VapeLiteV3.4.2.zip
- SHA256 50bcee764e58a8fdcd525ac20bf0105d660aec2184f7ad0622cd0e7ceaef5c74
Overview
overview
9Static
static
7VapeLiteV3.4.2.zip
windows11-ltsc_2024-x64
8LiteDLL.dll
windows11-ltsc_2024-x64
1Loader.exe
windows11-ltsc_2024-x64
1Patcher.dll
windows11-ltsc_2024-x64
1README.txt
windows11-ltsc_2024-x64
1VapeLite.exe
windows11-ltsc_2024-x64
9mappings/m...10.srg
windows11-ltsc_2024-x64
8mappings/m....9.srg
windows11-ltsc_2024-x64
3mappings/m....2.srg
windows11-ltsc_2024-x64
3mappings/m...10.srg
windows11-ltsc_2024-x64
3mappings/m....9.srg
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
VapeLiteV3.4.2.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral2
Sample
LiteDLL.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
Loader.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
Patcher.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral5
Sample
README.txt
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral6
Sample
VapeLite.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
900 seconds
Behavioral task
behavioral7
Sample
mappings/mcp-notch-1.7.10.srg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
900 seconds
Behavioral task
behavioral8
Sample
mappings/mcp-notch-1.8.9.srg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral9
Sample
mappings/mcp-srg-1.12.2.srg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral10
Sample
mappings/mcp-srg-1.7.10.srg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
General
- Target VapeLiteV3.4.2.zip
- Size 12.8MB
- Sample260720-rwc2qsds2r
- SHA256 50bcee764e58a8fdcd525ac20bf0105d660aec2184f7ad0622cd0e7ceaef5c74
- MD5 7b2c093163211f33353a9c570fee01dd
- SHA1 7379348a9f9896eccd3d1424b78a1e84516096f6
- SHA512 2e3f2e1298d8da38a87031e187da064c0321b02ae0b49ee803ed53b619b201604e7f745dc0ddb599f089d4ee0fed2dae9defc3f8b2b3c1cdac8a77331ebe6bb0
- SSDEEP 393216:iJVl/lMdTtGKv7/qY2wWOiSE+MSa4KtnLXi:iJLOWUyY2wZiqd6nu
- TLSH T15CD6334C92859366DDCD7AB0DF46FBA0C28618D9C767C7956EF03396BC124C07BAA093
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/VapeLite.dll themida - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/LiteDLL.dll unpack001/Loader.exe unpack001/Patcher.dll unpack001/VapeLite.dll
File Explorer
-
VapeLiteV3.4.2.zip.zip 12.8MB
-
LiteDLL.dll.dll 2.9MB
-
Loader.exe.exe 483KB
-
Patcher.dll.dll 112KB
-
README.txt866B
-
VapeLite.dll.exe 11.5MB
-
mappings/mcp-notch-1.7.10.srg2.0MB
-
mappings/mcp-notch-1.8.9.srg2.6MB
-
mappings/mcp-srg-1.12.2.srg5.8MB
-
mappings/mcp-srg-1.7.10.srg3.2MB
-
mappings/mcp-srg-1.8.9.srg4.3MB
LiteDLL.dll
- IMPHASH 9d5c6592ca6afcc97ad630748ce84564
- SHA256 06a77e962f6b954962f978e6fc6df61892df0cdb0ab1b1332d7dec6026cb2cbe
- MD5 6716db9e4d3f36bfaffe0e997fc741b7
- SHA1 c51a96fd26718a83775d91c623360985e0eaacd9
- SHA512 9490cfbc47161b9009dbbcde786e2494427423ed6b6ca5eb036f1453c180c152a77764d1c36f6ff42114c6553dbf5294720f926de6961097f43c64e1c263c2d9
- SSDEEP 49152:o/IjFTl0CD9tKSfCTRH0RU+mBhJp57o/Y7wjAzdIfxgRpe56h5L:X6zImho/Y7mAzdIJgRpe56hB
- TLSH T1BDD56DDF0179C3ACD23A563C520B563B8B6AB44AD726239BEBD740957B863C037B6311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1432128
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
jvm
JVM_GC
JNI_GetCreatedJavaVMs
opengl32
glGetIntegerv
glGetFloatv
glAlphaFunc
glIsEnabled
glClearDepth
glEnable
glDisable
glBlendFunc
glLineWidth
glTexParameterf
glColor4d
glBegin
glVertex2d
glEnd
glClearColor
glColor3d
glPushMatrix
glDepthMask
glClear
glGetDoublev
glColorMask
glDepthFunc
glDrawArrays
glFlush
glPopMatrix
glTranslated
glColor4f
glScaled
glNormal3f
glRotatef
glScalef
glTranslatef
glBindTexture
glVertex3d
glDeleteTextures
glEnableClientState
glDisableClientState
glPolygonMode
glShadeModel
glTexEnvi
glViewport
