HelloUser-main.zip
- SHA256 96f6999876a14b8d74ea2007c987ea2257da7f25c95f25d2e346396c5287b38a
Behavioral task
behavioral1
Sample
HelloUser-main.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
General
- Target HelloUser-main.zip
- Size 38.2MB
- Sample260702-tegppses9l
- SHA256 96f6999876a14b8d74ea2007c987ea2257da7f25c95f25d2e346396c5287b38a
- MD5 9754f66fe315dc807315862f83c972ab
- SHA1 398b888c90b98c18b7e141e0cc60ed2323cea427
- SHA512 76208726c40d8237f3af9abb8b4cc456a7aaffd55d9ba0a1e36021642cd98c0903252b0bff91dd2370760d3605282e1f8095ce340a4518eb9704884b05411f98
- SSDEEP 786432:jTehlnbuIcDskcLNbLZroksIYBSAduIb/GEVLfXGDG1XF0A/jHQI3e5F:f5IcDENBE3BSaunEV/0AF3e5F
- TLSH T1A29733B4779CD8C976C59447D7CDA126492CAA52BB907008A29DAB015C8FA3F4C87F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
orcus
Botnet
-
Nigga Rat
C2
-
94.26.106.89
Mutex
-
fb181432de6c4c48b2f234dbadec27d0
Attributes
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
01/11/2015 11:40:41
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgZQA0ADQANwAzADAAMgA5ADgAMQA4AGEANABhAGYAMAA5ADgAMwBjADYAOAA1ADAAYwAzAGUAMABmADgAZgBjAAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDQAMQA2AGYAYwAzADQANAAzAGIAMQA1ADQANABhADkAOABkADkANwA1ADUAMgBhADkAMQA0ADgAMQA2ADgAZAABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIGYAMwBkADQAMABmAGIAZQBmADcANQBiADQAMQAzADYAYQAwADgANAA0AGMAYgBhADUANgA2ADEANwA1ADEAMAACAAYG
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
aes.plain
Signatures
- Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- A stealer written in Python and packaged with Pyinstaller 4 IoCs
resource yara_rule static1/unpack001/HelloUser-main/RobloxCrashHandler.exe blankgrabber_exe static1/unpack002/#�e���t.pyc blankgrabber_exe static1/unpack001/HelloUser-main/SMEG.exe blankgrabber_exe static1/unpack003/����^r.pyc blankgrabber_exe -
resource yara_rule static1/unpack001/HelloUser-main/Hello.exe vmprotect - Codesign digest Mismatch 2 IoCs
File was altered after it was signed.
resource unpack001/HelloUser-main/RobloxCrashHandler.exe unpack001/HelloUser-main/SMEG.exe - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/HelloUser-main/built.exe pyinstaller - Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/HelloUser-main/Hello.exe unpack001/HelloUser-main/Madium.exe unpack001/HelloUser-main/UR (3) (1).exe unpack001/HelloUser-main/built.exe unpack001/HelloUser-main/lgcy.exe unpack001/HelloUser-main/lgcynbew.exe unpack001/HelloUser-main/lnew.exe
File Explorer
-
HelloUser-main.zip.zip 38.2MB
-
HelloUser-main/Hello.exe.exe 5.5MB
-
HelloUser-main/Madium.exe.exe 1.2MB
-
HelloUser-main/RobloxCrashHandler.exe.exe 7.4MB
-
#�e���t.pyc1KB
-
HelloUser-main/SMEG.exe.exe 6.8MB
-
����^r.pyc857B
-
HelloUser-main/UR (3) (1).exe.exe 3.2MB
-
HelloUser-main/built.exe.exe 17.0MB
-
built.pyc.js 62KB
-
HelloUser-main/lgcy.exe.exe 100KB
-
HelloUser-main/lgcynbew.exe.exe 100KB
-
HelloUser-main/lnew.exe.exe 100KB
HelloUser-main/Hello.exe
- IMPHASH e9f3803773a830e1628f9d779799b4e6
- SHA256 b83d1a9c9f25f100b493b3d1e765969a5cae6a29a5f2f4ff7d5b812ea79b37e2
- MD5 e2b87c28c6d43827c9a2dc6f2f4d9a2a
- SHA1 808f866fc7108d3540497168e538829f7739b76e
