Keygen+VCRuntime Backup.7z
- SHA256 1074aa2f7827c1981a231f82732aff9ef57a008b93c261799b58c38d5d55afd6
Overview
overview
7Static
static
3Keygen+VCR...kup.7z
windows10-2004-x64
1Keygen+VCR...kup.7z
windows11-ltsc_2024-x64
1Ableton_KeyGen.exe
windows10-2004-x64
7Ableton_KeyGen.exe
windows11-ltsc_2024-x64
7$TEMP/BASSMOD.dll
windows10-2004-x64
3$TEMP/BASSMOD.dll
windows11-ltsc_2024-x64
3$TEMP/R2RLIVE2.dll
windows10-2004-x64
3$TEMP/R2RLIVE2.dll
windows11-ltsc_2024-x64
3$TEMP/bgm.xm
windows10-2004-x64
1$TEMP/bgm.xm
windows11-ltsc_2024-x64
1$TEMP/keygen.exe
windows10-2004-x64
3$TEMP/keygen.exe
windows11-ltsc_2024-x64
3vcruntime140_1.dll
windows10-2004-x64
1vcruntime140_1.dll
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Keygen+VCRuntime Backup.7z
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Keygen+VCRuntime Backup.7z
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Ableton_KeyGen.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
Ableton_KeyGen.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
$TEMP/BASSMOD.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$TEMP/BASSMOD.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$TEMP/R2RLIVE2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$TEMP/R2RLIVE2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$TEMP/bgm.xm
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
$TEMP/bgm.xm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
$TEMP/keygen.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
$TEMP/keygen.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
vcruntime140_1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
vcruntime140_1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Keygen+VCRuntime Backup.7z
- Size 751KB
- Sample260727-s13nmahl21
- SHA256 1074aa2f7827c1981a231f82732aff9ef57a008b93c261799b58c38d5d55afd6
- MD5 a84ba956733883bd35f863893a60c48d
- SHA1 1e4aff4c3e257a83b4d6060c5e0cc62a1688375d
- SHA512 fb0e1f89527e8d9f8c6de218af9b8367db7eb5a039c351c6c2058525fce666dcdcf68569a743efcc28bb56f638dfe22a0cf7cf9185ac081fe16e6ff09fc9d0e2
- SSDEEP 12288:XzJqfNCnjM3t6s4tO+GEwi+aN3N8wixwVedfnMGqZYnAjnda:XzMUjEzj+GAv3N8dVdfMXFjnda
- TLSH T1A2F4234D1A7BC114F30FD2B88C32A355BBB40CB26A6954628631F8D5EB1CA178BFD5E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Ableton_KeyGen.exe unpack002/$TEMP/BASSMOD.dll unpack002/$TEMP/R2RLIVE2.dll unpack002/$TEMP/keygen.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/vcruntime140_1.dll
File Explorer
-
Keygen+VCRuntime Backup.7z.7z 751KB
-
Ableton_KeyGen.exe.exe 823KB
-
$TEMP/BASSMOD.dll.dll 33KB
-
$TEMP/R2RLIVE2.dll.dll 90KB
-
$TEMP/bgm.xm1.0MB
-
$TEMP/keygen.exe.exe 442KB
-
vcruntime140_1.dll.dll 8KB
Ableton_KeyGen.exe
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 d613bbf19a5003a2c514056665f79c7c2c3aff9d3712639f13078734fffcae5b
- MD5 e411dd01187df2e61a273e651107b524
- SHA1 745f0cd4ad88611b6032b6023ad554bf6ddeade6
- SHA512 0f5a4d1d8ba7b62e865cd7d170d33393d405bd6304d08f934f43df04b1f6907a49d114b762e60de653a3cc58d3fa8bf5c5c00a9e24121f527e0aff56293ab376
- SSDEEP 12288:XYkc9t2Sll/wjW3g6s4gO+fEoQ+aN3N8gijwVedffM8qZbnAjXVoiq:XYkcL56+Q4+fgv3N8NDdHMNejXA
- TLSH T1FC05234A7AA4C1A3E96747708C7BD62277F56C25AA76110B53A0BB6CFF31303811F792
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$TEMP/BASSMOD.dll
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
73795
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BASSMOD_ErrorGetCode
BASSMOD_Free
BASSMOD_GetCPU
BASSMOD_GetDeviceDescription
BASSMOD_GetVersion
BASSMOD_GetVolume
BASSMOD_Init
BASSMOD_MusicDecode
BASSMOD_MusicFree
BASSMOD_MusicGetLength
BASSMOD_MusicGetName
BASSMOD_MusicGetPosition
BASSMOD_MusicGetVolume
BASSMOD_MusicIsActive
BASSMOD_MusicLoad