glMatrixMode
glLoadIdentity
glTexImage2D
glOrtho
glGetTexEnviv
glPushAttrib
glVertexPointer
glPixelStorei
glTexParameteri
glGenTextures
glTexCoordPointer
glColorPointer
glScissor
wglGetCurrentDC
glDrawElements
wglGetProcAddress
glPopAttrib
glGetString
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
malloc
free
api-ms-win-crt-runtime-l1-1-0
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
abort
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf
__stdio_common_vswprintf_s
__stdio_common_vswprintf
ftell
fseek
_wfopen
fflush
fwrite
fread
fclose
__stdio_common_vsprintf
api-ms-win-crt-convert-l1-1-0
mbstowcs
wcstombs
atoi
strtol
_itoa
atof
api-ms-win-crt-string-l1-1-0
tolower
strncpy
wcsncmp
_strdup
strcmp
strcpy_s
strncmp
isprint
toupper
api-ms-win-crt-utility-l1-1-0
qsort
rand_s
srand
rand
api-ms-win-crt-math-l1-1-0
ceil
atan2
atan
ceilf
cos
cosf
fmodf
fmod
sqrt
floor
sinf
hypot
sqrtf
sin
powf
floorf
api-ms-win-crt-time-l1-1-0
_time64
kernel32
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwindEx
RaiseException
RtlPcToFileHeader
InitializeSListHead
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TlsSetValue
EncodePointer
DeleteCriticalSection
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
LoadLibraryExW
DecodePointer
OpenThread
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualFree
TlsFree
SetThreadContext
FlushInstructionCache
GetThreadContext
HeapDestroy
HeapAlloc
HeapReAlloc
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
GetCurrentThreadId
Thread32First
Thread32Next
GetCurrentProcess
HeapFree
VirtualProtect
HeapCreate
GetLastError
SetLastError
FreeLibraryAndExitThread
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleW
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
GetCurrentProcessId
ExitThread
Sleep
CreateThread
CloseHandle
user32
GetForegroundWindow
SendMessageW
GetAsyncKeyState
GetWindowThreadProcessId
GetWindowTextA
EnumWindows
SendInput
GetCursorPos
FindWindowW
GetClientRect
ClientToScreen
SetCursorPos
WindowFromDC
ScreenToClient
MapVirtualKeyW
GetKeyState
gdi32
SwapBuffers
ws2_32
setsockopt
WSAStartup
getaddrinfo
socket
connect
closesocket
freeaddrinfo
recv
send
shutdown
WSACleanup
WSASend
WSARecv
?tim@@YA_KPEAX@Z
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
248KB
Virtual Size
247KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
910KB
Virtual Size
161.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=33808,
count=12, id=260, version=33808,
count=77, id=261, version=33808,
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=10, id=257, version=29395,
count=3, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=308, id=1, productName=Unmarked objects,
count=296, id=265, version=34120,
count=1, id=256, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,
Loader.exe
- IMPHASH 8626e6c67e5a68933b7270ed1e896ccb
- SHA256 b190c31feb848ab27f3c060af3446f34818dc84cd27ebf282ed06c6534538c9c
- MD5 8726345d1e4a20b97e18f41bef97da28
- SHA1 e91b42df4b7bcab55bad603de8ce45e9cba40c53
- SHA512 030a479a7be18edfd9f5348cf2edf918c567e7cc245e54dd85b4ecf23bdf199108facebe55af3a8efae00f4aa6223552e600850f3c112668713e2514a470db0d
- SSDEEP 6144:m2LIW9DMeNzVdrNsBo6qtagQ8bIJmI1vFYCp/svoA21HK4txIFyMlMGhMg0510A3:mYMi7rCSH0mkmCp9796Fd9JI1N6H
- TLSH T164B4E096B3B643F8E0A78538C9511613E7B1785207119FEF43B48AB62F23AD61E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
67760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
MessageBoxA
advapi32
RegQueryValueExA
RegCloseKey
RegEnumKeyA
RegOpenKeyExA
shlwapi
PathRemoveFileSpecA
kernel32
WriteConsoleW
TlsGetValue
SetEndOfFile
HeapReAlloc
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetTempPathA
CloseHandle
WaitForSingleObject
Sleep
TerminateProcess
