GenP_3.8.0_SOURCE-CGP.zip
- SHA256 a7327c87f38027e10393fe9c188e9e01df756d7d8b012a5b82e9db2c6e89a9c4
Overview
overview
10Static
static
10genp-3.8.0....0.ps1
windows10-2004-x64
3genp-3.8.0....0.ps1
windows11-ltsc_2024-x64
3upx-5.0.1-...c.html
windows10-2004-x64
3upx-5.0.1-...c.html
windows11-ltsc_2024-x64
3upx-5.0.1-...oc.vbs
windows10-2004-x64
5upx-5.0.1-...oc.vbs
windows11-ltsc_2024-x64
5upx-5.0.1-...px.vbs
windows10-2004-x64
5upx-5.0.1-...px.vbs
windows11-ltsc_2024-x64
5upx-5.0.1-...px.exe
windows10-2004-x64
5upx-5.0.1-...px.exe
windows11-ltsc_2024-x64
5genp-3.8.0...st.ps1
windows10-2004-x64
3genp-3.8.0...st.ps1
windows11-ltsc_2024-x64
3genp-3.8.0...st.dll
windows10-2004-x64
8genp-3.8.0...ld.ps1
windows10-2004-x64
3genp-3.8.0...ld.ps1
windows11-ltsc_2024-x64
3genp-3.8.0...ld.bat
windows10-2004-x64
3genp-3.8.0...ld.bat
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
genp-3.8.0-src/GenP/GenP-3.8.0.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
genp-3.8.0-src/GenP/GenP-3.8.0.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
120 seconds
Behavioral task
behavioral3
Sample
upx-5.0.1-win64/upx-doc.html
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
120 seconds
Behavioral task
behavioral4
Sample
upx-5.0.1-win64/upx-doc.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
120 seconds
Behavioral task
behavioral5
Sample
upx-5.0.1-win64/upx-doc.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
120 seconds
Behavioral task
behavioral6
Sample
upx-5.0.1-win64/upx-doc.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
120 seconds
Behavioral task
behavioral7
Sample
upx-5.0.1-win64/upx.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
120 seconds
Behavioral task
behavioral8
Sample
upx-5.0.1-win64/upx.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
120 seconds
Behavioral task
behavioral9
Sample
upx-5.0.1-win64/upx.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
120 seconds
Behavioral task
behavioral10
Sample
upx-5.0.1-win64/upx.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
120 seconds
Behavioral task
behavioral11
Sample
genp-3.8.0-src/WinTrust/patch_wintrust.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
120 seconds
Behavioral task
behavioral12
Sample
genp-3.8.0-src/WinTrust/patch_wintrust.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
120 seconds
Behavioral task
behavioral13
Sample
genp-3.8.0-src/WinTrust/wintrust.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
120 seconds
Behavioral task
behavioral14
Sample
genp-3.8.0-src/build.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
120 seconds
Behavioral task
behavioral15
Sample
genp-3.8.0-src/build.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
120 seconds
Behavioral task
behavioral16
Sample
genp-3.8.0-src/run_build.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
120 seconds
Behavioral task
behavioral17
Sample
