4610
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord617
ord6215
Name
.text
Size
249KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25
- IMPHASH 08453a6e43fab2a723af5df16c73944f
- SHA256 9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25
- MD5 2f08d1f1b1968be7f9669e2ff94dea76
- SHA1 168befbd8691891fc9a983da90a80bff0aa79cb1
- SHA512 3dc06215caeff44944f577a5040a7f5ea89c16988021dd34dd914c110cd82052b4e4e8a1190568ed1bda89887bc4b132ac965818406b652c91a30acfc3b0ec5a
- SSDEEP 6144:ixxjPBn35E+ZXJtWc/yx1kk5NiIm4ALtvhwhz1m9r8:iTrZpEePWQyx5fiIm4otZm
- TLSH T141642266D7903E36CDA99C312BF7720452E3A9647AD43E1CFD109CE47CFAA5480ED24A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
FormatMessageW
GetCommandLineA
GetModuleHandleA
GetSystemTimeAsFileTime
GetTickCount
user32
CharUpperW
CreateWindowExA
DefWindowProcA
DefWindowProcW
DestroyWindow
DialogBoxParamW
DispatchMessageA
GetClientRect
GetDC
GetForegroundWindow
GetKeyboardLayout
GetMessageA
GetWindowPlacement
IsIconic
LoadCursorA
LoadIconA
LoadMenuA
LoadStringW
MessageBeep
MessageBoxW
RegisterClassExA
ReleaseDC
SetActiveWindow
SetCursor
SetMenu
ShowWindow
TranslateMessage
UpdateWindow
wsprintfW
comctl32
InitCommonControls
Name
.jddjtkg
Size
512B
Virtual Size
50B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
309KB
Virtual Size
308KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
512B
Virtual Size
238B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9
- IMPHASH d125c3c536281dfb67295a264a0c7721
- SHA256 f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9
- MD5 cb10fb803dc1f81b4bd324a5859b3ed5
- SHA1 9e778c1253ea59de4ea76f97d858b0a8d23a2fd2
- SHA512 05865e3554c1f8c90673baf0681de88058c7202439bbecacaaab4ce97bdc60bc77cb1e89d54b3c4ed049c0140c4bb2784433e5dc500debc47a7605b98312506f
- SSDEEP 1536:r8BG7Nckd6tnE0VVQrZzsIQSaB9a0OyJzL0OzfiPO4pPbEFvwfPISaOW9bmCDmf:rzikjEVQlQtBfOUPaP1zkqASxW9yCK
- TLSH T19BC3C052F59242F2EFA3453039197B229AFDED122035D60BDB9B09461EA0692F77E313
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
47917
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
iphlpapi
GetAdaptersAddresses
ws2_32
ntohs
recvfrom
sendto
bind
WSASetLastError
FreeAddrInfoW
GetAddrInfoW
getsockname
socket
WSACloseEvent
WSAStartup
inet_addr
WSARecv
WSASocketW
WSASend
WSAGetLastError
WSAConnect
WSAEnumNetworkEvents
htons
WSAEventSelect
shutdown
WSACreateEvent
select
closesocket
connect
WSAWaitForMultipleEvents
shlwapi
StrStrIA
StrStrIW
StrToIntW
StrTrimA
StrToIntA
StrStrA
wininet
HttpQueryInfoW
InternetSetOptionW
InternetWriteFile
InternetReadFile
InternetQueryDataAvailable
HttpSendRequestExW
InternetQueryOptionW
HttpOpenRequestA
InternetOpenA
HttpEndRequestW
InternetCloseHandle
InternetGetConnectedState
InternetOpenUrlA
HttpAddRequestHeadersA
HttpSendRequestA
InternetConnectA
advapi32
CryptReleaseContext
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegEnumKeyExW
RegOpenKeyW
CryptDestroyKey
CryptImportKey
CryptVerifySignatureW
CryptHashData
RegCloseKey
AdjustTokenPrivileges
CryptDestroyHash
RegOpenKeyExW
CryptCreateHash
DuplicateTokenEx
LookupAccountSidW
LookupPrivilegeValueW
CreateProcessAsUserW
RegQueryValueExW
GetTokenInformation
CryptAcquireContextW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