CreateThread
CreateRemoteThread
GetExitCodeThread
CreateProcessA
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
AssignProcessToJobObject
SetInformationJobObject
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
QueryFullProcessImageNameA
SetDllDirectoryA
CreateJobObjectA
CreateToolhelp32Snapshot
Process32First
Process32Next
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
HeapSize
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
GetFileType
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
GetProcessHeap
FlushFileBuffers
CreateFileW
ReadFile
ReadConsoleW
Java_Server_ready
Name
.text
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
314KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=149, id=261, version=33140,
count=12, id=260, version=33140,
count=8, id=259, version=33140,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=40, id=261, version=35207,
count=9, id=257, version=33140,
count=124, id=1, productName=Unmarked objects,
count=1, id=261, version=35209,
count=1, id=260, version=35209,
count=1, id=256, version=35209,
count=1, id=258, version=35209,
Patcher.dll
- IMPHASH 1ccaed511070730038fae9b9b7c3c8b2
- SHA256 c25686a0747662a7b29d2e4c10115e899d8e576e5235ab0dd9a1edf783f98633
- MD5 e0b97233bd32c6e78131c03482e012d4
- SHA1 4cb708a48e5382c63be4e860299ae295690a8c41
- SHA512 ea783bbc4661dcf681c073fe50d44369ff0659c12f24ff311f6aa4a82b90a151005c54e7fa0e397200bb13b6fe6ba1353b5a850bfe789b26456d45beaf0395c6
- SSDEEP 3072:tEweyRHTCJ8ltNvHyFswt8nReO7uD39WD9:zeyhCOn0FsAnmEE
- TLSH T181B34B5B72E510BFE1728138C8674A45D7B6B82507609FEF53A042AA1F237D68D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13984
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcessId
ExitProcess
CreateThread
OpenProcess
DisableThreadLibraryCalls
GetModuleHandleA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
GetLastError
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcess
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
GetProcAddress
Thread32First
Thread32Next
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
GetModuleHandleExW
GetModuleFileNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33140,
count=12, id=260, version=33140,
count=8, id=259, version=33140,
count=3, id=257, version=33140,
count=115, id=1, productName=Unmarked objects,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=35, id=261, version=35207,
count=1, id=261, version=35209,
count=4, id=260, version=35209,
count=1, id=258, version=35209,
README.txt
- SHA256 ff2e715d05a9eca9df681fa65db7f80b23f09b53b09673fb7227be4a633cd131
- MD5 9899c472d8608f1577dcc95f5b4b96e4
- SHA1 b32d191c8da786480c6dd96ee02caf46499822a4
- SHA512 1c6118794d6fdbf14eb3a4f07535340c916b510308493602089e415bdb2fe09bd50cd01423b6fb361e1a61a8477808091e83b6b0b6bc82e4c56192c6d9d6eee2
- TLSH T1DD11E3BE0B17C2AC5EB642E7229451A8FFB75073D08A92D9F539123832D182FC60090E
- MD5 SHA1 SHA512 TLSH
VapeLite.dll
- SHA256 074b284a14813185f5371025b1d94c1a95868c097487e08a538097564cc4afe7
- MD5 00e59dd6b0443d2726740e74277725a1
- SHA1 e6d2baeec5a695ec86be638cd55090d169ec8197
- SHA512 8dea3157ead4f0a91f7f3f1ffdf301cdf2701600bee6aa3712bc794cb80b6c17405ab2af602022cedd803ced06705cdad2aca3a76cf31920ccab33f500828011
- SSDEEP 196608:qD5lPm6XEAtvfFzwDJ1ckRrgL02VncjU96xpnbPtvvkwaUYGNo:q1ltUABQJjC1KYgpn2waUG
- TLSH T11BC6338B04A97FE3E85617BC941C2E52CD317A2B560A43FBFA0B4B71E64411ECF35269
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16642136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
1.4MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
338KB
Virtual Size
981KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
136KB
Virtual Size
489KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