genp-3.8.0-src/run_build.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
120 seconds
General
- Target GenP_3.8.0_SOURCE-CGP.zip
- Size 932KB
- Sample260805-ee99pada35
- SHA256 a7327c87f38027e10393fe9c188e9e01df756d7d8b012a5b82e9db2c6e89a9c4
- MD5 50b310456c6670b57cc57b874a9c9996
- SHA1 653fc542345471a4df08d98e05e2fe907689da34
- SHA512 46d8f0d91e6f3ca0252e8174e1a57be132e9fc7847064ce696b93b294db08024a2881fad36fe45c1bbb6ea7143027d42cbc5efb1c3af956ba040687b35c39540
- SSDEEP 24576:h9tMjv72RCz0I/KynmcvVuPWWAkRBE0yArptxek:TtajKO0LsQWWluIck
- TLSH T19E1533B1B8A676A6C0844535E68BE5C0BBF3B83004FDE35E14D1B9CEBC7B5901E9909D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://www.autoitscript.com/files/autoit3/autoit-v3.zip
-
exe.dropper
https://www.autoitscript.com/autoit3/scite/download/SciTE4AutoIt3_Portable.zip
Signatures
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack003/out.upx patched_upx -
resource yara_rule static1/unpack002/upx-5.0.1-win64/upx.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/upx-5.0.1-win64/upx.exe unpack003/out.upx
File Explorer
-
GenP_3.8.0_SOURCE-CGP.zip.zip 932KB
-
CGP.nfo33KB
-
genp-3.8.0-src/GenP/GenP-3.8.0.au3.ps1 133KB
-
genp-3.8.0-src/GenP/Skull.ico202KB
-
genp-3.8.0-src/GenP/config.ini12KB
-
genp-3.8.0-src/UPX/upx-5.0.1-win64.zip.zip 630KB
-
upx-5.0.1-win64/COPYING17KB
-
upx-5.0.1-win64/LICENSE5KB
-
upx-5.0.1-win64/NEWS25KB
-
upx-5.0.1-win64/README3KB
-
upx-5.0.1-win64/THANKS.txt2KB
-
upx-5.0.1-win64/upx-doc.html.html .vbs 37KB
-
upx-5.0.1-win64/upx-doc.txt.vbs 36KB
-
upx-5.0.1-win64/upx.1.vbs 39KB
-
upx-5.0.1-win64/upx.exe.exe 585KB
-
out.upx.exe 2.3MB
-
genp-3.8.0-src/WinTrust/patch_wintrust.ps1.ps1 1KB
-
genp-3.8.0-src/WinTrust/wintrust.dll.dll 373KB
-
genp-3.8.0-src/build.ps1.ps1 18KB
-
genp-3.8.0-src/build_info.txt125B
-
genp-3.8.0-src/run_build.bat535B
CGP.nfo
- SHA256 fe8c42e215a2e2557358e9a89e7e6093eff84676d33c74b7f31f2d1a427098b5
- MD5 18dfc3601330af51c35e20876b891386
- SHA1 2c645dae33e396a81cdba2fb168140417776a0f0
- SHA512 69fdcdf341f0210647f61c7d0c8b5f83fe83552c15e8d5e2bc79985ad274a50ce2f5d86cdc567a6e79c1d1dfe4e524e5918a3d308789c2c289d20d77b96b3954
- SSDEEP 48:SrEFhZ4H9zI3DuEZJHAKjrmAZhBdzWMMMEM2MMMMMMs43MUMMMMMMMsUpMMMYMM8:SrUeETKZJ8QmCYQYPpdohAZ4tpP
- TLSH T17DF23E7534F737414F214EA71A18CD7D9B999BE2AFF60885F0DD1809AB209B21B442F7
- MD5 SHA1 SHA512 SSDEEP TLSH
genp-3.8.0-src/GenP/GenP-3.8.0.au3
- SHA256 0ccb8be7f0722b5088d33c3663234fa1f2f598d29ad70fcc8a05200f2d202ac8
- MD5 88fbad5105ac33f8387219c77ac95c4b
- SHA1 afb189fecf60e3d7463f198add7dbb18c968d6a2
- SHA512 752213490f6c66fb2aec0e684f804d90865edbf195cd9ff0fdf72add07f9481031117575d1d69f1b38b755682f7b7dfe2df1e57d7907a560a924e9eba8885482
- SSDEEP 3072:h7L3Pb2sYWugo9fl99zKS/ECNL4MAjaL2L0tII:1P+WugOH9ECNL4vj0tII
- TLSH T10AD3C509FC2F088A7659F166B9B78D59F61FE86AD6392194F87DCC6C104442C90ECACF
- MD5 SHA1 SHA512 SSDEEP TLSH
genp-3.8.0-src/GenP/Skull.ico