- SHA512 ecd84be86ab8a8b4dc62f576ad8d0b67f184786f3dcc59342ab52a50f3b6850f65dfdf3e57dcbea501bd7e95062273adab217f458e09372c8fee816e079ce689
- SSDEEP 98304:pV/EhivlaIBBEZFBB5m1lr51aKcyFVLuM9PapyTwsqVSA+Un7M:pVsClawiFj5S15lVLuqCpy5qVSA+U
- TLSH T1B04612FE26543368C01689395533BC45F2B65A0F4AE9C9AEB2EF76C07B6E411C941F0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7325764
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
comctl32
ord380
kernel32
GetACP
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
OpenProcessToken
gdi32
SelectObject
wtsapi32
WTSSendMessageW
|���?`�rMck�V��-� 3����ޒ-��J���'���T+ ����"fK~� �\�/�����ʣ<D=������|�~z�h#�(f�-� ތǝN�Y��8�Z� ��)ڜ��
�#'���������X\��P�aƵf�l\�٩x�9٘ߟ��� �=�
�x���������,{Zz9^�-2�{�Pn�WX��]�E �����sX�l�S'!����$�Fet�)�W$W}Xy{�� ǐ�\���&0bD9;6� )�3@�BW%9�T g3��t������R�=�R8���l���U��i��e7a�R��65�%P2Ҋ�H����W�� Ѥ��_P(���,�\�_R~X �.����wX��������d���(t�M�4�FQ��R��$����
�!N�3����.L��� �� » F��^
�(BY�X� �"N�P��X^;1�Y�U ,05,�6;?���^���K�v�k �1cW��s#���m�V�E/b?_��Pq|E�x���]�c�I� R��� ������?�*pa: �4�Bs���}�?�͙6QyAC���1��ŹK�^�C���
��=��>a(�f"'��e�,����?�-��:5$PH�X�u�a�,辰@<�b���%���;�L�� ���`��i�!�z�t�Lgs�Ƌ ^� �(�W���.<'[����1�e Ҥn ���䙑�i��Ĕe�=5K��u%���~����R�gC�6��j�+`}���ۃ�M�w���V��-~�������ؖo
����cr�:-GbWR�:)�&EEK��-zk�����J���]yo� ���-^\�w������2��4.��6).�h��Է4h?�,�� ,'�@�,(��U:�s��U��HL�^M��jDu�����q����'J]8ֆ�苫��)O
��%G��3�@���4��d�c���:�ğ�a��.v P� 1�x�MW$\]����r!ݥ��<�+v��
S � }���R�����)�y?��W����: ]�b���Xۀ���F�˰d�:��-i&�hGBc2�!��r
pk6+�j��1�_� �$�08�?B*ړ��_3�vޢz�mL�/`�C}Ʃ��j��A�����ڼh|!�@� o��5�`p��"�ʴx�j����|#8��:���jZ�7��`+��x���?�/����o��i� %� [��W�T �,2�h���:/4_��� +V��ق� ��~Qr����Y`��@�kx�MO
!Ɖ5F�Z%,M�� ��༈�G����K�9�L�^W�� t,k<(���ɊVe���n�uSr�Z,s~��xE�9�Ƭ�㛠��*&��>�iPh�+7��k�\�)��0�[�UZ��� &�$��K�0��c�(S��I����G <t���<�*���D �����6Ծ��P�zI�6�k�I��HX\Q睺�~$!l]�] ��������1�C���;>�oJ"B �2g�� F��k��}j��� �H�>�P�%O([�Nd;��%����Ȯ����h�W� ���Z��R�a�%,K��#b�h��!U#AE�S�����| �4 Vo�R�p����;��"� >HJ����
<��V4�����MmGd�0������_�M� �.���#�| ʀ���I zQͻVnr��q�����y���z����l�[8������,g^��ȩ��!��0�d��M�{@�^�L����(�0\���郾�����
6��TRw��lV������!7E4<Wm
`Ctx|t�@�[�J��p?����%o�ح?��UB�
E#)[�����"a�.H
���Y|�ʋ�b�(C�^I�ά��.~ �R��� ��i���NY�gC"\�I�T�ŵg �� ¥ �rd��S� pT nc�$8�͕y(�P�o �e�K�0,jR:E@�{��R���~q��g�:i8�S�A_�g&�k`���o�Α����?��&�Lة+<��Q�`iCg���*�u�k&���������ޞ�� �� e��E�B{�� ( C�绹��\�_���W���7[�m�⥴@���<v_\�V����f]#҉ ��8��I�NdU���� �� ��F���!@�ٹvM�w� �֥h�wTCF3U��"�`�l�W�>��Og�cΙ���o�[��8�2�Ե�� ��<���L)�+o����֗2y���b1�N�$!�tl�0,��Hx�[
>[���`�^�1e��5ΔJ���(�+"os���1%`7��`"Ru����a7o���G �[�*�wJ|�F��a\0;6��%jσpA> R��;n���@�9�qT��$,������㹡� Y��4�����2R!&����ՠ�� ��kJg�s��ޫ*s�Wg���uB��� �% ]=��7��K�M}ʺP߃�H!�Z�Q��k�� �9�`�guw�c�Ƣ�x��;��F���'����P� ���{�u!��O�|�����YA�A�y�����]�?d �Ƴ ?�v�*L�F�U�� �X.�9k6@�9lhk WD��Y�z��x���L�&��L�M�~
�� ^� ː�Em�.!� ܽ��"V������ݸ�neM,���G���2QQ�fI�U��i�6l(u��{�F^hv�`�w!f��1�q�M>F�T�Z�
%\
���� ��
}�\T�~ P`�������̜3 :����3Y������ń�ZY�\����7����@V�uā�#����
�F�ý�����)�j:ח��o�\0x�f]K!I[tk�� �m����[g�x� ��`�*�WJ����=�t�XE��ٮ�t�v� ���d��?����ڔ�Q�(���-���%&n|��)^��7 ��a���<PJ��b� {����Y,_L�h�w�$�p�H��"" ��x�2!*�+������dLL�I� ��R '����p���}��G]XCv�lЮ�X��Ks�L|/��"� ���H��<��Gs^6n$L�Dea�X�"t)���8��U��#�<��� ����Z��v ��^��K���x1�QNFoﲤ�6_[�z_�~���0B���uTr�-~C�䶎��J��2��a�5��|ȿ�D�?��y��_�[f�'q�T�ۆ��Q}
Name
.text
Size
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
5.5MB
Virtual Size
5.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
HelloUser-main/Madium.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 18fb06d03d53edaf715b9bf316b7d3d5b0b16d05fe44cb0c8fdc2a475a4318eb
- MD5 e43cc9ae2dd502d446fb05036d8b1f4f
- SHA1 f53d475561fa6c4e343db196b88f8c90f7bd09f3
- SHA512 d3e775d81a1b114ce2879d4b25ccc2b7a1e575951cd3ff49f9003ef96d788cd299f69f71c8a6da46033de4ab550bc7a6b09f4bd62e687c04cd29379e3fbbca5a
- SSDEEP 24576:kC6IS04YNEMuExDiU6E5R9s8xY/2l/dRJ5dtsPxNGfH2QIbt+rX:kC6Q4auS+UjfU2T/5XD+QIbt+r
- TLSH T1B34502407BEC8E0AC5EE76BDB4A32CC407B4ED079556EB8E589920ED18AF702D530357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1237678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
HelloUser-main/RobloxCrashHandler.exe
- IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
- SHA256 88e241ae259fbe0dfca942a189aa1eaec1bfed5e2aedc3912344ce2ce911989a
- MD5 17f4e5d320dde130857390bdc06bf869
- SHA1 4d74d56d1be1313b04fd1c7b4fcd063f7012bbf1
- SHA512 2326bfbab6d0f6665e112cd390bf6e1c55a5932ed799b6769d24aacd8ed14dfa86f702862439be37fa79bc4347a2445564dcb1b99645c0ebac4ad88c9a5f711f
- SSDEEP 196608:AYdynpxOshoKMuIkhVastRL5Di3uM1MgR1qQ:AYdCxOshouIkPftRL54PPXd
- TLSH T157763309F3A844EAF582913DC686C215EB33399217B0E5DF079847662F176E94C3AF27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
A stealer written in Python and packaged with Pyinstaller
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
e4:c0:7a:af:7f:25:9d:3a:7d:c5:43:d7:ab:d8:83:a6:70:50:61:8e:bb:95:9d:4d:9f:a2:90:15:0f:22:32:0f
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Chains
Apr 25, 2023
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Serial Number
bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 29, 2021 - Sep 28, 2024
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
6
Entry point
57280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsFree
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
177KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33145,
count=159, id=1, productName=Unmarked objects,
count=27, id=260, version=35225,
count=1, id=258, version=35225,
#�e���t.pyc
- SHA256 2c418b4e9226d52d3b0ee4fd60d7471a0e679d358824d4bae0aa14cf36fd30ff
- MD5 67d382e0cce141acd0452df8fc86eb46
- SHA1 83a88d17cc4c15d0d0c0e1fe1b0c190722c12df1
- SHA512 bf814d7974ab486d7c60649bdc50cfd488cfc463b9f016ebdf2591ad5956eb0e9caee5ffb45bef455e8b07db1ae324905fd8aae9ef48230e258c97476d0aff69
- TLSH T1CA3115870262CD3EFCAAD37C903C5C9673E0D5E1FA1D6693280E513D9E64924B8525FC
- MD5 SHA1 SHA512 TLSH
-
A stealer written in Python and packaged with Pyinstaller
HelloUser-main/SMEG.exe
- IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
- SHA256 4b6af07dd66f5f596f868e74a5c3f97169e40e06a6334b07909c3fc9ad59f56f
- MD5 28ff6770c7cc4a2becf6bd63acaeadeb
- SHA1 4f4825431e2027aaecdddc04598a62cdd20b166f
