Algonaut - Atlas v2.6.2.zip
- SHA256 86ea5473fb5d7b1e1c5f7f5a967b0a8e55d4c960bc392325ee9a128fea9fb836
Behavioral task
behavioral1
Sample
Algonaut - Atlas v2.6.2.zip
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
900 seconds
Errors
Reason
scan timeout
General
- Target Algonaut - Atlas v2.6.2.zip
- Size 41.2MB
- Sample260804-wpv17aeg69
- SHA256 86ea5473fb5d7b1e1c5f7f5a967b0a8e55d4c960bc392325ee9a128fea9fb836
- MD5 2760208038bef18d5f7fbc7b05ac0d10
- SHA1 0da01210eab7888b1aad58c8d4896b9cbceead87
- SHA512 f7b8ac8129cddd5ef1fd3db41c6cc071a9832e10a981b1476ec4409ebaaaaa204bbe85d8c0756ab9f3fb4d64dd30c381a47ab5456263ae15f5dee638af9e25b8
- SSDEEP 786432:vd2CzzbeEPA6kZmbS5G4KHsFeWSJM0uz0tweS8Dg7pCLb9iB0Gu0M/:A43eEP7WZKHsFeW+M0uz0tweS8DcpCnh
- TLSH T10797339121A78D7C50B4E117E6599D6F9BDE54F6D43BCAE0AE4383100DACA34AF3243E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/Algonaut - Atlas v2.6.2/R2R/Algonaut_KeyGen.exe unpack002/$TEMP/BASSMOD.dll unpack002/$TEMP/R2RATLASKG.dll unpack002/$TEMP/keygen.exe unpack001/Algonaut - Atlas v2.6.2/Setup Atlas v2.6.2.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/Algonaut - Atlas v2.6.2/Setup Atlas v2.6.2.exe innosetup
File Explorer
-
Algonaut - Atlas v2.6.2.zip.zip 41.2MB
-
Algonaut - Atlas v2.6.2/R2R/Algonaut_KeyGen.exe.exe 613KB
-
$TEMP/BASSMOD.dll.dll 33KB
-
$TEMP/R2RATLASKG.dll.dll 312KB
-
$TEMP/bgm.mod142KB
-
$TEMP/keygen.exe.exe 441KB
-
Algonaut - Atlas v2.6.2/R2R/R2R.nfo13KB
-
Algonaut - Atlas v2.6.2/R2R/Runtime.txt115B
-
Algonaut - Atlas v2.6.2/Rutracker.nfo1KB
-
Algonaut - Atlas v2.6.2/Setup Atlas v2.6.2.exe.exe 85.6MB
Algonaut - Atlas v2.6.2/R2R/Algonaut_KeyGen.exe
- IMPHASH 46ce5c12b293febbeb513b196aa7f843
- SHA256 66a8df91df9f7783f3be30c5332642d5a335c0623cc1cced245cb63b04461b14
- MD5 58ba3b9567cb977f625faeb1fc971693
- SHA1 e4667d8cf0be9a6e0782b43848db930d7a1699c8
- SHA512 00dc46a33f1eb2f819a6d954531dead4b28b4faad4d0fad5bcd87f3d9b6b24a39394dbc46b10434df3d3899bf4b00fe84a310b0bc0fdfcea72797e4ac1904c6c
- SSDEEP 12288:BX4Lc9t2Sll1SZgRyQEvg3osztqhNCKJUBOhA+paZWN9djRk:B4LcL3UgRydvg4sztwXPzc4O
- TLSH T108D41317FED08573CCA2473188FF8922297B6D66C6BA2B4B66C4B73C19B2343551B643
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13983
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
WriteFile
GetCurrentProcess
GetModuleFileNameW
GetLastError
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
ExitProcess
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$TEMP/BASSMOD.dll
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
73795
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BASSMOD_ErrorGetCode
BASSMOD_Free
BASSMOD_GetCPU
BASSMOD_GetDeviceDescription
BASSMOD_GetVersion
BASSMOD_GetVolume
BASSMOD_Init
BASSMOD_MusicDecode
BASSMOD_MusicFree
BASSMOD_MusicGetLength
BASSMOD_MusicGetName
BASSMOD_MusicGetPosition
BASSMOD_MusicGetVolume
BASSMOD_MusicIsActive
BASSMOD_MusicLoad
BASSMOD_MusicPause
BASSMOD_MusicPlay
BASSMOD_MusicPlayEx
BASSMOD_MusicRemoveSync
BASSMOD_MusicSetAmplify
BASSMOD_MusicSetPanSep
BASSMOD_MusicSetPosition
BASSMOD_MusicSetPositionScaler
BASSMOD_MusicSetSync
BASSMOD_MusicSetVolume
BASSMOD_MusicStop
BASSMOD_SetVolume
Name
Size
31KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
$TEMP/R2RATLASKG.dll
- IMPHASH e915f69f1817baafb781783cee8ab9ec
- SHA256 641a3752546f3a2edf4e11a8bce80a1926d2465962cd832703e326cc3cd8ae2f
- MD5 4e66eb25dec14586623c82069930146f
- SHA1 0ea668cc15d4d94bd6a77504d4e95c4e5d5e4c2b