- SHA256 1532311559d17cf7ecc0be72fb47ec7d0ea086c414e2280566e0803133fd1d50
- MD5 c37b537e533890560fe52664a7f1c1a0
- SHA1 5d11653c7f93efdfcdc170d0c644b6452fa940dd
- SHA512 8d69bb6dcb70896c0dd0bd72c66b68536f033e7dc0d8208d65485ac15fe805b5d8c5c7ce2c61ac37cde7b3c4df759dc28e2b16f9da0b223090f7e3d475d451eb
- SSDEEP 3072:KxThxUTAzHOGox/C0wdvMqLD2T/ZS50M5anf3/L/5p1CudpSjnIiYjA:axdLPosFUqLD27etav/hXSj3
- TLSH T11114AF52B7C0D373D2B80330C5EB866937226F57AE822A9231D473BD78F93516427A79
- MD5 SHA1 SHA512 SSDEEP TLSH
genp-3.8.0-src/GenP/config.ini
- SHA256 542a00202a1a407b46416e85de932658eb556d249e6d8c98a702030efc704686
- MD5 189b990776e4d80da9ce0ba363301c49
- SHA1 4bda323c69d258e5127c26660047cc64c462824c
- SHA512 b257d2b906cddebe58c6689a797633a0db5fd404b4eacb7779c5a85db42499786c9c7190849d961d3c2e0903271afc02a7f8c4191b34d3fe0e5086e1f15ddd61
- SSDEEP 384:0oM5+Npwecd0K8vck/vcg+qNLaJ2ctKmm8hJ/o:0oM5+Npwe7nq2ctKv
- TLSH T19342C805C5D342B2CAE57E4E32717E932B3BF1CC95CE1351DB5A853E39D200492ABE99
- MD5 SHA1 SHA512 SSDEEP TLSH
genp-3.8.0-src/UPX/upx-5.0.1-win64.zip
- SHA256 c288989437ce70646a62799a4dcf25b4ec7ad8fbb4f93a29e25c14856659c1a4
- MD5 c7e44b194229b217d7e859c14714ba2f
- SHA1 6ca83cf65bd4891742740d29d69c9b1a59a5ded5
- SHA512 0fa7e6c224bab32235a6fc10fa354e86bc3e5abf231ccfa935bf97320041af75e1eb810ef6b6ac35b222c71109c762a4fca102015707ddfed7c76dd776014706
- SSDEEP 12288:VeRs5sNH4ncPK8IOkTSgFG2nmapJSePMNndxcNqquobLY9pHYLjVK3eASYhE:VSrRC/8I/42nmGJVGPWuAkpHE0uAZE
- TLSH T1F2D42361B42973A3C0D99A61D6AFD9807BF3FE3424EEA98D2DE05ACFD0AF2551C4405C
- MD5 SHA1 SHA512 SSDEEP TLSH
upx-5.0.1-win64/COPYING
- SHA256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643
- MD5 b234ee4d69f5fce4486a80fdaf4a4263
- SHA1 4cc77b90af91e615a64ae04893fdffa7939db84c
- SHA512 aee80b1f9f7f4a8a00dcf6e6ce6c41988dcaedc4de19d9d04460cbfb05d99829ffe8f9d038468eabbfba4d65b38e8dbef5ecf5eb8a1b891d9839cda6c48ee957
- SSDEEP 384:ghUwi5rpL676yV12rPd34ZomzM2FR+dWF7jUI:gmFWixMFzMdm7jUI
- TLSH T13A82A42E770443F205C202A16A4F68DFA32AD5B9723E1155386DC15E236FE35C3BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
upx-5.0.1-win64/LICENSE
- SHA256 905d4a66d5324e154d976bbf88829d4d9263815a2b97cc40954f06d4a23c28eb
- MD5 353753597aa110e0ded3508408c6374a
- SHA1 f33a1dbeeff88775cd66940d4d3383544b618680
- SHA512 10565fb864e912bf52e23e71ca8805f85de96f76ed06dc37c28f0cdb18eaa8ed3921245a1286b6856ae39787858d0f3ce15f6ca7053e76fc3e81541769a8f5ad
- SSDEEP 96:LrmxPO+n4/uwNmu+3h9R7x4YZgll+8jcH5k4:HmxPr4/uwoJ3hTvc+8jcZV
- TLSH T165B1B5AAEA0C93F005C316125985DDD8E20AA16772994CE4BC5DC38E0F6DB3892F92E1
- MD5 SHA1 SHA512 SSDEEP TLSH
upx-5.0.1-win64/NEWS
- SHA256 61816a7e22748a7d595d2080a0bd9dd03ff2a11a75f919981f27597fc8f63d84
- MD5 7a0e1c2d94cb31ac4f834b184f7e71b2
- SHA1 8e47d59956e3ad0110935b2b5678deb6f070fb88
- SHA512 c6e183cd37dc7e3c74102da65e778991af45d04eb54dfeb64647eb1ff09aa6f2c7583519992636f9fed1e62f61003a3fe6361fe55694c077bd9ca7b127287089
