akvirtualcamera-windows-9[.]3[.]3[.]exe

resource
akvirtualcamera-windows-9.3.3.exe
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/x64/AkVCamAssistant.exe
unpack001/x64/AkVCamAssistantMF.exe
unpack001/x64/AkVCamManager.exe
unpack001/x64/AkVCamTest.exe
unpack001/x64/AkVCamTestMF.exe
unpack001/x64/AkVirtualCamera.dll
unpack001/x64/AkVirtualCameraMF.dll
unpack001/x64/libvcam_capi.dll
unpack001/x86/AkVCamAssistant.exe
unpack001/x86/AkVCamAssistantMF.exe
unpack001/x86/AkVCamManager.exe
unpack001/x86/AkVCamTest.exe
unpack001/x86/AkVCamTestMF.exe
unpack001/x86/AkVirtualCamera.dll
unpack001/x86/AkVirtualCameraMF.dll
unpack001/x86/libvcam_capi.dll

akvirtualcamera-windows-9.3.3.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 0f8b464d27befc5fcc248e4f761e186f9eb032e7524e72bbe03ee5c0b8492e2f
MD5 d26d30869f06241c2ff9b8d997ff0ca0
SHA1 cf5afe95585843aae12dd85f92cc6aec80cb1d89
SHA512 96a9a25b12207469fae6c9376c43781bb5ca24c41486772a964838e132f0175f61455e553d1bb369ae84b661a76bfe8f23e41b55f9091a1515de7d60d4f16fb2
SSDEEP 98304:wN0hzCD8jhpozX2hhYdqbmUN0yEou5vJTiU8:wN0hBj7KGhhYcbwyEX5voU8
TLSH
T1FA16339863D6C0BEF3185B7946A5D7737A3BB4623CD84593FF45132E2816A60F82EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/LangDLL.dll

IMPHASH fe3375e7e4529b73ba45ab2246b9269b
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

share/build-info.txt

SHA256 cc366412f87a34a1ba0e955ef4d284added74b73d0e064ede8670ae7ebd27f8e
MD5 0be046392c75e57d97a90a7ee4261307
SHA1 e2bf328464a1544127e08222abf13223a68c302c
SHA512 ee90cef5ef095a1c68a52d5b9b7fbc04a657dd4e9726ffd7eabaf6c691e9e0aeec781b25f947d729e157e74199bf06a95bef76f108cf3b87e7fed273f824121d
TLSH
T1B9C02BEBC18157A3CE50834591403BD0D303C850FE2C8C1B7B730004F335080014B550
MD5 SHA1 SHA512 TLSH

x64/AkVCamAssistant.exe

IMPHASH 6e601e2a9dd3954a45eb3d9e9da20ff4
SHA256 936cee89faa3e58811892f96a0802e677b24fd1140e4c34f012be4f57bcf8df8
MD5 5f58410debceacd56b11cab980268115
SHA1 c8def38cb62b33096c686658b58a636f10c66d0b
SHA512 51647812c440bea2406d45195a605b0aee709d329e3bebb727893808766890f090732bb20028c405a0ddf4f9b208829a3fa2178d85f2e460fdb5540f995d1a5a
SSDEEP 49152:JNurorgYmZuaUyu8/ZU+B85pWeddHdQZVd7dPdqHdihw20dSWakHd9RrOodWdldO:msaUyk+BH
TLSH
T1E6753B3BE66288FCC1AFC174A783EAB1B930BC590134792E0A99D7213F59D604B5E7D4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte __C_specific_handler lstrlenW

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fdopen _fileno _fmode _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _read _setjmp _strdup _unlock _vscprintf _vsnprintf _vsnprintf_s _wfopen _write abort atexit atoi calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv isleadbyte isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromIID

shell32

ShellExecuteExA

user32

GetDC ReleaseDC

ws2_32

WSACleanup WSAGetLastError WSAStartup accept bind closesocket connect htons listen recv send setsockopt socket

