DiorSyntax.zip
- SHA256 fcd0001889f2b7d1355f4d09031d4d52875b28ed2a72519d2eabb879991f29b9
Overview
overview
8Static
static
3DiorSyntax.zip
windows10-2004-x64
1DiorSyntax.zip
windows11-ltsc_2024-x64
1DiorSyntax...AX.exe
windows10-2004-x64
1DiorSyntax...AX.exe
windows11-ltsc_2024-x64
1DiorSyntax...er.exe
windows10-2004-x64
7DiorSyntax...er.exe
windows11-ltsc_2024-x64
7updater.pyc
windows10-2004-x64
3updater.pyc
windows11-ltsc_2024-x64
3DiorSyntax...E!.txt
windows10-2004-x64
1DiorSyntax...E!.txt
windows11-ltsc_2024-x64
1DiorSyntax...s.json
windows10-2004-x64
3DiorSyntax...s.json
windows11-ltsc_2024-x64
3DiorSyntax...64.dll
windows10-2004-x64
1DiorSyntax...64.dll
windows11-ltsc_2024-x64
1DiorSyntax/ffmpeg.exe
windows10-2004-x64
1DiorSyntax/ffmpeg.exe
windows11-ltsc_2024-x64
1DiorSyntax/imgui.ini
windows10-2004-x64
1DiorSyntax/imgui.ini
windows11-ltsc_2024-x64
8DiorSyntax...ow.m4a
windows10-2004-x64
6DiorSyntax...ow.m4a
windows11-ltsc_2024-x64
1DiorSyntax...ba.m4a
windows10-2004-x64
6DiorSyntax...ba.m4a
windows11-ltsc_2024-x64
1DiorSyntax...am.m4a
windows10-2004-x64
6DiorSyntax...am.m4a
windows11-ltsc_2024-x64
1DiorSyntax...am.wav
windows10-2004-x64
6DiorSyntax...am.wav
windows11-ltsc_2024-x64
1DiorSyntax...s.json
windows10-2004-x64
3DiorSyntax...s.json
windows11-ltsc_2024-x64
3DiorSyntax/yt-dlp.exe
windows10-2004-x64
7DiorSyntax/yt-dlp.exe
windows11-ltsc_2024-x64
7__main__.pyc
windows10-2004-x64
3__main__.pyc
windows11-ltsc_2024-x64
8Behavioral task
behavioral1
Sample
DiorSyntax.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
DiorSyntax.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
DiorSyntax/DIORSYNTAX.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
DiorSyntax/DIORSYNTAX.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
DiorSyntax/OffsetsUpdater/DiorOffsetUpdater.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
DiorSyntax/OffsetsUpdater/DiorOffsetUpdater.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral7
Sample
updater.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
updater.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
DiorSyntax/OffsetsUpdater/IMPORTANTE!.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
DiorSyntax/OffsetsUpdater/IMPORTANTE!.txt
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
DiorSyntax/OffsetsUpdater/offsets.json
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral12
Sample
DiorSyntax/OffsetsUpdater/offsets.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral13
Sample
DiorSyntax/VMProtectSDK64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
DiorSyntax/VMProtectSDK64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
DiorSyntax/ffmpeg.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
DiorSyntax/ffmpeg.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
DiorSyntax/imgui.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral18
Sample
DiorSyntax/imgui.ini
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral19
Sample
DiorSyntax/music/flow.m4a
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral20
Sample
DiorSyntax/music/flow.m4a
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral21
Sample
DiorSyntax/music/rumba.m4a
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral22
Sample
DiorSyntax/music/rumba.m4a
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral23
Sample
DiorSyntax/music/stream.m4a
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral24
Sample
DiorSyntax/music/stream.m4a
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral25
Sample
DiorSyntax/music/stream.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral26
Sample
DiorSyntax/music/stream.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral27
Sample
DiorSyntax/offsets.json
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral28
Sample
