hgf.zip
- SHA256 239d9701ff9c57e84080e53fb4c4606ca86438f4658994748000cf80e9ffd743
Overview
overview
10Static
static
3hgf.zip
windows10-2004-x64
1hgf.zip
windows11-ltsc_2024-x64
1Power Off.exe
windows10-2004-x64
1Power Off.exe
windows11-ltsc_2024-x64
8UNKNOWN.zip
windows10-2004-x64
1UNKNOWN.zip
windows11-ltsc_2024-x64
8a/Axam.a.exe
windows10-2004-x64
7a/Axam.a.exe
windows11-ltsc_2024-x64
7processhac...up.exe
windows10-2004-x64
7processhac...up.exe
windows11-ltsc_2024-x64
8virusvippro.exe
windows10-2004-x64
virusvippro.exe
windows11-ltsc_2024-x64
main.pyc
windows10-2004-x64
3main.pyc
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
hgf.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
3600 seconds
Behavioral task
behavioral2
Sample
hgf.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
3600 seconds
Behavioral task
behavioral3
Sample
Power Off.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
3600 seconds
Behavioral task
behavioral4
Sample
Power Off.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
3600 seconds
Behavioral task
behavioral5
Sample
UNKNOWN.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
3600 seconds
Behavioral task
behavioral6
Sample
UNKNOWN.zip
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
14 signatures
3600 seconds
Behavioral task
behavioral7
Sample
a/Axam.a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
3600 seconds
Behavioral task
behavioral8
Sample
a/Axam.a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
3600 seconds
Behavioral task
behavioral9
Sample
processhacker-2.39-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
3600 seconds
Behavioral task
behavioral10
Sample
processhacker-2.39-setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
3600 seconds
Behavioral task
behavioral11
Sample
virusvippro.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
50 signatures
3600 seconds
Behavioral task
behavioral12
Sample
virusvippro.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
84 signatures
3600 seconds
backdoordefaultoffice04costuradefense_evasiondiscoverydownloaderexecutionacrstealerasyncratcobaltstrikedestiny_stealerformbooknanocorenightwirephantom_stealerquasarratonratremcossalatstealersvcstealerxredxworminstallerkeyloggerminerpackerpersistenceprivilege_escalationpyinstallerratrevoked_codesignspywarestealersuricatatrojanupx
Behavioral task
behavioral13
Sample
main.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
3600 seconds
Behavioral task
behavioral14
Sample
main.pyc
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
3600 seconds
General
- Target hgf.zip
- Size 15.9MB
- Sample260807-27e1ksdn8x
- SHA256 239d9701ff9c57e84080e53fb4c4606ca86438f4658994748000cf80e9ffd743
- MD5 55edfebf5fdeda28d7baa7858b554019
- SHA1 395d0034a2737e282d3c27b2eb533883056baa3c
- SHA512 144e62a41d2ecf11dbcda2f50bc9d3f5778edad858a57e6538982ad054ddd67b396035598d22620441640bca22aec3644756317a2b1ff4f60822aecb99ec0d03
- SSDEEP 393216:8IjtSEWPuhRW1R2JtWNhqKVzuC5zXA34tSQj:zRqR2JtEhqKVqC5jG4tJj
- TLSH T1EEF61118A5073817FC655A33F1CE95B385B1AC80DA33DE7B325A768D8BB2187247235B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/virusvippro.exe pyinstaller - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Power Off.exe unpack001/a/Axam.a.exe unpack001/virusvippro.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/processhacker-2.39-setup.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/processhacker-2.39-setup.exe innosetup
File Explorer
-
hgf.zip.zip 15.9MB
-
0Chrome.csv4KB
-
Power Off.exe.exe 621KB
-
UNKNOWN.zip22B
-
a/Axam.a.exe.exe 11KB
-
processhacker-2.39-setup.exe.exe 2.2MB
-
virusvippro.exe.exe 13.1MB
-
main.pyc12KB
0Chrome.csv
- SHA256 9126e9e9f0601193887c489405217cee33a7ea4709c299a1b55ef8620e2d77e5
- MD5 19dcf446a711e7cf5027e6a6356a1f9f
- SHA1 5e845795919a149ea14dde0d94bc25bcc70f49ce
- SHA512 5e721935c34d1a6997ea9d50ea6764a53afd80d7f5c144f5f17ed2e65780e3a26fb215cd647e03d3bf71d1ee64f5391be59daa1d4ce727416928a9ebaa95effd
- SSDEEP 96:aOe33FoHmj8cnHJEm9pIJHjSweluMTwDtn83c3kxF90eY+a:aOOgmj8cpfIdvYc3O3Lm
- TLSH T1CA91BCFFBFA521594B7B818A206D7C8EC22B300F8EAD80FA85A0445D945DC7A57834CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Power Off.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f9d12723a5ac3ade8212b4ec2f2b8452b7deb10e071bcb4e50a9cb6cb85b1457
- MD5 8d0b18eb87590fa654da3704092b122b
- SHA1 aaf4417695904bd718def564b2c1dae40623cc1d
- SHA512 fa54fad936e96ecabfab70f29fe5095b60ce5bfa7f31f6c405c42ad4f4f153ec7406d03d0451e11e886722abf28f09b219d3e8d9a703f20cb67b0950d8b70828
- SSDEEP 3072:paeTGhFvdX34iSh+gP01dM6U7Ho2nZ11YFVagzidIaYKaQFiyC6/sIvdX34iSh+B:p3TSvwo+TI9gNMwsEvwoLTI9AAI
- TLSH T199D4DA48A5073807FC282973F1DE95B785B0AC80D933DE7B365A368D8BB555B20B274B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
342778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\DoomsDark\Desktop\Widgets\PcHandler\PcHandler\PcHandler\obj\Release\Power Off.pdb
mscoree
_CorExeMain
Name
.text
Size
327KB
Virtual Size
326KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
293KB
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UNKNOWN.zip
- SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
- MD5 76cdb2bad9582d23c1f6f4d868218d6c
- SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
- SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
- MD5 SHA1 SHA512
a/Axam.a.exe
- SHA256 4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
- MD5 0fbf8022619ba56c545b20d172bf3b87
- SHA1 752e5ce51f0cf9192b8fa1d28a7663b46e3577ff
- SHA512 e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb
- SSDEEP 192:33K8Vn5fAIBkPA9tQdEnhAv+mKqh1RwE9gCOMv8eIry2aZoa5qq/:33X54IB8SCY2W3qmSgaIrTDSqq/
- TLSH T186329E8A7BBA6451C3D6C13347934E3863502D542D3A5F4A2AF5B3BB8CB0160F8106F4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
&%_*
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
U^#.
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=13, version=8169,
processhacker-2.39-setup.exe
- SHA256 28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
- MD5 54daad58cce5003bee58b28a4f465f49
- SHA1 162b08b0b11827cc024e6b2eed5887ec86339baa
- SHA512 8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
- SSDEEP 49152:l9hfV/U5NkLXXzGZjt6kFTCVP6hWE0wvmk/eE+FrAl+NGsOSE6IX8pq:Dh9/ULkjKxtTGP6VZd2rAcvOSE6Nq
- TLSH T14CA53303DF540D3BD5B79B76973FCB154E6A734528346C63B20D5C8E8BA47A288923B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
PE Signature issue
Digest
83:33:12:d6:73:40:58:da:f9:36:91:31:58:17:af:f2:3f:e7:11:0a:e3:31:bd:85:7b:43:70:47:90:53:db:12
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU
Chains
Aug 6, 2026
CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU
CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
b1:cd:ff:77:4a:7c:de:e6:76:24:73:fd:3c:9a:c6:c7:05:79:d7:d3
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU
Chains
Mar 29, 2016
CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU
Subject
CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU
Serial Number
0f:f1:ef:66:bd:62:1c:65:b7:4b:4d:e4:14:25:71:7f
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 30, 2013 - Jan 4, 2017
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU
Serial Number
04:0c:b4:1e:4f:b3:70:c4:5c:43:44:76:51:62:58:2f
Issuer
CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 30, 2013 - Jan 4, 2017
Subject
CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert\, Inc.,C=US
Serial Number
02:ce:42:94:59:02:a4:f3:c0:40:b0:ff:77:93:d1:4f
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 24, 2015 - Jan 7, 2025
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
1
Entry point
42488
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
virusvippro.exe
- IMPHASH 33742414196e45b8b306a928e178f844
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
- MD5 7d1a85e807ff9b48edc2e08a01b35e07
- SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
- SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
- SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
- TLSH T1D7D63338236406E7F4F6D734E940C4B6D6ABAD161B57C28383F8D56B2D232C16A373A5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
50048
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
HeapSize
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
GetDriveTypeW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
174KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33140,
count=12, id=260, version=33140,
count=8, id=259, version=33140,
count=2, id=253, version=34321,
count=9, id=259, version=34321,
count=17, id=260, version=34321,
count=40, id=261, version=34321,
count=7, id=257, version=33140,
count=140, id=1, productName=Unmarked objects,
count=25, id=260, version=34808,
count=1, id=258, version=34808,
main.pyc
- SHA256 ef7220d8bc8a9cce0341a88026eef346facaed0f859525d55184caf4df18cb57
- MD5 0ee8963c24b008f9a96fa492c89e69ef
- SHA1 5628d9974ea0d4d4c3c5c1a77370ef664d0a8aba
- SHA512 bc0f7569892dbe8c426997c35fe5439a79be8f753a0c0c2801c8529d29bf5b3982092eaff16bdace479e68efa248b1c38ac7b26ede4a214299fb62475fb4dbe3
- SSDEEP 384:itYLLo88lQu1DnZnmQ3+9KCAbwgYVJrQkn:22LoHVDnVckb4SG
- TLSH T1C342CF261C44D5B7CBB888B3DD6EC55E7ACE350A04B286FF56049990D57DAC801F9DC3
- MD5 SHA1 SHA512 SSDEEP TLSH