117KB
Virtual Size
218KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
43KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
8KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
10.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
7.6MB
Virtual Size
7.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=21, id=259, version=29395,
count=206, id=261, version=29395,
count=6, id=261, productName=VS2017 v15.9.1 build 27023, version=27023,
count=2, id=253, version=32533,
count=20, id=260, version=32533,
count=12, id=259, version=32533,
count=99, id=261, version=32533,
count=25, id=260, version=29395,
count=2, id=123, version=2207,
count=6, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=26, id=260, version=25830,
count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=33, id=261, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=259, productName=VS2017 v15.3 build 25506, version=25506,
count=480, id=260, version=24231,
count=14, id=260, version=27045,
count=33, id=257, version=29395,
count=476, id=1, productName=Unmarked objects,
count=147, id=265, version=32824,
count=1, id=255, version=32824,
count=1, id=258, version=32824,
mappings/mcp-notch-1.7.10.srg
- SHA256 8cbae8d2266b0b7e190311d9437e1c2b322585fb2814a9e5653ba530e313717d
- MD5 633c0039c7777b02bd3c9d7615ea4073
- SHA1 75fb39a9b4152e5bedfd17d82d345ea78be9b990
- SHA512 5c81af166222285e290c65df83658ee82d7efd0ac1b015a8449337e8e0e3b8db42c1e1e5bc3bb57e88d210ed72f46b6b64259aee2978f6cdf0b9daaff7705903
- SSDEEP 49152:E5F3iYaxrtusghV5HDSKKlONHdpBY2GDhI:k
- TLSH T19D958242D0CBBAE5797BF38BC4B0C551E5B0C3B36D5963ED7534481AFBE40C82296A68
- MD5 SHA1 SHA512 SSDEEP TLSH
mappings/mcp-notch-1.8.9.srg
- SHA256 c94374cb593b3aea6b016084c40160631c060a8ac6ca4136b3eeb32e0647ba86
- MD5 27a93893abfab13b27f018f010da0ee5
- SHA1 389d5f44b1e097ca5543e6f10fc89b7bdda5e14b
- SHA512 e193a5b737e8c78754d24cb8b4a041ed1797f4ced97770a4c3f08a7f467804ff7756e9ef1367e7724e53d74498ad74519a2a7d33028d7259106b5edd34027a3f
- SSDEEP 12288:nj2aTzVO4MYwzxW43ImkyLURIeTtP7AA+ukDRuDE7WCVdUbM4esIZDd3o:njtzVbMYwzxW43IJyKkNyesIZR4
- TLSH T1D0C57242D09BBAD6B97EF35BC4B0C510E5B0C3B36D1923ED7534881AFFE85C42296A58
- MD5 SHA1 SHA512 SSDEEP TLSH
mappings/mcp-srg-1.12.2.srg
- SHA256 97505188486e4adb6e99012d3843a19f026691384ac8fb027b4111468f8cacd2
- MD5 8ae80048053a18fbb7d7a36c7185ccba
- SHA1 25d5ed4f63fb9259656b7d6a96494cf2795c9e68
- SHA512 ead0cbc3b10b1098536e4e16811465939a2ebabd7e3a57fd2d1d59aa889fbda99fe93c7217ae0821195cbba7c46e0b7cdcc17541b60a5f357c120022576f945e
- SSDEEP 49152:92GZGx0WT3ODnn8LARnDIugDImGTgF16tlL5VgbePN6finq5yURYdA5wrw8U190p:rv
- TLSH T167562E41D0EBBAD96D3EF74B88B08511E571D3B36E1E23ED7134891AFFD44C4228AA58
- MD5 SHA1 SHA512 SSDEEP TLSH
mappings/mcp-srg-1.7.10.srg
- SHA256 53507cd7ad8af57f324a6602e47c612f762a8560abcfc9a1ef0c9b1d18f61275
- MD5 64c70ea6fad1839d23059b0e4c1d7e0a
- SHA1 eab9733eb48b30248df46e70b205bdee638b0e5f
- SHA512 3e7b5a6bc505aedee11af525d3893d223bef806eb74811de95ecf635b73605def3b9a4af3b20224cb86a4b688d7938382add35e4690e36b5ee56046e21120cca
- SSDEEP 49152:E0qGCgFno9e/jV/0OvM56q5UnmIugDFpsFqW9Ydd5wrw8Ul:j
- TLSH T152F54142D0DBBAE5783EF74B84B08551E570C3B36E5E23ED7234481AFFE41C92296A58
- MD5 SHA1 SHA512 SSDEEP TLSH
mappings/mcp-srg-1.8.9.srg
- SHA256 7b49dec303dfb850852ff67a37f51315f2a3657ddca31245fd40fe31f1177f8c
- MD5 a10d1ec5371105110b07acd5dc0139e9
- SHA1 ad07493c6108fd1d2f09514438d9dbaf770710cb
- SHA512 cf8dbdd549e0b99c00749a1c7c2cb339a5c9662c826db3c16861a0b1e8693f35dda285e737f73cd0d7cee8b1a4753fa3cc2e1f30014f662e490283cb4bae1c75
- SSDEEP 49152:mP5tLG7gpBpK/6GAUnmIugDjmJOzvYdd5wrw8UW:z
- TLSH T1EC263F42D0DBBAD9683EF70B88B08551E570D3B36E5E23ED7134891AFFD41C5228BA58
- MD5 SHA1 SHA512 SSDEEP TLSH