- SHA512 fa956ec5bebd22bf365a6748b0ca9ce0021bdc6739fbfbc3699e0c558cf3637f7a8728b20b3482b4010eb628fe0a96f02522b99da0b36cebe270d6455d8aa853
- SSDEEP 6144:750GdGEbE59069hVkCZ5mlCLCPTI6vnmp0ySBMgl2XBZYR2P7:VtwEb8FVkCZJuPxZySyfBaRS
- TLSH T16F64AE10F891C03AC66E04705A79DBA84ABDB8700FF1E9DB77D41EAE5D31AC0972671B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
77355
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
WriteFile
GetModuleHandleExW
TerminateProcess
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
SetEndOfFile
FindClose
GetLocaleInfoW
CreateFileW
GetCurrentThreadId
GetSystemDirectoryW
CreateEventW
Sleep
GetFileInformationByHandle
GetLastError
QueryPerformanceFrequency
FindNextFileW
CloseHandle
LoadLibraryW
GetCurrentDirectoryW
GetProcAddress
DeleteCriticalSection
ExitProcess
GetModuleHandleW
FreeLibrary
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
FlushFileBuffers
GetCommandLineW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
ReadConsoleW
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
VirtualProtect
EnterCriticalSection
ReadFile
GetSystemFirmwareTable
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
GetStdHandle
HeapAlloc
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
HeapFree
WriteConsoleW
GetTimeZoneInformation
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetCPInfo
GetStringTypeW
LCMapStringEx
MultiByteToWideChar
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
RaiseException
SleepConditionVariableSRW
WakeAllConditionVariable
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
user32
SendNotifyMessageW
PostMessageW
shell32
SHGetSpecialFolderPathA
winmm
timeGetTime
timeBeginPeriod
dbghelp
MakeSureDirectoryPathExists
RegisterProduct
Name
.text
Size
216KB
Virtual Size
215KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=259, version=33140,
count=181, id=261, version=33140,
count=24, id=259, version=35207,
count=16, id=260, version=35207,
count=85, id=261, version=35207,
count=25, id=260, version=33140,
count=23, id=257, version=33140,
count=286, id=1, productName=Unmarked objects,
count=7, id=265, version=35211,
count=1, id=256, version=35211,
count=1, id=255, version=35211,
count=1, id=258, version=35211,
$TEMP/bgm.mod
- SHA256 a5acec372c8e797e75e92658fe5d5a72eae0a5f44e0e9c12a4d46d9860a5065f
- MD5 70947623a221dd3f532a9783cb0a662a
- SHA1 10d69541ceb99d4c96e31643f612ef7c243bc0c0
- SHA512 00921b5408ab5d20e45dcbfde9dafbdb1d46106c82893141bdfab5121e9ae7a877d7b50a724cbc2123e20976642897401b284ea20f1ad2ea13204ae884dea210
- SSDEEP 3072:Fi3Od13mrKXspSRSMpK3XFB2c2C07n5ztWV2Wq7gtSX81ipzh6XUw7djvoITw:FmKXspSRSMw31585ZWVNqWGTpzQXPBnc
- TLSH T1D9E39D566B033A4BD8ED0778BDEF4372773ACA79061A525F1AC72C3564FB2199F88240
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/keygen.exe
- IMPHASH 61baf0ac33a569be37eaea52c317de1e
- SHA256 2aa5d573846ffd1bd27b5d9043c942ffe84fb6290a27e67ae90271e33feca48a
- MD5 02b0fc712fd8e32abb6c1103e95390ac
- SHA1 c95227e2662990cabee618bfc3e5ced7a5379a78
- SHA512 240e6a3c58c13e9792ba0f7523547c04b94fd395f8d22e40922cad7d8b0806c0666fdad9ea2659fe71e10a68075da053fd86cf10e6cbf17d5f4547cc789e138e
- SSDEEP 12288:ic/kEPDonR6Y436vRzAIe9UySHyHQ0D3d:ZLonR6Y43Ire
- TLSH T13EA4F711E26215FDE8FA133E265BB715D212636C0B67F2D3875B1A1A89311C342F9BCB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
_TrackMouseEvent
ord17
msimg32
GradientFill
kernel32
FreeEnvironmentStringsA
UnhandledExceptionFilter
VirtualQuery
VirtualProtect
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCPInfo
GetOEMCP
GetACP
HeapSize
SetUnhandledExceptionFilter
WriteFile
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ReadFile
CloseHandle
LCMapStringW
LCMapStringA
SetFilePointer
GetCurrentProcess
TerminateProcess
ExitProcess
GetVersionExA
GetStartupInfoA
GetModuleHandleA
SetCurrentDirectoryA
SetEnvironmentVariableA
CreateDirectoryA
GetFullPathNameA
GetCurrentDirectoryA
GetDriveTypeA
HeapReAlloc
RtlUnwind
RaiseException
HeapFree
HeapAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
FlushFileBuffers
CreateFileA
IsBadReadPtr
IsBadCodePtr
QueryPerformanceCounter
GetLocalTime
FindFirstFileA
FindNextFileA
GetLastError
FindClose
DeleteFileA
GetShortPathNameA
GlobalLock
GlobalUnlock
MulDiv
GlobalAlloc
GlobalFree
WideCharToMultiByte
MultiByteToWideChar
WinExec
GetWindowsDirectoryA
GetSystemDirectoryA
GetSystemInfo
GlobalMemoryStatus
GetVersion
GetComputerNameA
FreeLibrary
LoadLibraryA
GetProcAddress
GetCommandLineA
Sleep
GetTickCount
GetModuleFileNameA
GetLocaleInfoW
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
SetEndOfFile
GetEnvironmentStrings
user32
UnregisterClassA
AdjustWindowRectEx
LoadIconA
LoadCursorA
RegisterClassA
PostQuitMessage
DefWindowProcA
InvalidateRect
BeginPaint
EndPaint
FillRect
TabbedTextOutA
GetSysColor
MoveWindow
ReleaseDC
GetClassLongA
SetClassLongA
SetWindowLongA
IsWindowEnabled
EnableWindow
SetFocus
GetFocus
GetWindowLongA
GetClientRect
InflateRect
DrawFocusRect
DrawTextA
PostMessageA
SetWindowTextA
GetDlgItemTextA
GetDlgCtrlID
IsDlgButtonChecked
CallWindowProcA
FindWindowA
MsgWaitForMultipleObjects
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
MapVirtualKeyA
GetWindowRect
SetActiveWindow
SetWindowPos
GetAsyncKeyState
GetCursorPos
ShowCursor
SetCursorPos
MessageBoxA
EnumDisplaySettingsA
ChangeDisplaySettingsA
CreateWindowExA
ShowWindow
SendMessageA
DestroyWindow
GetDC
GetSystemMetrics
GetActiveWindow
gdi32
CreateDIBSection
CreateCompatibleDC
Rectangle
DeleteDC
SetBkColor
SetStretchBltMode
StretchBlt
Ellipse
MoveToEx
LineTo
SetPixel
GetPixel
GetTextExtentPoint32A
SetDIBColorTable
CreatePalette
CreatePen
GetTextMetricsA
SelectPalette
RealizePalette
BitBlt
SelectObject
SetBkMode
SetTextColor
GetStockObject
CreateFontIndirectA
DeleteObject
CreateSolidBrush
GetDeviceCaps
comdlg32
GetSaveFileNameA
ChooseColorA
GetOpenFileNameA
advapi32
GetUserNameA
shell32
ShellExecuteA
ShellExecuteExA
SHGetSpecialFolderPathA
ole32
CoCreateInstance
IIDFromString
CLSIDFromProgID
CoUninitialize
CreateStreamOnHGlobal
OleUninitialize
CoInitializeEx
OleInitialize
oleaut32
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayCopy
OleLoadPicture
SafeArrayGetElement
VariantClear
VariantInit
SafeArrayAccessData
SafeArrayGetDim
SafeArrayUnaccessData
SafeArrayCreate
SysFreeString
SysAllocStringByteLen
VariantChangeType
VariantCopyInd
VariantCopy
SysAllocString
SafeArrayPutElement
winmm
sndPlaySoundA
mciSendStringA
timeEndPeriod
timeGetDevCaps
timeBeginPeriod
timeGetTime
Name
.text
Size
197KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=105, version=2067,
count=35, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=4, id=95, version=2179,
count=2, id=93, version=2067,
count=16, id=93, version=2179,
count=5, id=25, version=9210,
count=224, id=1, productName=Unmarked objects,
count=147, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=42, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Algonaut - Atlas v2.6.2/R2R/R2R.nfo
- SHA256 855205835dacec1a477cbc2bcbade0fcdcbd3edf033edf742094cc30c958e9e3