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x64/AkVCamAssistantMF.exe

IMPHASH 9efd2784c104277a83b3fbf2448ebd40
SHA256 c2bc65d37a0a1b8e2882d4e3fe60fa355d5af1441ef1ae428f0d96a6af62ed21
MD5 444d172b302ea780cdef883e7bd02f5e
SHA1 334786da793f5e5d971739c17589fed4714a7008
SHA512 ba34f63702f50120cbb289e5684030d430b41beb55e5cacbda7acda347c1c2aa9aa8581003d05abcbf70fc2aa7ccbb2ed7383700d24afb13fd7c56d482bde58f
SSDEEP 49152:J9GJUentXHw2IZVzm4+lkrDcJdY96Ghw20dSWakHd9RrOodWdldTU7hQEdVdCJZy:UdIZ9Drj
TLSH
T17A852B3BE66244FCC2ABC074A783EAB1B930FC5901347A5E0A99C7213F5AD605F5E6D4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte __C_specific_handler lstrlenW

mfplat

MFCreateMediaType MFShutdown MFStartup

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fdopen _fileno _fmode _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _read _setjmp _strdup _unlock _vscprintf _vsnprintf _vsnprintf_s _wfopen _write abort atexit atoi calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getchar getenv isleadbyte isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromIID

shell32

ShellExecuteExA

user32

GetDC ReleaseDC

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

167KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x64/AkVCamManager.exe

IMPHASH 19801fabee03696203fa43e50f3712d9
SHA256 9af432eeeed9126f7cb9dab45770bd4fdf989bf0d49f3ec0b668eb3c28a8dd0c
MD5 2e017ab59d0f253d6fdcea41c62bfa0a
SHA1 3a0d07ba3f8c34cf6f69152834c26ce2b8a3623c
SHA512 a78c10b99840f81c17a07ccafad831d806953baf3c718388abb9c09be3c47b36a9f8185eecb4e62f269ef1e68c5eb469640396e13bd25b73d8fb087333811174
SSDEEP 49152:LDObkogXputUwAmYhcSaBl907vhAkwiAm36AdhVzrdjd8dAd3dCdhkuLdJdY96Zm:zsx1SaBl907iuAmZCQ
TLSH
T1F0C5FA3AD2638CE8C1BBC0B8AB879FF99470BD5D0634754B0694D7513BAED60079E2E4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte __C_specific_handler lstrlenW

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _read _setjmp _setmode _strdup _strtoui64 _unlock _vscprintf _vsnprintf _vsnprintf_s _wfopen _write abort atexit atoi calloc ceil exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc isleadbyte isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset putc putwc realloc remove setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower ungetc towupper ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromIID

shell32

ShellExecuteExA

user32

GetDC ReleaseDC

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

169KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x64/AkVCamTest.exe

IMPHASH a4ffe336655b4e8001b0f14140fda4af
SHA256 6fd3d1e07d227ee027988f8c1ef36f16c94bdd2ff8a00ce715444693c22d7663
MD5 40017acbf7150ebd353beeba4a7e5a24
SHA1 a741c021ba0d2c6d17c5c3a9a4a2f4f8165f1906
SHA512 344ee527a85b3ae3194092bd9853d4439755664ff3fe356cf01c05bb1be8d844efc500a8c9f654e50bca27222a7dcac90d051a727fa326ed190bcfce7be84382
SSDEEP 49152:F7a3cJXvOA7eAXusnoMBWUjT39orFdI7dkdidndJdY96Zdvdadmhd1dTdUdPdj7Z:F7/tusoMT3H7M
TLSH
T10DB5FA3AD2638CE8C1AFC078A7879FF9A570BC5D0634794B0694D7513BAED60079E2E4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetStartupInfoA GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte __C_specific_handler lstrlenW

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fdopen _fileno _fmode _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _read _setjmp _strdup _unlock _vscprintf _vsnprintf _vsnprintf_s _wfopen _write abort atexit atoi calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv isleadbyte isspace iswctype ldexp localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscmp wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize StringFromIID

shell32

ShellExecuteExA

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW EndPaint EnumWindows GetClientRect GetDC GetWindowLongPtrW MessageBoxW PeekMessageW PostQuitMessage RegisterClassW ReleaseDC SendNotifyMessageW SetWindowLongPtrW ShowWindow TranslateMessage UpdateWindow

