BotMonster_v2.8.zip
- SHA256 4cfe278f7f93048d0e247a301f43fdfac738ac3e5b62c8d445d7f5241c69103a
Password
2026
Overview
overview
10Static
static
5BotMonster_v2.8.zip
windows10-2004-x64
3BotMonster_v2.8.zip
windows11-ltsc_2024-x64
1BotMonster...er.exe
windows10-2004-x64
10BotMonster...er.exe
windows11-ltsc_2024-x64
10BotMonster...er.dll
windows10-2004-x64
1BotMonster...er.exe
windows10-2004-x64
1BotMonster...pi.dll
windows10-2004-x64
1BotMonster...er.exe
windows10-2004-x64
1Behavioral task
behavioral1
Sample
BotMonster_v2.8.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
BotMonster_v2.8.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
BotMonster_v2.8/BotMonsterLaunher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
BotMonster_v2.8/BotMonsterLaunher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
BotMonster_v2.8/bot_loader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
BotMonster_v2.8/data/mapper.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
BotMonster_v2.8/data/sqmapi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
BotMonster_v2.8/patcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target BotMonster_v2.8.zip
- Size 4.2MB
- Sample260712-flcsfacz5j
- SHA256 4cfe278f7f93048d0e247a301f43fdfac738ac3e5b62c8d445d7f5241c69103a
- MD5 723d78767b974fa6f8cf9136b9724c1a
- SHA1 61f67d5e84bc187a699afc1d8479aa15f7861d0a
- SHA512 9c03788c631f3008fd31873a5f7f26c8c8c348ffdee891332aafcba1b8d425d75e44984410dddd0c4e0ee6a5e5a91adb20db510832c992dbaa24c792cf269570
- SSDEEP 98304:n2h7e7e4lGAfSLmSF0+5r6nhAQMJubbd5UW47te+rjs3n:21e7e0/fSiSmKr6h5/d5UWmjYn
- TLSH T1001633E0EEFF6D04D223817FA10694992E62FBD9607C95EE97A1E4C1C5F4393692B4C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/BotMonster_v2.8/BotMonsterLaunher.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/BotMonster_v2.8/BotMonsterLaunher.exe unpack001/BotMonster_v2.8/bot_loader.dll unpack001/BotMonster_v2.8/patcher.dll
File Explorer
-
BotMonster_v2.8.zip.zip 4.2MB
-
BotMonster_v2.8/BotMonsterLaunher.exe.exe 3.4MB
-
BotMonster_v2.8/bot_loader.dll.dll 447KB
-
BotMonster_v2.8/data/mapper.dll.exe 817KB
-
BotMonster_v2.8/data/sqmapi.dll.dll 48KB
-
BotMonster_v2.8/patcher.dll.exe 219KB
BotMonster_v2.8/BotMonsterLaunher.exe
- SHA256 7e7ef5b1cc82799cff8ac357bc6f7b3e5c1bfc4275b0c93da61db7e458d611e8
- MD5 4e9def021931e28ae897bcb608b537db
- SHA1 ae588dce549e626c8e4f48a59a774d6340f6d9e0
- SHA512 c860c4b9a4f1033d55b6c3da9fe64f870aeb47a87dce7fe63e24163ca3d0cf40fb14782f5d5c6390d0845baf30b782fc1663f186fb4987b2ecfdd54f866e6223
- SSDEEP 98304:uWa3rTPf3V/GaurmP1jDvQ8FIrygnddybYX9p4:u3rTHQaqm9w+YDrta
- TLSH T1C3F5339611B70779EA2052B07F86B6C9588B0E738593183097EFA7395E3ECD453AF708
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
12932144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
8.9MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
BotMonster_v2.8/bot_loader.dll
- IMPHASH d28b3ab417795ac0656fb3b981127d8a
- SHA256 17c70f7c3e80812ec6f9e3c47215bc8a3fa8e34ebdcc5329d1a7815ce3bc7c44
- MD5 622389d5e1235eca8eb4a7b6e5121f88
- SHA1 363416b0855f8935505430b66cc414f4a7172d5b
- SHA512 1a5b0ce20346fe43a97f7109e418a93243175883ea0e0a26068936d375892901465e48f32607cef31615935ce4756c213791dad164fedb25b0e4e20ebb741c72
- SSDEEP 6144:kYgwl+/0uZgXSKl6qr9eTVtMZpA8IXJmpDXkxeq7T6ac:ki+/0uZgt6qvcltxeO
- TLSH T1D9A4281CAFE858A4D166C135D997A301E2B178646F11F7CF125086BE8FE3BD868387B4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
10
Entry point
92320
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ieshims.pdb
msvcrt
_stricmp
__C_specific_handler
calloc
_XcptFilter
_amsg_exit
fclose
_wfopen
?terminate@@YAXXZ
memmove
memcmp
_CxxThrowException
fputws
wcsncmp
_wcsicmp
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
_vsnprintf_s
_vscwprintf
_vsnwprintf
wcsrchr
_initterm
wcsstr
_wcslwr
wcspbrk
wcschr
memmove_s
towlower
iswctype
wcsspn
memcpy_s
realloc
free
wcstok_s
iswspace
_wcsnicmp
malloc
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
memset
__CxxFrameHandler3
wcscmp
kernel32
InitializeCriticalSectionAndSpinCount
DelayLoadFailureHook
ResolveDelayLoadedAPI
RaiseException
QueryFullProcessImageNameW
GetLogicalDriveStringsW
QueryDosDeviceW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
OpenFileMappingW
IsWow64Process
GetTickCount64
OpenProcess
CreateMutexW
InitializeCriticalSection
InitializeSRWLock
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
OutputDebugStringA
GetModuleHandleA
SetEnvironmentVariableW
GetCurrentProcess
DuplicateHandle
CopyFileExW
SetFileAttributesW
DeviceIoControl
GetFileInformationByHandle
CreateDirectoryW
lstrcmpiW
EncodePointer
FindClose
FindNextFileW
FindFirstFileW
TlsFree
VirtualProtect
GetCurrentThreadId
GetModuleHandleExW
GetModuleFileNameW
SearchPathW
GetFileAttributesW
SetLastError
LocalAlloc
VirtualQuery
GetCurrentDirectoryW
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetCurrentProcessId
GetProcessId
GetLastError
TlsSetValue
ExitThread
GetProcessIdOfThread
GetThreadId
HeapAlloc
GetProcessHeap
HeapFree
FormatMessageW
GetSystemDirectoryW
GetWindowsDirectoryW
GetLongPathNameW
GetFullPathNameW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetModuleFileNameA
DebugBreak
GetModuleHandleW
IsDebuggerPresent
OutputDebugStringW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
CloseHandle
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
OpenSemaphoreW
CreateThreadpoolTimer
CreateMutexExW
LeaveCriticalSection
CreateSemaphoreExW
LoadLibraryA
RaiseFailFastException
TlsGetValue
TlsAlloc
OpenEventW
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
TerminateProcess
DecodePointer
CreateFileW
GetFileSizeEx
api-ms-win-downlevel-shlwapi-l1-1-0
StrCmpNIA
StrCmpNCW
PathSkipRootW
PathIsUNCW
StrCmpICW
StrCmpCW
StrCmpICA
StrDupW
StrCmpNICW
PathGetArgsW
PathFindFileNameW
StrCmpIW
api-ms-win-downlevel-advapi32-l1-1-0
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegGetValueW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueW
ntdll
RtlNtStatusToDosError
NtQueryObject
iertutil
ord137
ord45
ord58
ord793
ord916
ord791
ord820
ord170
ord50
ord134
ord101
AcRedirNotify
AcRedirNotifySetEnabled
AcRedirSetEnabled
IEShims_AdminCheckAndLaunch
IEShims_CreateWindowEx
IEShims_GetOriginatingThreadId
IEShims_InDllMainContext
IEShims_Initialize
IEShims_SetRedirectRegistryForThread
IEShims_Uninitialize
Name
.text
Size
275KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
115KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=19, id=260, version=27412,
count=267, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=77, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
BotMonster_v2.8/data/mapper.dll
- IMPHASH 7534c642bdcb1528e25e71d0ce72d8bb
- SHA256 254f32e153f83e5f32060d270402ecfbdd5ee0d9088276d81abd24c2e13ba7ea
- MD5 fc4ce1e98125e7e30af6bc2d4a10250d
- SHA1 cc7e3f18771a3944cb08eca03ae7d5062b911ffd
- SHA512 22f9eed7ed428b143cee4b798ad63d56880e2aba8454d62e56045afc9c2e86e64534a9431440ded5db0292626efe5f7891ef79bca629e93df9b8b699ce4cd525
- SSDEEP 24576:b5P4lGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMMVd:bHMMHMMMvMMZMMMlmMMMiMMMYJMMHMML
- TLSH T199056C42F7C8D495E0B706318933CB654672FC659E20866F3199771E2E723C36AB2E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
2026
Digest
bc:05:d9:54:b9:17:9d:6d:2c:d8:87:a2:bc:41:05:2a:57:33:22:4e:7e:97:83:b6:0b:33:b0:ec:1d:b7:53:f3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:a6:58:10:67:4b:3d:6c:7c:f6:00:00:00:00:05:a6