- SHA512 74b67d7e94567f73a044e1c5daea628a9765d37494dfb1e360cb3cc967b056a931f8daac8cb0ee704e83c63b8030029c88b1bc00a099ec1a83eaf6036aa0060e
- SSDEEP 98304:6XAIu4+DcZsVi4mamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe4hTntAQ:u7p+DS4PeNoInY7/sHfbRyDKUsIhSTzE
- TLSH T163763350739405E1E8E3857DC6C7904D96B6F8121B20E6CF13E48B542E27BB09E7FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
A stealer written in Python and packaged with Pyinstaller
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
2b:6b:98:34:07:5f:2b:1b:18:ec:b8:9a:c0:d9:84:f7:25:dc:91:a0:18:19:07:04:d2:13:bd:7e:3b:63:29:c4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 28, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:18:41:84:19:ad:cb:ad:29:4f:00:00:00:00:05:18
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:22:41:d2:f6:aa:ff:c8:b5:ff:00:01:00:00:02:22
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
57280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsFree
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
177KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33145,
count=159, id=1, productName=Unmarked objects,
count=27, id=260, version=35225,
count=1, id=258, version=35225,
����^r.pyc
- SHA256 d6695e487af357804dea98e4adb5bef8a985aff780d0d034133bbf8d0bb540f0
- MD5 16502aaf0dcc6d28d13c93a8eafff377
- SHA1 dd27a87b36419c9749136c55d10f121d76491507
- SHA512 aecdda646757c5d27ab48c7265c5dccf68fe082ab3d07bc31997b1e95a8019a7c9ebee2002f7dc769971097ecf570cff0dfe1c7ab5aeb5363fec36424ff66765
- TLSH T1A61141D5505360A6FFEDB632A5B1E2209AF1A75562286A8FE00CB26DCCAC3D441F10A0
- MD5 SHA1 SHA512 TLSH
-
A stealer written in Python and packaged with Pyinstaller
HelloUser-main/UR (3) (1).exe
- IMPHASH cd0ef78c99733c5ed97ed0f267505821
- SHA256 9fe5fb74600e204a4739a0ed262f16ab6c7eb9f970f61d6315a8e5010f9bc3d4
- MD5 acf8907ce64638007fb5514265812c67
- SHA1 daa5404df21afc0cbfc126b9544fa68f3833e3f8
- SHA512 aa7478af047621b9f6d828356a20905f46a520cf364bc639ff0c21b5e9ae8eb29d5edcb2dd00c4dc327ca5348868d754c7068aff132d27d21e606e3ff821f9b6
- SSDEEP 49152:I6lJ8gDN56P1omLtSGq3dUDIGMGgaWwKUFK3l:ICWgWkXDGgaWwK9V
- TLSH T15BF59F13B384657EE05F1A360973B6649C3B7A50662A9D0FE7F10D8C8F253812E3E967
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2638840
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
winspool.drv
DocumentPropertiesW
ClosePrinter
OpenPrinterW
GetDefaultPrinterW
EnumPrintersW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
comctl32
ImageList_GetImageInfo
FlatSB_SetScrollInfo
InitCommonControls
ImageList_DragMove
ImageList_Destroy
_TrackMouseEvent
ImageList_DragShowNolock
ImageList_Add
FlatSB_SetScrollProp
ImageList_GetDragImage
ImageList_Create
ImageList_EndDrag
ImageList_DrawEx
ImageList_SetImageCount
FlatSB_GetScrollPos
FlatSB_SetScrollPos
InitializeFlatSB
ImageList_Copy
FlatSB_GetScrollInfo
ImageList_Write
ImageList_DrawIndirect
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Replace
ImageList_GetImageCount
ImageList_DragEnter
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_Read
ImageList_DragLeave
ImageList_LoadImageW
ImageList_Draw
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetOverlayImage
shell32