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x64/AkVCamTestMF.exe

IMPHASH 974fc421da5783207e7cf784b78ffdda
SHA256 f219b0f9dd054f0c8f760faa8eaa9c0732abd6fcd32aed1d940116e17787597f
MD5 960b63d2a78969736a2d8325a302e082
SHA1 2f2c37be45f39ab9a785ce2ed0a967a0aa6da748
SHA512 897da227bac7451a68e0912fff482df0bebcdc6c4862c9124b070e862499ebf84282c709b2014e67cd6689773f9c6608d347a65e3f7bce30178dd1e3202f3528
SSDEEP 49152:vL/Y59bBzKyYczq28gHd+4wDJeyppfdLOdxdvdndJdY96Zdyd+dOU7hQEdVdMhwB:iFqnOdHyo
TLSH
T1EBC5FA3AD2638CE8C1AFC0B8A7879FF99470BD5D0634755B0694D7513BAEE20079E2E4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExA RegSetValueExW

gdi32

GetStockObject GetSystemPaletteEntries StretchDIBits

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStartupInfoA GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount HeapAlloc HeapFree InitializeCriticalSection InterlockedPushEntrySList IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte __C_specific_handler lstrlenW

mfplat

MFCreateAttributes MFCreateEventQueue MFCreateMediaType MFCreateMemoryBuffer MFCreatePresentationDescriptor MFCreateSample MFCreateStreamDescriptor MFGetSystemTime MFShutdown MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fdopen _fileno _fmode _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _read _setjmp _strdup _unlock _vscprintf _vsnprintf _vsnprintf_s _wfopen _write abort atexit atoi calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv isleadbyte isspace iswctype iswspace ldexp localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize GetErrorInfo SetErrorInfo StringFromIID

oleaut32

SysFreeString SysStringLen

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

shell32

ShellExecuteExA

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW EndPaint EnumWindows FillRect GetClientRect GetDC MessageBoxW PeekMessageW PostQuitMessage RegisterClassW ReleaseDC SendNotifyMessageW ShowWindow TranslateMessage UpdateWindow

winmm

timeGetTime

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

191KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x64/AkVirtualCamera.dll

IMPHASH 6d7763ee836ea4d1a154ba79534ba4a5
SHA256 db4683984342d5b284d82978a12c11af52d0e3e6944b697ceb927e609e48b443
MD5 d43dd985e68db1db398edaea1ca1ed18
SHA1 f1f845a0818c390a019127105f47fe0a37692511
SHA512 8dd92fdad508bb30dc9d8fd1e378982c2094f78621ecd4c89e6c8526102ea590325f635e507979877b13058ba40d04f29f9e8d859e2e0c025e271362bb7d8d97
SSDEEP 49152:iKraJr/vgcDPp283S9W6VbpujHeQ87dkdidndJdY96Zdvdadmhd1dTdUdPdj7hQG:kJ28KWTHhEO
TLSH
T15EB5FB3AD2638CA8C1AFC078A7879FF9A470BC5D0634754B0694D7513BAED6047AE3E4
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyA RegCreateKeyExA RegCreateKeyW RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegSetValueA RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func __setusermatherr _amsg_exit _assert _beginthreadex _endthreadex _errno _fdopen _fileno _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _read _setjmp _strdup _unlock _vscprintf _vsnprintf _vsnprintf_s _wfopen _write abort atoi calloc fclose fflush fopen fprintf fputc fputs free freopen_s fwrite getenv isleadbyte isspace iswctype ldexp localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscmp wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize StringFromIID

shell32

ShellExecuteExA

user32

EnumWindows GetDC ReleaseDC SendNotifyMessageW

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

179KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

190B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x64/AkVirtualCameraMF.dll