bcrypt
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptFinishHash
BCryptVerifySignature
BCryptCloseAlgorithmProvider
BCryptImportKeyPair
BCryptDestroyKey
BCryptGetProperty
BCryptCreateHash
kernel32
Process32FirstW
GetLocalTime
GetProcAddress
lstrlenW
CreateFileW
ReadFile
SizeofResource
WideCharToMultiByte
OpenProcess
WriteFile
LockResource
Process32NextW
lstrcmpiW
CreateToolhelp32Snapshot
GetCurrentProcessId
SetLastError
HeapReAlloc
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
FlushFileBuffers
lstrcpyW
GetComputerNameA
lstrcatW
GetExitCodeProcess
TerminateProcess
GetTempFileNameW
CreateMutexW
GetTempPathW
OpenMutexW
MapViewOfFile
UnmapViewOfFile
CreateRemoteThread
FlushInstructionCache
CreateFileMappingW
MultiByteToWideChar
TryEnterCriticalSection
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcess
SystemTimeToFileTime
LoadResource
FindResourceW
GetFileSize
GetVersionExW
InterlockedDecrement
CreateEventW
InterlockedIncrement
lstrcmpA
lstrlenA
WaitForSingleObject
SetEvent
GetTickCount
Sleep
CreateEventA
GetLastError
CloseHandle
CreateThread
lstrcpyA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
TerminateThread
SetThreadPriority
ResetEvent
lstrcmpiA
user32
FindWindowW
GetWindowLongW
GetWindowInfo
wsprintfA
SendMessageW
GetParent
PostMessageW
SetActiveWindow
UpdateWindow
wsprintfW
EnumChildWindows
shell32
ShellExecuteW
SHGetFolderPathW
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
57KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=193, id=1, productName=Unmarked objects,
count=46, id=175, version=30319,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unpacked/Dyre_Unpacked.file
- IMPHASH 22dbb276300404135258818b9af1f7bc
- SHA256 05edcc3e5679ee254c78058c4f446e195544d3ff3374bd141c1895e7ed6a410b
- MD5 4d1d43789e038c6a03c07083ca0b0809
- SHA1 8c4d87363a4a2352847923091b9ddfa6891f2807
- SHA512 32de7891671af7049b22f8384735fbd342413b2dcafc1c3d94cfa773079e10a006fe21af730558a2839c1b07deb1edd3462b07bed777a5f306863991b9709710
- SSDEEP 6144:rj7W89i5WWwR7A7XJfZ4FFhDhMWwR7A7XJVgNgG7:rjntWqA7X5Z+NMWqA7XOgG
- TLSH T1A8357D06A19141F6E6A69078DA795E27D2BEB520132293CF37925ED91FB36D2F33C301
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9072
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrStrIW
kernel32
GetModuleHandleW
VirtualFree
WriteFile
SizeofResource
ReadFile
CreateFileW
lstrlenW
GetLastError
GetProcAddress
VirtualAlloc
OpenThread
LockResource
lstrcmpiW
CreateToolhelp32Snapshot
GetCurrentProcess
CloseHandle
HeapAlloc
HeapCreate
OutputDebugStringW
ExitProcess
GetCommandLineW
MapViewOfFile
OpenProcess
LoadLibraryW
Sleep
GetModuleFileNameW
lstrcmpW
OpenMutexW
Process32FirstW
GetProcessId
IsWow64Process
CreateFileMappingW
Process32NextW
lstrcatW
DeleteFileW
lstrcpyW
CreateProcessW
LoadResource
FindResourceW
lstrlenA
SetFilePointer
GetFileSize
HeapFree
user32
wsprintfW
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
shell32
SHGetFolderPathW
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
250KB
Virtual Size
250KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
666B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=82, id=1, productName=Unmarked objects,
count=7, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,