Shell_NotifyIconW
SHAppBarMessage
user32
MoveWindow
CopyImage
SetMenuItemInfoW
GetMenuItemInfoW
DefFrameProcW
GetDlgCtrlID
FrameRect
RegisterWindowMessageW
GetMenuStringW
FillRect
SendMessageA
EnumWindows
ShowOwnedPopups
GetClassInfoExW
GetClassInfoW
GetScrollRange
SetActiveWindow
GetActiveWindow
DrawEdge
GetKeyboardLayoutList
LoadBitmapW
EnumChildWindows
UnhookWindowsHookEx
SetCapture
GetCapture
ShowCaret
CreatePopupMenu
GetMenuItemID
CharLowerBuffW
PostMessageW
SetWindowLongW
IsZoomed
SetParent
DrawMenuBar
GetClientRect
IsChild
IsIconic
CallNextHookEx
ShowWindow
GetWindowTextW
SetForegroundWindow
GetAsyncKeyState
IsDialogMessageW
DestroyWindow
RegisterClassW
EndMenu
CharNextW
GetFocus
GetDC
SetFocus
ReleaseDC
mouse_event
GetClassLongW
SetScrollRange
DrawTextW
PeekMessageA
MessageBeep
SetClassLongW
RemovePropW
GetSubMenu
DestroyIcon
IsWindowVisible
PtInRect
DispatchMessageA
UnregisterClassW
GetTopWindow
SendMessageW
GetComboBoxInfo
LoadStringW
CreateMenu
CharLowerW
SetWindowRgn
SetWindowPos
GetMenuItemCount
GetSysColorBrush
GetWindowDC
DrawTextExW
GetScrollInfo
SetWindowTextW
GetMessageExtraInfo
GetSysColor
EnableScrollBar
TrackPopupMenu
DrawIconEx
GetClassNameW
GetMessagePos
GetIconInfo
SetScrollInfo
GetKeyNameTextW
GetDesktopWindow
SetCursorPos
GetCursorPos
SetMenu
GetMenuState
GetMenu
SetRect
GetKeyState
IsRectEmpty
ValidateRect
GetCursor
KillTimer
WaitMessage
TranslateMDISysAccel
GetWindowPlacement
GetMenuItemRect
CreateIconIndirect
CreateWindowExW
GetDCEx
PeekMessageW
MonitorFromWindow
GetUpdateRect
SetTimer
WindowFromPoint
BeginPaint
RegisterClipboardFormatW
MapVirtualKeyW
OffsetRect
IsWindowUnicode
DispatchMessageW
CreateAcceleratorTableW
DefMDIChildProcW
GetSystemMenu
SetScrollPos
GetScrollPos
InflateRect
DrawFocusRect
ReleaseCapture
LoadCursorW
ScrollWindow
GetLastActivePopup
GetSystemMetrics
CharUpperBuffW
SetClipboardData
GetClipboardData
ClientToScreen
SetWindowPlacement
GetMonitorInfoW
CheckMenuItem
CharUpperW
DefWindowProcW
GetForegroundWindow
EnableWindow
GetWindowThreadProcessId
RedrawWindow
EndPaint
MsgWaitForMultipleObjectsEx
LoadKeyboardLayoutW
ActivateKeyboardLayout
GetParent
MonitorFromRect
InsertMenuItemW
GetPropW
MessageBoxW
SetPropW
UpdateWindow
MsgWaitForMultipleObjects
DestroyMenu
SetWindowsHookExW
EmptyClipboard
GetDlgItem
AdjustWindowRectEx
IsWindow
DrawIcon
EnumThreadWindows
InvalidateRect
GetKeyboardState
ScreenToClient
DrawFrameControl
SetCursor
CreateIcon
RemoveMenu
GetKeyboardLayoutNameW
OpenClipboard
TranslateMessage
MapWindowPoints
EnumDisplayMonitors
CallWindowProcW
CloseClipboard
DestroyCursor
CopyIcon
PostQuitMessage
ShowScrollBar
EnableMenuItem
HideCaret
FindWindowExW
MonitorFromPoint
LoadIconW
SystemParametersInfoW
GetWindow
GetWindowRect
GetWindowLongW
InsertMenuW
IsWindowEnabled
IsDialogMessageA
FindWindowW
GetKeyboardLayout
DeleteMenu
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
oleaut32
SysFreeString
VariantClear
VariantInit
GetErrorInfo
SysReAllocStringLen
SafeArrayCreate
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantChangeType
advapi32
RegSetValueExW
RegConnectRegistryW
RegEnumKeyExW
RegLoadKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegUnLoadKeyW
RegSaveKeyW
RegDeleteValueW
RegReplaceKeyW
RegFlushKey
RegQueryValueExW
RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegRestoreKeyW
msvcrt
memcpy
memset
kernel32
GetACP
CloseHandle
LocalFree
GetCurrentProcessId
SizeofResource
QueryPerformanceFrequency
IsDebuggerPresent
VirtualFree
GetFullPathNameW
GetProcessHeap
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
EnumSystemLocalesW
GetStdHandle
GetModuleHandleW
FreeLibrary
TryEnterCriticalSection
HeapDestroy
ReadFile
GetLastError
GetModuleFileNameW
SetLastError
GlobalAlloc
GlobalUnlock
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
MulDiv
FreeResource
GetVersion
RaiseException
GlobalAddAtomW
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
GlobalFindAtomW
VirtualQueryEx
GlobalFree
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
WritePrivateProfileStringW
GetStartupInfoW
GlobalDeleteAtom
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
InitializeCriticalSection
GetThreadPriority
GetCurrentProcess
SetThreadPriority
GlobalLock
VirtualAlloc
GetCommandLineW
GetSystemInfo
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
LCMapStringW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
EnumResourceNamesW
GetLocalTime
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
GetDateFormatW
TlsGetValue
SetErrorMode
IsValidLocale
TlsSetValue
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
CreateEventW
GetPrivateProfileStringW
WaitForMultipleObjectsEx
SetThreadLocale
GetThreadLocale
ole32
IsEqualGUID
OleInitialize
OleUninitialize
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
gdi32
Pie
SetBkMode
CreateCompatibleBitmap
GetEnhMetaFileHeader
RectVisible
AngleArc
ResizePalette
SetAbortProc
SetTextColor
GetTextColor
StretchBlt
RoundRect
SelectClipRgn
RestoreDC
SetRectRgn
GetTextMetricsW
GetWindowOrgEx
CreatePalette
CreateDCW
PolyBezierTo
CreateICW
GetStockObject
CreateSolidBrush
GetBkMode
Polygon
MoveToEx
PlayEnhMetaFile
Ellipse
StartPage
GetBitmapBits
StartDocW
AbortDoc
GetSystemPaletteEntries
GetEnhMetaFileBits
GetEnhMetaFilePaletteEntries
CreatePenIndirect
CreateFontIndirectW
PolyBezier
EndDoc
GetObjectW
GetCurrentObject
GetWinMetaFileBits
SetROP2
GetEnhMetaFileDescriptionW
ArcTo
Arc
SelectPalette
SetGraphicsMode
ExcludeClipRect
MaskBlt
SetWindowOrgEx
EndPage
DeleteEnhMetaFile
Chord
SetDIBits
GetViewportOrgEx
SetViewportOrgEx
CreateRectRgn
RealizePalette
SetDIBColorTable
GetDIBColorTable
CreateBrushIndirect
PatBlt
SetEnhMetaFileBits
Rectangle
SaveDC
DeleteDC
BitBlt
SetWorldTransform
FrameRgn
GetDeviceCaps
GetTextExtentPoint32W
GetClipBox
IntersectClipRect
Polyline
CreateBitmap
CombineRgn
SetWinMetaFileBits
GetStretchBltMode
CreateDIBitmap
SetStretchBltMode
GetDIBits
CreateDIBSection
ExtCreateRegion
LineTo
GetRgnBox
EnumFontsW
CreateHalftonePalette
SelectObject
DeleteObject
ExtFloodFill
UnrealizeObject
CopyEnhMetaFileW
SetBkColor
CreateCompatibleDC
GetBrushOrgEx
GetCurrentPositionEx
SetDCPenColor
GetNearestPaletteIndex
CreateRoundRectRgn
GetTextExtentPointW
ExtTextOutW
SetBrushOrgEx
GetPixel
GdiFlush
SetPixel
EnumFontFamiliesExW
StretchDIBits