IMPHASH d83cf83c36389b804b8917fc7af9603f
SHA256 b3a130a00d5a8c5aed21e2c6d6e4e8d992834fd7bbc0a8b3d5d7161c1a012f06
MD5 1adab5a615b0b2c331620e5945010e8f
SHA1 aaacea862d7ad311b2b8aebe6b39655c416d9731
SHA512 1fbac409a3dd594164bd875d3650cbc010b35a82eb2b6f81720dc8d5084cbab63a64f19626075e0eaae5d415d995178c34d1a97448b124dbe8ed4ab3d9076a62
SSDEEP 49152:WlEigDCiHHt2eNpxGIStOhqtSW56yRAOdxdvdndJdY96Zdyd+dx7hQEdVdehw20W:W5KpxGIStOm6NN
TLSH
T126C5FB3BD2638CA8C1ABC0B8A7879FF9A470BC5D0634754B0698D75137AFD60179E2E4
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyA RegCreateKeyExA RegCreateKeyW RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueA RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount HeapAlloc HeapFree InitializeCriticalSection InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

mfplat

MFCreateAttributes MFCreateEventQueue MFCreateMediaType MFCreateMemoryBuffer MFCreatePresentationDescriptor MFCreateSample MFCreateStreamDescriptor MFGetSystemTime

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func __setusermatherr _amsg_exit _assert _beginthreadex _endthreadex _errno _fdopen _fileno _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _read _setjmp _strdup _unlock _vscprintf _vsnprintf _vsnprintf_s _wfopen _write abort atoi calloc fclose fflush fopen fprintf fputc fputs free freopen_s fwrite getenv isleadbyte isspace iswctype iswspace ldexp localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree GetErrorInfo SetErrorInfo StringFromIID

oleaut32

SysFreeString SysStringLen

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

shell32

ShellExecuteExA

user32

EnumWindows GetDC ReleaseDC SendNotifyMessageW

winmm

timeGetTime

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

196KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x64/libvcam_capi.dll

IMPHASH 6e4676efc3f2301b825fda6d4153ccc2
SHA256 0d89d35b8dfea73a26203bc8ff5b21e4cc4073e856837ba0832e909f4bc6a2d2
MD5 e090b7f385baab5842ae1167a8b53bcb
SHA1 025224f32191fc34187bf6732e1de7199d10a25c
SHA512 19bbb5df4b2db21b24489dd2e1774bf184ef211e09bba000271a0a8d716bad17a247fc75c5f028ceecc3ab42bd4d970bdd6f990004c99a5a3deefb61576b8766
SSDEEP 49152:6d1MyYnhq9r+VwGRUntgLOWdFdudhVzxd8dhkuXdJdY96jdldPkZEd6dsZVd7dPq:1A+V4gj
TLSH
T198852A3BE66248B8C1ABC074EB83EEB2B930FC5D1134795E0A99C7213F5AD70475E694
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func _amsg_exit _assert _beginthreadex _endthreadex _errno _fdopen _fileno _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _read _setjmp _strdup _unlock _vscprintf _vsnprintf _vsnprintf_s _wfopen _write abort atoi calloc fclose fflush fopen fprintf fputc fputs free fwrite getenv isleadbyte isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromIID

shell32

ShellExecuteExA

user32

GetDC ReleaseDC

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/AkVCamAssistant.exe

IMPHASH 09e3ff1a33ef1b48faaad76afaf966d3
SHA256 f50f66f4614a26ac0c6eb02a47c816a65ca53fd391b2341c90a5bc95eb9eda09
MD5 3c418449bf31fd9f073fce61f80de083
SHA1 155913b7eb5d96c04e73ec77b430c806f0312ad9
SHA512 7ed0fae0e3497714466ccea1b9fdfcf51c8af191fefd721f2082510071837c608f130ec8e281ab6b066d4bea647506e7f9ee7aff57ac8c9b16a7372040c9a55c
SSDEEP 49152:i/oyEAEGOUB5hdMdTZXdwdGd8HddBAmUdZWakkdMhre9dpdldR07t:szG8
TLSH
T186852B39E60201B5C5239371C99FDB7BCB047A698122EE6FBE4ECE04B1336577C59286
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

msvcrt

__lc_codepage __getmainargs __p__iob __p___initenv __p___mb_cur_max __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _endthreadex _errno _fdopen _fileno _fstati64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp3 _strdup _unlock _vsnprintf _vsnprintf_s _wfopen _write abort atexit atoi calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv isleadbyte isspace iswctype malloc localeconv localtime longjmp memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromIID

shell32

ShellExecuteExA

user32

GetDC ReleaseDC

ws2_32

WSACleanup WSAGetLastError WSAStartup accept bind closesocket connect htons listen recv send setsockopt socket