BASSMOD_MusicPause
BASSMOD_MusicPlay
BASSMOD_MusicPlayEx
BASSMOD_MusicRemoveSync
BASSMOD_MusicSetAmplify
BASSMOD_MusicSetPanSep
BASSMOD_MusicSetPosition
BASSMOD_MusicSetPositionScaler
BASSMOD_MusicSetSync
BASSMOD_MusicSetVolume
BASSMOD_MusicStop
BASSMOD_SetVolume
Name
Size
31KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
$TEMP/R2RLIVE2.dll
- IMPHASH 1ea75222587b83ba07fd195bb464f1e6
- SHA256 b19809c08159bbe10544ccb5f72dc1582900ed4b395dffb8b2b4c59f042edd49
- MD5 d544f8f89b89ad6d48426e6c74c8761c
- SHA1 2b72376ea84fbfeb63e0859e70b66b277f9e4b23
- SHA512 138a63ed00efba40d56364a5564b048082cea07b54693c9b49ecf84ddc8d2f82722a1eed05ebad48e980bb0621bd4ecd976a02767edeb35ec985efaf3751b510
- SSDEEP 1536:eAIaEl2KYVxMweGw5SaTCibbb+S4A3u8:eAIaEAKYVxW75SO
- TLSH T12A933A4434A3F331C46A217D735AA7671F7FF4741262D8978FB90D8A5A22B83CF16682
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4308
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
rand
srand
time
sprintf
memcmp
strlen
malloc
calloc
qsort
memset
realloc
strcat
free
memcpy
advapi32
CryptGenRandom
CryptAcquireContextA
GenerateLicenseFile
Name
.text
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=30795,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=204, id=260, version=33811,
count=1, id=256, version=33811,
count=1, id=258, version=33811,
$TEMP/bgm.xm
- SHA256 9ae311e672f224a27350dd37cce871187377531741df048082b9cb680cd12882
- MD5 eac249a6cbd92e5a744f1921261b4134
- SHA1 3c1be061f209bf9cef151399f896a1e7927bb2cb
- SHA512 3cdb465c746c816b5f9badbe10020a636aca694c1992e076cb251f81ba9cca158ba5455587d0bb966743b943ce88ad0c99c74d39664c55723e169d070a799459
- SSDEEP 24576:njg85PbKWstZdIzNIPRnuEHDGLG5nyQweozKajh/q0nqVVjAsOktahU5F+eOohVz:njgcPuWs6zNIeLG5nyQweozKa1/q0nqH
- TLSH T1D2358A037B049442D4652AB68C3DC7ED5325FD48AE61974739DAFE5BBEFA2C34C12288
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/keygen.exe
- IMPHASH 61baf0ac33a569be37eaea52c317de1e
- SHA256 c105a865c9c0f6588243527427b86292da435b7885f6fd50cca2352833a48f59
- MD5 23eba9883fefc81d7cccb833c09731b1
- SHA1 a64f819ed2a9a2b2e099696fd5f30bf581212f9e
- SHA512 611d6dc41da07c2238309df74e9a0c0bf2059a56c4b14717f3f3a0bbcac6f749a3f14d073eb9ac6712ea2964b012d8bc14f02490294a2087373b4aee72552698
- SSDEEP 6144:pcmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOzE0BeCibL5qcOA:pc/kEPDonR6Y436vRSiIxOA
- TLSH T1B3A4285AE3348EBEF5B1113C6C9D7A1EA5510231CBB8E8FF865A78FA48A15DC1C3C245
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
_TrackMouseEvent
ord17
msimg32
GradientFill
kernel32
FreeEnvironmentStringsA
UnhandledExceptionFilter
VirtualQuery
VirtualProtect
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCPInfo
GetOEMCP
GetACP
HeapSize
SetUnhandledExceptionFilter
WriteFile
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ReadFile
CloseHandle
LCMapStringW
LCMapStringA
SetFilePointer
GetCurrentProcess
TerminateProcess
ExitProcess
GetVersionExA
GetStartupInfoA
GetModuleHandleA
SetCurrentDirectoryA
SetEnvironmentVariableA
CreateDirectoryA
GetFullPathNameA
GetCurrentDirectoryA
GetDriveTypeA
HeapReAlloc
RtlUnwind
RaiseException
HeapFree
HeapAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
FlushFileBuffers
CreateFileA
IsBadReadPtr
IsBadCodePtr
QueryPerformanceCounter
GetLocalTime
FindFirstFileA
FindNextFileA
GetLastError
FindClose
DeleteFileA
GetShortPathNameA
GlobalLock
GlobalUnlock
MulDiv
GlobalAlloc
GlobalFree
WideCharToMultiByte
MultiByteToWideChar
WinExec
GetWindowsDirectoryA
GetSystemDirectoryA
GetSystemInfo
GlobalMemoryStatus
GetVersion
GetComputerNameA
FreeLibrary
LoadLibraryA
GetProcAddress
GetCommandLineA
Sleep
GetTickCount
GetModuleFileNameA
GetLocaleInfoW
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