- SSDEEP 384:awYuSxNjjR0sDi2u7lCTirSyzeZVzuqxGzgl77SGj9WFybwruza9CoVd1zhyNhz8:ixNjjR7ju7lCTLa4+qy/W+VrzkhPdwXR
- TLSH T13FB2B822290531B203C396C27BD671C6EB1BA1BDB710E125B7BB850C1F513DE566F6E8
- MD5 SHA1 SHA512 SSDEEP TLSH
upx-5.0.1-win64/README
- SHA256 a68fe2b3fe48f4fd67b2924019abe41cd1749ad025c43f265269b011d40ad830
- MD5 f658702644480c07bddb594457f8eb3c
- SHA1 ed075d72511cbd1c65c7944b8aed087604785545
- SHA512 c30d0e6735266b0f1a54a373289919e97ec09c08b4ed9a9ebacad05f21d2741292f9881168c5876560c1bfd6990424bf68ac956b5aab7ff4ecf0b51281cbfa9a
- TLSH T11371B6E6574C67B30EC2163253494CC6EE4E5A2A725A5CF5BC0C424F2318F1889FE5F8
- MD5 SHA1 SHA512 TLSH
upx-5.0.1-win64/THANKS.txt
- SHA256 33bcf25cedd3865b26b92b7e20e3a0f2f51bdebedc360122d0627995cfb4c2a6
- MD5 ab6a6106f9a2af3c3a54ad878fe1355c
- SHA1 c0a4292535cc85670c7e285cd552f1d0c98f56bb
- SHA512 4b795aefdb096af0d894c11fd89800b2faf72796997a21c1f7a38e234f3b7a89061f9b47dc25bf34bb46a6bed299fff3f9ec75ca2c492d14250a9419f958b540
- TLSH T1AD4153674D0DB73311829A315A084D81EB9D45372662CCFBBB7F430D5B4086A4AEE1C0
- MD5 SHA1 SHA512 TLSH
upx-5.0.1-win64/upx-doc.html
- SHA256 f308ba932cfe33da54b33b21ccef83f073ab1a208bee54a5b6fa22963e7f663f
- MD5 cc0164496a03755ddcbc2a8f29dd5b90
- SHA1 be9995bb184b8a40d2357cb960c506f3f3c5cdee
- SHA512 4dba4a7a1b364b60b1a0b06e19e77314756bfc478e7b9046add619690ad648431e1fa9cfcccfee9f50f992b4c5ab61870fd92d01c02f78b353b3f08f11ac967b
- SSDEEP 768:NWHwJhpQ/Yh7xxDmoyW4WB8FmS7lkUcyhE2UcyhEEoam4qKTwRwQTnIkonb4h:wHwJhpQ/+7XR4WsJkdOE2dOEEq4pTwRD
- TLSH T1A403E976C75D13B304C5AA797F19A6DD9B2AA32C323222D0B84D820DA30593855FFBF5
- MD5 SHA1 SHA512 SSDEEP TLSH
upx-5.0.1-win64/upx-doc.txt
- SHA256 cdfbf5d3955da09942c1993d8e9049ea47709765cae5ddf134e8bf0856a28435
- MD5 2b20cf0d043c8b5c0fc0f27aecef750d
- SHA1 12f10bf0605dfc46233846f3801b86e15dc109a0
- SHA512 3bf5914ffd9b8cfdb46b1ea58d0deedc6518ede533038fc54f48e04481bbf8ae0aade1970699a5384aba5cd11855c621529707a5e702ee04728c37037b41c055
- SSDEEP 768:PmW5wh5hr32FGhyidWclu84ZyrtkwKK6kwKKOM6dftXEY3y3X78Swxw+9:Pl5wh5hr+3igclu84Y5Z65ZOtVXEY3Uk
- TLSH T16FF2C66A9B4813F615824A716FDDDBCA5726D22B32326550B8DD820C1F05D385AFBBF0
- MD5 SHA1 SHA512 SSDEEP TLSH
upx-5.0.1-win64/upx.1
- SHA256 406c403c530a928e3f090d4872809ca57c9d72d9e33b15ff0ebcf572bb182451
- MD5 cc9d2d9860b8397a7de936120e26f04e
- SHA1 b1015aff97afa5ca538ebeb0c17c6cf835cbf068
- SHA512 33261a23fa8279d2600eb6925662eb01c0b30b0611d95d52b992b2f29be6cf390a37ebb14bdd08981c2019f9f986bfd566160fe734eac7f044359e5bb41e47cc
- SSDEEP 768:4buWbuszVANCMGjfiqmjsl70EWmHkSJ+TdbFiG1mfUkghDUkgq7WczzofcfodPgn:GbuszVANC1tmmw3mHkSs5bFiu0xghDxp
- TLSH T1D203E877468D13B51E8159D05F19AAC95725E22A3332D164F9AC810DE301A3F8AFBBF3
- MD5 SHA1 SHA512 SSDEEP TLSH
upx-5.0.1-win64/upx.exe
- SHA256 8def9daba0817636962e60878e117ee1dcba6c3f64fb4bc13449d447385f1b5b
- MD5 a14acd4e0fd7f388b6c42cde82fec28b
- SHA1 475dc900fe226a6bda388fcf861a2c83b269fccd
- SHA512 a7393ce2597adf34077649d757ea3a378abdc9dfc4424300d332d8e1476deac8397e5ca5da62aca46bc3aeb1078a62f8a70433e6db0872c086647e05d7cb3b32
- SSDEEP 12288:EB3+loKiHEbMXeYJdRSGlv0I95DJeYB5P8Lepdn2DGMNbhEtPNi6Qe2:EZWXi9RXhZ9xo45P8LeLyzIPPd
- TLSH T1ECD423AB5831B877C72003FDAC8C9546B3A0769CD1EFE24ED0CAD7669039DEA6154738
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2402000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
582KB
Virtual Size
584KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 f4fbd49ea7725912fd55bd177fd3214c75b034c5d319c91373821363b82bedcc
- MD5 f0758d30d2f03c7574ce22996e8cb371
- SHA1 e5cc5e14b32d04d8235b7fc2e146d6604611df85
- SHA512 6cb51690c04ca6fd6ac152c18b47d5bee228b0a08e8c8ffa916644af00f1538083e853a54005ada2fe2f0606e30bbb69e94241461fa739c5c05c27175c53e1f0
- SSDEEP 24576:5JX3wWzjab8Ixjrjuedj1xUCwjXA7P3dlJFZx/7lgCGJp:wWzmgI4ij/2A7lxw
- TLSH T190B55B41E2D15CDED67AC23A111B3A32B17AB80211F55ECB32BCC7B49B7AD489347678
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
904KB
Virtual Size
903KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
genp-3.8.0-src/WinTrust/patch_wintrust.ps1
- SHA256 a73b572bbf1ddbf7d9f5a03ea5ecf9e2c296ecbefbc60104656f21644b20b2f2
- MD5 4c1563eb08376a1fc0979a18c1df28fc
- SHA1 00cd35fb7cc22f4a8f609fce569f93d79ad66021
- SHA512 4b5b48bbae0679e6efff4c852d69218f66ab29634eaa2e76f2c3b19c3e7836903b488c13b58f485b55bfd0ff92fdbbbdbfc22cacb8ffe0e814fb3ae769be11f3
- TLSH T17841C0225D41C31481F70F17056A8564EDA7723FB244AA10747CC354AFB4F2ECA61DEE
- MD5 SHA1 SHA512 TLSH
genp-3.8.0-src/WinTrust/wintrust.dll
- IMPHASH 535395085773d709ddd7a1de7e97336e
- SHA256 ecb263d1f71b514cbd3abae65bac84942355e0c2b31c3c11ba35709716caaee4
- MD5 1b3bf770d4f59ca883391321a21923ae
- SHA1 b45e3a82acda5ffa59716ee3e6f2c7c36063d671
- SHA512 581a823a8371c830add8821af3b6ad3b15ccb51fc04adfc83d2cb20ed8c38c31416fad3ddddea34064dbf1a36e4ecab04659f26f66d265f07e044ab6147d4ef1
- SSDEEP 6144:pgCBP6xz5/RZdpcIJJlmWnoBdM6DxlWGqrJvuxS2WeTwNLZLV/M9iQZoBNmlK/oW:CkPY/Vpc0JHWDxlRqb5qK/R
- TLSH T10B844A2EA6F910A4D8B6913885538206D6737874237196CF429CC6BD9F2BFE47A3DF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
74:0c:a3:96:fb:b7:c9:46:df:e4:23:90:91:5b:49:a6:f7:e9:07:f3:5d:42:e7:42:a6:4f:2a:be:b7:3c:7d:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2020
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:17:31:60:7e:07:76:31:9e:09:00:00:00:00:01:17
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Feb 11, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
69824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wintrust.pdb
msvcrt
__dllonexit
_onexit
_lock
_unlock
__C_specific_handler
memset
memmove
memcpy
memcmp
qsort_s
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_vsnwprintf
_wcsicmp
atol
strcmp
__CxxFrameHandler3
memcpy_s
qsort
wcschr
wcstol
_itow_s
_memicmp
_stricmp
_wcsnicmp
wcsrchr
wcscat_s
_wtol
towupper
_vsnprintf
_ltoa
bsearch
wcscmp
api-ms-win-core-version-private-l1-1-0
GetFileVersionInfoByHandle
api-ms-win-core-file-l1-1-0
GetFileAttributesExW
CreateFileW
SetFilePointerEx
CompareFileTime
ReadFile
WriteFile
CreateDirectoryW
SetEndOfFile
GetFileSize
SetFilePointer
GetFileAttributesW
FindClose
GetFileInformationByHandle
FindNextFileW
GetFileSizeEx
SetFileAttributesW
FindFirstFileW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ResetEvent
DeleteCriticalSection
LeaveCriticalSection
SetEvent
ReleaseSRWLockExclusive
EnterCriticalSection
InitializeCriticalSection
ReleaseMutex
WaitForMultipleObjectsEx
CreateMutexA
CreateEventA
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalReAlloc
LocalFree
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GetCurrentDirectoryW
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
GetProcAddress
FreeLibrary
LoadResource
LockResource
GetModuleHandleExA
FreeResource
DisableThreadLibraryCalls
SizeofResource
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
LoadLibraryA
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExW
RegEnumKeyExA
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
RegSetValueExA
RegEnumValueA
RegGetValueW
RegQueryValueExA
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount
GetSystemDirectoryW
GetTickCount64
GetSystemInfo
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
OpenThreadToken
OpenProcessToken
GetCurrentThreadId
GetCurrentThread
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-memory-l1-1-1
VirtualUnlock
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-datetime-l1-1-0
GetDateFormatA
GetTimeFormatA
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-security-base-l1-1-0
GetSidSubAuthority
EqualSid
GetLengthSid
IsValidSid
AllocateAndInitializeSid
CopySid
GetAclInformation
AddAce
SetFileSecurityW
GetSidIdentifierAuthority
FreeSid
GetTokenInformation
GetFileSecurityW
GetAce
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAccessAllowedAceEx
GetSidSubAuthorityCount
InitializeAcl
InitializeSecurityDescriptor
rpcrt4
RpcStringBindingComposeW
RpcStringFreeW
RpcEpResolveBinding
RpcBindingFree
NdrClientCall3
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-kernel32-legacy-l1-1-0
FindResourceExA
CreateFileMappingA
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpA
lstrlenA
lstrlenW
ntdll
NtQuerySecurityAttributesToken
NtQueryEaFile
RtlGetVersion
RtlCreateUnicodeString
NtQuerySecurityObject
RtlInitUnicodeString
RtlCompareUnicodeString
RtlAppendUnicodeStringToString
RtlEqualUnicodeString
RtlPrefixUnicodeString
RtlAllocateHeap
LdrResSearchResource
RtlGetAce
RtlCopyUnicodeString
RtlGetNtSystemRoot
RtlInitializeSidEx
RtlEqualSid
RtlGetDaclSecurityDescriptor
RtlFreeUnicodeString
ZwQueryVolumeInformationFile
RtlNtStatusToDosError
NtQuerySystemInformation
RtlFreeHeap
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AddPersonalTrustDBPages
CatalogCompactHashDatabase
ComputeFirstPageHash
ConfigCiFinalPolicy
ConfigCiPackageFamilyNameCheck
CryptCATAdminAcquireContext
CryptCATAdminAcquireContext2
CryptCATAdminAddCatalog
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminCalcHashFromFileHandle2
CryptCATAdminCalcHashFromFileHandle3
CryptCATAdminEnumCatalogFromHash
CryptCATAdminPauseServiceForBackup
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminRemoveCatalog
CryptCATAdminResolveCatalogPath
CryptCATAllocSortedMemberInfo
CryptCATCDFClose
CryptCATCDFEnumAttributes
CryptCATCDFEnumAttributesWithCDFTag
CryptCATCDFEnumCatAttributes
CryptCATCDFEnumMembers
CryptCATCDFEnumMembersByCDFTag
CryptCATCDFEnumMembersByCDFTagEx
CryptCATCDFOpen
CryptCATCatalogInfoFromContext
CryptCATClose
CryptCATEnumerateAttr
CryptCATEnumerateCatAttr
CryptCATEnumerateMember
CryptCATFreeSortedMemberInfo
CryptCATGetAttrInfo
CryptCATGetCatAttrInfo
CryptCATGetMemberInfo
CryptCATHandleFromStore
CryptCATOpen
CryptCATPersistStore
CryptCATPutAttrInfo
CryptCATPutCatAttrInfo
CryptCATPutMemberInfo
CryptCATStoreFromHandle
CryptCATVerifyMember
CryptSIPCreateIndirectData
CryptSIPGetCaps
CryptSIPGetInfo
CryptSIPGetRegWorkingFlags
CryptSIPGetSealedDigest
CryptSIPGetSignedDataMsg
CryptSIPPutSignedDataMsg
CryptSIPRemoveSignedDataMsg
CryptSIPVerifyIndirectData
DllRegisterServer
DllUnregisterServer
DriverCleanupPolicy
DriverFinalPolicy
DriverInitializePolicy
FindCertsByIssuer
GenericChainCertificateTrust
GenericChainFinalProv
GetAuthenticodeSha256Hash
HTTPSCertificateTrust
HTTPSFinalProv
IsCatalogFile
MsCatConstructHashTag
MsCatFreeHashTag
OfficeCleanupPolicy
OfficeInitializePolicy
OpenPersonalTrustDBDialog
OpenPersonalTrustDBDialogEx
SoftpubAuthenticode
SoftpubCheckCert
SoftpubCleanup
SoftpubDefCertInit
SoftpubDllRegisterServer
SoftpubDllUnregisterServer
SoftpubDumpStructure
SoftpubFreeDefUsageCallData
SoftpubInitialize
SoftpubLoadDefUsageCallData
SoftpubLoadMessage
SoftpubLoadSignature
SrpCheckSmartlockerEAandProcessToken
TrustDecode
TrustFindIssuerCertificate
TrustFreeDecode
TrustIsCertificateSelfSigned
TrustOpenStores
WTConvertCertCtxToChainInfo
WTGetBioSignatureInfo
WTGetPluginSignatureInfo
WTGetSignatureInfo
WTHelperCertCheckValidSignature
WTHelperCertFindIssuerCertificate
WTHelperCertIsSelfSigned
WTHelperCheckCertUsage
WTHelperGetAgencyInfo
WTHelperGetFileHandle
WTHelperGetFileHash
WTHelperGetFileName
WTHelperGetKnownUsages
WTHelperGetProvCertFromChain
WTHelperGetProvPrivateDataFromChain
WTHelperGetProvSignerFromChain
WTHelperIsChainedToMicrosoft
WTHelperIsChainedToMicrosoftFromStateData
WTHelperIsInRootStore
WTHelperOpenKnownStores
WTHelperProvDataFromStateData
WTIsFirstConfigCiResultPreferred
WTLogConfigCiScriptEvent
WTLogConfigCiSignerEvent
WTValidateBioSignaturePolicy
WVTAsn1CatMemberInfo2Decode
WVTAsn1CatMemberInfo2Encode
WVTAsn1CatMemberInfoDecode
WVTAsn1CatMemberInfoEncode
WVTAsn1CatNameValueDecode
WVTAsn1CatNameValueEncode
WVTAsn1IntentToSealAttributeDecode
WVTAsn1IntentToSealAttributeEncode
WVTAsn1SealingSignatureAttributeDecode
WVTAsn1SealingSignatureAttributeEncode
WVTAsn1SealingTimestampAttributeDecode
WVTAsn1SealingTimestampAttributeEncode
WVTAsn1SpcFinancialCriteriaInfoDecode
WVTAsn1SpcFinancialCriteriaInfoEncode
WVTAsn1SpcIndirectDataContentDecode
WVTAsn1SpcIndirectDataContentEncode
WVTAsn1SpcLinkDecode
WVTAsn1SpcLinkEncode
WVTAsn1SpcMinimalCriteriaInfoDecode
WVTAsn1SpcMinimalCriteriaInfoEncode
WVTAsn1SpcPeImageDataDecode
WVTAsn1SpcPeImageDataEncode
WVTAsn1SpcSigInfoDecode
WVTAsn1SpcSigInfoEncode
WVTAsn1SpcSpAgencyInfoDecode
WVTAsn1SpcSpAgencyInfoEncode
WVTAsn1SpcSpOpusInfoDecode
WVTAsn1SpcSpOpusInfoEncode
WVTAsn1SpcStatementTypeDecode
WVTAsn1SpcStatementTypeEncode
WinVerifyTrust
WinVerifyTrustEx
WintrustAddActionID
WintrustAddDefaultForUsage
WintrustCertificateTrust
WintrustGetDefaultForUsage
WintrustGetRegPolicyFlags
WintrustLoadFunctionPointers
WintrustRemoveActionID
WintrustSetDefaultIncludePEPageHashes
WintrustSetRegPolicyFlags
WintrustUserWriteabilityCheck
mscat32DllRegisterServer
mscat32DllUnregisterServer
mssip32DllRegisterServer
mssip32DllUnregisterServer
Name
.text
Size
261KB
Virtual Size
261KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=260, version=27412,
count=3, id=259, version=27412,
count=391, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=88, id=269, version=27412,
count=4, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
genp-3.8.0-src/build.ps1
- SHA256 14be137b4644140653363fa7b13ada4b66e50a57257226bd231d62aadf8364ae
- MD5 3489ee25b34b46deabe8d371ee8b0d76
- SHA1 2a6a17729cba08dcc18db071ef3b2db62c1e6721
- SHA512 ec2d55c57bfc474276a270e04d870dbe3d7324d4fdc0f16f48783c4dc22fd618bc43e3d4608e0dd0cef29aaff12c4c1188ca5fb14c01ecda9f5f5a9af2f793a5
- SSDEEP 192:dh3auTbrrPixXPIyoP3s9LKE87Focy2/aXVL1bpmyU5XVL1Gp43rHRX0frzNJt:3x89LKE/2yq0jzNJt
- TLSH T17B82B61D6982821982F31B7E8B969298ED9B01BF43451780747CC187BFB163FCB91E97
- MD5 SHA1 SHA512 SSDEEP TLSH
genp-3.8.0-src/build_info.txt
- SHA256 5bff34f3b20e7489574185a1f3c1263221ffb5e1bac4449d25520432678a8b42
- MD5 fe91d47527e7ec9024f4d263a5884de5
- SHA1 a3bc91ed50abf1c49b6ae37e07470ebb72876326
- SHA512 378d5723083e9b6ddb9f7b43e1e4405fb88554fc100e5d2f9a578d8f197825bdab15977285e30084ebdbea35dd311c748df33bce7658cdcd9e4e9c8a8117dfb7
- TLSH T166B02B7F9C51C728C43304C200A50F4CC172157573C040C00030048945134FF503CB0A
- MD5 SHA1 SHA512 TLSH
genp-3.8.0-src/run_build.bat
- SHA256 e89150350b8b4d6957c180b8c044f367cdea8d0d0b71c8f59dca8f9ec99a2be5
- MD5 2a1b445614f030c40fb92204611c1034
- SHA1 16ca04b1ab1e42d16cfb4bf88b461adc82537b3e
- SHA512 87e0d358c98fd77f7556ab5c4a5b5718892de7a6c25d85badab6ca66fd9b0819dbbe3c6408cadf2d17079e521ab5f120c7c1f6597bf777645102c8df9421ff31
- TLSH T125F08B0B3A88DBB803F144A345F4DEB2DC66431B7400E4C674280C50BF1A6809BF1FC9
- MD5 SHA1 SHA512 TLSH