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/4

Size

395KB

Virtual Size

394KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/AkVCamAssistantMF.exe

IMPHASH 847e5a5aff21e0b22fcd0569863416b3
SHA256 d25b56fdad216ab673e294879dc2627a9e90ba36ea71ab859ce2756dc73af557
MD5 014ed33957730af94063826f3793f553
SHA1 2a6375b6ba92384660703ad806eadd63dd66b6aa
SHA512 b6c1f4ecd668172efee5faf7431aa40ae4d251695e1c07ccb8c719e017901561708ddc2a7e5177a9b3ccca26abd83919caa9b71e009a15d5824d9a058697cb74
SSDEEP 49152:c/rpFhvUejcAdY963BAmUdZWakkdMhre9dpdlde57hAPdedzuZXdwdGd8Hddf:c/FFJ
TLSH
T189851B35E60245B4C523A771C49FDB7BCB147A688122AE6FBF4ACD04F2336137C99296
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

mfplat

MFCreateMediaType MFShutdown MFStartup

msvcrt

__lc_codepage __getmainargs __p__iob __p___initenv __p___mb_cur_max __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _endthreadex _errno _fdopen _fileno _fstati64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp3 _strdup _unlock _vsnprintf _vsnprintf_s _wfopen _write abort atexit atoi calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getchar getenv isleadbyte isspace iswctype malloc localeconv localtime longjmp memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromIID

shell32

ShellExecuteExA

user32

GetDC ReleaseDC

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/4

Size

414KB

Virtual Size

414KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/AkVCamManager.exe

IMPHASH a74e25c172f278d487a26102a10ea03f
SHA256 b6ce57d198f6e8edca5f0c5e4d9701a93eb5716f183def0ff1a1b9040bd51ece
MD5 90220a1fcdb6417671152bb7db8196f3
SHA1 0b3b6c524d8246aac7c7a1f312f4bec390a37f90
SHA512 ef22e2c7f30c5e4064f4cd5ddf4e3c22f65fcbdab96a560136861fe24b52fde8bd3fe95562629f623fc38d137b6ca4aeaa649e5f2f1b08ec19b6a4c91ca5dcbe
SSDEEP 49152:8MWVszPRrVYH7fq9JgkIISZYdhVzsdndMdwdfdydhkuEdJdY96Zd9dldOdhdPkZh:87urRrO+Vc
TLSH
T188C52736E10700F4C51367B385AFDABFCB143E6C802A6E6F694D9D04B33765AAC56263
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

msvcrt

__lc_codepage __getmainargs __p__iob __p___initenv __p___mb_cur_max __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _endthreadex _errno _fdopen _filelengthi64 _fileno _fileno _fstati64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp3 _setmode _strdup _unlock _vsnprintf _vsnprintf_s _wfopen _write abort atexit atoi calloc ceil exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc isdigit isleadbyte islower isspace isupper iswctype malloc localeconv localtime longjmp memchr memcmp memcpy memmove memset putc putwc realloc remove setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromIID

shell32

ShellExecuteExA

user32

GetDC ReleaseDC

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/4

Size

508KB

Virtual Size

507KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/AkVCamTest.exe

IMPHASH b975bfdcde3020be370cdb1b2a62d9b2
SHA256 6b9c8a33ff92f908267266c99b6fb92cbbf401736db6fa4d5aa0427946ec9338
MD5 965db57720f4dde9f606177a79190643
SHA1 b948f50a2cba6b5a8ee173a4750b16e40a0c5559
SHA512 be9c3e7cb8a322eba73f1d3bf4d538a92159c0b329f0dae4bb7ebbc58ef60aecde4ef4d37d51cb45916d4179ed7fcbd347e30a157a576e3144fb1ecc65def639
SSDEEP 49152:CsmrrL57aWQxEUneKAdlLdzdyd3dJdY96Zd/dtdIDd5dTdfdod77hAPdedtBAmUg:CsmFVf8
TLSH
T1CCC50836E21740F8C513A7B385AFDABFCB146E1C402A6E6F6D4D9D00B33761AAC56253
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetStartupInfoA GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