DiorSyntax/offsets.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral29
Sample
DiorSyntax/yt-dlp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral30
Sample
DiorSyntax/yt-dlp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral31
Sample
__main__.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral32
Sample
__main__.pyc
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
General
- Target DiorSyntax.zip
- Size 131.9MB
- Sample260716-rm127sft4k
- SHA256 fcd0001889f2b7d1355f4d09031d4d52875b28ed2a72519d2eabb879991f29b9
- MD5 7d171ecd9f8901b09da748381be4317d
- SHA1 88c4c1e178c4984eb0611bf03769f3b2bf565910
- SHA512 a3b1b26fcd5271be61cb38706fce8c544a8dc822b75ea3cc93653918dcb729ebb24dd547e1787518cb6e421984810ca6eaddf3f2988de58cf835de64d4bbf61a
- SSDEEP 3145728:iqACfHJi5mCkdq3fcmdgDlDxAu+pQeeZ9bVhfGJuNz:iqACfHpdd1CucQzZ9Deyz
- TLSH T14E6833D150117885B819F472ACF1AB406374797CB0192CA7DF76E29E38E3A76CFA3909
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 2 IoCs
resource yara_rule static1/unpack001/DiorSyntax/OffsetsUpdater/DiorOffsetUpdater.exe pyinstaller static1/unpack001/DiorSyntax/yt-dlp.exe pyinstaller - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/DiorSyntax/DIORSYNTAX.exe unpack001/DiorSyntax/OffsetsUpdater/DiorOffsetUpdater.exe unpack001/DiorSyntax/VMProtectSDK64.dll unpack001/DiorSyntax/ffmpeg.exe unpack001/DiorSyntax/yt-dlp.exe
File Explorer
-
DiorSyntax.zip.zip 131.9MB
-
DiorSyntax/DIORSYNTAX.exe.exe 9.5MB
-
DiorSyntax/OffsetsUpdater/DiorOffsetUpdater.exe.exe 11.8MB
-
updater.pyc24KB
-
DiorSyntax/OffsetsUpdater/IMPORTANTE!.txt248B
-
DiorSyntax/OffsetsUpdater/offsets.json9KB
-
DiorSyntax/VMProtectSDK64.dll.dll 116KB
-
DiorSyntax/ffmpeg.exe.exe 193.1MB
-
DiorSyntax/imgui.ini1KB
-
DiorSyntax/music/flow.m4a3.5MB
-
DiorSyntax/music/rumba.m4a2.2MB
-
DiorSyntax/music/stream.m4a2.4MB
-
DiorSyntax/music/stream.wav26.6MB
-
DiorSyntax/offsets.json9KB
-
DiorSyntax/yt-dlp.exe.exe 17.6MB
-
__main__.pyc371B
DiorSyntax/DIORSYNTAX.exe
- IMPHASH 5c5a390ef6b266ff6d719949b5006692
- SHA256 8d1d20dd4271f8f5ad47b5480e2431dbe2a299bf33433175e939bc9b2c8b1579
- MD5 0e80522dac9623aa20e2f2e18843dc63
- SHA1 0a494dbef743eea61693e78a1422c5f391448166
- SHA512 904386fd64e7a5c0c71904b75458b51e70002b973e5d70cbfc87394dede5c390820195844783dc70d4062464d54d8c295de4643a801efd21c3f6876304393d03
- SSDEEP 49152:eNkuRBrlu4O5JoIN2IxuyxEBc48dHAV2gvZ2MAOG3GQlcjpYwJZ1fFmzcGf9uHAO:52sZCHJZnmzpVlG32wK
- TLSH T1BFA6B55976EA0091D2B9C039E503972BED713099433C95FB93818DC9AF707E8AE7CB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3713364
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\User\Desktop\todo\Amber\DIORSYNTAX\x64\Debug\DIORSYNTAX.pdb
kernel32
GetTickCount
GetCurrentDirectoryA
OutputDebugStringA
CloseHandle
WaitForSingleObject
CreateProcessA
GetTickCount64
GetModuleHandleW
GetStdHandle
IsDebuggerPresent
CheckRemoteDebuggerPresent
SetUnhandledExceptionFilter
GetLastError
SetErrorMode
CreateMutexA
Sleep
GetCurrentProcess
GetCurrentProcessId
ExitProcess
TerminateProcess
GetCurrentThread
GetCurrentThreadId
GetThreadContext
GetLocalTime
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
GetModuleFileNameW
GlobalFindAtomA
GetConsoleMode
SetConsoleMode
FlushConsoleInputBuffer
SetConsoleTextAttribute
GetConsoleWindow
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Thread32First
Thread32Next
Module32FirstW
Module32NextW
SwitchToThread
SetThreadPriority
SetThreadAffinityMask
DuplicateHandle
GetProcessId
OpenProcess
GetConsoleScreenBufferInfo
K32EnumProcessModules
K32GetModuleFileNameExW
K32GetModuleInformation
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
VirtualProtect
CreateProcessW
GetExitCodeProcess
HeapQueryInformation
SetFilePointerEx
ReadConsoleW
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
IsThreadAFiber