GetPaletteEntries
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
106KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
113B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
84B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
219KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
418KB
Virtual Size
418KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
HelloUser-main/built.exe
- IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
- SHA256 761f138fffe8dd5045d0df00ce4477e73542101a2fec8052507476b9c7dec4c2
- MD5 f7cdc5d5b1da28ff832609ddcc65a575
- SHA1 16c0cf82dabfa88768dcc693784fb932de139c2c
- SHA512 a583fd0079e9960bee8b20c172b666e1336035175371bedd8d0ba0c2c51d4585b003eb6e19f376222033adb1c5d5d120621d97235c7041e69a4f6932a389e7ff
- SSDEEP 393216:/uqcsmcOCHDMWYsFl7dCR1C99rloYtusWBp28GP943ez2GDr86:/uqlXOYlFlUR1OrlqVFGPq3er1
- TLSH T12A0733E073DC44ABEAD6117B91CAE216CE31F8616B01C59BD3B8D2051C9B7B48D6BF18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsFree
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
177KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33145,
count=159, id=1, productName=Unmarked objects,
count=27, id=260, version=35225,
count=1, id=258, version=35225,
built.pyc
- SHA256 21115d3d556725c0731fc95e811d982215bcdd51ebca87e6d25e0ade7375696f
- MD5 9a41ba4acb8c7c62698be742a68bc092
- SHA1 b53ce4387141f46062c96775892dc69decfaab02
- SHA512 5415c4c416c9c15ed1bfc8903d565e02baac29dc1e12601e15ca4ecf66b813616a81aeb13d2d779b26581aeaebb70443fb4d852c4748403f074ffee9708183b5
- SSDEEP 1536:0oCrv8QJT5QMAzU0ow2Bdi+m+mPvswjHBkjRrfQ:05b8ET5Q9U0ow2BdtRmPvswd48
- TLSH T191534A523AF05C9DF309EBB6562B66E8E816755E708A4E8FE100FC207C8522BF6F5534
- MD5 SHA1 SHA512 SSDEEP TLSH
HelloUser-main/lgcy.exe
- IMPHASH b4d1f2d1ff81e1422a846265341502d1
- SHA256 f356d33deacc7af10786b58d0fd05914c8aa954995ef681284bcbbda75a67039
- MD5 6bca98a90111e0d61433e84e9dde40cb
- SHA1 4e3894b00b392632f0c59c64720ef92f0132c8d0
- SHA512 54e094f0c5e7b2e2c37f366de9079a4ed93327d50cedcaf5c0d4c5c192f42241d16b76511a79536afa1c056f42c3a81d23f332df30520002d64931a2ccc25131
- SSDEEP 1536:Tw6fPjLrkG01hoJd048P35+jYXmzK5nqd2vsYud/+4QRZJE9MBsyeJM/PYajBsmP:plmFBgNBYlhOSu8TGi
- TLSH T140A3E709F4A2152EC3A38037DF062556DDA13C5687999DFB23C1AEB65DE1AA43F3C702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
79472
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception
__current_exception_context
memmove
__C_specific_handler
memset
__std_exception_destroy
memcpy
__std_exception_copy
memcmp
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
api-ms-win-crt-string-l1-1-0
strlen
isdigit
isxdigit
api-ms-win-crt-convert-l1-1-0
wcstombs
strtol
api-ms-win-crt-runtime-l1-1-0
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
_crt_atexit
terminate
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_errno
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
kernel32
GetCurrentThreadId
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
Name
.text
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=27, id=261, version=35721,
count=7, id=257, version=35721,
count=2, id=257, version=33145,