msvcrt

__lc_codepage __getmainargs __p__acmdln __p__iob __p___initenv __p___mb_cur_max __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _endthreadex _errno _fdopen _fileno _fstati64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp3 _strdup _unlock _vsnprintf _vsnprintf_s _wfopen _write abort atexit atoi calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv isleadbyte isspace iswctype ldexp malloc localeconv localtime longjmp memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscmp wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize StringFromIID

shell32

ShellExecuteExA

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW EndPaint EnumWindows GetClientRect GetDC GetWindowLongW MessageBoxW PeekMessageW PostQuitMessage RegisterClassW ReleaseDC SendNotifyMessageW SetWindowLongW ShowWindow TranslateMessage UpdateWindow

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/4

Size

496KB

Virtual Size

495KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/AkVCamTestMF.exe

IMPHASH 7ce401de145faa0c5eda3e32c1f9c1a4
SHA256 c0e0370d4ddb598aeb884fd1e6075fbc056086103bc906be74c6fc3858349bdd
MD5 2653421f1cb14f70a8c231a07ba69a3b
SHA1 bb3dba64de4027ded3c89229fcbff30ca92ef1ac
SHA512 b6d82274d78f063d0c6d2790c03d401fc8c9c9871b36aa266503a2ac1b2c729464f76b430cd324b822bb93832ce6d0be8dda08d2294cfcca5699826aeffd9b32
SSDEEP 49152:j/T60BRmCLdpW6lPKDycduYdSdJd3dJdY96ZdDdCdg57hAPdedABAmUdZWakkdMj:jr60Bkw9zS
TLSH
T1CCC51836E11740E4C5176BB385AFDABFCB047E1C802A6E6F6D4D9D00B33762AAC56253
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExA RegSetValueExW

gdi32

GetStockObject GetSystemPaletteEntries StretchDIBits

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetStartupInfoA GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

mfplat

MFCreateAttributes MFCreateEventQueue MFCreateMediaType MFCreateMemoryBuffer MFCreatePresentationDescriptor MFCreateSample MFCreateStreamDescriptor MFGetSystemTime MFShutdown MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

msvcrt

__lc_codepage __getmainargs __p__acmdln __p__iob __p___initenv __p___mb_cur_max __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _endthreadex _errno _fdopen _fileno _fstati64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp3 _strdup _unlock _vsnprintf _vsnprintf_s _wfopen _write abort atexit atoi calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv isleadbyte isspace iswctype ldexp malloc localeconv localtime longjmp memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize StringFromIID

shell32

ShellExecuteExA

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW EndPaint EnumWindows FillRect GetClientRect GetDC MessageBoxW PeekMessageW PostQuitMessage RegisterClassW ReleaseDC SendNotifyMessageW ShowWindow TranslateMessage UpdateWindow

winmm

timeGetTime

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/4

Size

505KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/AkVirtualCamera.dll

IMPHASH 6a8c18c2bb8a7e6ddadc02941b0d6290
SHA256 3127051a5042e57993dfd00cdfa4aff910d9622eaf128cc2bfc9fc77c39ad38b
MD5 74f621cade8d9d94af2702489fe02444
SHA1 05f9f739246d7463d219f5c3935475abb265476c
SHA512 f519f79326364d9938fb49b99e6669deae691409a30f4574fb54e419738f80cbeb58a4d3fdeb753eff1355bfdaf02ea782ccdef895bcfdedf98f764c1cf40b2d
SSDEEP 49152:/+xMhVAME4pZ9G5BxfqLdzdyd3dJdY96Zd/dtdIDd5dTdfdod77hAPded6BAmUdO:WxAm9ah
TLSH
T179C50836E20740E4C513A7B3C5AFDABBCB187E1D402A6E6F6D4E9D00B33761AAC56153
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyA RegCreateKeyExA RegCreateKeyW RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegSetValueA RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