- MD5 161fe06e80f499a97f1c5b91fcc65b08
- SHA1 09ba010e43da1aa922c182ed85ce0e517b2d409a
- SHA512 9125434a70682929454597ac5acbeb4bf5ecf42938ec6e72c30784ac773e250f50ca903fc783016ee3978742f1640942e1f8faabbf320ab7fabd91042084e45a
- SSDEEP 192:2CyVUyaf/FLhps88fsS8h8J8y8NpbZSeVow9iKT9uOVSf29+M:2Laf/FLrhmD8h8J8y8Np7H9r9uf29v
- TLSH T1BB520D204B20E7B8AA23C67B0E4411C0F295DA0A2D3934DC72AFD5B5FB97D7615783AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Algonaut - Atlas v2.6.2/R2R/Runtime.txt
- SHA256 bfc154f26ce668cd8307352d25481e75bde07fec530b9d56dc3e7a047fe8946b
- MD5 96cdcd55ad8b18e699a3163e44f2a563
- SHA1 85a95833b19901358c06ba0e2282ac6a994f34c5
- SHA512 eeb9ed99cdb29f4253a8d4df856c2a1b959e034f8d6960663cc5fe64c1d3c6729fc4d959fc1c3eb746563d14d23ea63110da95099b9933935e88eb337a0f47a7
- TLSH T1FFB092280C8422590A26B9C22812ABD8670A4B9573292CA901A58199428A1CAA26C6A1
- MD5 SHA1 SHA512 TLSH
Algonaut - Atlas v2.6.2/Rutracker.nfo
- SHA256 2b850f9984d4dbcbcc3e3177565f776e428416fcfe4410c4b3f326c9475c9089
- MD5 965feb7c472bd68aa38351cacffc6205
- SHA1 8cdfdbee5a5591940aae9524623b5b26c430e55e
- SHA512 470e2c2bed960c4f033b46dc43c7de6888995c305f99ec21d78ef1083ef45143a48ba670672177c38f036c1d4f557f2cabcdddf134878cc601c949305c6fa314
- TLSH T14D3162B8530DD74A1E3A53B85D1D6B3E66A70E1743418CFBB35C00BCD3A83AC9AD1949
- MD5 SHA1 SHA512 TLSH
Algonaut - Atlas v2.6.2/Setup Atlas v2.6.2.exe
- IMPHASH e8ac1646024d52d1534a88da2e8037cd
- SHA256 2cd23c8b8ed837e2581a86da2e690e31c1fa9a321e6665df930dad90639c657e
- MD5 7dc704db55efd39630f95e2341bd3ae6
- SHA1 521247d4f21b568cf94638a325b45d0b24f40014
- SHA512 ab27b774cc1d9a56fc081c6763b5d2a674cdde87d29734a6ffc8cb826b2f6fc9d6fa28d5877cc8ba4b4792f856a2eeedb06b96a8771978e324d2990a25d34e50
- SSDEEP 786432:4rozrLrp5TakH7pd+5mm9ajuaZAMDH8FGa4nqdW/FKopblQaIEI:zrakl0aj5Aea4nqWiaI7
- TLSH T11818CF47B29910CAC0A6C17CC6979E27E332B86557308BCB355DA76D3F27BE04E7A250
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Minor OS version
1
Major OS version
6
Entry point
720936
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetACP
GetExitCodeProcess
CloseHandle
LocalFree
SizeofResource
VirtualProtect
QueryPerformanceFrequency
VirtualFree
GetFullPathNameW
GetProcessHeap
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
SetFilePointerEx
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
GetFileSizeEx
LoadLibraryA
ResetEvent
GetVolumeInformationW
GetVersion
GetDriveTypeW
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
LoadResource
SuspendThread
GetTickCount
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetCommandLineW
GetSystemInfo
GetTempPathW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
LCMapStringW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
comctl32
InitCommonControls
user32
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
oleaut32
SafeArrayPutElement
VariantInit
VariantClear
SysFreeString
SafeArrayAccessData
SysReAllocStringLen
SafeArrayCreate
SafeArrayGetElement
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetUBound
SafeArrayGetLBound
VariantChangeType
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
OpenProcessToken
FreeSid
AllocateAndInitializeSid
EqualSid
RegQueryValueExW
GetTokenInformation
ConvertSidToStringSidW
RegCloseKey
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
693KB
Virtual Size
693KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
113B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