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetConsoleCtrlHandler
OutputDebugStringW
GetCommandLineW
GetCommandLineA
WriteFile
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
GetSystemInfo
HeapValidate
HeapSize
WriteConsoleW
GetFileType
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
LoadLibraryExW
RtlUnwindEx
GetCPInfo
CompareStringEx
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
CloseThreadpoolWait
SetThreadpoolWait
WideCharToMultiByte
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetLocaleInfoA
MultiByteToWideChar
LoadLibraryA
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
GetProcAddress
GetModuleHandleA
CreateThreadpoolTimer
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
FreeLibrary
QueryPerformanceFrequency
QueryPerformanceCounter
GetTimeZoneInformation
VerSetConditionMask
InitOnceExecuteOnce
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetEndOfFile
RtlCaptureStackBackTrace
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceComplete
InitOnceBeginInitialize
RtlPcToFileHeader
WakeConditionVariable
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CopyFileW
CreateFileA
GetFileSizeEx
ReadFile
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
RaiseException
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
FormatMessageA
GetLocaleInfoEx
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
GetTempPathW
AreFileApisANSI
DeviceIoControl
CreateDirectoryExW
user32
TrackMouseEvent
GetMessageExtraInfo
GetKeyState
GetCapture
SetCapture
ReleaseCapture
IsWindowUnicode
ScreenToClient
LoadCursorW
MonitorFromWindow
SetProcessDPIAware
GetKeyboardLayout
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
TranslateMessage
GetForegroundWindow
GetDC
ReleaseDC
GetClientRect
SetCursorPos
SetCursor
GetCursorPos
OpenClipboard
SetForegroundWindow
DispatchMessageW
GetWindowThreadProcessId
GetDesktopWindow
ShowCursor
MapVirtualKeyA
mouse_event
SendInput
FindWindowA
SetWindowLongA
GetWindowLongA
GetWindowTextW
SetWindowTextW
GetMonitorInfoW
SetWindowLongW
GetWindowLongW
GetWindowRect
PeekMessageW
UpdateWindow
GetSystemMetrics
GetAsyncKeyState
BringWindowToTop
SetWindowDisplayAffinity
SetWindowPos
MoveWindow
SetLayeredWindowAttributes
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
DefWindowProcW
ClientToScreen
gdi32
CreateRectRgn
DeleteObject
GetDeviceCaps
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
ShellExecuteA
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
dwmapi
DwmGetColorizationColor
DwmEnableBlurBehindWindow
DwmIsCompositionEnabled
DwmExtendFrameIntoClientArea
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
winhttp
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpSetTimeouts
winmm
waveOutSetVolume
timeBeginPeriod
mciSendStringA
wininet
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetReadFile
Name
.textbss
Size
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
7.2MB
Virtual Size
7.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
31KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
408KB
Virtual Size
407KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
1024B
Virtual Size
563B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=205, id=261, version=33145,
count=36, id=260, version=33145,
count=28, id=259, version=33145,
count=1, id=253, version=35207,
count=14, id=259, version=35207,
count=20, id=260, version=35207,
count=113, id=261, version=35207,
count=4, id=156, version=21202,
count=27, id=260, version=32822,
count=21, id=257, version=33145,
count=309, id=1, productName=Unmarked objects,
count=50, id=261, version=35223,
count=1, id=255, version=35223,
count=1, id=151,
count=1, id=258, version=35223,
DiorSyntax/OffsetsUpdater/DiorOffsetUpdater.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 6925df0e49811cf6c638cd68f2ab34392b2fc5535d8f72ecd67b5c78b1cb7529