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 22, 2024 - Jul 5, 2025
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f9:1f:67:8d:75:ab:a4:f1:b1:00:01:00:00:01:f9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
10352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
iexplore.pdb
user32
GetWindowThreadProcessId
AllowSetForegroundWindow
FindWindowExW
SendMessageTimeoutW
IsWindowVisible
SetUserObjectInformationW
IsWindowEnabled
msvcrt
_onexit
__dllonexit
_unlock
_lock
memset
_commode
__C_specific_handler
_vsnwprintf
memcpy_s
iswspace
?terminate@@YAXXZ
_purecall
memmove_s
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
wcsncmp
free
_XcptFilter
_amsg_exit
__wgetmainargs
memcmp
kernel32
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
HeapSetInformation
WaitForSingleObjectEx
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetProcAddress
HeapAlloc
OpenSemaphoreW
IsDebuggerPresent
AcquireSRWLockExclusive
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW
Sleep
CloseThreadpoolTimer
SetDllDirectoryW
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
LocalFree
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
GetCommandLineW
GetCurrentProcess
ReleaseSemaphore
GetModuleHandleExW
TerminateProcess
LeaveCriticalSection
InitializeCriticalSection
SetErrorMode
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
LocalAlloc
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
CreateMutexExW
api-ms-win-downlevel-advapi32-l1-1-0
RegGetValueW
EventRegister
EventWriteTransfer
EventWriteEx
EventUnregister
api-ms-win-downlevel-shell32-l1-1-0
SetCurrentProcessExplicitAppUserModelID
advapi32
EventSetInformation
iertutil
ord650
ord791
ord797
ord798
ord701
ord597
ord796
ord793
ord594
ord398
api-ms-win-downlevel-shlwapi-l1-1-0
StrStrIW
api-ms-win-downlevel-ole32-l1-1-0
CoCreateGuid
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
757KB
Virtual Size
757KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=20, id=260, version=27412,
count=5, id=261, version=27412,
count=13, id=257, version=27412,
count=156, id=1, productName=Unmarked objects,
count=11, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
BotMonster_v2.8/data/sqmapi.dll
- IMPHASH d6cca9daf1f9f60889b9b319d3ded266
- SHA256 8c3c3ba91869d27872c3b373857fdf49d68e04cda1a0de39289cb56936fb78d3
- MD5 abb02cf4f95140471eed4adc012645ce
- SHA1 3651e7be8921661c55ba434e4620f19c455016be
- SHA512 4b480fffce172015d92424a835f0c2e1431cad41eb459b87a7da54947e749970fe9530921917fbc1155958bf138232deaebf7cc15f7c1c1863468a9ba3896685
- SSDEEP 768:DmuzodxqlL1ilAb+AxSeyoRTY8RYISZpoiq+ff9n6ee2jFgd1PfF29z4J:DfmUwtoRs5rff96OOLPfFCz4J
- TLSH T105237C86E3BC2095F1775778C165561BFA7636292B00E6EF0270C26C2F13BE49B34B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
2026
Digest
3a:a4:34:84:2a:a4:11:84:c6:da:f0:69:3e:49:ef:ef:90:f6:5e:72:d6:7d:32:42:f7:8e:cc:75:35:ab:c9:71
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e3:df:bd:9b:9a:1c:68:83:22:00:01:00:00:01:e3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
sqmapi.pdb
msvcrt
_unlock
_lock
__dllonexit
_onexit
_initterm
_amsg_exit
_XcptFilter
memcpy_s
__C_specific_handler
wcsrchr
_vsnwprintf
__CxxFrameHandler3
_callnewh
malloc
free
memset
advapi32
RegDeleteKeyW
RegEnumKeyW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
kernel32
OpenSemaphoreW
HeapAlloc
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
DebugBreak
IsDebuggerPresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
OutputDebugStringW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
SetLastError
GetLastError
GetCurrentProcess
CloseHandle
LocalFree
ExpandEnvironmentStringsW
FindFirstFileW
DeleteFileW
FindNextFileW