SetEndOfFile
GetEnvironmentStrings
user32
UnregisterClassA
AdjustWindowRectEx
LoadIconA
LoadCursorA
RegisterClassA
PostQuitMessage
DefWindowProcA
InvalidateRect
BeginPaint
EndPaint
FillRect
TabbedTextOutA
GetSysColor
MoveWindow
ReleaseDC
GetClassLongA
SetClassLongA
SetWindowLongA
IsWindowEnabled
EnableWindow
SetFocus
GetFocus
GetWindowLongA
GetClientRect
InflateRect
DrawFocusRect
DrawTextA
PostMessageA
SetWindowTextA
GetDlgItemTextA
GetDlgCtrlID
IsDlgButtonChecked
CallWindowProcA
FindWindowA
MsgWaitForMultipleObjects
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
MapVirtualKeyA
GetWindowRect
SetActiveWindow
SetWindowPos
GetAsyncKeyState
GetCursorPos
ShowCursor
SetCursorPos
MessageBoxA
EnumDisplaySettingsA
ChangeDisplaySettingsA
CreateWindowExA
ShowWindow
SendMessageA
DestroyWindow
GetDC
GetSystemMetrics
GetActiveWindow
gdi32
CreateDIBSection
CreateCompatibleDC
Rectangle
DeleteDC
SetBkColor
SetStretchBltMode
StretchBlt
Ellipse
MoveToEx
LineTo
SetPixel
GetPixel
GetTextExtentPoint32A
SetDIBColorTable
CreatePalette
CreatePen
GetTextMetricsA
SelectPalette
RealizePalette
BitBlt
SelectObject
SetBkMode
SetTextColor
GetStockObject
CreateFontIndirectA
DeleteObject
CreateSolidBrush
GetDeviceCaps
comdlg32
GetSaveFileNameA
ChooseColorA
GetOpenFileNameA
advapi32
GetUserNameA
shell32
ShellExecuteA
ShellExecuteExA
SHGetSpecialFolderPathA
ole32
CoCreateInstance
IIDFromString
CLSIDFromProgID
CoUninitialize
CreateStreamOnHGlobal
OleUninitialize
CoInitializeEx
OleInitialize
oleaut32
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayCopy
OleLoadPicture
SafeArrayGetElement
VariantClear
VariantInit
SafeArrayAccessData
SafeArrayGetDim
SafeArrayUnaccessData
SafeArrayCreate
SysFreeString
SysAllocStringByteLen
VariantChangeType
VariantCopyInd
VariantCopy
SysAllocString
SafeArrayPutElement
winmm
sndPlaySoundA
mciSendStringA
timeEndPeriod
timeGetDevCaps
timeBeginPeriod
timeGetTime
Name
.text
Size
197KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=105, version=2067,
count=35, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=4, id=95, version=2179,
count=2, id=93, version=2067,
count=16, id=93, version=2179,
count=5, id=25, version=9210,
count=224, id=1, productName=Unmarked objects,
count=147, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=42, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
vcruntime140_1.dll
- IMPHASH 43f0d00640b4d8e643c20e225b7862e3
- SHA256 a9d61d9fcee0d83656757eb36a8586de44d1e4f47bebd13afdbd474a47b82209
- MD5 f38bbb2dcea08be0ae9e8c4447e9cd58
- SHA1 92a97c5c1e9699a2b5cb6c8be3a87e78e7874ffa
- SHA512 9e92737f3e2a6468a01ab938caa296164f2d8b8739664f5cadd6b7fd9a05ee0bb4126235672dbf0bdda7823017ba1b3b2f4886763dd9eb7fe496392ecea5c38f
- SSDEEP 96:diVUHd9dOK4TkTRfeir+hizHs1ds14ge8DdVilNyTLxiyhi5G2Kt4t2Hv3:diuXdOtsRZzHS8dVHDc5G7t4tCv3
- TLSH T175124BA7D3DC0485F7ABC7B5D167CE0316B9B95782735B0D22B1633A0E663407462B72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
99:89:a9:f9:2f:b7:0e:95:03:3d:d6:9c:a9:76:7f:40:89:2b:51:93:b8:a4:da:5a:9d:80:4c:b7:8e:52:33:f8:cb:17:16:11:f8:81:61:d8:5d:ed:b2:d7:4c:04:db:2d:63:dd:03:29:91:bd:af:00:58:86:ed:7f:92:46:3b:e9
Digest Algorithm
sha512
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
shlwapi
PathStripPathW
kernel32
GetModuleHandleA
lstrcatW
GetSystemDirectoryW
VirtualProtect
FreeLibrary
GetModuleFileNameW
LoadLibraryW
GetProcAddress
lstrcmpW
__CxxFrameHandler4
__NLG_Dispatch2
__NLG_Return2
Name
.text
Size
1024B
Virtual Size
619B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=30795,
count=10, id=1, productName=Unmarked objects,
count=1, id=260, version=33811,
count=1, id=256, version=33811,
count=1, id=255, version=33811,
count=1, id=151,
count=1, id=258, version=33811,