- MD5 b5d7cb65ba66896d0f8f45c1cbe4017d
- SHA1 01747bbef7221bd84efca1a339b8983ba599adbe
- SHA512 cf984c1000944f2c9d7640896f30d1c095c25a98d3e15acc63679c636e8af4b3afc992f7bc863fc1eb23a5ec30180ec6cbcca6cbf3f511b93f85920c51922977
- SSDEEP 196608:uAAE6PkSTYtbW897G6x7eovq5XMP6PzFc4euky97WPHsoq1bRjMFQG:xFu9U1bdq1B7ZeXygPHsoq1bpiZ
- TLSH T122C6338523960991F89FB33D65C14A9BC2E1B4201771CADB1BF08EB82D672E5EE31F51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
updater.pyc
- SHA256 a240bbc5fb12ab9f1164e1e9cabd8a44a9d8201cd878649a28be0648132c57e6
- MD5 dddfa35c4372d957db779623e88749de
- SHA1 054826694d8f3737c790fd561d85498b65a788a8
- SHA512 5d8297f55e99c8cfc0cb103cf1b00c35100872d9bf2a607cd47331f5c1774edc2846107264dc078df02d53e9b6d15114b91e89c247f474bc993a7a67c74f83a4
- SSDEEP 384:nuXN6jklv16uqZ4GJDRFa4W5ADK1L+WQBar+ZSJDYMWt1QZSMXVUjc6:u96YDq+sq/5A2zrpJDYMWg1Vsc6
- TLSH T140B22AB89910E473FEAAFB3E32E392516B720146B540C743E2785CBD1CE6265451E31E
- MD5 SHA1 SHA512 SSDEEP TLSH
DiorSyntax/OffsetsUpdater/IMPORTANTE!.txt
- SHA256 d0bf33aca7af7d216dd6d15b2de9c64adcb5bc2960a12838a4e18a2bf938b62e
- MD5 9d5f5a530907aaf65784324ffeeed868
- SHA1 b66be6a63fe887e79122510eed9783363372d7ab
- SHA512 a8218a4c67bd401b3666261a86a8168ba8132436984a93eb09d5970f00fafeca314cc8389e1d4b09443685372068fb5506d17e0b5495cdf00e4b05d8504160e0
- TLSH T1BBD0977FAC00AD042259C64CA832F4A2DB065CE63800C0B31A8FC22D0525F388F8F1E8
- MD5 SHA1 SHA512 TLSH
DiorSyntax/OffsetsUpdater/offsets.json
- SHA256 7c90e9a42b9534bc9f5fa9dfdb9b6a9215101364504826afc586d5b0baf9606c
- MD5 7e48476b4816d24d962db05462b9839c
- SHA1 7e84a5aac47c216d5e8c61404b35717c19311c1b
- SHA512 291b6f7cc7d7a5abb2fe00f0315f6d4c74e2b4b6a7d3e7c0b8bf16fd790bd7ce669b6faeb92d74dd54db4102514b2147869624d6b6a03cc359c85d88e8c8655d
- SSDEEP 192:mI8lyeVzYmwxL9CsU2vqZr2bAE32E96fnuAIC5dvj1+UsD+W/1zvoE:mh9zUxLf4OQuh4v/sD//1zwE
- TLSH T12612782CDA608DA939BE63A4287C0707E620337751498A9B797C498C5F77E37018AF5F
- MD5 SHA1 SHA512 SSDEEP TLSH
DiorSyntax/VMProtectSDK64.dll
- IMPHASH 1851ff453adce0cef5274e320d5bed3c
- SHA256 cd2cdc90f423c9d23ee55a242d68a1731c12cc69877de45e913646356f25b597
- MD5 5cb50b816388efa581dc9cbf17c50f15
- SHA1 7f7299786f35c9658795f5739bbc14bd50f4bfe9
- SHA512 513ec1464a2b4222115f2590579349263487ba2d83382658b17123f7688deea915e30c29b863dca75194b7f0e0c82715c590dccd919fad4dc8f0438fac22ab03
- SSDEEP 3072:dmcqYHq7Aiytzg2ScpvgJcG5sqYX6UyHdlBS:40Hq7AiyegZgJZSXq9H
- TLSH T14EC36C57B3E540BBE1B6C679C8634A55D3B678150B24DBAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
8864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=124, id=243, version=40116,
count=14, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
DiorSyntax/ffmpeg.exe
- IMPHASH a349522f6a5ba1ccb4badb1226ec55ab
- SHA256 6a059f42b85f54d9a413185d05ec16b7b5e85304af0bddd381d64a91be00adec
- MD5 4059aca3ffcd4e1c2cc3d3641f21484e
- SHA1 7339ed58c2ca9b0fb24310f57871ad1c7f2c5b65
- SHA512 813e6a4649615f834f02c6d3eef8775a04675251fa909bf9c2e5d6c8bbddfcd1f1196e56a6d76f2a205f88bb810e08aa8b96db2f2c3ef062a19dd7933c3fb097
- SSDEEP 1572864:Yo740alpY/dYuI/N4RZtB6JJu6R0vz0EUwdcYS/aEHBt6w5Hnflkg+rkVRJsZRws:mAgiKY6un
- TLSH T1C0A85C4AF5F34F6AD82B857C42BBB731B528F45C53119B272388F6343A12B605B5BB18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEnumProvidersW
CryptExportKey
CryptGenRandom
CryptGetProvParam
CryptGetUserKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashW
DeregisterEventSource
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
GetUserNameA
InitializeSecurityDescriptor
OpenProcessToken
RegCloseKey
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegisterEventSourceW
ReportEventW
SetSecurityDescriptorDacl
avrt
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW
bcrypt
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider
cfgmgr32
CM_Get_Child
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Status
CM_Get_Device_IDW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_Sibling
CM_Locate_DevNodeW
CM_Open_DevNode_Key
crypt32
CertCloseStore
CertCreateCertificateContext
CertCreateSelfSignCertificate
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertOpenSystemStoreW
CertSetCertificateContextProperty
CertStrToNameA
CryptBinaryToStringA
CryptEncodeObjectEx
CryptHashCertificate2
CryptStringToBinaryA
d2d1
D2D1CreateFactory
dwrite
DWriteCreateFactory
gdi32
AddFontMemResourceEx
BitBlt
CombineRgn
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectW
CreateRectRgn
DeleteDC
DeleteObject
EnumFontFamiliesExW
EnumFontFamiliesW
GetDIBColorTable
GetDeviceCaps
GetObjectA
GetStockObject
GetTextFaceW
RemoveFontMemResourceEx
SelectObject
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
if_indextoname
if_nametoindex
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
AreFileApisANSI
CancelIoEx
CloseHandle
ConvertFiberToThread
ConvertThreadToFiberEx
CopyFileW
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiberEx
CreateFileA
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DebugBreak
DeleteCriticalSection
DeleteFiber
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitThread
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FormatMessageA
FormatMessageW
FreeLibrary
GetACP
GetActiveProcessorCount
GetCommandLineW
GetComputerNameA
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDriveTypeA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeThread
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSize
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetHandleInformation
GetLastError
GetLogicalDrives
GetLongPathNameA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadGroupAffinity
GetThreadPriority
GetThreadTimes
GetTickCount
GetTickCount64
GetTimeZoneInformation
GetUserDefaultLocaleName
GetVersion
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSRWLock
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
LockFileEx
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExA
MoveFileExW
MulDiv
MultiByteToWideChar
OpenFileMappingA
OpenProcess
OutputDebugStringA
PeekConsoleInputA
PeekNamedPipe
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleInputA
ReadConsoleW
ReadFile
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTextAttribute
SetDllDirectoryA
SetDllDirectoryW
SetErrorMode
SetEvent
SetFileCompletionNotificationModes
SetFilePointer
SetHandleInformation
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadAffinityMask
SetThreadContext
SetThreadDescription
SetThreadErrorMode
SetThreadGroupAffinity
SetThreadInformation
SetThreadPriority
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SignalObjectAndWait
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
SuspendThread
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFileEx
UnmapViewOfFile
UnregisterWait
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-convert-l1-1-0
atof
atoi
mbrtowc
mbsrtowcs
mbstowcs
strtod
strtof
strtol
strtoll
strtoul
strtoull
strtoumax
wcrtomb
wcstombs
wcstombs_s
wcstoul
api-ms-win-crt-environment-l1-1-0
__p__environ
_putenv_s
_wgetcwd
_wgetenv
getenv
getenv_s
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_access
_findclose
_findfirst64i32
_findnext64i32
_fullpath
_lock_file
_rmdir
_stat64
_stat64i32
_unlink
_unlock_file
_waccess
_wchdir
_wchmod
_wfindfirst64i32
_wfindnext64i32
_wfullpath
_wmkdir
_wremove
_wrename
_wrmdir
_wstat64
_wunlink
remove
rename
_wstat64i32
_unlink
_stat64i32
_stat64
_rmdir
_mkdir
_mkdir
_fstat64i32
_fstat64
_chmod
api-ms-win-crt-heap-l1-1-0
_aligned_free
_aligned_malloc
_aligned_realloc
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
_create_locale
_free_locale
localeconv
setlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
_hypot
acos
acosf
asin
asinf
asinhf
atan
atan2
atan2f
atanf
cbrt
cbrtf
ceil
ceilf
cos
cosf
cosh
erf
erff
exp
exp2
exp2f
expf
expm1
expm1f
fabs
floor
floorf
fma
fmaf
fmax
fmaxf
fmin
fminf
fmod
frexp
hypot
llrint
llround
llroundf
log
log10
log10f
log1p
log1pf
log2
log2f
logf
lrint
lrintf
lround
lroundf
modf
modff
nextafter
pow
powf
remainder
round
roundf
sin
sinf
sinh
sinhf
sqrt
sqrtf
tan
tanf
tanh
tanhf
trunc
_j1
_fdopen
api-ms-win-crt-multibyte-l1-1-0
_mbsrchr
api-ms-win-crt-private-l1-1-0
longjmp
memchr
memcmp
memcpy
memmove
strchr
strrchr
strstr
wcsrchr
wcsstr
__intrinsic_setjmp
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_assert
__p___argc
__p___argv
_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_endthreadex
_errno
_exit
_get_errno
_initialize_narrow_environment
_initterm
_initterm_e
_register_thread_local_exe_atexit_callback
_set_errno
_set_invalid_parameter_handler
_wassert
abort
exit
perror
raise
signal
strerror
strerror_s
_getpid
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vswprintf
_chsize_s
_close
_fileno
_ftelli64
_get_osfhandle
_locking
_lseeki64
_open
_read
_setmode
_sopen
_wfopen
_wopen
_write
_wsopen
_wtmpnam_s
clearerr
fclose
feof
ferror
fflush
fgetc
fgets
fopen_s
fputc
fputs
fputwc
fread
fseek
ftell
fwrite
getc
getchar
getwc
putc
putchar
puts
putwc
rewind
setbuf
setvbuf
ungetc
ungetwc
fopen
_write
_setmode
_read
_open
_lseeki64
_kbhit
_isatty
_isatty
_ftelli64
_fseeki64
_fseeki64
_fileno
_dup
_close
api-ms-win-crt-string-l1-1-0
iswctype
_strnicmp
_wcsicmp
isalnum
isalpha
isblank
iscntrl
isdigit
isprint
isspace
isupper
isxdigit
mbrlen
memset
strcat
strcmp
strcoll
strcpy
strcspn
strlen
strncat
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strspn
strtok
strtok_s
strxfrm
tolower
toupper
towlower
towupper
wcscat
wcscat_s
wcscmp
wcscoll
wcscpy
wcscpy_s
wcslen
wcsncmp
wcsncpy
wcsnlen
wcsxfrm
wctype
_wcsnicmp
_wcsdup
_strnicmp
_stricmp
_stricmp
_strdup
_strdup
api-ms-win-crt-time-l1-1-0
_ftime64
_ftime64_s
_gmtime64
_gmtime64_s
_localtime64
_localtime64_s
_mktime64
_time32
_time64
_wutime64
clock
strftime
wcsftime
api-ms-win-crt-utility-l1-1-0
bsearch
div
qsort
rand
rand_s
srand
ncrypt
NCryptCreatePersistedKey
NCryptDeleteKey
NCryptExportKey
NCryptFinalizeKey
NCryptFreeObject
NCryptImportKey
NCryptOpenStorageProvider
NCryptSetProperty
ntdll
NtWriteFile
RtlNtStatusToDosError
ole32
CLSIDFromString
CoCreateInstance
CoGetMalloc
CoInitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateBindCtx
OleLoadFromStream
OleSaveToStream
PropVariantClear
StringFromCLSID
StringFromGUID2
oleaut32
OleCreatePropertyFrame
rpcrt4
UuidCreate
secur32
AcceptSecurityContext
AcquireCredentialsHandleA
ApplyControlToken
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
QueryContextAttributesA
SetContextAttributesA
shell32
CommandLineToArgvW
SHGetFolderPathA
SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathA
shlwapi
PathRemoveFileSpecW
SHCreateStreamOnFileA
user32
AdjustWindowRectEx
BeginPaint
CopyIcon
CreateWindowExA
DefWindowProcA
DestroyCursor
DestroyWindow
DispatchMessageA
DrawIcon
EndPaint
EnumDisplayMonitors
EnumWindows
FindWindowW
FrameRect
GetClassNameW
GetClientRect
GetCursorInfo
GetDC
GetDesktopWindow
GetForegroundWindow
GetIconInfo
GetMessageA
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
GetWindowLongPtrA
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
IsIconic
IsWindowVisible
LoadCursorA
MapWindowPoints
MessageBoxW
MonitorFromWindow
PeekMessageA
PostThreadMessageA
ReleaseDC
SendMessageA
SetWindowLongPtrA
SetWindowRgn
ShowWindow
TranslateMessage
usp10
ScriptFreeCache
ScriptItemize
ScriptPlace
ScriptShape
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
winmm
waveInAddBuffer
waveInClose
waveInGetDevCapsW
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsW
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
ws2_32
WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAGetLastError
WSAGetOverlappedResult
WSAIoctl
WSAPoll
WSARecvFrom
WSAResetEvent
WSASendMsg
WSASendTo
WSASetLastError
WSASocketA
WSAStartup
WSAStringToAddressA
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
Java_java_awt_BDFontMetrics_charWidthN
Java_java_awt_BDFontMetrics_charsWidthN
Java_java_awt_BDFontMetrics_destroyFontN
Java_java_awt_BDFontMetrics_destroyN
Java_java_awt_BDFontMetrics_getFontFamilyAndStyleN
Java_java_awt_BDFontMetrics_initN
Java_java_awt_BDFontMetrics_loadFontN
Java_java_awt_BDFontMetrics_resolveFontN
Java_java_awt_BDFontMetrics_stringWidthN
Java_java_awt_BDFontMetrics_unloadFontConfigN
Java_java_awt_BDGraphics_drawStringN
Java_org_videolan_Libbluray_cacheBdRomFileN
Java_org_videolan_Libbluray_getAacsDataN
Java_org_videolan_Libbluray_getBdjoN
Java_org_videolan_Libbluray_getPlaylistInfoN
Java_org_videolan_Libbluray_getTitleInfosN
Java_org_videolan_Libbluray_getUOMaskN
Java_org_videolan_Libbluray_listBdFilesN
Java_org_videolan_Libbluray_readRegN
Java_org_videolan_Libbluray_seekN
Java_org_videolan_Libbluray_selectAngleN
Java_org_videolan_Libbluray_selectPlaylistN
Java_org_videolan_Libbluray_selectRateN
Java_org_videolan_Libbluray_selectTitleN
Java_org_videolan_Libbluray_setKeyInterestN
Java_org_videolan_Libbluray_setUOMaskN
Java_org_videolan_Libbluray_setVirtualPackageN
Java_org_videolan_Libbluray_soundEffectN
Java_org_videolan_Libbluray_tellTimeN
Java_org_videolan_Libbluray_updateGraphicN
Java_org_videolan_Libbluray_writeRegN
Java_org_videolan_Logger_logN
Name
.text
Size
115.6MB
Virtual Size
115.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rodata
Size
208KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
72.0MB
Virtual Size
72.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
14.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
391KB
Virtual Size
391KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
DiorSyntax/imgui.ini
- SHA256 d5b2b147abd736977b3774163e80f573fd30eda7003bb99d50d822df50bed149
- MD5 84a4a72f3191c1411fb5e1d295bd47ac
- SHA1 bc1266b2105cc52a5755c09d33842c0611cdab4d
- SHA512 edf761ce4a07c8cd34ea3a3e76fe5b355bd2df689d477dfab1c4beafed60e4eabdf8b880a2e1108f938fd8e7a4a938b3d698e57630ed5f2ad8929762081634ff
- TLSH T13B115952733A052E91F2A498B73223D83B8EB741A447B0C0A1416866FF5B8B3101F2C9
- MD5 SHA1 SHA512 TLSH
DiorSyntax/music/flow.m4a
- SHA256 eaa5cecbcaf2cb497e4e601b198f54e09bc9a608805b7b444b3c2171ffe744ed
- MD5 9f7e5ea5332d912c6f5b5087fec16cc0
- SHA1 db0271abcb4f1b81c50f2f51e4e3ff53873a3adc
- SHA512 f3eeec500689fa1992a0120634cae890a3190abd8b00b03b50e1ca84a0309ada0963996bab813a4d5ae84bb56bc42a5ac6c7383a248a27b8dd4b946d83f0efa4
- SSDEEP 98304:syQDl8Yrgk/r6SzORjPwsfu0PS617EWJMJHn:sym6eNJZ
- TLSH T1860633F493083885F543697368D0ABA4EDB9F07B108CD5D64820AB4744B4BF9EFA64F9
- MD5 SHA1 SHA512 SSDEEP TLSH
DiorSyntax/music/rumba.m4a
- SHA256 a9d050711b9e3212a7ddb0870ea5e2c2a8f164d73da1948abf061737579b768e
- MD5 8fb8e34af935fa8b614d92f2dba0b929
- SHA1 59d07ef5e3ee60febaed18a12f3345905ba8214d
- SHA512 237e1f2de52c1273326aa1430b141d248e1d6795901e6e25790b4eee65f78638518bfd969d89deacfd88cb0e76dabaf363981aad1fd37b142ef118e140c7b1df
- SSDEEP 49152:Pc0JwEzgpIQn8yfkqnd720OErUvxu3LuJmSHsN121DaM:Pt9QnRfdAXEgvxudNN12FaM
- TLSH T1BFB533BDAF105087F7576232F0D26B387860B0625399D5538003692E64B13FADFBADE6
- MD5 SHA1 SHA512 SSDEEP TLSH
DiorSyntax/music/stream.m4a
- SHA256 bd07940a8f6977afc08b4da5cc90130ebc0b1529f0e49e7016beb5cd381bb8d4
- MD5 3d803791df960794e72161c4c6abe7e4
- SHA1 5e09b4d85ff007f30e968140feed0472857653b8
- SHA512 2c70060330c9a2e498a4e4e5d1c070fc2524881a0c4da6604e3738e6dbca293aaa15fe08d2d8eb56bdbf854bacca365edcdf02b5b53ff2b21a5646927e15b306