GetSystemDirectoryW
Sleep
CreateDirectoryW
GetTickCount
WaitForSingleObjectEx
GetSystemTimeAsFileTime
FormatMessageW
FindClose
ntdll
EtwTraceMessage
SqmAddToAverage
SqmAddToStream
SqmAddToStreamDWord
SqmAddToStreamDWord64
SqmAddToStreamString
SqmAddToStreamV
SqmCheckEscalationAddToStreamDWord
SqmCheckEscalationAddToStreamDWord64
SqmCheckEscalationAddToStreamString
SqmCheckEscalationSetDWord
SqmCheckEscalationSetDWord64
SqmCheckEscalationSetString
SqmCleanup
SqmClearFlags
SqmCreateNewId
SqmEndSession
SqmEndSessionEx
SqmFlushSession
SqmGetEnabled
SqmGetEscalationRuleStatus
SqmGetFlags
SqmGetInstrumentationProperty
SqmGetLastUploadTime
SqmGetMachineId
SqmGetSession
SqmGetSessionStartTime
SqmGetUserId
SqmIncrement
SqmIsNamespaceEnabled
SqmIsWindowsOptedIn
SqmLoadEscalationManifest
SqmReadSharedMachineId
SqmReadSharedUserId
SqmSet
SqmSetAppId
SqmSetAppVersion
SqmSetBits
SqmSetBool
SqmSetCurrentTimeAsUploadTime
SqmSetDWord64
SqmSetEnabled
SqmSetEscalationInfo
SqmSetFlags
SqmSetIfMax
SqmSetIfMin
SqmSetMachineId
SqmSetString
SqmSetUserId
SqmStartSession
SqmStartUpload
SqmStartUploadEx
SqmSysprepCleanup
SqmSysprepGeneralize
SqmTimerAccumulate
SqmTimerAddToAverage
SqmTimerRecord
SqmTimerStart
SqmUnattendedSetup
SqmUnloadEscalationManifest
SqmWaitForUploadComplete
SqmWriteSharedMachineId
SqmWriteSharedUserId
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=253, version=27412,
count=11, id=260, version=27412,
count=3, id=259, version=27412,
count=137, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=20, id=269, version=27412,
count=3, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
BotMonster_v2.8/patcher.dll
- IMPHASH d9652e955db76ba3eebab87845bb3f85
- SHA256 3099b6cf67191b1a7e4d8463576fe85835e8df2296dba3470b0cd42babd336c8
- MD5 d831180f7596e0d2bb87b2cc57ecfca2
- SHA1 472a9d3f90a50222d4944c70422734f4955f15a1
- SHA512 879446f600f21135c6e0ed3df8991906f6213569f72f701cb97ce0acd52a1187e0a0faf484e50ed22ab8ea64d1217c65a2ff1b693aa06f5993532ca163f5a6b7
- SSDEEP 3072:VstD7trOt9pfslMYO9mXn9H0LeinObM6gZy5ChoTic:Vw1rOt9pdYamXnrdbMKw
- TLSH T129249DC3B44D64E4E8AA0935043E4C154A67BE9D0798299F36CB7B1E1FB72C36173A83
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
10
Entry point
10064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ielowutil.pdb
kernel32
CreateThread
HeapSetInformation
CreateEventW
GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetCurrentProcess
GetProcessHeap
HeapAlloc
ResetEvent
CloseHandle
GetProcAddress
RaiseException
RaiseFailFastException
MapViewOfFile
GetLastError
IsWow64Process
OpenEventW
GetModuleFileNameW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
TerminateProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
UnmapViewOfFile
WaitForSingleObject
SetLastError
HeapFree
SetEvent
OpenFileMappingW
Sleep
user32
MsgWaitForMultipleObjects
PostQuitMessage
DispatchMessageW
TranslateMessage
PeekMessageW
msvcrt
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_XcptFilter
_fmode
_commode
?terminate@@YAXXZ
_amsg_exit
_wcsnicmp
memset
_wtoi
_wcmdln
wcstok_s
_vsnwprintf
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
ole32
CoUninitialize
CoCreateInstance
CLSIDFromString
CoInitializeSecurity
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
wininet
InternetSetCookieExW
InternetGetCookieExW
iertutil
ord466
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
540B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
203KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=261, version=27412,
count=2, id=259, version=27412,
count=21, id=260, version=27412,
count=23, id=257, version=27412,
count=149, id=1, productName=Unmarked objects,
count=14, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,