count=64, id=1, productName=Unmarked objects,
count=1, id=265, version=36244,
count=1, id=258, version=36244,
HelloUser-main/lgcynbew.exe
- IMPHASH 20c55d66e9ef9cc9de77a7f537597372
- SHA256 745b8185fbf7a7625ad29e328212ee642b131d7850c17b24d6d225f4264d5786
- MD5 c6a125a8599ae505b25b9b2e98cbb13e
- SHA1 aff2614851db671f613c6b7cf05b20e53f6e602a
- SHA512 8b652c54a46b4d8b975c37647f921c26a0794882cad6ac6eb4b5ca9edb2c2ae347dd51d40a40aa2461cb408d58dc977d7b8f29aa63f3ea5c7f448f93115b0e27
- SSDEEP 1536:oJNYly2m9ZtmIDI/1FPMbfev/1itLuBZEnRih3e8plqTkv+GG4hXlVuJ2Fm9evev:oNp8VHEGG7EmLBb2ySiHH
- TLSH T1E1A3090AE5A2257EC3A7C03ACE061545EAA07C5957985EFBA3C18EB54CF19A03F3D713
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
79168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception
__current_exception_context
memmove
__C_specific_handler
memset
__std_exception_destroy
memcpy
__std_exception_copy
memcmp
__std_terminate
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
api-ms-win-crt-string-l1-1-0
strlen
isdigit
isxdigit
api-ms-win-crt-convert-l1-1-0
wcstombs
strtol
api-ms-win-crt-runtime-l1-1-0
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
_crt_atexit
terminate
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_errno
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
kernel32
GetCurrentThreadId
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
Name
.text
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=27, id=261, version=35721,
count=7, id=257, version=35721,
count=2, id=257, version=33145,
count=64, id=1, productName=Unmarked objects,
count=1, id=265, version=36246,
count=1, id=258, version=36246,
HelloUser-main/lnew.exe
- IMPHASH b4d1f2d1ff81e1422a846265341502d1
- SHA256 20c0fb21f144d02ca4b570a2539a3500912504b795ffc656266a161d4133f774
- MD5 df54ad6079cbedd5169281254a2c66f1
- SHA1 88c4ca75cf46097fbd1ee79269dab63446a53e7b
- SHA512 98b00ab9ccd73dc097fa8cbc8dd85a4601ce0377d264114d5fffa8dad89f196cc8d842558b2749d64cd9f76e1009e11fe41c98ddf233bae69a735206f9dcc7e7
- SSDEEP 1536:7BUyJE4WAYD4R3bvyP5DQpAnwTXVtETOq9a3zuIQrtGjsHWu6i5MIPoBsL71qveG:RWAFNWvkeC4rW9uQ54
- TLSH T1B7A30909E9A2116EC3B78037DE462956CEA13C4547899DFB63C1DEB65CE1AA43F3C702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
79184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception
__current_exception_context
memmove
__C_specific_handler
memset
__std_exception_destroy
memcpy
__std_exception_copy
memcmp
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
api-ms-win-crt-string-l1-1-0
strlen
isdigit
isxdigit
api-ms-win-crt-convert-l1-1-0
wcstombs
strtol
api-ms-win-crt-runtime-l1-1-0
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
_crt_atexit
terminate
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_errno
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
kernel32
GetCurrentThreadId
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
Name
.text
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=27, id=261, version=35721,
count=7, id=257, version=35721,
count=2, id=257, version=33145,
count=64, id=1, productName=Unmarked objects,
count=1, id=265, version=36246,
count=1, id=258, version=36246,