- SSDEEP 49152:WA8kWpjQiQrV3Q59KI42MKXCSQbFy0i3WvrYB+PkjRvUBSYGUcWSUV2DO:W3rBwxKXIxy2skPEYSYGhUeO
- TLSH T196C533F63329B19FD3470172F4DC9F51E8A995EAA409B993201393AA00749E5CFD18FE
- MD5 SHA1 SHA512 SSDEEP TLSH
DiorSyntax/music/stream.wav
- SHA256 f1413c825198846d5e85ba0f5cf1bf860bb72027bd4c48ee00f7ed2479aca588
- MD5 abb6dddf7da6e4b8afc49625fdfa9c5d
- SHA1 dab3eac9f50ca712860f9c524318ea58e9a455e3
- SHA512 824276c3a8ce9966cd46b9e85b371f1e98289490f740c6b73a15d0d52d551546ae49d78572639071c1ada0f8b68ac3a4aa04ebdde6e625dd6220104e27160483
- SSDEEP 393216:xInxX93S0Y9cqvI26CP91jDzJLhIzB9JbaqETY4wr8qJQ500dzIkRXCQskJNYI/z:iaHWx/Cl5RLhubHJUAQS0dzujDI
- TLSH T1B6573346D4C079C1EC3D877149928EB803377A576D034A09327CFE87B962AAB7B0D65E
- MD5 SHA1 SHA512 SSDEEP TLSH
DiorSyntax/offsets.json
- SHA256 7c90e9a42b9534bc9f5fa9dfdb9b6a9215101364504826afc586d5b0baf9606c
- MD5 7e48476b4816d24d962db05462b9839c
- SHA1 7e84a5aac47c216d5e8c61404b35717c19311c1b
- SHA512 291b6f7cc7d7a5abb2fe00f0315f6d4c74e2b4b6a7d3e7c0b8bf16fd790bd7ce669b6faeb92d74dd54db4102514b2147869624d6b6a03cc359c85d88e8c8655d
- SSDEEP 192:mI8lyeVzYmwxL9CsU2vqZr2bAE32E96fnuAIC5dvj1+UsD+W/1zvoE:mh9zUxLf4OQuh4v/sD//1zwE
- TLSH T12612782CDA608DA939BE63A4287C0707E620337751498A9B797C498C5F77E37018AF5F
- MD5 SHA1 SHA512 SSDEEP TLSH
DiorSyntax/yt-dlp.exe
- IMPHASH b5fd7faade21e7a4651e8d3ddea32051
- SHA256 3db811b366b2da47337d2fcfdfe5bbd9a258dad3f350c54974f005df115a1545
- MD5 b20877630fd113c96d579e2488e2f3a5
- SHA1 957fadcae18597e09d981fbd49e5ac9debe69178
- SHA512 2ba9017431052ff5396598ce5e6c8b3984df816c5d858fd3aa8cd59a814f3b791c145cb4420153911ccb8ff40e8f0ad6a82aba08b7979d5fde22629aaaa07ad0
- SSDEEP 393216:EpwtSd5gzULMYTzDtDfDgrc6paxi4JV1qsXxcjtjRvoivsG:Ep4S3Y4Dtb0IWaxJ1qsXxijhoK
- TLSH T10807334EBAC1A895C8FAD972146BCA30A172FC519309EE4ECF6C77872F875946137E10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
OpenProcessToken
kernel32
CloseHandle
CreateDirectoryW
CreateFileW
CreateProcessW
CreateSymbolicLinkW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FormatMessageW
FreeLibrary
GetCPInfo
GetCommandLineW
GetConsoleWindow
GetCurrentProcess
GetCurrentProcessId
GetDriveTypeW
GetEnvironmentVariableW
GetExitCodeProcess
GetFinalPathNameByHandleW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStartupInfoW
GetTempPathW
InitializeCriticalSection
K32EnumProcessModules
K32GetModuleFileNameExW
LeaveCriticalSection
LoadLibraryExW
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RemoveDirectoryW
SetConsoleCtrlHandler
SetDllDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fileno
_fmode
_get_osfhandle
_getpid
_initterm
_lock
_snwprintf
_stricmp
_strnicmp
_strdup
_unlock
_vsnwprintf
_wcsdup
_wcsdup
_wcserror
_wcsnicmp
_wfopen
_wfullpath
_wputenv_s
_wtempnam
_wstat
atexit
abort
calloc
clearerr
exit
fclose
feof
ferror
fflush
fprintf
fputc
fputwc
free
fread
fseek
fwprintf
fwrite
iswctype
ftell
localeconv
malloc
mbstowcs
memcmp
memcpy
realloc
setbuf
setvbuf
signal
strchr
strcmp
strcpy
strerror
strlen
strncat
strncmp
strncpy
strtol
strtoul
vfprintf
wcscat
wcschr
wcscmp
wcslen
wcsncmp
user32
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
GetMessageW
GetWindowLongPtrW
GetWindowThreadProcessId
MsgWaitForMultipleObjects
PeekMessageW
RegisterClassW
SetWindowLongPtrW
ShowWindow
ShutdownBlockReasonCreate
TranslateMessage
Name
.text
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
__main__.pyc
- SHA256 ac232904a85558cbffadc3514d65fd19728ea013b489ec8352285a53d3daafec
- MD5 b7094c47f6abd2b68c259c0caaeb1355
- SHA1 ba14749e2cf0d23ad5356228022730c9dd4654e0
- SHA512 594dab5ee13795e0b5ec81f26040852032a8b02087c479c8fc58b339384879c00243dca7dd11e2c8d4a9640876c91938d85b5d62aa57534f02ef806fa23da0d3
- TLSH T1E5E02015553675CDF0F8A7F97430651044F6BDEA976510031709D553B4443202F5D70D
- MD5 SHA1 SHA512 TLSH