msvcrt

__lc_codepage __p__iob __p___mb_cur_max __setusermatherr _amsg_exit _assert _beginthreadex _endthreadex _errno _fdopen _fileno _fstati64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp3 _strdup _unlock _vsnprintf _vsnprintf_s _wfopen _write abort atoi calloc fclose fflush fopen fprintf fputc fputs free freopen_s fwrite getenv isleadbyte isspace iswctype ldexp malloc localeconv localtime longjmp memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscmp wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize StringFromIID

shell32

ShellExecuteExA

user32

EnumWindows GetDC ReleaseDC SendNotifyMessageW

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/4

Size

501KB

Virtual Size

500KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

190B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/AkVirtualCameraMF.dll

IMPHASH 68ec789396d2a392e933617c861597a3
SHA256 ad9408ff3c43df80e26d896b40d325daeb1e2ef36ef505b7b64c7800cfc04055
MD5 36cca6ee0dd46982658b0fe85741a050
SHA1 343f85e8353c99d7453882e202cf1203566761ee
SHA512 b6b2b18fc0b5ab600a6ad8cb6648ecedf77058e590313de78a366b3aac4e5bbaca57d267a9ac16c255b8638a3f7adf0d3c460fa15d402891cfe4ffdb54547ee9
SSDEEP 49152:JaXYAyt23TvOUZDFYdSdJd3dJdY96ZdDdCdd7hAPded+BAmUdZWakkdMhre9dpdm:EXYrHJw1
TLSH
T1A6C51936E10740E4C5136BB285AFDBBFCB047E1D802AAE6F6D4D9D04B33761AAC56253
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyA RegCreateKeyExA RegCreateKeyW RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueA RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

mfplat

MFCreateAttributes MFCreateEventQueue MFCreateMediaType MFCreateMemoryBuffer MFCreatePresentationDescriptor MFCreateSample MFCreateStreamDescriptor MFGetSystemTime

msvcrt

__lc_codepage __p__iob __p___mb_cur_max __setusermatherr _amsg_exit _assert _beginthreadex _endthreadex _errno _fdopen _fileno _fstati64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp3 _strdup _unlock _vsnprintf _vsnprintf_s _wfopen _write abort atoi calloc fclose fflush fopen fprintf fputc fputs free freopen_s fwrite getenv isleadbyte isspace iswctype ldexp malloc localeconv localtime longjmp memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromIID

shell32

ShellExecuteExA

user32

EnumWindows GetDC ReleaseDC SendNotifyMessageW

winmm

timeGetTime

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

157KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/4

Size

510KB

Virtual Size

509KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/libvcam_capi.dll

IMPHASH d4785f67eb00de59dc66b5c985d60e05
SHA256 9ca8da28de925c9481d5409f66828de16dc7527e5db27d4b22168c4cf0b35076
MD5 3d9ef2c999a7bccd623f201e9e26a8f6
SHA1 e60afbc536baf9d6be0e4effcbb952788b84f47f
SHA512 a230c6303d88db7866dcee2f4d5bb69168b70fbae0277782707c644ce9c3946f075e6f8155b7ac469311b20fae2306129b45d33ab38619bde4f70b74693219d5
SSDEEP 49152:OKeuuiialtb1YJNdKdOdhVzZdMdhkurdJdY96zdldPkZFdydPZXdwdGd8Hd77hA5:OK0mT
TLSH
T1C5952B3AE60605B4C523A371C49FDB7BCB147A688022AE6FFE5ECD04B5376137C59286
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueW RegGetValueA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegSetValueExA RegSetValueExW

gdi32

GetSystemPaletteEntries

kernel32

CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcesses K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte lstrlenW

msvcrt

__lc_codepage __p__iob __p___mb_cur_max _amsg_exit _assert _beginthreadex _endthreadex _errno _fdopen _fileno _fstati64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp3 _strdup _unlock _vsnprintf _vsnprintf_s _wfopen _write abort atoi calloc fclose fflush fopen fprintf fputc fputs free fwrite getenv isleadbyte isspace iswctype malloc localeconv localtime longjmp memchr memcmp memcpy memmove memset realloc remove setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm swprintf_s towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromIID

shell32

ShellExecuteExA

user32

GetDC ReleaseDC

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect htons recv send setsockopt socket

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/4

Size

425KB

Virtual Size

424KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer