2020-05-02.zip
- SHA256 7d7915adca023f34d50e5d241589068f24140f6c185dfbcd545c37366712a5c8
Password
infected
General
- Target 2020-05-02.zip
- Size 48.8MB
- Sample260807-rnv8cazwds
- SHA256 7d7915adca023f34d50e5d241589068f24140f6c185dfbcd545c37366712a5c8
- MD5 16f31c9fa79bcfd4402ab6460c370aca
- SHA1 c5265fc241b204e363592d9bdef7612c7240cc14
- SHA512 559e3ff16be09854eb4d25e8c3164be5755f6bcde3eb4089452353d82c49f76511a6a010f3e0fa26065abf9f017d203b1f901d9ea126cca6d9546a83fee6d8c6
- SSDEEP 1572864:1iZb5kQgiNv3YAhZC+KSP+qm+tfl0JwkReorJ61m+KwPk+5:4tu/q3YAhZ7+qm+Bl0J7RedYGss
- TLSH T12BB73304662F735CF98DDA7DA2028FA90CB437082D16D9DD782A9779B7F094E0D63B84
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
HacKed
C2
-
46.43.94.45:5552
Mutex
-
e95207e7c391d6074bc8311434696fbb
Attributes
-
reg_key
e95207e7c391d6074bc8311434696fbb
-
splitter
|'|'|
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
HacKed by lovo
C2
-
1111h1z1.publicvm.com:240
Mutex
-
df54d5b8e5b62ff4e3987298d3f422d0
Attributes
-
reg_key
df54d5b8e5b62ff4e3987298d3f422d0
-
splitter
@!#&^%$
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Kinsing payload 1 IoCs
resource yara_rule static1/unpack001/d247687e9bdb8c4189ac54d10efd29aee12ca2af78b94a693113f382619a175b.elf family_elf_kinsing_loader - WSHRAT payload 1 IoCs
resource yara_rule static1/unpack001/3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js family_wshrat - Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack001/935d4108d5fb3a2e5eae96b136c4744ae18eeba8043673a68a7e7fe84f66cfb1.elf patched_upx -
resource static1/unpack001/484c0b7849b80fcf9ef6c8bfd5435671858eae263db624132e5f89e16a225e78.xlsm - Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Requests dangerous framework permissions 6 IoCs
description ioc Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack004/PO-8372929.exe autoit_exe static1/unpack001/46aea26e8f56dc23f73abcad5be9e8643692ebdeb90b845bcb80c9782067110b.img autoit_exe static1/unpack001/52f995a46c899c2f2eee60bfcff3788fa72d5953632121366aa00e6bff74ef57.exe autoit_exe static1/unpack001/7176b60cfd7b9b4bf9e9a4683bcd45444d59c86a370f6afb8b38d8ed8bbe4144.exe autoit_exe static1/unpack001/8044dc7f383547fb4d9acfc1bfd1adfe3e6def133317a506b991e5b62a29bc63.exe autoit_exe static1/unpack001/9d528e8db916612c2faf8740966a0a9f7f5b2f70e87eae53409cde09731f6f8f.exe autoit_exe static1/unpack001/c2aece4c0138a4ce56c8baa129b99e8740277795ac3c69e03d3a86cb7e629582.exe autoit_exe static1/unpack001/c2d42ef1435490d3bd280f0e1aaa0b42fe1d417e5364a000531a930c841f22f9.exe autoit_exe static1/unpack001/d7d3cc14120ca37b33e14b0d8c34298133edee7b7535756cc78f79e121591b1f.exe autoit_exe static1/unpack001/eed50aaa25fe237cf2fac39728afe3112f0bc09d6dd6fab8e27469409a83806e.exe autoit_exe - Codesign digest Mismatch 2 IoCs
File was altered after it was signed.
resource unpack001/5b15b1fd3bf2eef911358d7125b5120eb716dcd75af883cd133dc0e346988c85.exe unpack001/fef351d237d3cd331330624de2476bc9cf4aea538177800ac16521d0e9da3baf.exe -
resource yara_rule static1/unpack001/935d4108d5fb3a2e5eae96b136c4744ae18eeba8043673a68a7e7fe84f66cfb1.elf upx - Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/152f42d8d6eebc376fb97fa9633cf863bbdbed2646f7eb62a5b3b2aea8bd4dc9.apk - Unsigned JAR 1 IoCs
Checks for missing JAR codesign signature.
resource unpack001/ec7b29b432de2e8473a82ad32f6a12a608848ccc50a49ce67dad1d0fc3850c26.jar - Unsigned MSI 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/53dcc282a6b694f8e4b053e6b5b50b2e2fa446072b25cf1d9139e130a3ef3e51.msi - Unsigned PE 46 IoCs
Checks for missing Authenticode signature.
resource unpack001/013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe unpack001/014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe unpack004/PO-8372929.exe unpack001/0a52207d41d26b229e114a83c78f1ef7997c4c1b8f37b614bdae503e2309499f.exe unpack007/OSSB RESPO....D GASES PDF.exe unpack009/RFQ- PT MULYA MANDIRI NEW ORDER PO 02.05.20.doc.exe unpack001/1fbae4f859c40f9446d06e76a4acf496fe0a43fb93b87f87d1077ab8a4490480.exe unpack001/237494387c104ddeff1f3b40842da5cd430bf526663c0b10cf2979d8265397fc.exe unpack001/280ebd2392e96c2017db58a6559696b0492370122272e05a01b4ec6d75eef33b.exe unpack001/3655fd141632949c32d6f76901bd5a70e6c93576f086d1eb001924c9f22429b6.exe unpack001/437814cb410ed70eaaac12965985bf31492ade3b5adc6efea838868ac61c624a.exe unpack001/4ca951e9d3fcc4196ad777f1f908cf2857e6ed55a7d72d7b0f6636a6b522fe7e.exe unpack001/4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991.exe unpack001/51ae05ee92d6ab4b2a4590f967d645c4db074f74267e95e4fa5c2b9e5485cbc3.exe unpack001/52f995a46c899c2f2eee60bfcff3788fa72d5953632121366aa00e6bff74ef57.exe unpack001/55805d7d04848a1bcc7067a8d1dda5fe30f76f27c4e6b831a2d9dc56a3a1294e.exe unpack001/5eb9ca5476eb4c9c83bbb5d6bbb7ff90474749121e2e063bbd9e988c4e4917e2.exe unpack001/66d659af0fce5ee7b2787e527ae60c9aace938821572aaef05761916e055e69d.exe unpack001/6fa4299d985f18a3b0cc7323ad653988f8fb51d8ceb58600432ba78271885cd4.exe unpack001/7176b60cfd7b9b4bf9e9a4683bcd45444d59c86a370f6afb8b38d8ed8bbe4144.exe unpack001/792fbf337e4d738502dba52638e1c20de4486e092e02f83db77e10ddb0ab448f.exe unpack001/7a9c52c23667b18ab730f2b378df05985bd50aa16d051fccacb61549397ae3de.exe unpack001/8044dc7f383547fb4d9acfc1bfd1adfe3e6def133317a506b991e5b62a29bc63.exe unpack001/8507c1a84b8dcfa202d9333e43138cb0e496f227439e50ed7eee1c13611ebd02.exe unpack001/92bee9898c4a67a5fe3a209982221c240bc96627ee3fac96369eafa443bde986.exe unpack001/95708fbe180a43fbef0014d207456fd8812cb202d77e1078c466ca474e38c7a8.exe unpack001/9855e6cab6dc7b89aa792aafd85bf39ac186954964427fc6e4c236a0a613d8e4.exe unpack001/9bb6a76344a0906d9292209ede4ecb2b87bda68265397a1e854cf464e078ec5d.exe unpack001/9d528e8db916612c2faf8740966a0a9f7f5b2f70e87eae53409cde09731f6f8f.exe unpack001/a744e64bd387c4f4ef681744a8fd7d8ab024e3f6650302f24163fe506e92cccf.exe unpack001/ba27536db363cf3a604908ecd21ca5b81b0b20e3f6f0447628b82e34240ae67a.exe unpack001/c1c48079d48701477eadebf62b9cfad53f71b72f2fb2f6e123e673e8d11b1a5b.exe unpack001/c2aece4c0138a4ce56c8baa129b99e8740277795ac3c69e03d3a86cb7e629582.exe unpack001/c2d42ef1435490d3bd280f0e1aaa0b42fe1d417e5364a000531a930c841f22f9.exe unpack001/c371004e8407621dcf815c95f130ef0bbfeec0dfcee1433800e56a9b247b8702.exe unpack001/d3ea6307c607925c48b94aa06102187c9157527d70c69fb146c2904827a77162.exe unpack001/d53e1cc243a49cf35101c2fa4b837949450d7c6655c999f82a2491c421fb9ee0.exe unpack001/d7d3cc14120ca37b33e14b0d8c34298133edee7b7535756cc78f79e121591b1f.exe unpack001/d85fd6f691e44f6dd37f4a89a821ef9b3a73664bc72a1ed7fa9223978dbf09e9.exe unpack001/dc2ade935288f5f4da5bf02568606500b3084531de864cdff19915e78bbec1aa.exe unpack001/ddbe4689702130a4dc5d5133c517f466a47e003b645326c7dded00247bde315f.exe unpack001/e9e5209ff937e49e34e4c17419aad97b3931cd189a7f28333385c6fe9eef561b.exe unpack001/eed50aaa25fe237cf2fac39728afe3112f0bc09d6dd6fab8e27469409a83806e.exe unpack001/f117245eaab9a6b6d5b35cf2c8be03e3b4411b7194291649d676d43037fd7626.exe unpack001/f1a2cb04bdeeb63eebeeaad98ba4a91b193b0a5a806e43ee25747001983dbc09.exe unpack001/fbae0ff635e7b7cb7646fded915f70803f4c564348b77bf2c6d9809c4353e9a6.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/152f42d8d6eebc376fb97fa9633cf863bbdbed2646f7eb62a5b3b2aea8bd4dc9.apk
File Explorer
-
2020-05-02.zip.zip 48.8MB
-
013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe.exe 955KB
-
014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe.exe 1.0MB
-
0704ecdae1cb082ca9d8a9e0946850b24c9a99a0899297fdbe485b118e3bb352.rar.rar 1.1MB
-
PO-8372929.exe.exe 1.6MB
-
0a52207d41d26b229e114a83c78f1ef7997c4c1b8f37b614bdae503e2309499f.exe.exe 522KB
-
0b02b398c8e5d024ba2f3bbb6d9b0c1cf1bbf051a273bf871a46cf9802eff9c8.zip.zip 348KB
-
OSSB RESPO....D GASES PDF.exe.exe 404KB
-
0fca4415d54809aca8df88584e592601590d47701fdb6c46c80c045229274311.zip.zip 298KB
-
RFQ- PT MULYA MANDIRI NEW ORDER PO 02.05.20.doc.exe.exe 699KB
-
13f82f8a450c7c2d5c3a01fce16501e95e3894b8f84634e31718db80c0b79c7f.zip.zip 505KB
-
152f42d8d6eebc376fb97fa9633cf863bbdbed2646f7eb62a5b3b2aea8bd4dc9.apk.apk 36KB
-
178d7b5eaafd1b4c145d0f308fce5e9a2ce541659566aaea0b5b8421b39769c5.rar.rar 5KB
-
1d38c90449b94815fe2eeb6c5704cdcba3f7e5616cfc5b8604b5336d6eb4912e.zip.zip 19KB
-
1fbae4f859c40f9446d06e76a4acf496fe0a43fb93b87f87d1077ab8a4490480.exe.exe 291KB
-
237494387c104ddeff1f3b40842da5cd430bf526663c0b10cf2979d8265397fc.exe.exe 245KB
-
280ebd2392e96c2017db58a6559696b0492370122272e05a01b4ec6d75eef33b.exe.exe 613KB
-
28f91ad76c55177cb3831f6bd316e29184d4b432c9a16d60a9db9a9726b9f769.rar.rar 341KB
-
345f60c23675ae94e2a5b4a783e3d5c1ee840cc1ad7c71b0bb5a94551ab73d3c.r00.rar 1.1MB
-
3655fd141632949c32d6f76901bd5a70e6c93576f086d1eb001924c9f22429b6.exe.exe 452KB
-
37fd2fdf899066121eff16bb8caab4740eeae4a759a0c3305af7b994660eef80.z.rar 1.1MB
-
3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js.js 193KB
-
4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da.msi.msi 1.1MB
-
437814cb410ed70eaaac12965985bf31492ade3b5adc6efea838868ac61c624a.exe.exe 397KB
-
46aea26e8f56dc23f73abcad5be9e8643692ebdeb90b845bcb80c9782067110b.img.iso 2.2MB
-
484a712197407f3294b64ba3285a0b715a526dd6e58fc7b584a9f3dd5f8d4863.jar.jar 495KB
-
484c0b7849b80fcf9ef6c8bfd5435671858eae263db624132e5f89e16a225e78.xlsm.xlsm 411KB
-
4ca951e9d3fcc4196ad777f1f908cf2857e6ed55a7d72d7b0f6636a6b522fe7e.exe.exe 963KB
-
4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991.exe.exe 438KB
-
51ae05ee92d6ab4b2a4590f967d645c4db074f74267e95e4fa5c2b9e5485cbc3.exe.exe 391KB
-
52f995a46c899c2f2eee60bfcff3788fa72d5953632121366aa00e6bff74ef57.exe.exe 1.6MB
-
53dcc282a6b694f8e4b053e6b5b50b2e2fa446072b25cf1d9139e130a3ef3e51.msi.msi 1.1MB
-
55805d7d04848a1bcc7067a8d1dda5fe30f76f27c4e6b831a2d9dc56a3a1294e.exe.exe 388KB
-
5b15b1fd3bf2eef911358d7125b5120eb716dcd75af883cd133dc0e346988c85.exe.exe 934KB
-
5b69f8de67c6ce1c40904742cd26f91442c518496fb8e3f9509f069f1a347dc3.elf.elf 111KB
-
5c7d5c1bfc961dcd484d92d502fb73932456502fa22db6b66a5719baf2d64d0b.zip.zip 19KB
-
5e43dbbacf2011c12d45d40e8435c41dd331ba2adf4f7df80bedf53b436ff78d.doc.docm .doc 104KB
-
5eb9ca5476eb4c9c83bbb5d6bbb7ff90474749121e2e063bbd9e988c4e4917e2.exe.exe 429KB
-
6454d7e9ab89840c38bed8246d96fd9f13e57b7b9b8449c55aa7dbe0e881cb45.iso.iso 1.2MB
-
66d659af0fce5ee7b2787e527ae60c9aace938821572aaef05761916e055e69d.exe.exe 629KB
-
69e178f924ea4a6c0add0e4b8c1224d9f47ed366def2cfaa5d0d754df7cdd0d5.zip.zip 496KB
-
6a28596183b375a4c5d67febe6c72ff29e5bbb29e56875c72624357fd659b6d0.gz.rar 485KB
-
6a2adc0f321760d969e448ff7da18ceca73ae52c5e3ca8f7e923f1e9132b0af6.rar.rar 316KB
-
6cd321b504c7323e893fa7e55125696ba87ab42fc3077e11ff9eedabd6b0893e.img.iso 1.2MB
-
6fa4299d985f18a3b0cc7323ad653988f8fb51d8ceb58600432ba78271885cd4.exe.exe 21KB
-
7176b60cfd7b9b4bf9e9a4683bcd45444d59c86a370f6afb8b38d8ed8bbe4144.exe.exe 1.6MB
-
73bdfefd546d1a751a77b6de3a36460b6108a06940a1c9dc73c9dfdd78f8f649.elf.elf 30KB
-
74126598c35fd00fec92f98a31819cdd22bbbd1a0ddcf33fb8af978576e1ee7a.rar.rar 1.2MB
-
792fbf337e4d738502dba52638e1c20de4486e092e02f83db77e10ddb0ab448f.exe.exe 73KB
-
7a9c52c23667b18ab730f2b378df05985bd50aa16d051fccacb61549397ae3de.exe.exe 701KB
-
7d1fc871156054dc4d288f7302e4324143f27048d394195041894f4cde2551d9.zip.zip 477KB
-
8044dc7f383547fb4d9acfc1bfd1adfe3e6def133317a506b991e5b62a29bc63.exe.exe 1.7MB
-
8507c1a84b8dcfa202d9333e43138cb0e496f227439e50ed7eee1c13611ebd02.exe.exe 400KB
-
8a1ceef47b70bd179c7a439e9d106dc7e489bff0b4dc7df1968491bc8d639de3.rar.rar 342KB
-
9202be882e0e5eb2e051ebb9ca02fb2841e60ad69a2316cd8d5d42980a16c622.zip.zip 19KB
-
928111a62a25ff3af20e627c8ab5edd0f333413988ea4ef90f75adf7cd5b6c39.jar.jar 5KB
-
92bee9898c4a67a5fe3a209982221c240bc96627ee3fac96369eafa443bde986.exe.exe 287KB
-
935d4108d5fb3a2e5eae96b136c4744ae18eeba8043673a68a7e7fe84f66cfb1.elf.elf 1KB
-
95708fbe180a43fbef0014d207456fd8812cb202d77e1078c466ca474e38c7a8.exe.exe 623KB
-
969989cd37da58261a4345c90947b6b7478350d8050f570ae9f598ec3da4c7a1.zip.zip 354KB
-
9855e6cab6dc7b89aa792aafd85bf39ac186954964427fc6e4c236a0a613d8e4.exe.exe 220KB
-
9b7f1f5676565f733fc5114f1e03458f9d9feaef6cd0319370ccc68e08eddf94.zip.zip 213KB
-
9bb6a76344a0906d9292209ede4ecb2b87bda68265397a1e854cf464e078ec5d.exe.exe 388KB
-
9d528e8db916612c2faf8740966a0a9f7f5b2f70e87eae53409cde09731f6f8f.exe.exe 1.4MB
-
a07bc8319e27b10703b425c0d01d91d3c96b4c64f8de8840ae85a5fa8b82093e.img.iso 1.2MB
-
a19a61fac499bbbcb7ca34fa6ce436fef7096dfcadba07eb60249c003a027e41.zip.zip 352KB
-
a5738448758c46e7963c181e72795721c5fb1e5ac0d318326a46834eebb58bfa.iso.iso 1.3MB
-
a744e64bd387c4f4ef681744a8fd7d8ab024e3f6650302f24163fe506e92cccf.exe.exe 699KB
-
afa54b391cbb8384d600ba564bce662efb0b9642bba62277f5e177563c1499e7.zip.zip 298KB
-
b36007e8275a822141b6dabf8cfba95a3833e5cd1cc4d8be6b61ad5ba32f065a.iso.iso 504KB
-
b89803afd7c2a43ed9ba1f3d7ff64d9fd22f5b48ddb6695ee153fa1b04fb8736.zip.zip 19KB
-
ba27536db363cf3a604908ecd21ca5b81b0b20e3f6f0447628b82e34240ae67a.exe.exe 795KB
-
c1c48079d48701477eadebf62b9cfad53f71b72f2fb2f6e123e673e8d11b1a5b.exe.exe 539KB
-
c2aece4c0138a4ce56c8baa129b99e8740277795ac3c69e03d3a86cb7e629582.exe.exe 1.6MB
-
c2b78ccda6eddf0d522085cde769ed4baccf4ee43620b55980ca4abf21f54bbd.jar.jar 517KB
-
c2d42ef1435490d3bd280f0e1aaa0b42fe1d417e5364a000531a930c841f22f9.exe.exe 1.6MB
-
c371004e8407621dcf815c95f130ef0bbfeec0dfcee1433800e56a9b247b8702.exe.exe 646KB
-
caac8878a9edaa3acccbfead8f029781de7f53d6bd446179fe55b17ac3f02ae1.jar.jar 497KB
-
cdee0a7c17dd6a585a7c6781651c6c5a0b967cc3ed828cbbe604065f3663b5d4.7z.rar 177KB
-
d184268bf1ee860b491b319eb7f96adcab1a9ea696ffb4c26449a60c33b7a9e3.doc.docm .doc 104KB
-
d247687e9bdb8c4189ac54d10efd29aee12ca2af78b94a693113f382619a175b.elf.elf 15.9MB
-
d3ea6307c607925c48b94aa06102187c9157527d70c69fb146c2904827a77162.exe.exe 795KB
-
d53863a442ba69cf7cc9011b3c51390b360b38d9b705ae41e0143d3e985d5309.zip.zip 19KB
-
d53e1cc243a49cf35101c2fa4b837949450d7c6655c999f82a2491c421fb9ee0.exe.exe 650KB
-
d67935690a5b19212da2674c83b4154bceda5324dd65f7c5986fd9cf29eea572.zip.zip 478KB
-
d709aab9b049d7b936c554f5a1d640af0ce17e3ae3fdd7323cfa286718d609e4.zip.zip 499KB
-
d7d3cc14120ca37b33e14b0d8c34298133edee7b7535756cc78f79e121591b1f.exe.exe 1.7MB
-
d85fd6f691e44f6dd37f4a89a821ef9b3a73664bc72a1ed7fa9223978dbf09e9.exe.exe 795KB
-
da43ed194729f82db68b1d91a17cea6afde8ae81357116c35c4c129888a836bf.elf.elf 848KB
-
dc2ade935288f5f4da5bf02568606500b3084531de864cdff19915e78bbec1aa.exe.exe 409KB
-
ddbe4689702130a4dc5d5133c517f466a47e003b645326c7dded00247bde315f.exe.exe 628KB
-
e138a95285847be1c2423f2d4f11d62541840025ed7ba1c9dd444978bcb15abc.iso.iso 1.3MB
-
e4e33b67a18d6278dfddf3b4f0599fd37793d5997434be028510592ef1849b0e.gz.rar 463KB
-
e9e5209ff937e49e34e4c17419aad97b3931cd189a7f28333385c6fe9eef561b.exe.exe 324KB
-
ec1535aa485bec3fd330957474638a47369a59ad2b7775ca74639ce4eb0c018c.elf.elf 688KB
-
ec7b29b432de2e8473a82ad32f6a12a608848ccc50a49ce67dad1d0fc3850c26.jar.jar 535KB
-
eec9b14da6a2745f089361002429d13b044d66dedf944e951b39f9d243ae3df9.doc.rtf .doc 577KB
-
eed50aaa25fe237cf2fac39728afe3112f0bc09d6dd6fab8e27469409a83806e.exe.exe 1.6MB
-
eeebfcd5e9663d396806c5c355c67f96a04a80d45168cd4d28f6642044a3dc6b.zip.zip 332KB
-
f117245eaab9a6b6d5b35cf2c8be03e3b4411b7194291649d676d43037fd7626.exe.exe 404KB
-
f1a2cb04bdeeb63eebeeaad98ba4a91b193b0a5a806e43ee25747001983dbc09.exe.exe 268KB
-
f24fdcaaebc99149ac1285ccb56b24bd839a5fe524084b02e43d59d341278fb0.zip.zip 23KB
-
f5b6264a5adebb665f4d89cdeba64f5506421b04086da17c5928171ae0e8f435.r00.rar 1.1MB
-
fbae0ff635e7b7cb7646fded915f70803f4c564348b77bf2c6d9809c4353e9a6.exe.exe 444KB
-
fed28e2344db756d6233bbadd95487f1b1cc060ae195ab20647ddd508dcb656b.zip.zip 19KB
-
fef351d237d3cd331330624de2476bc9cf4aea538177800ac16521d0e9da3baf.exe.exe 675KB
013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe
- IMPHASH 10080279f86c8f524876f5bf41c92c73
- SHA256 013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8
- MD5 13694c1e016d5a35d902070111f63d18
- SHA1 8a7de1581df4a927a1b5144af9d590750649aa2c
- SHA512 5ddc6f8a61d0879a337f6eb751cfdf8965ba6efcc59abb1fe84f5a304588e0738be214c76dbf6d565d72ec00b8ae398c62f1492a66510926d452c1eca16e6b89
- SSDEEP 24576:nnrmNg9r6EAsSDBpvEwL55pkRT8cDbhvKyew4:n39r6/DjlL55rcHE5w4
- TLSH T1662523596BF72123F1B1A930313486B07BA7BE307A70A29D1654116C1F786E35AB0F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
4517
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\wihijemuyus\hugoxatu.pdb
kernel32
GetAtomNameW
GlobalUnfix
GetLastError
GetProcAddress
WritePrivateProfileStringA
GetModuleHandleA
GetProcessShutdownParameters
LCMapStringW
GlobalAlloc
GetTickCount
FindFirstFileExW
GetCurrentProcess
InterlockedIncrement
HeapAlloc
GetLocaleInfoA
lstrlenA
FindResourceA
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapFree
Sleep
RtlUnwind
HeapSize
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
IsProcessorFeaturePresent
advapi32
CloseEventLog
RegSetValueExW
SetSecurityDescriptorSacl
FreeSid
NotifyChangeEventLog
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
879KB
Virtual Size
42.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=171, productName=VS2010 build 30319, version=30319,
count=9, id=158, productName=VS2010 build 30319, version=30319,
count=57, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=95, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe
- IMPHASH cfae1388aa40a45341161bd352c242ae
- SHA256 014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89
- MD5 00b24dcb1665fc7c6e67e51ed80d660f
- SHA1 928f0cde4c8d935e181aa9b1990d72cbe58fd6eb
- SHA512 588119d135c3a8d3cd3037da882a5e75f02075848f5a2624ead6739fd0e4c984493bfad6daa48306e8b30c03744156bc3be04532cfea7d2492212ce3f78e41d6
- SSDEEP 24576:9QurI9Kqgrkv7yNS9QgPB5zbuawcXQhgKF:9QAI9KfQyEQq2O2XF
- TLSH T1E735122237D0CDF6F1625E306952C6A49AEBBC265E25558FCB84672F0E370E087ED346
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
23682
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetupComm
SetPriorityClass
MapViewOfFile
LoadResource
HeapAlloc
GetConsoleAliasA
SetConsoleScreenBufferSize
SleepEx
ConnectNamedPipe
_lcreat
GetProcessPriorityBoost
GetModuleHandleW
GetTickCount
GetProcessTimes
GlobalAlloc
GetThreadSelectorEntry
CreateMailslotW
DisconnectNamedPipe
GetLargestConsoleWindowSize
SetVolumeLabelA
FindFirstFileExA
GetLastError
GetLongPathNameW
GetProcAddress
GetNumaHighestNodeNumber
GetPrivateProfileStringA
GetAtomNameA
BuildCommDCBAndTimeoutsW
GetExitCodeThread
SetConsoleWindowInfo
FindAtomA
FindFirstVolumeMountPointA
CreateIoCompletionPort
GetProcessAffinityMask
OpenFileMappingA
WriteConsoleW
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetEnvironmentVariableW
GetConsoleMode
GetConsoleCP
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
SetFilePointer
ExitProcess
WriteFile
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
SetStdHandle
CreateFileW
user32
ClientToScreen
GetCaretPos
advapi32
QueryServiceLockStatusW
winhttp
WinHttpCloseHandle
msimg32
TransparentBlt
@shutting@0
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
832KB
Virtual Size
831KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
39.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
0704ecdae1cb082ca9d8a9e0946850b24c9a99a0899297fdbe485b118e3bb352.rar
- SHA256 0704ecdae1cb082ca9d8a9e0946850b24c9a99a0899297fdbe485b118e3bb352
- MD5 5b0f1fd23071bfb88c0df5460cc54e0a
- SHA1 13aaa5a5c08776193a6336f4eb5bf0165328ca27
- SHA512 ae82298f6ff3f498bc3683272a0fb500c6848b26706d22ed6fda649a3cb09ce36abb48f78f2b0ea2ccd4b0d5bd9a0b99570cf19b393089d4cef6624479e0d707
- SSDEEP 24576:a0FEkSxuwFLLnfKvS4RMf1HmY7BEK4PKb1dViVQWn3I5jVbgDgb:nEkSxuwRDKa4Rk1Y5PO7CQWn4bbgDA
- TLSH T1464533EC2DF86B63C34D563B64198A3DAC3C513289CFA3041E5176B6BD12E4A3A6C578
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
PO-8372929.exe
- IMPHASH 7f2222d75bcebeb591b7d884c5b9299b
- SHA256 c2d42ef1435490d3bd280f0e1aaa0b42fe1d417e5364a000531a930c841f22f9
- MD5 0b7d26586342b5eee2f7bd0e5d9c40fc
- SHA1 204ea25f8d131c88b751aba5a4672a48692d324a
- SHA512 98d7568b59c922495cf91864eb60f3d93d1c9fec2d34ceea443469c8890d8d781614c9b8235ed830a93df4717459fe20210bad25ee0ddd2b46aa6973026ebf1d
- SSDEEP 24576:Dtb20pkaCqT5TBWgNQ7awxB1CdRVtYon4AS9HfmqMK5WKm5sJ6A:AVg5tQ7awxB1Cp7SWgWKme5
- TLSH T11F75E12273DDC361C3B25273BA167751BEBF782506A5F46B2FD8093DB920122521EA73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
155508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
recv
send
setsockopt
ntohs
recvfrom
select
WSAStartup
htons
accept
listen
bind
closesocket
connect
WSACleanup
ioctlsocket
sendto
WSAGetLastError
inet_addr
gethostbyname
gethostname
socket
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetConnectW
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetCurrentThread
FindNextFileW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
CloseHandle
GetLastError
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
RaiseException
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateThread
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
DrawMenuBar
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
CopyImage
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
UnregisterHotKey
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
DeleteMenu
PeekMessageW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
CharLowerBuffW
GetWindowTextW
gdi32
SetPixel
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
GetDeviceCaps
CloseFigure
LineTo
AngleArc
CreateCompatibleBitmap
CreateCompatibleDC
MoveToEx
Ellipse
PolyDraw
BeginPath
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
EndPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAclInformation
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
InitiateSystemShutdownExW
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAce
GetAce
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
UnRegisterTypeLi
SafeArrayCreateVector
SysAllocString
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
VariantCopy
VariantClear
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
VariantChangeType
SafeArrayAllocDescriptorEx
VariantInit
Name
.text
Size
557KB
Virtual Size
557KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
840KB
Virtual Size
839KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
0a52207d41d26b229e114a83c78f1ef7997c4c1b8f37b614bdae503e2309499f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0a52207d41d26b229e114a83c78f1ef7997c4c1b8f37b614bdae503e2309499f
- MD5 026649ffe495ccbe47e6aa8215eb2291
- SHA1 faab853607386e928e73c77c1338e16fea981bd1
- SHA512 182b279e16e5c69db6de815861bcb1a13ec285f0b341cb53e78e4249ac781cad9bb3af20d608869d5c6506b4e94b08de61285bb0f42aad493502ba6bbfbb5b70
- SSDEEP 12288:oNiBx56BMvgWUN02zePAZjI8R2PIVTDt:PWk4Rye5
- TLSH T195B4E5B3D31CD9D1DD9952F4610E9E630A607F9FA0D5A2C81DEDB1BBC738661E1E0882
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
357678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
341KB
Virtual Size
341KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
0b02b398c8e5d024ba2f3bbb6d9b0c1cf1bbf051a273bf871a46cf9802eff9c8.zip
- SHA256 0b02b398c8e5d024ba2f3bbb6d9b0c1cf1bbf051a273bf871a46cf9802eff9c8
- MD5 7e4531b4dce53026742c2b063569244d
- SHA1 6fcf993e722270b9b745ee27210247b5fe8b1f32
- SHA512 984032d9d7bf5733b2ba2570b8a3adaadd8fc79b19a1064218713b1c0d99ff562552012ff2e66a16cf0fd5454209f4c9a82f788b5079df79c55baaa379064ff7
- SSDEEP 6144:Vs+3yJBKnqo2VLQEWbol4uxGVC8k/rtG4z4i0G8Zl4reiwuYg3ruRj0btmiZEEJ:VviJ4dbEuuwQ/o4zD0orgg3ruRMXXJ
- TLSH T176742309831775ECDBC9D6EBBA191C9B151EC8B2CA91BFA408B0D44E40A34917777F8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
OSSB RESPO....D GASES PDF.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f117245eaab9a6b6d5b35cf2c8be03e3b4411b7194291649d676d43037fd7626
- MD5 e005a0a91d66a7686e28b59d3ab9e72a
- SHA1 894d84bd4e1a1787112cca9c987b8820dae9454d
- SHA512 bc10993d4578423596801b278c511a365452d3ace5493a9f01ba7ae29765e5bc6674918a43e72bf60223a5b0f5800ebc4db2e84d2bf7d0413b22086879a9c45a
- SSDEEP 12288:LNiBx56BMvgcr15HECu2e/K4zD0sr2y3r+mcXu:m15HECu2e/trd3qmau
- TLSH T11194F106A22A3B96D77FC3FDB162210047F5E4A27296E79A7FE140F50C62FD40525ACB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
419550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
402KB
Virtual Size
401KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
0fca4415d54809aca8df88584e592601590d47701fdb6c46c80c045229274311.zip
- SHA256 0fca4415d54809aca8df88584e592601590d47701fdb6c46c80c045229274311
- MD5 27f974efaa65213342a2aeff279b0cd3
- SHA1 71e040a2627a04255804463864f51494bc80a07a
- SHA512 d4f4078383a6c25b27cb5471c65b0f28e45e21e85a0c0e41dbc18609d2941ab0eda5efdfc96de40704d37eb3e79e8998cd5cf042bb4162edd21696d4da9ce200
- SSDEEP 6144:lt6a6lrlnmJlU9LMXUnzrrheyf9Bx3LixfGCQ+EfzNDQ3f3E62xHCjanC+Xvsdod:DP6lxnmJlOSErF4xfJEfzNDQ38LHCmn3
- TLSH T12654239B713B381F73615CF55E8E80497473936882D83033A65919843F1E9FEDAD69C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
RFQ- PT MULYA MANDIRI NEW ORDER PO 02.05.20.doc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a744e64bd387c4f4ef681744a8fd7d8ab024e3f6650302f24163fe506e92cccf
- MD5 cc65735b15a81c1070912c7f4e5455b1
- SHA1 7b28884f945790693d37ad2625337ae26a58dcc2
- SHA512 9172819283b1531e6f89d88540c5348e42c79621260859bcb8cdc3db40781e1779196d95b03b0ebbffa90f53309a509d53e68f4811fc3fd0403f575ceca9f9f1
- SSDEEP 6144:Gwg5JHngb+geFAFOeFAOBOAEpMUwSoa1X6lHMqhAmCRFDhEbziWlL+91mRJ:IJgygzFOzOlECmoa1X6dMqhA3RQiWx
- TLSH T1AEE46E3FAA456805E13C45B210A595A17276EAC73D01C74F39C9A7BCAF823CA371937D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
721806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
697KB
Virtual Size
696KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
13f82f8a450c7c2d5c3a01fce16501e95e3894b8f84634e31718db80c0b79c7f.zip
- SHA256 13f82f8a450c7c2d5c3a01fce16501e95e3894b8f84634e31718db80c0b79c7f
- MD5 76852e85ed86298ce5456f0aee355470
- SHA1 fbf5af98dffdcb3d20bab04bcb0566e2ed6557c3
- SHA512 8e846653977c8727d359521b369d6c876cf51f7c8c5bb59b024bd58dca09b03054c4a7d8191d2141cad286a4623287b80c77798ea5e3fb944561a2a569da303d
- SSDEEP 12288:XngDiqGCkvK/sVj+DYp7Ya+e4eSlsVJfCcvnjZ65u4flPUNSB:XntqdCK0iY1ZzTSqVQcvnjZ2dtPUNE
- TLSH T1A5B42313E00ECDD70A7C1F999A768375AACC83E129461CE7830E4668DBCD77A36D8646
- MD5 SHA1 SHA512 SSDEEP TLSH
152f42d8d6eebc376fb97fa9633cf863bbdbed2646f7eb62a5b3b2aea8bd4dc9.apk
- SHA256 152f42d8d6eebc376fb97fa9633cf863bbdbed2646f7eb62a5b3b2aea8bd4dc9
- MD5 e1f93c3987cdfc7841ec6bfb78b4e25e
- SHA1 8013ac90e173750939bd5d3e43b20293c2e0f512
- SHA512 aeb48a525b84f8a0d83c9edd9893ef1d0f24949ef75704ac63b2de3d74db5ff206627b5cbd08e18b85c420e17735eddbc7536e3e7954fe1806bf12b17ac9f029
- SSDEEP 768:BjLOVb6vHL935DpWGjOIW6RFrYPlXfpcpP4N:BWbsL93t1TvRF4lXfpcpU
- TLSH T12EF2F147BFA0B676D267AA3A9F691701FCBCF24D692B691AC510053E8D190B19F0B80C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
0bdf0decdf67286cd8934ec75ce34033d0b866ed
Digest Algorithm
sha1
Digest Matches
Trusted
Not trusted
Signing Certificate
CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d
Chains
Jan 1, 0001
Subject
CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d
Serial Number
93:6e:ac:be:07:f2:01:df
Issuer
CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d
Revocation Status
Not revoked
Timespan
Feb 29, 2008 - Jul 17, 2035
dbsal999.rlaendl9.view
.MainActivity
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.READ_SMS
android.permission.SEND_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECEIVE_SMS
android.permission.WRITE_SETTINGS
android.permission.CALL_PHONE
android.permission.MODIFY_PHONE_STATE
.MainActivity
android.intent.action.MAIN
.RegDPMActivity
android.intent.action.MAIN
.PreodicService
.DeviceAdmin
android.app.action.DEVICE_ADMIN_ENABLED
.SMSBroadcastReceiver
android.provider.Telephony.SMS_RECEIVED
CallStateReceiver
android.intent.action.PHONE_STATE
178d7b5eaafd1b4c145d0f308fce5e9a2ce541659566aaea0b5b8421b39769c5.rar
- SHA256 178d7b5eaafd1b4c145d0f308fce5e9a2ce541659566aaea0b5b8421b39769c5
- MD5 5baf8572d4e5607aef17ea2fb74f37fa
- SHA1 392018d0a0d3393e6f75876439381b1c9157f10a
- SHA512 b4673737060e5328d70c0a9523c34f13f4925eb12f21de71483348efd1279b9f19b5e1405487b795b7018d777596c33b8ad9ec2989e2b46481dfaf6945d776f7
- SSDEEP 96:yyUU8BVwkUIw47tpLKrTT9BSVts+SMwpaPmUNtuDScWGgtgg:yyWBV5UIw4BoxJtMOauUN8DSc6gg
- TLSH T141B16DD8309615707075C6DD90B5CD036CAC0BA9267F5442B24A9DC979A5DBE0EF6C08
- MD5 SHA1 SHA512 SSDEEP TLSH
1d38c90449b94815fe2eeb6c5704cdcba3f7e5616cfc5b8604b5336d6eb4912e.zip
- SHA256 1d38c90449b94815fe2eeb6c5704cdcba3f7e5616cfc5b8604b5336d6eb4912e
- MD5 b652eb708e7e03ab84dbba6ffc7965e8
- SHA1 0d71dcc2e4c5d47347d26767ee8627e53d2ce21f
- SHA512 cc7cec895ffed354b2089c359540b8237a0e610bac1a19e05b7573795243c45e45a01de9def269b1da711e381980d46a3420bcf028599e073c0a65f0d41ed13b
- SSDEEP 384:pr6AwoWALGpUUwfKbUHPe7lA5FHj4U+XBcfB7bSfDUOBrBrf:pr6Aw12GiZGKPZT2BABCrJf
- TLSH T1E692D0C324677C9BAE8197C25A4C7B768F2E427551E4E48FF72249B80ED2B648923934
- MD5 SHA1 SHA512 SSDEEP TLSH
1fbae4f859c40f9446d06e76a4acf496fe0a43fb93b87f87d1077ab8a4490480.exe
- IMPHASH 250ba31d444f273789e3ca348000e37e
- SHA256 1fbae4f859c40f9446d06e76a4acf496fe0a43fb93b87f87d1077ab8a4490480
- MD5 c97d31e6c4311d688c7de8a19ba9f488
- SHA1 2c0aa234321581f6414535e165a832b8cd4a4704
- SHA512 62ffa02b28fa3105aa8da596d3f1fa3d26e820909de85e63dc1b539ac02305e08d5e77ec06a462f9864c281d3ff5db71fb8c9f624ea973c99981da080fa8b0ee
- SSDEEP 6144:weOh9kp45g6fNFO2ActWo7qMT357w4DRUzI2t7UMS5PfK:wdkYn4AqMT35M4DRULHA3K
- TLSH T1C254E106B6E38B6EF693E5735831CA4C0732895729325F679583C21568E1FCBB421BCB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
43082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?width@ios_base@std@@QAE_J_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
vcruntime140
__CxxDetectRethrow
memmove
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
__CxxUnregisterExceptionObject
_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__FrameUnwindFilter
memset
__current_exception
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_cexit
_c_exit
_exit
exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
abort
_initterm
_register_thread_local_exe_atexit_callback
_initterm_e
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
_set_new_mode
kernel32
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
CreateFileW
GetFileSize
ReadFile
CloseHandle
GetCommandLineW
Sleep
CreateFileA
VirtualAlloc
LoadLibraryA
GetProcAddress
InitializeSListHead
shell32
CommandLineToArgvW
mscoree
_CorExeMain
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=32, id=261, version=28427,
count=12, id=260, version=28427,
count=1, id=259, version=28427,
count=5, id=257, version=28427,
count=4, id=257, version=26715,
count=93, id=1, productName=Unmarked objects,
count=5, id=261, productName=VS2019 v16.5.1 build 28611, version=28611,
count=1, id=255, productName=VS2019 v16.5.1 build 28611, version=28611,
count=1, id=258, productName=VS2019 v16.5.1 build 28611, version=28611,
237494387c104ddeff1f3b40842da5cd430bf526663c0b10cf2979d8265397fc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 237494387c104ddeff1f3b40842da5cd430bf526663c0b10cf2979d8265397fc
- MD5 953de55f32a514c6590587789efc13bc
- SHA1 e5d76050f2c6be59550eb0ad3302968b09774a26
- SHA512 e216c66651efab6d6c5c05ccb753de51d7b53ceb93532f7db389d9a233527fd9d6800679fbf1a679b60fda2e79981602e21d344873331762ab79939ee4e9ca05
- SSDEEP 1536:xfrG0BX7rRWua3L8rgUbvqDHSn34eU8fCZFQzBPmSASvaYV9zBmN7qD5G5Gcq4Ol:xDGsXn03tD6vNUGZchVrshM7KzhQ5
- TLSH T1F334C4E2D5814190EDA94F7411322D3681BBBFBA7DB8B54E985EB0767B731C3203681B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
223KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
280ebd2392e96c2017db58a6559696b0492370122272e05a01b4ec6d75eef33b.exe
- IMPHASH a2fcf9d2498e7b637d3c423ec2f92296
- SHA256 280ebd2392e96c2017db58a6559696b0492370122272e05a01b4ec6d75eef33b
- MD5 1331b2aefb47bb0be0ff0887d494daa9
- SHA1 25a5ea4ebccabd376332f1b089789531a432812b
- SHA512 027f978c64ee26757e0cecd1a271949c2b3aac60e57fde12a3492d2c6631456d2f40ce34d4feb12aa4941f0499ea9d38960a65629ed3531c7edb9afba6aa58ad
- SSDEEP 12288:cxGRFtmUUzQySL0wKkQI84Ijz33tSXtYgdfeR44lF8t:UkFtmxQyQ0wiI84I/3Q9YgdGTWt
- TLSH T155D48E73F2D04677D0761A795C1B97A8583ABE203E28A88B2BF53D4C9F35381743A197
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
415540
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCloseKey
user32
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongA
SetCapture
SetActiveWindow
SendMessageW
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageW
PeekMessageA
OffsetRect
OemToCharA
MessageBoxA
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageW
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessagePos
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgItem
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassLongA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
CompareStringA
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcpyA
WriteFile
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualAlloc
SizeofResource
SetThreadLocale
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
ReadFile
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalFindAtomA
GlobalDeleteAtom
GlobalAddAtomA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCPInfo
FreeResource
InterlockedExchange
FreeLibrary
FormatMessageA
FindResourceA
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileA
CreateEventA
CompareStringA
CloseHandle
Sleep
gdi32
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SelectClipRgn
SaveDC
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExtTextOutA
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
comctl32
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
comdlg32
GetOpenFileNameA
url
InetIsOffline
Name
.text
Size
399KB
Virtual Size
399KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
13KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
52B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
28f91ad76c55177cb3831f6bd316e29184d4b432c9a16d60a9db9a9726b9f769.rar
- SHA256 28f91ad76c55177cb3831f6bd316e29184d4b432c9a16d60a9db9a9726b9f769
- MD5 37eed44f7aea49c311202e4195e49bc2
- SHA1 232e5609ca88abe5a0f57d078134046cffb52a92
- SHA512 5076149f38f9468c1b8a86f84066530bb912bf8fccef3bda03309f5ced8ea5f33e346fb0af8215a0be89d88942385e1889e37f80ca323af503583ada1dd5fef4
- SSDEEP 6144:JM1Rm5htZOVkqIWAUNTsvQLil/50OFaxu/5aBLwTUbAIfNvLkylrobkshAWt8slI:K1Rm5TZOv57NeQ2V5rFaxOkkAbAIBLky
- TLSH T142742364E9BFC3FF01E98B586C943F611F0A7628F6F5340A4C586206091542AF7E69B7
- MD5 SHA1 SHA512 SSDEEP TLSH
345f60c23675ae94e2a5b4a783e3d5c1ee840cc1ad7c71b0bb5a94551ab73d3c.r00
- SHA256 345f60c23675ae94e2a5b4a783e3d5c1ee840cc1ad7c71b0bb5a94551ab73d3c
- MD5 1eeedc3465bbd2ab177f5c32fc20d2e2
- SHA1 7f58e985396f703325ffcf7d9548465c0c53ac1d
- SHA512 f5c4108a2f3faf214404f9d0b2a7baf6834fc9603a61265c1d1b49dcf5ecfbdbd8834ebdea4431b2fad068472107c74d8081d83a720b82f5e85012b20803dfd1
- SSDEEP 24576:Bt6QWmOg7867YpDDDaV3ofHxSKXJ+SmxWGRnUxueje8FclDlg/w+aGrL:n6QW50TgneJocKXvmxFwu0vFKDu/IGv
- TLSH T1AA35336F25E1C49136F5A07FDA92F0A72EC85A1A34BA1B73DFD402F964664E6E87D000
- MD5 SHA1 SHA512 SSDEEP TLSH
3655fd141632949c32d6f76901bd5a70e6c93576f086d1eb001924c9f22429b6.exe
- IMPHASH 3dec5dd8fa8589d1799dd9fdf6adf40d
- SHA256 3655fd141632949c32d6f76901bd5a70e6c93576f086d1eb001924c9f22429b6
- MD5 885319be5c719ca896a32a123c3af494
- SHA1 1244fb70d3639c31cf3ffc9503e7bc29863b5d3b
- SHA512 b4db55f85d5f93c661074424849dbb3dba1c8d2f392205844ced74f5f282b9367620039a95ea7dd9b89a753cc4cacb1587add56d5b6526460e1a299627382cf0
- SSDEEP 6144:2XNqCM/2Sxscg0KRENASR1W45K9eAoRfQWod1:2ECDt7mRsDet9Q
- TLSH T114A44AC6B09697BFED4726FF358A855DBC23D91C1B4974FBC789AA520A30705EE22340
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21357
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
IsBadReadPtr
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
IsBadWritePtr
VirtualAlloc
SetUnhandledExceptionFilter
CloseHandle
FlushFileBuffers
SetFilePointer
WriteFile
IsBadCodePtr
WinExec
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
HeapSize
HeapAlloc
ReadFile
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualFree
GetVersionExA
LoadLibraryExW
GetCurrentProcess
GetLastError
HeapCreate
MultiByteToWideChar
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
RtlUnwind
RaiseException
HeapFree
TerminateProcess
HeapReAlloc
user32
SetTimer
MessageBoxA
DialogBoxParamA
KillTimer
ExitWindowsEx
SetDlgItemTextA
EndDialog
ReleaseDC
PostQuitMessage
GetWindowDC
BeginPaint
EndPaint
DefWindowProcA
ReleaseCapture
SendMessageA
SetCapture
GetWindowRect
MoveWindow
DestroyWindow
GetSystemMetrics
CreateWindowExA
ShowWindow
UpdateWindow
SetWindowPos
LoadIconA
LoadCursorA
RegisterClassExA
LoadStringA
LoadBitmapA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
gdi32
SetBkMode
SetTextColor
TextOutA
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
CreateCompatibleBitmap
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
Name
.text
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
392KB
Virtual Size
388KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=15, id=14, version=7299,
count=71, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=9, id=19, version=8034,
count=97, id=1, productName=Unmarked objects,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=19, id=11, productName=VS98 (6.0) build 8168, version=8168,
37fd2fdf899066121eff16bb8caab4740eeae4a759a0c3305af7b994660eef80.z
- SHA256 37fd2fdf899066121eff16bb8caab4740eeae4a759a0c3305af7b994660eef80
- MD5 15241f5f6d14ad4cdc8ddd373a487837
- SHA1 79d22882da9da95caaee8edecb70a47fff4cdafd
- SHA512 faf18fa72aba9cbc9a72036d00e2491253a237338cd5f27d01febfd7b117aa69bcbf062efc83769f5f107ff68852b56a5e7d6614ae0c6781d27ae8bdc081e6c2
- SSDEEP 24576:VzWeBBqhRLNu0Ic6TaE62VzjS0XQO4KXyuQy513OfUCt4bwTRG6aWuwvqXcaBO1:V72ZLVQzjiO4fNo3SUC+6aWu4Ica4
- TLSH T10535337CC8B1C588BFBCE6E36EE0598416DA692F0829303656489CC36D5D7E43B1DA7C
- MD5 SHA1 SHA512 SSDEEP TLSH
3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js
- SHA256 3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00
- MD5 421bdc206ca515eff10d9019e7d6682d
- SHA1 61d69fe41176f9dcf84fcc451cd3375d55b277c6
- SHA512 d1ad2b34cb8f816468839ed38fce1ea9ca7bae14a30807832d2c108608ecfc2b1f9cec1e5254b6bbae0827b3f2944b504b750d3f6a3499bcdf2847d2aabb9507
- SSDEEP 6144:GpdWeXigeXFd1LdkiOBvRZRHFPAeRnAklgF2GuuZD:4Sd1LjOJ7dTtl029q
- TLSH T16F14A07B690AFDDDA7762AC090292615CCDDB60B1308C158FACCB5483F76160CFBA976
- MD5 SHA1 SHA512 SSDEEP TLSH
-
WSHRAT payload
4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da.msi
- SHA256 4134aa6962ce37a46a86a788a2b28d931ca6dec6281c82349ecabfdf434317da
- MD5 ef4be631848738f8a19b9c83aedb2fe0
- SHA1 f8a546309e2cc86900654788c01a2344b4f6e4f3
- SHA512 93fcdca28c2f19ac21fce976812b9baabc1c6cf239540bc28d5aafd160838f68d026f2ba235a9b548e29018ad070387810c43f2caa492b087e8e80f693484912
- SSDEEP 6144:OE1fJEHMOJABJJ2+Rinnnnnnnnnnnnnnnnnnnnnr:OEfE4Unnnnnnnnnnnnnnnnnnnnnr
- TLSH T1B135F1E0E829FE57F326D43CA025F658C6D91CE1E706D07AB02AF6A455B3390245DB2F
- MD5 SHA1 SHA512 SSDEEP TLSH
437814cb410ed70eaaac12965985bf31492ade3b5adc6efea838868ac61c624a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 437814cb410ed70eaaac12965985bf31492ade3b5adc6efea838868ac61c624a
- MD5 97e137140c1ad868364d3018cdc877a9
- SHA1 6257ed03911016997edbe6deec63416b75933ec5
- SHA512 8d693141ce244640d29b8dc4343f7970273473091401dedc1ceb4bb6b42cdb0742e9133d3c895c0fc6df22a53efad62e083670d77a918f3310a5a79c020c6f7e
- SSDEEP 12288:uNiBx56BMvgpKDlmX7ZNsD03MSONeJ4MTeERAfEcXMs4:KKDOvW08NM1bAEm4
- TLSH T10E840166BB6A7F17D37E87FCA2A2700003F5B097B197C3592FE650F41A26F900515A8B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
412606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
395KB
Virtual Size
394KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
46aea26e8f56dc23f73abcad5be9e8643692ebdeb90b845bcb80c9782067110b.img
- SHA256 46aea26e8f56dc23f73abcad5be9e8643692ebdeb90b845bcb80c9782067110b
- MD5 d2a584f51d890305a78fadaa2b34ef55
- SHA1 3831a78750503d50b8aa7edcf5cf7536061f7492
- SHA512 99846a3d87af64870c824938af7ad433fcf6690419020507069fa813146b3746722493ab31139cd55e8ef7797bb91593ea149a34a160426701dce728195d408e
- SSDEEP 24576:Etb20pkaCqT5TBWgNQ7aNA8FaVtoYnMPkfJmnVjTrXqmNE86aLdb6A:tVg5tQ7aNA86nMPyJyBXN6aN5
- TLSH T150B5D0A2638DC264C6B35173B9367753AD7B781D4DA4B41F2FD46E2EBD20312011BAA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
484a712197407f3294b64ba3285a0b715a526dd6e58fc7b584a9f3dd5f8d4863.jar
- SHA256 484a712197407f3294b64ba3285a0b715a526dd6e58fc7b584a9f3dd5f8d4863
- MD5 387f5cedb97aff48c3905a0b5a635604
- SHA1 7b8c94ccc84d5f48119af79ff5e47b4fa8d3738c
- SHA512 899d8848351d5b7b918a7ed38a610dceb82d8928c1f26d955aa206f0fe9ede1161e93e845adb67372d953ea972cbefc3d8d53a624ba909b6ea5a9e29d861988a
- SSDEEP 12288:Ipeb8cFBDLwPHEPrqxXVzqnQOzaO9yHhH7jtvEAv2ODv71Dzbk:eqBQwSYaOIHhHd52sv79k
- TLSH T130B423B9A90C9337E27F2338580178B29CBDC12DE40BD8A5D0A5D336596CEE91F87E51
- MD5 SHA1 SHA512 SSDEEP TLSH
484c0b7849b80fcf9ef6c8bfd5435671858eae263db624132e5f89e16a225e78.xlsm
- SHA256 484c0b7849b80fcf9ef6c8bfd5435671858eae263db624132e5f89e16a225e78
- MD5 b430c7ad70cf8acf00c3399041d0e90a
- SHA1 162f4ba878f11c824c88760ad3322f7b85a99a51
- SHA512 27e4d4c6cfbac4ab1a717f3a8c56be98f7456b003fb294f29ab41f8012522bfde4c74519ebcbcc00cc23344614f9e927b65e79423884d1a623db16575f0eb8df
- SSDEEP 12288:G49w8fyunGthwu8kxPthZugvq4jzjSGUu9M:G49b7AhFxPthZnvL3tq
- TLSH T10094233FD298BE8ECAF3EA7D8D458AE7231653DD339078BA686C8484065F12DC071D95
- MD5 SHA1 SHA512 SSDEEP TLSH
ThisWorkbook
Sheet1
4ca951e9d3fcc4196ad777f1f908cf2857e6ed55a7d72d7b0f6636a6b522fe7e.exe
- IMPHASH 3754b80279d9b4e303c75abb17138ea1
- SHA256 4ca951e9d3fcc4196ad777f1f908cf2857e6ed55a7d72d7b0f6636a6b522fe7e
- MD5 11b8443bb27a671c0fe7b7bd176f205a
- SHA1 cea9fb3e370f50ddc41a1dee7a55d80c9358c1e7
- SHA512 b31e0e6915ddb62afa88a8906273a4c46a2b4b04ca84647024af6404ae9b89af05fd1f7bbfbbfa0d98e21d48230a3dac35d78fbbc0a4393a3f1d7a9d47c1bdfe
- SSDEEP 24576:YuuH8Hn64rWbXiaYXLmUBVpCsBtEe/eTXrLx:5H6ZyTX6+pCQEwel
- TLSH T1D325239966D6983AD4E1D1F539B1B3E41A273932B371865FF34C9A8E1E306E40CB6307
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4517
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\vuxinoxa\cimivedolodibef.pdb
kernel32
GetAtomNameW
GlobalUnfix
FindFirstFileExA
GetLastError
GetProcAddress
GetProcessVersion
WritePrivateProfileStringA
GetModuleHandleA
LCMapStringW
GlobalAlloc
GetTickCount
GetCurrentProcess
InterlockedIncrement
FindResourceW
GetLocaleInfoA
lstrlenA
HeapReAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapFree
Sleep
RtlUnwind
HeapSize
MultiByteToWideChar
GetStringTypeW
HeapAlloc
IsProcessorFeaturePresent
advapi32
RegSetValueExW
SetSecurityDescriptorSacl
FreeSid
NotifyChangeEventLog
CloseEventLog
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
819KB
Virtual Size
818KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
68KB
Virtual Size
41.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=171, productName=VS2010 build 30319, version=30319,
count=9, id=158, productName=VS2010 build 30319, version=30319,
count=57, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=94, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4d269e29e4a96282e8d332bedffabf195931e18c4dd54ee23bcf044daf1c7991
- MD5 a6b33c0c749c8f6b094de46fbd993627
- SHA1 5b8cb1fdcea5858efbd48362512220983225eca0
- SHA512 9dcbcbd601d2e9ef807b1abcb2a23b2c76f133c8adca099c14872ee39174a294caf2f2a6a44c329262b14adef388b33c5a462c0cf414944b2ff8e72e9a4117a6
- SSDEEP 12288:77gLd7i2OcejBo+ek4ciC1dmamRSL77Emi162IkSajXphuhoFPVzfIl5cJb:7Ed7i2OcejBo+ek4ciC1dmamRSL779it
- TLSH T1F4949D2815E9551DF5BF5B79D9F82121CBFCBA633603F75E45A011AA0D33B80CE8226B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
453998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
435KB
Virtual Size
435KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
51ae05ee92d6ab4b2a4590f967d645c4db074f74267e95e4fa5c2b9e5485cbc3.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 51ae05ee92d6ab4b2a4590f967d645c4db074f74267e95e4fa5c2b9e5485cbc3
- MD5 d301e3da0a7cb82dd0c1d926e3028007
- SHA1 3c9651c0c529004cfd81e96c6a754b24bfc6bc4d
- SHA512 0bbdf5274261cfd4fcb988dc45fea5c2610062f52c529c739732b9744efdcf6dcb850cf6e578107bf62831f023386bf78f85cc17e3d7619fb6637322080f9b1b
- SSDEEP 6144:/NiBx56TIAMvg9/zlcmAXe+VMvij926Yk45x+HqBlodgPQJ3ofL/BnhJfAorB270:/NiBx56BMvg55ijcvzpr5D9fAorB
- TLSH T1B384F19272697F57C23E87F9E161311043F1B0D77262E3867ED142F92829FE81A255CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
405630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
388KB
Virtual Size
388KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
52f995a46c899c2f2eee60bfcff3788fa72d5953632121366aa00e6bff74ef57.exe
- IMPHASH 7f2222d75bcebeb591b7d884c5b9299b
- SHA256 52f995a46c899c2f2eee60bfcff3788fa72d5953632121366aa00e6bff74ef57
- MD5 ca47b1087159af27517471a7bd4af6ea
- SHA1 15ede8441219ecdef9abb4f814957ab5dedd684a
- SHA512 fe174470b5fecff826945c180f1b3625921f461a14728eb5aa4a4660faac9d37bffa6971b7f7885be5c954f3bd7a422d7b78d4ee81b29e184cc095c3937a3eb6
- SSDEEP 24576:5tb20pkaCqT5TBWgNQ7axC7mUi3/kGBMpryZljVwKW0Dfnl/I1CR5qH9MV6A:KVg5tQ7axCaUOkGapryZ3BNbe1u5qk5
- TLSH T18475E12273DDC364C7B25273BA16B701BEBF782506A5F86B1FD4093DE920122525EA73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
155508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
recv
send
setsockopt
ntohs
recvfrom
select
WSAStartup
htons
accept
listen
bind
closesocket
connect
WSACleanup
ioctlsocket
sendto
WSAGetLastError
inet_addr
gethostbyname
gethostname
socket
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetConnectW
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetCurrentThread
FindNextFileW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
CloseHandle
GetLastError
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
RaiseException
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateThread
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
DrawMenuBar
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
CopyImage
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
UnregisterHotKey
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
DeleteMenu
PeekMessageW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
CharLowerBuffW
GetWindowTextW
gdi32
SetPixel
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
GetDeviceCaps
CloseFigure
LineTo
AngleArc
CreateCompatibleBitmap
CreateCompatibleDC
MoveToEx
Ellipse
PolyDraw
BeginPath
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
EndPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAclInformation
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
InitiateSystemShutdownExW
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAce
GetAce
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
UnRegisterTypeLi
SafeArrayCreateVector
SysAllocString
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
VariantCopy
VariantClear
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
VariantChangeType
SafeArrayAllocDescriptorEx
VariantInit
Name
.text
Size
557KB
Virtual Size
557KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
828KB
Virtual Size
828KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
53dcc282a6b694f8e4b053e6b5b50b2e2fa446072b25cf1d9139e130a3ef3e51.msi
- SHA256 53dcc282a6b694f8e4b053e6b5b50b2e2fa446072b25cf1d9139e130a3ef3e51
- MD5 878c93a88ba8412baefe9b6e297ee650
- SHA1 54c139e0cda1919b4f324bcb5dc3a78a80c73024
- SHA512 fddf477b9e5c2a744bd6645f83f449237497cce47df0f6fcb13621c0942823972a49b364eb84d26465a0bbff98b38cc00d690ea5200ab8e52eda623f42ccfc16
- SSDEEP 3072:rEef5ZLXBx6UOCLqKPsHDnnnnnnnnnnnnX:rEef5Zz6UOCLqKUHDnnnnnnnnnnnnX
- TLSH T18035E0E0F82AFE57F326D438A425F668C6D91CA1E706D079B42AF7A451B3380145DB2F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned MSI
Checks for missing Authenticode signature.
55805d7d04848a1bcc7067a8d1dda5fe30f76f27c4e6b831a2d9dc56a3a1294e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 55805d7d04848a1bcc7067a8d1dda5fe30f76f27c4e6b831a2d9dc56a3a1294e
- MD5 9037c3a7687970da970994e8df71d48d
- SHA1 72c5668b2e3bba6dae1458e6cb2d507a5b9f1c80
- SHA512 c75c0da75b303ae11790c01454d3a5c78f991677750fd28706214bd75180c3d2d3bf5c0370e18b9cabe62b1a9d6c4b6068f2f690b52a0c21d0facde2e5700606
- SSDEEP 12288:DNiBx56BMvgwesFACKL1EQ0PZCb2gLJSSu:8dKj0PZC6B
- TLSH T18484F041B6287F16D2BE87FCB1A6610043F6B19272AAD3997FF640F50C62FC45246AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
403342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
386KB
Virtual Size
385KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
5b15b1fd3bf2eef911358d7125b5120eb716dcd75af883cd133dc0e346988c85.exe
- IMPHASH f00d8dcb202a28bfc47f99ef51cb4107
- SHA256 5b15b1fd3bf2eef911358d7125b5120eb716dcd75af883cd133dc0e346988c85
- MD5 2e9388fa93aa73819d8fc600611cc73c
- SHA1 cc271db98fc74f0cf3ee8508b3b546522876cdc5
- SHA512 7f4181524ee0d908cd8bae86b9f355f0f1cd66b4837f820a2981b7b9444dec27ce2123885440c3971b0dc8c5279145100017322f09491804d7bf9d23f1ec852f
- SSDEEP 12288:4YOUBBN/eZZe7M138vlLtfTpOOPBebQubsRPuUcsl6k4/yypwD6FoEwc:r58ZCM138v9rTJebvb55xk2pwD6FoEwc
- TLSH T1AA159FC5F14888DBE93B19B3983BA63050467DED90F1811E729E772955B338210BFE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
ac:00:31:00:b6:7c:6d:41:6d:98:64:f5:80:a1:fd:05:c7:a4:0c:c5
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Adobe Systems\, Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Acrobat Engineering,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US
Chains
Oct 25, 2010
CN=Adobe Systems\, Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Acrobat Engineering,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
CN=Adobe Systems\, Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Acrobat Engineering,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US
Serial Number
02:90:96:5e:91:33:40:cd:a6:63:4c:ef:31:f7:fd:07
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 28, 2009 - Nov 4, 2012
Minor OS version
0
Major OS version
6
Entry point
5954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Codes\Version9\HEXCALC\Release\HEXCALC.pdb
kernel32
Sleep
VirtualProtect
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
HeapReAlloc
RtlUnwind
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
LCMapStringEx
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
InterlockedIncrement
InterlockedDecrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
GetCurrentThreadId
MultiByteToWideChar
HeapAlloc
EncodePointer
DecodePointer
RaiseException
HeapFree
ExitProcess
GetModuleHandleExW
GetProcAddress
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
CreateFileW
user32
DestroyWindow
DefWindowProcW
PostQuitMessage
SetFocus
MessageBeep
SendMessageW
GetDlgItem
CharUpperW
SetDlgItemTextW
wsprintfW
DispatchMessageW
TranslateMessage
GetMessageW
ShowWindow
CreateDialogParamW
MessageBoxW
RegisterClassW
LoadCursorW
LoadIconW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
590KB
Virtual Size
597KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
289KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=207, version=50628,
count=11, id=205, version=50628,
count=88, id=206, version=50628,
count=98, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=3, id=211, version=50727,
count=1, id=201, productName=VS2012 build 50727, version=50727,
count=1, id=151,
count=1, id=204, productName=VS2012 build 50727, version=50727,
5b69f8de67c6ce1c40904742cd26f91442c518496fb8e3f9509f069f1a347dc3.elf
- SHA256 5b69f8de67c6ce1c40904742cd26f91442c518496fb8e3f9509f069f1a347dc3
- MD5 e736dbb0e7fdf27d3ff6f54749ebb2f0
- SHA1 02afad2be33b9b0bff4ed6d06b6a0e6e715dca94
- SHA512 bcc40c49e2f7610bf225d880a1b92c8222f649246360141cdcefc8e5204075705ca4a0fe2d7f9de0702040a738bc0570f3993c735d40fcfa09c10b835b87b9fa
- SSDEEP 1536:Z3eTS6ItNV2/+MuuoZXBA9nzM+x/UeZIhoukW+0NW:Z6/+0o4/x/fYouw0NW
- TLSH T1D9B3941AAB619F77DC1FCE3302AA4901218DA58A02E93F6FB2B4C55CE74B94F08D3D54
- MD5 SHA1 SHA512 SSDEEP TLSH
5c7d5c1bfc961dcd484d92d502fb73932456502fa22db6b66a5719baf2d64d0b.zip
- SHA256 5c7d5c1bfc961dcd484d92d502fb73932456502fa22db6b66a5719baf2d64d0b
- MD5 8e3c3ac30cfb8006659c8b1c38c77ca3
- SHA1 ffea409c07951f861ca1ffd11e18e298048d3dd0
- SHA512 a0c4622878e19c37130a1fc8e52616e909c8b096239ea8acbb9e5fe497b485b4eae6fcaf9822277fa8dd4cfb262d327448134fd12c7721f11ddb44fbbd8af7a8
- SSDEEP 384:xr6AwoWALGpUUwfKbUHPe7lA5FHj4U+XBcfB7bSfDUOBrBr5:xr6Aw12GiZGKPZT2BABCrJ5
- TLSH T10392E1C324677C9BAE819BC15A4C7B768F3F817451E4E48BF72249780ED2B64C923934
- MD5 SHA1 SHA512 SSDEEP TLSH
5e43dbbacf2011c12d45d40e8435c41dd331ba2adf4f7df80bedf53b436ff78d.doc
- SHA256 5e43dbbacf2011c12d45d40e8435c41dd331ba2adf4f7df80bedf53b436ff78d
- MD5 2c345e5852377648695d8805a20bb5ad
- SHA1 9778780beb58938d47dc4f8d09158ddc5d536af6
- SHA512 ee25b10b173b622c78944fab4236fd333a2ad9c568ddce48b14f0efbd5e3a3341411c80eea24f67c4507d91949fa6f5a862f7852ed653f081b7cffd427801543
- SSDEEP 3072:Dz8HoUNnZFeHru5Y6+C4lvrKKUfC7q7Q7X9gv13x3F:Dgpn7YTdCmofC7q7Q7XCv1BV
- TLSH T1AAA36A138D58DF93D06886F47E030EAC7B072B1C998A39EE15155ECFBF681525EC924E
- MD5 SHA1 SHA512 SSDEEP TLSH
ThisDocument
clyli
5eb9ca5476eb4c9c83bbb5d6bbb7ff90474749121e2e063bbd9e988c4e4917e2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5eb9ca5476eb4c9c83bbb5d6bbb7ff90474749121e2e063bbd9e988c4e4917e2
- MD5 dce34cf780d56c10d05817c4857d92e5
- SHA1 21ed22281936cf57edf8edcf872a3c6cebc99691
- SHA512 2d0f20f755155dd5c0a4272a57c7e583e0074ca6e75cc3db107ba3e742b89be3f8474f383cfad02f8a16a42807f76a4937719d236e644df5436f4dafb2a45de1
- SSDEEP 6144:LMRLDlNDrTlfiX9tvpWRYfYCu4EPwCzE2JhvlLMzK3/bn4tHkfaLmvONkn06LtBX:LOjp0hkfaLIak1tBX
- TLSH T15694F13A3249CEAFC65E0ABE4D599140437097A12515E3DFBECD627507C339B930B8AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
444806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
426KB
Virtual Size
426KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
6454d7e9ab89840c38bed8246d96fd9f13e57b7b9b8449c55aa7dbe0e881cb45.iso
- SHA256 6454d7e9ab89840c38bed8246d96fd9f13e57b7b9b8449c55aa7dbe0e881cb45
- MD5 a68cd7a39e38a0811ff85f682d6774a2
- SHA1 ea74935d932d606688e10a24e0e54355dc404f05
- SHA512 f398fc5615ac70dae5c1c9e2e45f7fc792ec7a4388d2928df4271394895228503a2d22a3542abdc2b17e8d64146bd41486dbfebf4ed5bf2767c656e75fdaa62d
- SSDEEP 12288:VxGRFtmUUzQySL0wKkQI84Ijz33tSXtYgdfeR44lF8:vkFtmxQyQ0wiI84I/3Q9YgdGTW
- TLSH T145457E73B2D04677D0761A795C1B97A8583ABE103E28A84B3BF93D4C9F39381743A197
- MD5 SHA1 SHA512 SSDEEP TLSH
66d659af0fce5ee7b2787e527ae60c9aace938821572aaef05761916e055e69d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 66d659af0fce5ee7b2787e527ae60c9aace938821572aaef05761916e055e69d
- MD5 d790806974579b39d05a8ac3ad12c242
- SHA1 4d3b782de3c4122e908a5fdc220a7498e47e6f26
- SHA512 6494cbffb560aab9ed7e5428ecdbf87e620e465db0715fac079c2fa9e8873b81eb4b5022bd806b921095dbf8fa94c734fd3ccc15d742e560ab8c47104bb9c72c
- SSDEEP 12288:QWtjYXYpiGJqeCPMufGEVb7Rbu/EiPGZKV:KX0LqJ0ulRbueKV
- TLSH T1B3D4CF2815F9991EF9BF4BBD99F862518BF8B6633603F75E55D002991C33B80CD4212B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
648862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
626KB
Virtual Size
625KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
69e178f924ea4a6c0add0e4b8c1224d9f47ed366def2cfaa5d0d754df7cdd0d5.zip
- SHA256 69e178f924ea4a6c0add0e4b8c1224d9f47ed366def2cfaa5d0d754df7cdd0d5
- MD5 6c3836e10f44853752200ecce615eb64
- SHA1 f80d7b7cd3b7ad61f51bf1e04acbb36cc8cc0302
- SHA512 99a8b3eac070bfebc1418b3c465f8183edc46bf5be4ed472aa0516b00d71c14cae3345cd1a85f7a8dd7982d23a3f2f1192e7f0500e8041a1b11d4e338ab63f6e
- SSDEEP 12288:YUCrGfwUVZzaPY8Am9SSRPBs/ucCe8hyms3IKANV:YXSfLZzR8Am9V/wucahHBKAv
- TLSH T1D2B423E081CB2E62D24C1BA41B9FE03A215E86D51B9DF354FD0919FAC19A87335F4A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
6a28596183b375a4c5d67febe6c72ff29e5bbb29e56875c72624357fd659b6d0.gz
- SHA256 6a28596183b375a4c5d67febe6c72ff29e5bbb29e56875c72624357fd659b6d0
- MD5 c99880b0e3472c198233e4e6065e996f
- SHA1 98346a2d1021bca513b93f678cc734d6e1da3814
- SHA512 642b5bf14ed739da552a545bccab59e1447d1c72bc38fc7be86cc0fbb7eefc55286ae0988b20b05c2e5f04e5fdb8ccf34530f5c687ef53d5c7119645204964ef
- SSDEEP 12288:Aj18ZZJKJD/6HU/2CKcQ+/MVAZ3YBl2mMI81eFZvjaWE:A6JfU/JvR6AxC2C/ve1
- TLSH T143B423EA3E43591AB4D6EDBCC8E4988CDD45A86C2CC53DA619798409CF8C061CDF93F8
- MD5 SHA1 SHA512 SSDEEP TLSH
6a2adc0f321760d969e448ff7da18ceca73ae52c5e3ca8f7e923f1e9132b0af6.rar
- SHA256 6a2adc0f321760d969e448ff7da18ceca73ae52c5e3ca8f7e923f1e9132b0af6
- MD5 178954421128e21c534ff85b16da47d9
- SHA1 e8e75ffc1418c00b9dccd116e3366d233b4da6d0
- SHA512 c0827e1bdcf6a82a4343792408aed063facc23aed71f819b0c789cd9d246b6a6a03a03130adbff1d9e952de236a1a3da69a5d119ddef9c99fad578fe85c5a18b
- SSDEEP 6144:onyUlPx/4Akaqj4pA/zdIsE2fhVBh9ob5j4C0xU1t0Z0ALUKLl9KN77bXAaYV:on3lCAka4eA/zdIOZVBhCVL0if0WALUw
- TLSH T108642342B2A9965C5937C04D6C436FB8E65B45A104C237A2CFF527314ABF3ABA92CC1D
- MD5 SHA1 SHA512 SSDEEP TLSH
6cd321b504c7323e893fa7e55125696ba87ab42fc3077e11ff9eedabd6b0893e.img
- SHA256 6cd321b504c7323e893fa7e55125696ba87ab42fc3077e11ff9eedabd6b0893e
- MD5 04cc69bee253cef2d0e5766efa55d358
- SHA1 0d34cc5bf7340999a3073fae9bfff753a9267143
- SHA512 1bfc297fbf5b943250becbdf3797cb524046208eb4322461d924205c88ffbf9880e5a67ee8b14291aa9c7aa9d7da7bdd7aa621f92b4591e336294668fd1f6451
- SSDEEP 6144:XeOh9kp45g6fNFO2ActWo7qMT357w4DRUzI2t7UMS5Pf:XdkYn4AqMT35M4DRULHA3
- TLSH T19D45E106B6E38B6EF692A1734830CA5C0732895729325F57B58BC2156BE1FC7B4217CB
- MD5 SHA1 SHA512 SSDEEP TLSH
6fa4299d985f18a3b0cc7323ad653988f8fb51d8ceb58600432ba78271885cd4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6fa4299d985f18a3b0cc7323ad653988f8fb51d8ceb58600432ba78271885cd4
- MD5 f8a10c77c094f5b748c17fde795a4080
- SHA1 648e0dbab231dd5ef3854ae87fdcad8fff31b87d
- SHA512 2514a6be82c6b5d200d4cc6f0b7922a16ad99ff87c6c4abecfaeeeaf67f4b287bd99f207c448cf24384bfb1c8565aa5d9f9fe944677d2c0c209adf44c2716483
- SSDEEP 384:enTqRfFHJA1ICYVHM7ayt9DXhQhWlAA7MWjqbddT3iaAZzqp1h6:qGKu8PDX2GozR
- TLSH T192A21A4A3FE68601C5BC46FE8DB382101B7992435E62E71F5DEDE8DA67237840D80DE9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
7176b60cfd7b9b4bf9e9a4683bcd45444d59c86a370f6afb8b38d8ed8bbe4144.exe
- IMPHASH 7f2222d75bcebeb591b7d884c5b9299b
- SHA256 7176b60cfd7b9b4bf9e9a4683bcd45444d59c86a370f6afb8b38d8ed8bbe4144
- MD5 d10502d6353bd5df8a36c04da4e7051b
- SHA1 5a23cdcea00c73ae8dd2a7a13a19359779d9afd2
- SHA512 be2b1d94418984259f60e3076809f5a6b10b750722727e5c2e9f2f3d83f99eec8e101ca41e42f5a5dffd2f38ab45d5a9bef978944a475f2f0d67ea474247862a
- SSDEEP 24576:Rtb20pkaCqT5TBWgNQ7aAA8Cz2YUF5Vk9BogtzSHzPUM9EDqNaWAMQEE8oVh8iKx:iVg5tQ7aAJCz2Y+UeHgPWNaWoEEEgs5
- TLSH T1A375E11373DEC361C7B25273BA26B701AEBB782506A4F56B1FD4093DF860162521EA73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
155508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
recv
send
setsockopt
ntohs
recvfrom
select
WSAStartup
htons
accept
listen
bind
closesocket
connect
WSACleanup
ioctlsocket
sendto
WSAGetLastError
inet_addr
gethostbyname
gethostname
socket
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetConnectW
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetCurrentThread
FindNextFileW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
CloseHandle
GetLastError
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
RaiseException
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateThread
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
DrawMenuBar
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
CopyImage
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
UnregisterHotKey
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
DeleteMenu
PeekMessageW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
CharLowerBuffW
GetWindowTextW
gdi32
SetPixel
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
GetDeviceCaps
CloseFigure
LineTo
AngleArc
CreateCompatibleBitmap
CreateCompatibleDC
MoveToEx
Ellipse
PolyDraw
BeginPath
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
EndPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAclInformation
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
InitiateSystemShutdownExW
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAce
GetAce
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
UnRegisterTypeLi
SafeArrayCreateVector
SysAllocString
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
VariantCopy
VariantClear
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
VariantChangeType
SafeArrayAllocDescriptorEx
VariantInit
Name
.text
Size
557KB
Virtual Size
557KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
825KB
Virtual Size
825KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
73bdfefd546d1a751a77b6de3a36460b6108a06940a1c9dc73c9dfdd78f8f649.elf
- SHA256 73bdfefd546d1a751a77b6de3a36460b6108a06940a1c9dc73c9dfdd78f8f649
- MD5 b1b4a2799d7f8ce7a4dc007d6013666d
- SHA1 01ab203641e20d8b66a08b48910f773477385c54
- SHA512 0426c4f249fc25a91c189ed593095fd944bb41f59b3dc0c113f0093d410724fa667758ed4f84175b7cde1d30b1df28d1b1e736d33d52185a5e8f1179d3f4fb4d
- SSDEEP 768:m1k7snCb8eQemodrPLWeKNJ+1ko+OSuCZU++:vsnCSemCLLWeKNJ+1kbOSI
- TLSH T190E21836553D2F16D4D0F63E233B8BD463D02A5E2B98898EBD660E0FEF3542854570BA
- MD5 SHA1 SHA512 SSDEEP TLSH
74126598c35fd00fec92f98a31819cdd22bbbd1a0ddcf33fb8af978576e1ee7a.rar
- SHA256 74126598c35fd00fec92f98a31819cdd22bbbd1a0ddcf33fb8af978576e1ee7a
- MD5 544c87a35b1a6ce2fbdedfe078126693
- SHA1 b19b85f2c550115876b8b2634b563156c4e441a5
- SHA512 a9ccfd376a1e78caf918572fe706d5a9ea07565cc638b65e87aff34fe9f414b43a7d1274b560d34235d524c9b1b815c8689dfd6b42598d2fa389d2f0093807fe
- SSDEEP 24576:/2XBjcpns/zvUFTeOz+CYczoP8W4V0FNalkbh3ceNhOBEaGnGihNcxiTRi:uqpnr3DYczBFl/eNhOBH6h6xig
- TLSH T1854533D4AA28F2A687D26B0E40CC64C91381DD64AFB74DE7C847943E778599D078D8FC
- MD5 SHA1 SHA512 SSDEEP TLSH
792fbf337e4d738502dba52638e1c20de4486e092e02f83db77e10ddb0ab448f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 792fbf337e4d738502dba52638e1c20de4486e092e02f83db77e10ddb0ab448f
- MD5 b3c290bd72f63fc2081cf8f01c078258
- SHA1 f304bbaa50db43be5d132b5c7a90692ffc278118
- SHA512 d740c125e5b3135806719730919018558abd441cff1a3de5b01bede0620e274a27170e687c672e26bc49066565fe4b53116fc094749ca7bbe18067a49a3fc5bc
- SSDEEP 768:EXeEvwIlLMRpcnu6x0atvpLWEFLiuV/abAXToYzUWuGlV7ZtZ6q/pmD:OeEvwIZMRWu66IWEFLpSSToKjuGz7rd
- TLSH T1DD73AF05BF189456C4BD0B715622D67013B0AC9B0463EF899DE9ACCFFE732C25C8A6B5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
7a9c52c23667b18ab730f2b378df05985bd50aa16d051fccacb61549397ae3de.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7a9c52c23667b18ab730f2b378df05985bd50aa16d051fccacb61549397ae3de
- MD5 acb50993f4199ce417bbafac3b2b9513
- SHA1 74d56c16b1898c6273288cea063f1331d763cb61
- SHA512 63a930bc6963ed23711880571a8e62ca34ce340b00aa5600295629dc9126725c11ad324e29257f262ee008d27c75641efd05fe5806c053e2ad0b9c529a421685
- SSDEEP 6144:ng5JHngTgeFAFOeFAs4g+bYKkxntG3l3TKZufqEBuRVfIf74WD0K8Uy8:WJgTgzFOz3hkxnQVOZ12Yuvb
- TLSH T1FCE47D3B6B856406D03E05B154A55691B673AACB3E02C74F39CBA3AC7F827CB370925D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
722942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
698KB
Virtual Size
698KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
7d1fc871156054dc4d288f7302e4324143f27048d394195041894f4cde2551d9.zip
- SHA256 7d1fc871156054dc4d288f7302e4324143f27048d394195041894f4cde2551d9
- MD5 c3ae91356500f9925cbcbd5e527b0fbf
- SHA1 ab3863b31726ce2e48a0bd98e602aa4e3376009e
- SHA512 f9323671356099f6154fd9180d61a72c541c4d7cb717a97a8d1352a6ed93cdd9e48ba8c99a632c34e07f4182774aa8f017fe29285db8db091c9c3a24bd3cdcdf
- SSDEEP 12288:6a1iMyyPNkUJXXqwe2cnwPFIvHFjLJryuSVeOz3Ca/VyZgI:ZMMXNJXXQn55RyD3X/ogI
- TLSH T161A423315E2B8CCD39CE4479831470D7F91CC075BB971E4E5492AE249E0B80BB9ADCAB
- MD5 SHA1 SHA512 SSDEEP TLSH
8044dc7f383547fb4d9acfc1bfd1adfe3e6def133317a506b991e5b62a29bc63.exe
- IMPHASH 7f2222d75bcebeb591b7d884c5b9299b
- SHA256 8044dc7f383547fb4d9acfc1bfd1adfe3e6def133317a506b991e5b62a29bc63
- MD5 613b84634e28713c96db76d7ffe339aa
- SHA1 2bec49a8e8f3bf8fd6d64d296c223e35a16cc8d5
- SHA512 ca5fd712caba1965fb5c72e8c6a77ae2b7dc1ce5a0471f7f18b9c2ac3177a725369fb1d85076243502171b8ff53fcb893f58159786ccc17516b3ccb4300056fd
- SSDEEP 24576:otb20pkaCqT5TBWgNQ7aNA8FaVtoYnMPkfJmnVjTrXqmNE86aLdb6A:xVg5tQ7aNA86nMPyJyBXN6aN5
- TLSH T12D85D0A2639DC264C6B35173B936B7536D7B781D4DA4B41F2FD46E2EBC20312011BAA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
155508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
recv
send
setsockopt
ntohs
recvfrom
select
WSAStartup
htons
accept
listen
bind
closesocket
connect
WSACleanup
ioctlsocket
sendto
WSAGetLastError
inet_addr
gethostbyname
gethostname
socket
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetConnectW
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetCurrentThread
FindNextFileW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
CloseHandle
GetLastError
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
RaiseException
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateThread
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
DrawMenuBar
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
CopyImage
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
UnregisterHotKey
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
DeleteMenu
PeekMessageW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
CharLowerBuffW
GetWindowTextW
gdi32
SetPixel
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
GetDeviceCaps
CloseFigure
LineTo
AngleArc
CreateCompatibleBitmap
CreateCompatibleDC
MoveToEx
Ellipse
PolyDraw
BeginPath
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
EndPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAclInformation
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
InitiateSystemShutdownExW
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAce
GetAce
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
UnRegisterTypeLi
SafeArrayCreateVector
SysAllocString
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
VariantCopy
VariantClear
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
VariantChangeType
SafeArrayAllocDescriptorEx
VariantInit
Name
.text
Size
557KB
Virtual Size
557KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
963KB
Virtual Size
962KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
8507c1a84b8dcfa202d9333e43138cb0e496f227439e50ed7eee1c13611ebd02.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8507c1a84b8dcfa202d9333e43138cb0e496f227439e50ed7eee1c13611ebd02
- MD5 bc02804c340af53694ffc25fb0ac8239
- SHA1 1e8a3267f910b41c5759bc2caa6bab977a4f2560
- SHA512 6052e1bcb01d5d554bc149eb6d17e6a790c328e5836937cee17780b3e55064a0addd53d77bbd99776cd841281e3c4ad4cc733429b31bbc22a1625705a5c1d793
- SSDEEP 12288:PNiBx56BMvgNsx4n2t6TIeRfc4bLlOO7:Bs6n2YU+NLlr
- TLSH T15194F152A7243F53C27F83FC9162616043F9F0A2B266EB8A7FD141F94862FE445649CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
415022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
397KB
Virtual Size
397KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8a1ceef47b70bd179c7a439e9d106dc7e489bff0b4dc7df1968491bc8d639de3.rar
- SHA256 8a1ceef47b70bd179c7a439e9d106dc7e489bff0b4dc7df1968491bc8d639de3
- MD5 69f4144a35ccfae84d6b27682d8414ea
- SHA1 5c1b97ed0f7343b132ae00083318da96c9a0b74d
- SHA512 c4c86239a16bfd98de8a4cec85255f14cd8b5452ed7e76fdc053c99cd6d411833509cdf582634a0dcb55af5a911ba45fb9ff02a7fbe27897c79f9faf2cf1fc61
- SSDEEP 6144:BQM/w5y1JRcPJteTb2D3vS0rEGlMOnbjNT+RJ6QKELl8yMTBGU:BQY1bcPveXmS0AGljSmoCNT3
- TLSH T104742387A7C02778BDFF2BD20FB6470E2975E99ABC35304A6C7ABBD064401E21566037
- MD5 SHA1 SHA512 SSDEEP TLSH
9202be882e0e5eb2e051ebb9ca02fb2841e60ad69a2316cd8d5d42980a16c622.zip
- SHA256 9202be882e0e5eb2e051ebb9ca02fb2841e60ad69a2316cd8d5d42980a16c622
- MD5 a78b0d8ce0836ff754d59f6d0dd52966
- SHA1 dd016916b1d8c2392f158aa4c557dd63390744b9
- SHA512 f69d933ed412864e5d185775b6b958ea4f7824af46c0ccc70f251ca94b9e1aa39a6b30c65e92d2798c99fe9d916f41e65fb8ec4aa2cdbbedec125d2e07a3c366
- SSDEEP 384:7pr6AwoWALGpUUwfKbUHPe7lA5FHj4U+XBcfB7bSfDUOBrBr4Q:Fr6Aw12GiZGKPZT2BABCrJT
- TLSH T19E92D1C324577C9BAE8197C5564C7B799F2F417510E0E48BF72649B80ED2BA4C523938
- MD5 SHA1 SHA512 SSDEEP TLSH
928111a62a25ff3af20e627c8ab5edd0f333413988ea4ef90f75adf7cd5b6c39.jar
- SHA256 928111a62a25ff3af20e627c8ab5edd0f333413988ea4ef90f75adf7cd5b6c39
- MD5 3a9a0752b21ddce5af9dc6995c942405
- SHA1 59922f4aebff3aaf2eb60e4ecb75fa00b38ed4cc
- SHA512 94f580a1865a4566645cc3dc918d2427114f6c9c3d2de8cad3e411e7ce5207ea2b72b1b89c5434f85994cca91901231adf2e236bf4a8ef2c4a42780cb154b615
- SSDEEP 96:GRFZlapHZhil91onRGXMhcGUYU6QB6/YshjVs9mhPgNSiTNySFryc1ZIumfv5xck:eFZMHZlIXMyne/drhIg6Lrl1AvvjR
- TLSH T1B3C14B782DE8C38EC233C274C3CFA035EA6402D84B99F0975788E8542D698D4574BFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
92bee9898c4a67a5fe3a209982221c240bc96627ee3fac96369eafa443bde986.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 92bee9898c4a67a5fe3a209982221c240bc96627ee3fac96369eafa443bde986
- MD5 2f130c225d24f9c9ea9d9a0ce08ebdae
- SHA1 89aaf5ec737b2ff120b479a473a5620b0c34810f
- SHA512 f7a08f98b8bdc979e3eb424c10ebf8967e6b6a6310b3f5c3fdc4d723a5bc66f433eb69f1c5a3d4c0a35682dbebb5a58203b43773ae8e1f293912478f18cb8879
- SSDEEP 6144:HTqBxJ/Ot2lvazf+7RbJ8ftfJ0+9BwXHQ:gOmvaD+7RbRyWXHQ
- TLSH T147545B1602AC462FD6EEC6B8C4682640C7F5B557FBC3F75E9D9041BC2892B45EC923A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
298762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
284KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
935d4108d5fb3a2e5eae96b136c4744ae18eeba8043673a68a7e7fe84f66cfb1.elf
- SHA256 935d4108d5fb3a2e5eae96b136c4744ae18eeba8043673a68a7e7fe84f66cfb1
- MD5 6e7a7c553d56aeb621f8f79782d5afba
- SHA1 f04f3a8e4a4b76d27f23ad3aa935ceeafff5db00
- SHA512 cf11ec42b79bfc83cb51a661a4ec4bbbbae8bd3a5e2180d54b7fee4574573b88beb17e67fd0ef2c2baf4fa1b42d876fe221225ffe3c769e111f5c90cf7e7dd68
- TLSH T13321D8E981E94529C2A13737EC814B427F3A80F3E2131B2187B89B1C6F54646E484190
- MD5 SHA1 SHA512 TLSH
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
95708fbe180a43fbef0014d207456fd8812cb202d77e1078c466ca474e38c7a8.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 95708fbe180a43fbef0014d207456fd8812cb202d77e1078c466ca474e38c7a8
- MD5 2568ec084960c66d9f2f8d7eefd94f62
- SHA1 f5d99c63444d51aa08196564e164e009b9d6f131
- SHA512 936c18ee2b7226a02b76374fc6e1687b858ea34cc7539d3084b7c6eafd3f80a7d8f73aa60302ba2f7d6e6c80f40f532e64a49e2aa07791e2b3d11eb4768e5834
- SSDEEP 12288:+H/k7SPgpjOx56/54mkTP/WOAG0ZzpoobBl9GW7:bS2OaiP/4Gi2+4W7
- TLSH T14BD4BF6816F9991EF9BF5B7DE9A851108BF8F5633603FB6E45D012A90C33B81CD4122B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
642654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
620KB
Virtual Size
619KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
969989cd37da58261a4345c90947b6b7478350d8050f570ae9f598ec3da4c7a1.zip
- SHA256 969989cd37da58261a4345c90947b6b7478350d8050f570ae9f598ec3da4c7a1
- MD5 e462a9fb9a2db318ab6afa72a3c5b804
- SHA1 145959dcf5f42270285cca77a4e92aa75e43d5e4
- SHA512 12a86977b4300b78ebaf80bf7197fedc30bfea5728a41a9b95cbba59bbe3e039362b77a013e690e1c70a0e516f81526f1345093a100a098e286634d71c74998b
- SSDEEP 6144:ol1AvrL3U11yyMOBBZ6AUcVN9dZhX1WagpxnCs8r61EzK5cq2Zhq6jOO:yWL3UnyyMOBXvUcD9N1j+nKmCzK+LZki
- TLSH T1B3742383F07B21757E723540989B0DAB6EAA5E079D37063490EAF54D102BCAC273DE1E
- MD5 SHA1 SHA512 SSDEEP TLSH
9855e6cab6dc7b89aa792aafd85bf39ac186954964427fc6e4c236a0a613d8e4.exe
- IMPHASH d57326dc0ee27755d1c95acede967a36
- SHA256 9855e6cab6dc7b89aa792aafd85bf39ac186954964427fc6e4c236a0a613d8e4
- MD5 e8f4977f6eba7a7f41208568f9e0b273
- SHA1 1e5144b7028f5c4a27e1e092bf798f7e8812cffb
- SHA512 2b80a0689c66f14a0c00755358638a03b68376b1f8729afb85c8c9bd0d0c058512b4a4749de6a29204ac1612f72574b7d5b8c5ddf0123e5bfbf8cf05e73520c6
- SSDEEP 3072:fIgBeiRJeGxta6SvuCwyrj1nUpLYbWC4d6VrIuQX0ogd+2ajsKo8UKYmGZUz+yM:fI4FvxtOGEmB0WHQCjg9OYl
- TLSH T183248E2232E1C0B3D2E701314EE5AFB9B6FAFD204F329A4763D4171D5D369E1462636A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45052
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
TerminateProcess
HeapFree
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
GetACP
GetTimeZoneInformation
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetCommandLineA
GetStartupInfoA
RtlUnwind
GetProfileStringA
FormatMessageA
GetFileTime
GetFileSize
GetFileAttributesA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
DuplicateHandle
SetErrorMode
GetOEMCP
GetCPInfo
GetThreadLocale
SizeofResource
GetProcessVersion
GetLastError
SetLastError
WritePrivateProfileStringA
GlobalFlags
MulDiv
lstrcpynA
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
LoadLibraryA
FreeLibrary
GetVersion
lstrcatA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcpyA
GetModuleHandleA
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
GlobalUnlock
GlobalFree
LockResource
CloseHandle
GetModuleFileNameA
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
GetTickCount
LoadLibraryExW
FindResourceA
LoadResource
GetCurrentProcess
user32
GetNextDlgGroupItem
MessageBeep
InvalidateRect
CharUpperA
InflateRect
RegisterClipboardFormatA
PostThreadMessageA
SetFocus
AdjustWindowRectEx
ScreenToClient
GetClientRect
CopyRect
GetTopWindow
IsChild
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
DefWindowProcA
CreateWindowExA
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
SetRect
GetMessagePos
GetForegroundWindow
EndPaint
SetWindowLongA
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
MapDialogRect
SetWindowPos
GetWindow
SetWindowContextHelpId
EndDialog
DrawTextA
IsWindow
GetSystemMetrics
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
LoadIconA
SendMessageA
AppendMenuA
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DrawFocusRect
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
SetCursor
PostQuitMessage
CopyAcceleratorTableA
CharNextA
GetSysColorBrush
GetMessageTime
GrayStringA
PostMessageA
EnableWindow
DefDlgProcA
IsWindowUnicode
GetSystemMenu
BeginPaint
GetWindowDC
ReleaseDC
GetDC
PtInRect
GetClassNameA
ClientToScreen
GetDesktopWindow
LoadCursorA
DestroyMenu
LoadStringA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
GetSysColor
SetActiveWindow
TabbedTextOutA
UpdateWindow
SendDlgItemMessageA
SetForegroundWindow
MapWindowPoints
gdi32
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
IntersectClipRect
SetBkMode
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
CreateSolidBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextColor
GetBkColor
DPtoLP
LPtoDP
GetMapMode
PatBlt
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateDIBitmap
GetTextExtentPointA
BitBlt
CreateCompatibleDC
CreateBitmap
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
comctl32
ord17
oledlg
ord8
ole32
CoFreeUnusedLibraries
OleInitialize
CoTaskMemAlloc
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
OleUninitialize
olepro32
ord253
oleaut32
VariantTimeToSystemTime
SysAllocStringLen
SysFreeString
VariantCopy
VariantChangeType
SysAllocString
SysAllocStringByteLen
SysStringLen
VariantClear
Name
.text
Size
140KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=37, id=19, version=8022,
count=47, productName=Unmarked objects (old),
count=19, id=19, version=8034,
count=456, id=1, productName=Unmarked objects,
count=27, id=14, version=7299,
count=140, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=95, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
9b7f1f5676565f733fc5114f1e03458f9d9feaef6cd0319370ccc68e08eddf94.zip
- SHA256 9b7f1f5676565f733fc5114f1e03458f9d9feaef6cd0319370ccc68e08eddf94
- MD5 6976507f69eb5df839c360acf3418387
- SHA1 9b2e187cd225b730f9a2ee5b0f6241051e177c31
- SHA512 0ff06f07caa2197dbbadccacda2a8d34fb9bf9033458ba7fa227ea3f40451e2a2d09043efee9be29e04bebebf836f279b44e3b028f3c6c05e468209cdc55cbe2
- SSDEEP 3072:D07Hj2+K67V2IMNMyKOkGE/QmPnrykr69j8vlr0NUCOk3ZGi4oYLSIb2ibfyeVEc:AHqV673CxeBkj8vlYLOkJYo4VDuE
- TLSH T1D52423D40B7EB43E937A4DCFDC14982969FD5A48CBC190506E2D29184A1D7BCEB42B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
9bb6a76344a0906d9292209ede4ecb2b87bda68265397a1e854cf464e078ec5d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9bb6a76344a0906d9292209ede4ecb2b87bda68265397a1e854cf464e078ec5d
- MD5 c83d6249297ee11022914620794c6cdf
- SHA1 37c612196e6fcb0b5b9d491f5bce8ec9033c9810
- SHA512 37a0c43cb450841ae5eb7a2f8f0dc0d6c41d8c1e0eeec1d3f60bf1156f8521190155f9836a60128e2f4cbd41152de281796c820f655d1865bcabc47787fc3dc9
- SSDEEP 6144:cXKAPDk/BJIg4h1bUaDnzFcJF9vciqWDX0BuD3ZH6gqFVj/qC7yK/z/xzSPb:aPDkwg4BmF2ieuDpapvj5JFzS
- TLSH T16E84021B7ED86A63C7AE0BF986509100A3F9F516F153F786E8C4E5F21C4B7800956ACB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
402942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
386KB
Virtual Size
385KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
9d528e8db916612c2faf8740966a0a9f7f5b2f70e87eae53409cde09731f6f8f.exe
- IMPHASH eb97e4fc5518ac300a92a11673825e0b
- SHA256 9d528e8db916612c2faf8740966a0a9f7f5b2f70e87eae53409cde09731f6f8f
- MD5 761b30512424896e14ba3b5dce1f2d70
- SHA1 9ccaf2f43f807da7401e6965c986fd9f74551a0f
- SHA512 8678fc97055006bb5e706ec4fb0a87eeed10b079a0e5d04269bda12cb606448ecb22e483509a29a995a92eda991c1dd6bc1606e9a8637603e476cda0787e5b45
- SSDEEP 24576:mAHnh+eWsN3skA4RV1Hom2KXMmHa6u43UgMPh74w9NXohccOL5:Bh+ZkldoPK8Ya6XUgc8w4h1O
- TLSH T12F65CE0273D2C036FFABA2739B6AF24556BD78250133852F13981D79BD701B2267E663
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
163850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSACleanup
socket
inet_ntoa
setsockopt
ntohs
recvfrom
ioctlsocket
htons
WSAStartup
__WSAFDIsSet
select
accept
listen
bind
closesocket
WSAGetLastError
recv
sendto
send
inet_addr
gethostbyname
gethostname
connect
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetQueryDataAvailable
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetConnectW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
SetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
DeleteFileW
FindNextFileW
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
LoadLibraryW
VirtualAlloc
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentThread
CloseHandle
GetFullPathNameW
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
FindClose
SetEnvironmentVariableA
user32
AdjustWindowRectEx
CopyImage
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
SetRect
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
MonitorFromRect
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
PeekMessageW
UnregisterHotKey
CheckMenuRadioItem
CharLowerBuffW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
LoadImageW
GetClassNameW
gdi32
StrokePath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
GetDeviceCaps
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
DeleteDC
GetPixel
CreateDCW
GetStockObject
GetTextFaceW
CreateFontW
SetTextColor
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
StrokeAndFillPath
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
RegCreateKeyExW
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
AddAce
SetSecurityDescriptorDacl
GetUserNameW
InitiateSystemShutdownExW
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoSetProxyBlanket
CoCreateInstanceEx
CoInitializeSecurity
oleaut32
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
RegisterTypeLi
CreateStdDispatch
DispCallFunc
VariantChangeType
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
VariantCopy
VariantClear
OleLoadPicture
QueryPathOfRegTypeLi
RegisterTypeLibForUser
UnRegisterTypeLibForUser
UnRegisterTypeLi
CreateDispTypeInfo
SysAllocString
VariantInit
Name
.text
Size
568KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
605KB
Virtual Size
605KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
a07bc8319e27b10703b425c0d01d91d3c96b4c64f8de8840ae85a5fa8b82093e.img
- SHA256 a07bc8319e27b10703b425c0d01d91d3c96b4c64f8de8840ae85a5fa8b82093e
- MD5 a1b27ae0d55a63472c747359bed5e36c
- SHA1 27d5968fc10b55b734575b19fb21a2dbd4c994d6
- SHA512 75a787aab4372439862672469e5e00055396ca83746a4da0c84ddb1825731e8c535d5015eb66961bcc261ec89e881dbdff597a5cf60411053e18414bba7ed6a7
- SSDEEP 6144:2g5JHngTgeFAFOeFAs4g+bYKkxntG3l3TKZufqEBuRVfIf74WD0K8Uy8:RJgTgzFOz3hkxnQVOZ12Yuvb
- TLSH T10D557D3B6B856406D03D05B154A55691B673AACB3E02C74F39CFA3AC6F827CB370926D
- MD5 SHA1 SHA512 SSDEEP TLSH
a19a61fac499bbbcb7ca34fa6ce436fef7096dfcadba07eb60249c003a027e41.zip
- SHA256 a19a61fac499bbbcb7ca34fa6ce436fef7096dfcadba07eb60249c003a027e41
- MD5 f9c5b70fd1fb381995b7d296e10ca262
- SHA1 1f7bcab81ae3fc6f2d3358cfb195f1fe324b40bb
- SHA512 ed7e19626daf936a602c00a2d53f47f974ac4bdaa96cf1d4335e213fde012f6284af6f1ea5dcac1fc68a366ef156be6084c8e1ad4b3a054e06191b76ab36172d
- SSDEEP 6144:C4HMWTu0qZXLWlcvQcZ/ePA/sx1Us3iauRSnKISo8bGhc1KNQwGLYziOgyq9:CbUJSXLWyAPA/sjUHauRAShGhcUNhGEU
- TLSH T173742347EA37C23BD0AD485CA2F5EA90E4C3E32D4EF0D8B31F45068C69E586D965D2C6
- MD5 SHA1 SHA512 SSDEEP TLSH
a5738448758c46e7963c181e72795721c5fb1e5ac0d318326a46834eebb58bfa.iso
- SHA256 a5738448758c46e7963c181e72795721c5fb1e5ac0d318326a46834eebb58bfa
- MD5 06d24e3465d2171e613e93cf3a74770f
- SHA1 068d7555c674e2478951a9866a305e1de4153b99
- SHA512 8d2afacb5d1fe8d2fa10d35f83d003fd0fdbb6a1fc5339f887ca701798ddcca98c0d5a6340ff83d1411e32daf041c9d36bb9490cdf932971c3f3a33a307061b9
- SSDEEP 12288:09/U2oV1xRKhWIBBWn7/Dazp/+0oeiKA/kJ1XI6GuF9UJUbZedYsD7HsCNb:0e2eUBBWn7qN4e5MkfY/xdYKLs0
- TLSH T168556D23F2D14837D5732A388C1B9B59A92ABE103978AC457BF53D4C4F3A6817C352A7
- MD5 SHA1 SHA512 SSDEEP TLSH
a744e64bd387c4f4ef681744a8fd7d8ab024e3f6650302f24163fe506e92cccf.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a744e64bd387c4f4ef681744a8fd7d8ab024e3f6650302f24163fe506e92cccf
- MD5 cc65735b15a81c1070912c7f4e5455b1
- SHA1 7b28884f945790693d37ad2625337ae26a58dcc2
- SHA512 9172819283b1531e6f89d88540c5348e42c79621260859bcb8cdc3db40781e1779196d95b03b0ebbffa90f53309a509d53e68f4811fc3fd0403f575ceca9f9f1
- SSDEEP 6144:Gwg5JHngb+geFAFOeFAOBOAEpMUwSoa1X6lHMqhAmCRFDhEbziWlL+91mRJ:IJgygzFOzOlECmoa1X6dMqhA3RQiWx
- TLSH T1AEE46E3FAA456805E13C45B210A595A17276EAC73D01C74F39C9A7BCAF823CA371937D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
721806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
697KB
Virtual Size
696KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
afa54b391cbb8384d600ba564bce662efb0b9642bba62277f5e177563c1499e7.zip
- SHA256 afa54b391cbb8384d600ba564bce662efb0b9642bba62277f5e177563c1499e7
- MD5 a05152ab7844320752e3dbedbc8b02be
- SHA1 803322b899e2d31a3a717b28d474f27b784e498b
- SHA512 cff3073a556a318ed1ce59bdecb34f5628b9701bf6fc2e2b6fe1e63943cb32f68be5b808df607f31f25c588a3a7a63b2ea8326ada308ffb72efa60b54743e58c
- SSDEEP 6144:IOoqXMzKV/bn4tlkjaLGvOzkn0imQLhFa:tP0TkjaLoKkOEa
- TLSH T12E54236D7E5C6BF91937530237EE4054AD40A67339121A9872DFCEA38359317C2DD0AE
- MD5 SHA1 SHA512 SSDEEP TLSH
b36007e8275a822141b6dabf8cfba95a3833e5cd1cc4d8be6b61ad5ba32f065a.iso
- SHA256 b36007e8275a822141b6dabf8cfba95a3833e5cd1cc4d8be6b61ad5ba32f065a
- MD5 b5bb2f95993a05e4fb8fb3aaa2a6b8d4
- SHA1 233c1529d7093eec5517a79eed37d66500bb813e
- SHA512 4772ef2e533f8d4988851206881d56bea91671f1e5b10225ae9175d5c52257821ed8eb4a0fa9f364aa30be6800d463d3f2a8e28c0baf43bd3fa3986f2577237e
- SSDEEP 1536:KMwv4HY3j6jBB/8mnzr+kruojw3gL658N2D0ymJzcv:1wmYzIOmf3S8wwydv
- TLSH T121B4A21B7604D5EDCA0F89B0CE86D25C46237DB0AFE58042BECE778E0B3B1669965353
- MD5 SHA1 SHA512 SSDEEP TLSH
b89803afd7c2a43ed9ba1f3d7ff64d9fd22f5b48ddb6695ee153fa1b04fb8736.zip
- SHA256 b89803afd7c2a43ed9ba1f3d7ff64d9fd22f5b48ddb6695ee153fa1b04fb8736
- MD5 6f7e19af6eb288734954af67420f16ab
- SHA1 2cdf88023cc9b1d367587477eb2bc8430dd8fd89
- SHA512 de9f285102f5996e6e6ef48d324d2f74851850e90278e79c0184068d0b52c1b3ff2a18fdcfa2ac0572b20ab1c10b71405cebe5fe2a2ffd0084685cd33d3680c3
- SSDEEP 384:ar6AwoWALGpUUwfKbUHPe7lA5FHj4U+XBcfB7bSfDUOBrBrM:ar6Aw12GiZGKPZT2BABCrJM
- TLSH T10F92D1C324677C9BAE81A7C1664C7B758F3F427551E4E48BF72149B80ED2B64C923934
- MD5 SHA1 SHA512 SSDEEP TLSH
ba27536db363cf3a604908ecd21ca5b81b0b20e3f6f0447628b82e34240ae67a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ba27536db363cf3a604908ecd21ca5b81b0b20e3f6f0447628b82e34240ae67a
- MD5 53c913776131435ce8eae21dd0c84f1c
- SHA1 91c2be90d7617331ccec2309cd3868abf601f243
- SHA512 82ca7268a931349ce9118d05704095ff0917c66e23c7dcae7406f69930b90eb2c03b7d8026b22fefd8304acd9df27abdb5ef98e1bd2b8528985457f5888bbdac
- SSDEEP 12288:o0cBVK75KKeVciYT19f+yVIql2h8ycQkvANGRniAYuNVVKQUmEk5QHg:Dce9KKwhOAyVhqMoMnHY2VKQF56
- TLSH T15705BF3E7B188E91F7DA1632C0DB920897A4DC5126B3E71B7964336E0E31367BD069C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
607726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
585KB
Virtual Size
585KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
207KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
c1c48079d48701477eadebf62b9cfad53f71b72f2fb2f6e123e673e8d11b1a5b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c1c48079d48701477eadebf62b9cfad53f71b72f2fb2f6e123e673e8d11b1a5b
- MD5 0407c6398b69d986606bca0e236cccc2
- SHA1 8761d2bd4a0caa1385af736a227779fdefb88f3a
- SHA512 01e130a3acef81f8bd89c35592db5d59768ddbaebc3d731c3c0cae5d77c1189687320d5dfac3073ae56ee2d33ae4b344d92f6954f13a92b695b1f0a895df442f
- SSDEEP 12288:lm4oMkdURhK5Ei8Mn1R+jBoXXQlvM6duj/21WwM:npK5OML+0Xmv1qu1WP
- TLSH T12FC4CF570698462FDAFF0ABBC16C5540C7F5B157B693F78E899140BC0882F59ECC62A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
557046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
536KB
Virtual Size
535KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
c2aece4c0138a4ce56c8baa129b99e8740277795ac3c69e03d3a86cb7e629582.exe
- IMPHASH 7f2222d75bcebeb591b7d884c5b9299b
- SHA256 c2aece4c0138a4ce56c8baa129b99e8740277795ac3c69e03d3a86cb7e629582
- MD5 b65cec29eb931f36fdf68cce302616ca
- SHA1 6702cafc6aacdeeb628ffda538ee735b3e3f78e2
- SHA512 eafbbcfcb18a50d4fc09dc34278f848dbeb3515dcf75f9901dce87b6e50c58518cea0d9a53c4b433632c4bc0d90728c92b244accb6109660e1793ade53e1da9d
- SSDEEP 24576:1tb20pkaCqT5TBWgNQ7a32T2yCdYpDrDQ5eTrbIKssTFC7p431aJKnL7+rpRibny:mVg5tQ7a32TbCurDdTrAV7p4/H++I5
- TLSH T18875E12273DE8360C3B25273BA167701BE7F782506E5F56B2FD8093DB820562561EA73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
155508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
recv
send
setsockopt
ntohs
recvfrom
select
WSAStartup
htons
accept
listen
bind
closesocket
connect
WSACleanup
ioctlsocket
sendto
WSAGetLastError
inet_addr
gethostbyname
gethostname
socket
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetConnectW
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetCurrentThread
FindNextFileW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
CloseHandle
GetLastError
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
RaiseException
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateThread
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
DrawMenuBar
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
CopyImage
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
UnregisterHotKey
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
DeleteMenu
PeekMessageW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
CharLowerBuffW
GetWindowTextW
gdi32
SetPixel
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
GetDeviceCaps
CloseFigure
LineTo
AngleArc
CreateCompatibleBitmap
CreateCompatibleDC
MoveToEx
Ellipse
PolyDraw
BeginPath
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
EndPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAclInformation
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
InitiateSystemShutdownExW
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAce
GetAce
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
UnRegisterTypeLi
SafeArrayCreateVector
SysAllocString
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
VariantCopy
VariantClear
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
VariantChangeType
SafeArrayAllocDescriptorEx
VariantInit
Name
.text
Size
557KB
Virtual Size
557KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
824KB
Virtual Size
824KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
c2b78ccda6eddf0d522085cde769ed4baccf4ee43620b55980ca4abf21f54bbd.jar
- SHA256 c2b78ccda6eddf0d522085cde769ed4baccf4ee43620b55980ca4abf21f54bbd
- MD5 e95b919d444c230c99ab150c438810f6
- SHA1 d64422d07d51fe40a87ec735425732055887ff0d
- SHA512 ed30093bac5f8aecb2d92f01a919a6d48a366b228a344d1eae20ccbb02d62644384ecbae921dddf8d5363696c16535814e96e9fcd1b4868e8720e19c5659d327
- SSDEEP 12288:2W1CN1B5JF1Wp3CBxoViHR9gkn6MUDjNggGdauzBVbyNTk:2Wwx5j1WpAiCF6MUdgzxVIk
- TLSH T1F4B423F031AAA693E67FB478429D1CF2C47BD1D4CB46CD0846DC612514A38824B6EFEE
- MD5 SHA1 SHA512 SSDEEP TLSH
c2d42ef1435490d3bd280f0e1aaa0b42fe1d417e5364a000531a930c841f22f9.exe
- IMPHASH 7f2222d75bcebeb591b7d884c5b9299b
- SHA256 c2d42ef1435490d3bd280f0e1aaa0b42fe1d417e5364a000531a930c841f22f9
- MD5 0b7d26586342b5eee2f7bd0e5d9c40fc
- SHA1 204ea25f8d131c88b751aba5a4672a48692d324a
- SHA512 98d7568b59c922495cf91864eb60f3d93d1c9fec2d34ceea443469c8890d8d781614c9b8235ed830a93df4717459fe20210bad25ee0ddd2b46aa6973026ebf1d
- SSDEEP 24576:Dtb20pkaCqT5TBWgNQ7awxB1CdRVtYon4AS9HfmqMK5WKm5sJ6A:AVg5tQ7awxB1Cp7SWgWKme5
- TLSH T11F75E12273DDC361C3B25273BA167751BEBF782506A5F46B2FD8093DB920122521EA73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
155508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
recv
send
setsockopt
ntohs
recvfrom
select
WSAStartup
htons
accept
listen
bind
closesocket
connect
WSACleanup
ioctlsocket
sendto
WSAGetLastError
inet_addr
gethostbyname
gethostname
socket
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetConnectW
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetCurrentThread
FindNextFileW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
CloseHandle
GetLastError
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
RaiseException
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateThread
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
DrawMenuBar
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
CopyImage
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
UnregisterHotKey
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
DeleteMenu
PeekMessageW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
CharLowerBuffW
GetWindowTextW
gdi32
SetPixel
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
GetDeviceCaps
CloseFigure
LineTo
AngleArc
CreateCompatibleBitmap
CreateCompatibleDC
MoveToEx
Ellipse
PolyDraw
BeginPath
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
EndPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAclInformation
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
InitiateSystemShutdownExW
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAce
GetAce
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
UnRegisterTypeLi
SafeArrayCreateVector
SysAllocString
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
VariantCopy
VariantClear
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
VariantChangeType
SafeArrayAllocDescriptorEx
VariantInit
Name
.text
Size
557KB
Virtual Size
557KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
840KB
Virtual Size
839KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
c371004e8407621dcf815c95f130ef0bbfeec0dfcee1433800e56a9b247b8702.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c371004e8407621dcf815c95f130ef0bbfeec0dfcee1433800e56a9b247b8702
- MD5 e0ce90dcf297efc48a543d22f7d07c81
- SHA1 881f6b4e63cee3b94fbf33333f9b676e5b0f0701
- SHA512 480b85483a4a96b64dad652a119a3656cb22b5afdf72e3c9fa431d9a28a7351e08fb7c9b2567e736aa05d815eb1f48d15c8e6e75ae31e2aedcf81b12ba3064e5
- SSDEEP 12288:4Ulc2u9Og5Ed13rhQEmjXEarXGvWwueajxEao/lDZFO5cJ:TkOgGdhl0IaJwublEa43N
- TLSH T1CBE4C0281AE9981DF9FF8B7DE9A851518BF8B5633503FB6E59D012D90D33B80CD4122B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
666670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
643KB
Virtual Size
643KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
caac8878a9edaa3acccbfead8f029781de7f53d6bd446179fe55b17ac3f02ae1.jar
- SHA256 caac8878a9edaa3acccbfead8f029781de7f53d6bd446179fe55b17ac3f02ae1
- MD5 a36e0176cc90b6c668bf967f982b684f
- SHA1 79de521af4318ffbfdbbc2e99c5337d0f40e781d
- SHA512 17968a18f60fcf8d7eb2add1caea9c833dd640cb10a4bf24983aa563114fe15c5d84ad19392f4d7d4843416ffd09b1f541d3916a5fcc6acb22ea76104558fc62
- SSDEEP 12288:fUer8fKU1dz+XYq0496SNr3s/ucCe8h2msv2E3E:f1Qfpdztq049tFwucahrz2E
- TLSH T143B423E096CA1973D24EAB701A5BE07A310C86C867CCE315B9445CF6C5D98B329F4E9F
- MD5 SHA1 SHA512 SSDEEP TLSH
cdee0a7c17dd6a585a7c6781651c6c5a0b967cc3ed828cbbe604065f3663b5d4.7z
- SHA256 cdee0a7c17dd6a585a7c6781651c6c5a0b967cc3ed828cbbe604065f3663b5d4
- MD5 c8268d01ddb1aa8db101c2c2bd77a7a0
- SHA1 ffef85a51e2b72e059faaac368c5dbb5d4c65469
- SHA512 90bf897f31c59fd3b375cc896d00a612e76d8a9e5c8eeedeb13d0799acd38ed5b63684d4f0c8f468810ee4a564d8ab3008e2011aa39f514d6ca785fd49c88015
- SSDEEP 3072:Egi613bjcEnpa3GVqmD82bkYUuPPhWSfbHclhTv2k5eccdSWJBUH9wTvVf9bc723:bOEnpvVqmDZ9PxbHclh72Ge/XUW9lbcM
- TLSH T1900423C6188C07554732820365C7CAF36CFD4C95ACDEE6B6FA10BAE2176F0D9784989D
- MD5 SHA1 SHA512 SSDEEP TLSH
d184268bf1ee860b491b319eb7f96adcab1a9ea696ffb4c26449a60c33b7a9e3.doc
- SHA256 d184268bf1ee860b491b319eb7f96adcab1a9ea696ffb4c26449a60c33b7a9e3
- MD5 3df4759d030d0411223e88dec54f67ac
- SHA1 e1db6b0ac6321a48c7902888687fa0390f0e85ad
- SHA512 4a0fd2a1184434a11275d26a461ebf5a4269920e63af515fe9ad1e6063a2bcad47ca0f74150e4ae3fff68266c35e34acaa3eadbe400eefa7a277bca418281e48
- SSDEEP 3072:E4tHoUNnZFeHru5Y6+C4lvrKKUfC7q7Q7X9gv13o38:E4tpn7YTdCmofC7q7Q7XCv14M
- TLSH T1BDA369078D58DF83D0A887F47E130EACBB07271C998539EE05665ECFBE681521ED914E
- MD5 SHA1 SHA512 SSDEEP TLSH
ThisDocument
sda_csx
d247687e9bdb8c4189ac54d10efd29aee12ca2af78b94a693113f382619a175b.elf
- SHA256 d247687e9bdb8c4189ac54d10efd29aee12ca2af78b94a693113f382619a175b
- MD5 a71ad3167f9402d8c5388910862b16ae
- SHA1 42dc7206e1b10684b5a3a76251788c65460ad3a6
- SHA512 84d75a1a88983ac9e31987be2311c36287b670fc3e90b17aff4abc6bc2a490cfb3677260851ca40ecda70848e698b6f9b0c9dfff0ab65a7ce84da2b1740cf238
- SSDEEP 98304:fF0eXNNm/p9epaDRzLtZMWjvNnueZ8xD0/i:fFbXbm/p9epaDRzLvMWrNnuZ
- TLSH T1B1F6AF7EF85418D7D5BFE135CA92666537713862832277C74A60AAD30E23BB4FD2A304
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Kinsing payload
d3ea6307c607925c48b94aa06102187c9157527d70c69fb146c2904827a77162.exe
- SHA256 d3ea6307c607925c48b94aa06102187c9157527d70c69fb146c2904827a77162
- MD5 b163f86e0a052dc10597cbeae51de878
- SHA1 5659035fc298d484c37c06aa4cb816d254f201d7
- SHA512 2f38b3ea27913cfe33b0d26b5ec5bb4ba8ee839c64aabe939410b9579e683053066b039bd0717dc18e019553186b2c6d609b67b358f660af7c97053426b50015
- SSDEEP 12288:v9/U2oV1xRKhWIBBWn7/Dazp/+0oeiKA/kJ1XI6GuF9UJUbZedjsDZHsCNXs:ve2eUBBWn7qN4e5MkfY/xdjKRsYs
- TLSH T1B7056D23F2D14837D5732A388C1B9B59A92ABE103D78AC457BF53D4C4F3A68178352A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
637320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
618KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
d53863a442ba69cf7cc9011b3c51390b360b38d9b705ae41e0143d3e985d5309.zip
- SHA256 d53863a442ba69cf7cc9011b3c51390b360b38d9b705ae41e0143d3e985d5309
- MD5 276f81f60f006ff3ece1f91ec7d3ea9b
- SHA1 ffef828af2492a8550303f33219ff4fbd6ffbd92
- SHA512 90654de7b9cbfc4a02c06c5e3f583a783de8bf883efb0aebe2b49f36f1ff95fe2ecff2131d74b05214a1b9163b335d5509d068a9b0458757b0ee8b34c2d9b37e
- SSDEEP 384:ar6AwoWALGpUUwfKbUHPe7lA5FHj4U+XBcfB7bSfDUOBrBru:ar6Aw12GiZGKPZT2BABCrJu
- TLSH T11C92D1C324677C9BAE8197C5564C7FB68F2F417451E4E48BF72249B80ED2B64C923934
- MD5 SHA1 SHA512 SSDEEP TLSH
d53e1cc243a49cf35101c2fa4b837949450d7c6655c999f82a2491c421fb9ee0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d53e1cc243a49cf35101c2fa4b837949450d7c6655c999f82a2491c421fb9ee0
- MD5 24673822b56de4a29247ff0bce18da81
- SHA1 4a974b38a8336bf72f0d631f6e96729d09ac1b33
- SHA512 5a432eb59a275466e0fc8e2c3a7d910479b85c3f75b8824e6fda261414e6b951d1e9ce688322376ce6bc35edc1413b795dfbac83843fbb42ef28b5cc1c98d270
- SSDEEP 12288:CyHocZgAkMKSbUZbVpt81I5PpX1ILVbuHlLd5VN5cJNy:CyIVAPgZb3cSPpqVbdI
- TLSH T1FEE4CF2855F8A91DF9BF5B78E9B821648BF8BA733203F76E55D002990D33B41CD81276
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
670350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
647KB
Virtual Size
646KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
d67935690a5b19212da2674c83b4154bceda5324dd65f7c5986fd9cf29eea572.zip
- SHA256 d67935690a5b19212da2674c83b4154bceda5324dd65f7c5986fd9cf29eea572
- MD5 42f754bf529ec170bb99f52030452082
- SHA1 27f9ce69e0e39f0fa71edbfb165895a7f182e929
- SHA512 3e4d1cc93c29672b1866e4a3df3981422872404e762a21469b5fbf0977ec995cb7b554ccaabdb0f3d1e557d2ca88d58aa583b2a5a22e0518443f1b04a680d416
- SSDEEP 12288:LxwvnVKGfI4CzmufmmpTvRPc/EaC0443M+:LavPI7au5RPcw43n
- TLSH T164A43301488DDBA6E61CAB561A32F7D4FB59C1E42C55DF02608FE5A4123FD708B3DCA5
- MD5 SHA1 SHA512 SSDEEP TLSH
d709aab9b049d7b936c554f5a1d640af0ce17e3ae3fdd7323cfa286718d609e4.zip
- SHA256 d709aab9b049d7b936c554f5a1d640af0ce17e3ae3fdd7323cfa286718d609e4
- MD5 7cffb5b96c7700c96356126f9650e764
- SHA1 5fdc8b365e408155a10533c5937bec77f2a208a4
- SHA512 6887a01fd377dcfa3d07e28438e218225804e687bd1cacefa002df2e1f1993e4b566b142a3e794cfd4d3270bccb95bdd91ca52223a7dfc781e7242b3b562b859
- SSDEEP 12288:yaZv8P2CN9pKDkFM2PlxHk0S3xyRbJoqp:yaZEpNvEkFR99KyRbNp
- TLSH T1C2B433AC57D4ADF3F5DB8AA9C08D08D9AFB7124F64148034286BA5FC93D40E6F1B5067
- MD5 SHA1 SHA512 SSDEEP TLSH
d7d3cc14120ca37b33e14b0d8c34298133edee7b7535756cc78f79e121591b1f.exe
- IMPHASH eb97e4fc5518ac300a92a11673825e0b
- SHA256 d7d3cc14120ca37b33e14b0d8c34298133edee7b7535756cc78f79e121591b1f
- MD5 68b33595735545c82e96f5e3c968e69e
- SHA1 e79d58fd07b7e6b6e6a24f03c60bd453a59ad2e2
- SHA512 a45ebdf2ea8525ef9c0fe0ecb32aec0df3533fe5452ae97f8b87587e9dcaba0e082316daacd56c481ce23e80ac47eb648eb7fc4f5961acc4610d03aff3cc7294
- SSDEEP 24576:mAHnh+eWsN3skA4RV1Hom2KXMmHa7j3ScoP03bH26hVrOVY5RUsQTY7Ru5:Bh+ZkldoPK8Ya7j3ScqyO2bIT+y
- TLSH T17F85DF0263D2C032FFAB92739B6AF6455ABCBD254133852F13981D79BD701B2167E263
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
163850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
WSACleanup
socket
inet_ntoa
setsockopt
ntohs
recvfrom
ioctlsocket
htons
WSAStartup
__WSAFDIsSet
select
accept
listen
bind
closesocket
WSAGetLastError
recv
sendto
send
inet_addr
gethostbyname
gethostname
connect
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetQueryDataAvailable
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetConnectW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
SetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
DeleteFileW
FindNextFileW
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
LoadLibraryW
VirtualAlloc
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentThread
CloseHandle
GetFullPathNameW
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
FindClose
SetEnvironmentVariableA
user32
AdjustWindowRectEx
CopyImage
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
SetRect
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
MonitorFromRect
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
PeekMessageW
UnregisterHotKey
CheckMenuRadioItem
CharLowerBuffW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
LoadImageW
GetClassNameW
gdi32
StrokePath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
GetDeviceCaps
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
DeleteDC
GetPixel
CreateDCW
GetStockObject
GetTextFaceW
CreateFontW
SetTextColor
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
StrokeAndFillPath
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
RegCreateKeyExW
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
AddAce
SetSecurityDescriptorDacl
GetUserNameW
InitiateSystemShutdownExW
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoSetProxyBlanket
CoCreateInstanceEx
CoInitializeSecurity
oleaut32
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
RegisterTypeLi
CreateStdDispatch
DispCallFunc
VariantChangeType
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
VariantCopy
VariantClear
OleLoadPicture
QueryPathOfRegTypeLi
RegisterTypeLibForUser
UnRegisterTypeLibForUser
UnRegisterTypeLi
CreateDispTypeInfo
SysAllocString
VariantInit
Name
.text
Size
568KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
887KB
Virtual Size
887KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
d85fd6f691e44f6dd37f4a89a821ef9b3a73664bc72a1ed7fa9223978dbf09e9.exe
- SHA256 d85fd6f691e44f6dd37f4a89a821ef9b3a73664bc72a1ed7fa9223978dbf09e9
- MD5 38bf2d40f2d35ab56e3a5f28398ad179
- SHA1 1a10eb97a9974c9359b77457b4a45bf5b90d4505
- SHA512 c7addf3244eba6c49768cad24e06e1a03cd0168a74db163bf78a84e65afe2e7546d03bcbbf429c36d4909442c59a7ad39b5e8ca98d42a1ac0d02b7461d66f599
- SSDEEP 12288:v9/U2oV1xRKhWIBBWn7/Dazp/+0oeiKA/kJ1XI6GuF9UJUbZedYsD7HsCNbs:ve2eUBBWn7qN4e5MkfY/xdYKLs0s
- TLSH T1B6056D23F2D14837D5732A388C1B9B59A92ABE103D78AC457BF53D4C4F3A68178352A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
637320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
618KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
da43ed194729f82db68b1d91a17cea6afde8ae81357116c35c4c129888a836bf.elf
- SHA256 da43ed194729f82db68b1d91a17cea6afde8ae81357116c35c4c129888a836bf
- MD5 4206dbcf1c2bc80ea95ad64043aa024a
- SHA1 d2bf643b0641ce6d19d9ec79e3de27e04d66d739
- SHA512 0ed0687b8731580b781f124b70e7ea7e1b23b24385b01ff48cfefc0c12b90efed3013df10ecb79a26998535bed2e4b46c482ebcfce92b66d819c042ddf2941d4
- SSDEEP 12288:Gu6iwLf0hFYgXY8Ly4UrrT/yXkl0ocAwRTVgSryleSKuY:Gu6FLgFYeLy9rX6XkyxTVglU
- TLSH T116054B5AB2F370FCD163C031079FDB66693AB47A02216EBB2184E5353D52EA01F19B67
- MD5 SHA1 SHA512 SSDEEP TLSH
dc2ade935288f5f4da5bf02568606500b3084531de864cdff19915e78bbec1aa.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dc2ade935288f5f4da5bf02568606500b3084531de864cdff19915e78bbec1aa
- MD5 b88d3763d805703f950052e40bbb4ac2
- SHA1 a58de67c93b6500e3b5fb0c05cbced4440e5fd75
- SHA512 b5868f15249ef93a10f414884186586f3c17520509b163a3af0f200e5f936b1e4dcef8107d96022e763f7d50167e33707a01c66b067c02d638691179e04a3638
- SSDEEP 12288:+NiBx56BMvgf5KL3UnyyMGBXdUcDPN1jMnKmqzKoLaFwFx2eE:fLuYiUgN1Nmq+Tw/2eE
- TLSH T17794F183B66A7B23D67E83FCA0A6211007F5B483B357D3592FE540F91C62FD4152A98B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
424318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
406KB
Virtual Size
406KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ddbe4689702130a4dc5d5133c517f466a47e003b645326c7dded00247bde315f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ddbe4689702130a4dc5d5133c517f466a47e003b645326c7dded00247bde315f
- MD5 af63453dc99f38dfdf6653c0a196e438
- SHA1 6843ccfa502f38076ef542f7b9576d9c56927e22
- SHA512 9c4d9a8d4dda33d068daf80c84491d37bf08a38f9c6754e39eebd7774e2ec071b9ab42adc90fff9e2cfd0806284ab7b4bd15f69e9b4db49ac2d41c0d7430feb9
- SSDEEP 12288:vDheLQWiuCrf/v7Os+ecLh9mUEdce89JcR5+GPxkOJBVGweUclw9fivHFDL5Tyui:0LQWiuCrf/v7Os+ecLh9mUEJ8Xc35xd3
- TLSH T158D4CF2856EA9A1DF9FF4B78DAE82111CBF8F6633603FB5D459011990D33B41CE4226B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
648190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
625KB
Virtual Size
625KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e138a95285847be1c2423f2d4f11d62541840025ed7ba1c9dd444978bcb15abc.iso
- SHA256 e138a95285847be1c2423f2d4f11d62541840025ed7ba1c9dd444978bcb15abc
- MD5 114bd8a88dab2c987bc7a919e86338bb
- SHA1 65a00911c1a7c604d244275d470924393adab1ce
- SHA512 089267f03f99c6c2a268f4d879306c8e808b805141fbbaf0805f451e191574c7d2ec808504bada23efa40d3a794dd9a5bc290a661ccf73ac0b162e603c7b78dd
- SSDEEP 12288:89/U2oV1xRKhWIBBWn7/Dazp/+0oeiKA/kJ1XI6GuF9UJUbZedjsDZHsCNX:8e2eUBBWn7qN4e5MkfY/xdjKRsY
- TLSH T117556D23F2D14837D5732A388C1B9B59A92ABE103978AC457BF53D4C4F3A6817C352A7
- MD5 SHA1 SHA512 SSDEEP TLSH
e4e33b67a18d6278dfddf3b4f0599fd37793d5997434be028510592ef1849b0e.gz
- SHA256 e4e33b67a18d6278dfddf3b4f0599fd37793d5997434be028510592ef1849b0e
- MD5 01022e7f8e09a8f9341e74fea434c3d3
- SHA1 c3a078320a03c11961aaf8d08dfd26a30d679dc9
- SHA512 3991d766fde78ba308352553b4c5abc1714d03a02a453327f7b6f8c56226b1c032d77ea7e7fd95909e0645b07a258a5d930830b1f07dcc8e86caaca39559b799
- SSDEEP 12288:rKklCGXYREZPhrHNQSKgcgS/Pnr2UL9eYZrtu39Ecv:W32YyZPhrtQfg0/PyUL06r4mq
- TLSH T1B3A423E1E14EA96BA92BC4066BE864FE8DDC1374101953953AF7C4088199D1C3F2E7FD
- MD5 SHA1 SHA512 SSDEEP TLSH
e9e5209ff937e49e34e4c17419aad97b3931cd189a7f28333385c6fe9eef561b.exe
- IMPHASH cb20163e28e6ea8fab2ca5e66992cb61
- SHA256 e9e5209ff937e49e34e4c17419aad97b3931cd189a7f28333385c6fe9eef561b
- MD5 46cd6b5771442308a5211038e3721f8c
- SHA1 607a475d11191d269d89c4175fe6871149258028
- SHA512 56b09461e22de6b52d46e6e0217093882bb62f8dcdf6af2d232a8e10a9731931f4bc51f23811010658ec3f441465939067a45004edd6abb939f3671ee29e0bd5
- SSDEEP 6144:nuYjzcrl7TTFAk9mWvBwJ+1kyUbasEBzbcqGwdqPuGm0:nuYgTFBgMKQkp4XcqZ1
- TLSH T189646B127FA08A7AC3E329364F938F7962B9BC514E3197832342270DDE755A1C72375A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
97458
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetCommandLineA
ExitProcess
TerminateProcess
HeapReAlloc
HeapSize
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
VirtualAlloc
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
VirtualProtect
HeapFree
HeapAlloc
RtlUnwind
GetTickCount
GetFileTime
GetFileAttributesA
FileTimeToLocalFileTime
SetErrorMode
FileTimeToSystemTime
GetOEMCP
GetCPInfo
CreateFileA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
LeaveCriticalSection
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GlobalFlags
InterlockedIncrement
WritePrivateProfileStringA
GlobalReAlloc
InterlockedDecrement
SetLastError
MulDiv
FormatMessageA
LocalFree
GlobalGetAtomNameA
GlobalFindAtomA
lstrcatA
lstrcmpW
lstrcpynA
GlobalUnlock
GlobalFree
FreeResource
CloseHandle
GlobalAddAtomA
GetCurrentThread
GetCurrentThreadId
GlobalLock
GlobalAlloc
FreeLibrary
GlobalDeleteAtom
lstrcmpA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
LoadLibraryA
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
GetLastError
MultiByteToWideChar
LoadLibraryExW
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
FreeEnvironmentStringsW
InterlockedExchange
user32
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetSysColor
DestroyMenu
EqualRect
GetClassInfoA
RegisterClassA
UnregisterClassA
EndPaint
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
OffsetRect
IntersectRect
SendMessageA
DrawIcon
AppendMenuA
GetSystemMenu
IsIconic
GetClientRect
EnableWindow
LoadIconA
GetSystemMetrics
InvalidateRect
IsWindow
CharUpperA
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetNextDlgTabItem
wsprintfA
TabbedTextOutA
DrawTextA
DrawTextExA
EndDialog
SetMenuItemBitmaps
GetFocus
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
GetMessageA
ClientToScreen
GetDC
ReleaseDC
GetWindowDC
AdjustWindowRectEx
BeginPaint
PostMessageA
PostQuitMessage
SetCursor
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetParent
MessageBoxA
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
SetCapture
LoadCursorA
ReleaseCapture
GetSysColorBrush
PostThreadMessageA
RegisterClipboardFormatA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
SetRect
IsRectEmpty
CharNextA
GrayStringA
gdi32
DeleteDC
GetStockObject
CreateRectRgnIndirect
ExtSelectClipRgn
GetTextColor
GetRgnBox
GetMapMode
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetBkColor
CreateBitmap
DeleteObject
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
GetDeviceCaps
GetObjectA
SetBkColor
SetTextColor
GetClipBox
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
advapi32
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
comctl32
ord17
ImageList_Destroy
shlwapi
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA
oledlg
ord8
ole32
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
oleaut32
VariantCopy
SysAllocString
SafeArrayDestroy
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocStringByteLen
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysFreeString
odbc32
ord51
ord50
ord45
ord44
ord68
ord43
ord59
ord13
ord18
ord46
ord12
ord19
ord11
ord49
ord48
ord8
ord20
ord16
ord3
ord14
ord9
ord15
ord1
ord2
ord10
ord41
ord17
ord5
Name
.text
Size
200KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9111,
count=10, id=95, version=2179,
count=6, id=25, version=9210,
count=2, id=93, version=2067,
count=17, id=93, version=2179,
count=593, id=1, productName=Unmarked objects,
count=28, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=142, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=9, id=39, version=8491,
count=127, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
ec1535aa485bec3fd330957474638a47369a59ad2b7775ca74639ce4eb0c018c.elf
- SHA256 ec1535aa485bec3fd330957474638a47369a59ad2b7775ca74639ce4eb0c018c
- MD5 631211efab55a704c7d61b141d082f11
- SHA1 65847414353fc8c95f8490a4d56acc6ce87197d6
- SHA512 5366b4a0c9bd97dd5d5521ae1d221cc9c8b722b4e4c43aae95ef8377ebf7024376e2ea3f0d52dd1d059184713e56e21ea2c632e6c2de2720d9a1d991e9ebdf7c
- SSDEEP 12288:ZEVNLkFIG4h7nh1UVry06Csaw/gPPoptMCYoM+2xAWhHYf5qyBgpsc5Y77Jlfax2:ZpaBh7nhE6CsFoPQptcZlh4X4LY77Jl1
- TLSH T1ECE49E99E386E9E1E17300B1135ECBF20630A6366053D6F7FB85B65A74727222F06376
- MD5 SHA1 SHA512 SSDEEP TLSH
ec7b29b432de2e8473a82ad32f6a12a608848ccc50a49ce67dad1d0fc3850c26.jar
- SHA256 ec7b29b432de2e8473a82ad32f6a12a608848ccc50a49ce67dad1d0fc3850c26
- MD5 146cdf0485b6cc3269a5144502362f09
- SHA1 1f5bd528dffa479a29f1fa200d4fd959e6bd1fb2
- SHA512 e0395ef0aec91de347ceb0c2a02b37b91e0f8b2295a2287a7e6b03e1440b713d7c59efe228ae09de71667ee8bdbed7a59c5d3ef24838d559b86c0cdbfc3e0ffd
- SSDEEP 12288:HmtYpmaYSHoA/cWWwq2d7E+COBfZJVHCr2m+L5:q/aYSIccObFE+CihCro5
- TLSH T1B8C423976B0A05F6CFEBA8F1C22DF7F363509850AA76DC5160A394A14F90F943B05CE9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned JAR
Checks for missing JAR codesign signature.
eec9b14da6a2745f089361002429d13b044d66dedf944e951b39f9d243ae3df9.doc
- SHA256 eec9b14da6a2745f089361002429d13b044d66dedf944e951b39f9d243ae3df9
- MD5 54f778369ad36cb51d021c58168473e4
- SHA1 cc0010c2fa3e2e36e927df9e3cb067cf2a3fca5c
- SHA512 76ad89da246a7ec784714c6b80ae78f9ea5e129f586640db43a78fb6f95637e826e9fc7401f4e3953fe1154cf5662bc558b69bc0da5f20c2b09c5f3c4b3c6a89
- SSDEEP 1536:Hshhu0VhfTurb6ci0VhfTurb6ci0VhfTurb6ci0VhfTurb6ci0VhfTurb6cJv:H2144440v
- TLSH T12BC4007850CE04B6F78B50303EEDBBBC00B2F5878BDAAD6013A9D1355BB6BD6691584C
- MD5 SHA1 SHA512 SSDEEP TLSH
eed50aaa25fe237cf2fac39728afe3112f0bc09d6dd6fab8e27469409a83806e.exe
- IMPHASH 7f2222d75bcebeb591b7d884c5b9299b
- SHA256 eed50aaa25fe237cf2fac39728afe3112f0bc09d6dd6fab8e27469409a83806e
- MD5 f3a6e840926fb89b9603c1a2358e82bb
- SHA1 7292aecc0f1350c55e5d6c2323fd8b8b0446eff3
- SHA512 29ccc0c78fd27abc22824fbf2fe1c41f17076c597e6d55987238f11bcad2b8588d8b1bf05808580aad5829fc6327461f9e5932ee9afe55f996a0cd8e1aee5dcf
- SSDEEP 49152:TVg5tQ7aIMAw+zsoyZkgZ4Oj4Tp4opx/r5:Jg56Qf+Io6kbOj4TpLpx
- TLSH T1F375E12373DE8361C7725273BA15B711BEBB782506B1F86B2FD4093DF820162525EA63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
155508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
recv
send
setsockopt
ntohs
recvfrom
select
WSAStartup
htons
accept
listen
bind
closesocket
connect
WSACleanup
ioctlsocket
sendto
WSAGetLastError
inet_addr
gethostbyname
gethostname
socket
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetConnectW
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetCurrentThread
FindNextFileW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
CloseHandle
GetLastError
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
RaiseException
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateThread
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
DrawMenuBar
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
CopyImage
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
UnregisterHotKey
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
DeleteMenu
PeekMessageW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
CharLowerBuffW
GetWindowTextW
gdi32
SetPixel
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
GetDeviceCaps
CloseFigure
LineTo
AngleArc
CreateCompatibleBitmap
CreateCompatibleDC
MoveToEx
Ellipse
PolyDraw
BeginPath
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
EndPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAclInformation
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
InitiateSystemShutdownExW
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAce
GetAce
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
UnRegisterTypeLi
SafeArrayCreateVector
SysAllocString
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
VariantCopy
VariantClear
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
VariantChangeType
SafeArrayAllocDescriptorEx
VariantInit
Name
.text
Size
557KB
Virtual Size
557KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
843KB
Virtual Size
842KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
eeebfcd5e9663d396806c5c355c67f96a04a80d45168cd4d28f6642044a3dc6b.zip
- SHA256 eeebfcd5e9663d396806c5c355c67f96a04a80d45168cd4d28f6642044a3dc6b
- MD5 3d6f6206075146bf6f654d4e0d9fab5a
- SHA1 023323d7ce3ab49797b57db3c7baa19ff9e4c80f
- SHA512 edb7c1dc0bb5e1b44ae03c091514aad7af3623f1389b2506fcd1db0a015a360444d6831a7ee21f46539004935cdaf1cd549c945ca04bf98420064d7b583d5c0b
- SSDEEP 6144:x1vQQp9npJ0nK9JhAZ50yLMIKQpTV+yVeIql5Mb8HMC6LSRISuoezVY/AFMNm:LpfJesjAcyLH8y0PlqbUMLLSgo8Y4Fx
- TLSH T1247423C8FD689A1CEAED3CE2288D944C4977738051DF93DC773E67629542788A2C5A33
- MD5 SHA1 SHA512 SSDEEP TLSH
f117245eaab9a6b6d5b35cf2c8be03e3b4411b7194291649d676d43037fd7626.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f117245eaab9a6b6d5b35cf2c8be03e3b4411b7194291649d676d43037fd7626
- MD5 e005a0a91d66a7686e28b59d3ab9e72a
- SHA1 894d84bd4e1a1787112cca9c987b8820dae9454d
- SHA512 bc10993d4578423596801b278c511a365452d3ace5493a9f01ba7ae29765e5bc6674918a43e72bf60223a5b0f5800ebc4db2e84d2bf7d0413b22086879a9c45a
- SSDEEP 12288:LNiBx56BMvgcr15HECu2e/K4zD0sr2y3r+mcXu:m15HECu2e/trd3qmau
- TLSH T11194F106A22A3B96D77FC3FDB162210047F5E4A27296E79A7FE140F50C62FD40525ACB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
419550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
402KB
Virtual Size
401KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f1a2cb04bdeeb63eebeeaad98ba4a91b193b0a5a806e43ee25747001983dbc09.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f1a2cb04bdeeb63eebeeaad98ba4a91b193b0a5a806e43ee25747001983dbc09
- MD5 dfcea995a1ac9d2e779f37b667840041
- SHA1 e5e28daeb5438c6f3f41526d3779126f98d68712
- SHA512 c07f5839a2bab4e88608ee19666c92c3bf1274827b5d2a57019265fac5074f93b07a4a411bf24c6f15addb6181b6d9838ccace06a590135beb148ae2ec52b26c
- SSDEEP 6144:4NiBx56TIAMvglSIk6xeBMj8vleLOkJ1uSX7Cg0:4NiBx56BMvgwl6xaMjbCkjB
- TLSH T1AB44DF96B639BF26C33E47FDA164600043F5B492B282D39A3FE501F61D26FE84512D8B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
280014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
265KB
Virtual Size
265KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f24fdcaaebc99149ac1285ccb56b24bd839a5fe524084b02e43d59d341278fb0.zip
- SHA256 f24fdcaaebc99149ac1285ccb56b24bd839a5fe524084b02e43d59d341278fb0
- MD5 b4fb6eb6c5eb5472e1614110738858d4
- SHA1 3223734ac928a788a767210de87af45a7e94bf58
- SHA512 d4d8bfc3fc8af4b08511dbb38731b03b0fbbcf6ee20da6e091febac6fad533ac5dfb47218d3a7f5670358a6e8a44d8cbf0032ac10c17f04d4a1914ce22d65574
- SSDEEP 384:2pEWm06cjAQazNRwKuY3jrTLOMP5N9LtNihY8McuCKnCXUkKPPT44CVuD4RVXmdb:VWm0lUZRwKn3jrTLOo5NdH8McuCKns1k
- TLSH T163B2D015673A4E31B573F38410CDE5ABE8ADF954329D425A6A98C7AB0A07A334C22F84
- MD5 SHA1 SHA512 SSDEEP TLSH
f5b6264a5adebb665f4d89cdeba64f5506421b04086da17c5928171ae0e8f435.r00
- SHA256 f5b6264a5adebb665f4d89cdeba64f5506421b04086da17c5928171ae0e8f435
- MD5 6df9a589d7b1b8a769b49179ef7f75e4
- SHA1 dc3ee1a0d36d6c063e22da1c32a1c1f6fda4b04b
- SHA512 efc5d952196b53add65f6bff8dd08bdb0b08e340b3f4c5a4d3feddd2a46d07511bcbcfa5e67d248664aba13e8a05d727440dced7f7892b670c8e7e26460a1df3
- SSDEEP 24576:6KqzTUvLNu0Ic6YrSIG2PfvtGfoyuOy3MdpDX4CLmF:izITLpr15MLLmF
- TLSH T1D84533AC9C93EA05BBC33596443CE598BFC46762148F96D2E8F8AC9B5739CD2014D39C
- MD5 SHA1 SHA512 SSDEEP TLSH
fbae0ff635e7b7cb7646fded915f70803f4c564348b77bf2c6d9809c4353e9a6.exe
- IMPHASH a62443d8e361af507b0d22251125bbfd
- SHA256 fbae0ff635e7b7cb7646fded915f70803f4c564348b77bf2c6d9809c4353e9a6
- MD5 96c31f972f7dff2632aeb270268c2011
- SHA1 20ba389bdd0cf117c64b20e8486f1158959654bc
- SHA512 70bb0a1ecc107302fe99047d5012de43cf66dec7011726bf03056eae25f5b2589cdeaca06bc1b7aa20ba9aa442bba20c5db1a61068025e80c38c73b0f6e679fd
- SSDEEP 1536:rMwv4HY3j6jBB/8mnzr+kruojw3gL658N2D0ymJzcv:QwmYzIOmf3S8wwydv
- TLSH T14CA4B41B7604D5FECA0F89B1CE86D35C46237DB0AFD58043BEC6778E0B3A5269969243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5084
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
_CIcos
_adj_fptan
__vbaFreeVar
__vbaStrVarMove
ord589
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
ord514
_adj_fprem1
__vbaStrCat
__vbaHresultCheckObj
ord557
_adj_fdiv_m32
ord666
ord669
ord591
__vbaBoolStr
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaChkstk
ord526
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
ord561
ord562
ord673
_adj_fpatan
__vbaR4Var
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
_adj_fprem
_adj_fdivr_m64
ord714
ord530
__vbaFPException
ord717
ord538
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
ord689
ord610
__vbaVarDup
ord613
_CIatan
__vbaStrMove
__vbaUI1Str
ord543
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
Name
.text
Size
72KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
364KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=7, id=9, version=8783,
count=1, id=13, version=9782,
fed28e2344db756d6233bbadd95487f1b1cc060ae195ab20647ddd508dcb656b.zip
- SHA256 fed28e2344db756d6233bbadd95487f1b1cc060ae195ab20647ddd508dcb656b
- MD5 e6afbabb16aed7512a41c4f8c0bd8fa3
- SHA1 c65ef34e9e95eb3dfb3ddb64d551233aa900b007
- SHA512 c84aa04efdfa27ff401e3d9c2952ae81d0f7401da2cf124e3ce429d103e04fb5f9ebefd3e742b256572e5e9b741e15ac077111e947c754cceff40304b38cd2d6
- SSDEEP 384:kr6AwoWALGpUUwfKbUHPe7lA5FHj4U+XBcfB7bSfDUOBrBrdC:kr6Aw12GiZGKPZT2BABCrJdC
- TLSH T1E792D0C324677C9BAE8197C15A4C7B768F3E817451E4E48BF72289B80DD2F64C923934
- MD5 SHA1 SHA512 SSDEEP TLSH
fef351d237d3cd331330624de2476bc9cf4aea538177800ac16521d0e9da3baf.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fef351d237d3cd331330624de2476bc9cf4aea538177800ac16521d0e9da3baf
- MD5 47e7783e10cb51b92e6b547f3830314f
- SHA1 cebfdaae20b92a47f3c65e4ff8e62fb1d61a4bed
- SHA512 f0e1e281862c25ed87365d5e7ba08257ed57a758bc0bf86d14e6dc2778d6f6de9dfa10cd04df33c5c295f8aed4c091e035464df7743435a52e3c33c761f6a366
- SSDEEP 6144:sg5JHngrgeFAFOeFAlazd5TqJzLBErQVojt/lVDoZc7alXP7DX2CBk/K:LJgrgzFOzIzd5kBErOojt/lq+7a97D0C
- TLSH T146E4AC2776959019D44C47F0182AC9E6BA37BF8A3D444A9E708BF32D2FF339A671421D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
2e:90:f6:b4:a0:be:a3:4c:8e:9a:3e:d6:35:f5:19:43:67:74:53:eb:86:02:8e:93:ca:e3:cc:c2:d4:0a:90:52
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=3910805,CN=Comodo Security Solutions\, Inc.,O=Comodo Security Solutions\, Inc.,POSTALCODE=07013,STREET=1255 Broad St,L=Clifton,ST=NJ,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Feb 6, 2020
SERIALNUMBER=3910805,CN=Comodo Security Solutions\, Inc.,O=Comodo Security Solutions\, Inc.,POSTALCODE=07013,STREET=1255 Broad St,L=Clifton,ST=NJ,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=3910805,CN=Comodo Security Solutions\, Inc.,O=Comodo Security Solutions\, Inc.,POSTALCODE=07013,STREET=1255 Broad St,L=Clifton,ST=NJ,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
1b:42:7b:06:0e:28:66:bf:b5:86:cc:26:7e:1c:3e:aa
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 4, 2018 - Dec 3, 2021
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
487518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
468KB
Virtual Size
468KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
196KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