paid_clumsy.zip
- SHA256 5c265a825bb94453ffdd98b352d635465e5fc159b75beb9852c5a20d65715be6
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
paid_clumsy/paid clumsy/Paid Clumsy/WinDivert.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
paid_clumsy/paid clumsy/Paid Clumsy/WinDivert.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
paid_clumsy/paid clumsy/Paid Clumsy/WinDivert64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
paid_clumsy/paid clumsy/Paid Clumsy/WinDivert64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
paid_clumsy/paid clumsy/Paid Clumsy/clumsy.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
paid_clumsy/paid clumsy/Paid Clumsy/clumsy.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target paid_clumsy.zip
- Size 423KB
- Sample260811-vschksxdpc
- SHA256 5c265a825bb94453ffdd98b352d635465e5fc159b75beb9852c5a20d65715be6
- MD5 a450c0b1c78e572921aac4189f2d6786
- SHA1 4214f7cdf6ad8a5ebd470d11ac518d25fa40dafc
- SHA512 d29c401066a152abf0e9c21740cb3a930deab567b9f2b33f928bb998ad23bb1e7d1f7aa8e57b22e815b557993afbc55e34a264a2fc6dddd65dd4297f781b075d
- SSDEEP 12288:A14wKYHhZSSVLKB1fB9u51JHvzskHsOCr:y4wKYBZ2B1psbJPHE
- TLSH T154942332DCFAD3AF928AB7F9215B0B90D7B0B1935DE38812D12642656069F9113631FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/paid_clumsy/paid clumsy/Paid Clumsy/WinDivert.dll unpack001/paid_clumsy/paid clumsy/Paid Clumsy/clumsy.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/paid_clumsy/paid clumsy/Paid Clumsy/WinDivert64.sys
File Explorer
-
paid_clumsy.zip.zip 423KB
-
paid_clumsy/paid clumsy/Paid Clumsy/Screen.ahk176B
-
paid_clumsy/paid clumsy/Paid Clumsy/WinDivert.dll.dll 15KB
-
paid_clumsy/paid clumsy/Paid Clumsy/WinDivert64.sys.sys 37KB
-
paid_clumsy/paid clumsy/Paid Clumsy/clumsy.exe.exe 1.3MB
-
paid_clumsy/paid clumsy/Paid Clumsy/config.txt2KB
-
paid_clumsy/paid clumsy/Paid Clumsy/vrpaid.ahk567B
paid_clumsy/paid clumsy/Paid Clumsy/Screen.ahk
- SHA256 57612d7def75bb54b4f32c51457c62e707aba139206bf4c975b8beef5ef7fd5c
- MD5 d85007047eb067fe40643ccc22e87b1f
- SHA1 54feaeb443c507bdd7728968c0e70e3e13085205
- SHA512 94c3ea2045750d4ed90035da81cb7b732d2c32696aa1893ced3e8b1315340c125db2127ccfa384a319f2b5a4214b6cf8d0e25f09bd5f97e6797b4b12f05040d8
- TLSH T172C0804F361593321778373143261D9BC5D1D71D5555DF4270A459811A7389D0BC140C
- MD5 SHA1 SHA512 TLSH
paid_clumsy/paid clumsy/Paid Clumsy/WinDivert.dll
- IMPHASH 4b5b0fb09f29ed8e5306bbb27b5ae668
- SHA256 9444a6e6b66f13f666f9c60d1935824f61c7256e35a8cf0440e29baa7fbe42c7
- MD5 1b1284100327d972e017f565dbecf80e
- SHA1 5b4f0c122a80478973eb6f9cb3bbcaf186295aea
- SHA512 4ccb9e233a3573f6eded0efa8fa54ed929818394cdf2153623d902c749d37751da6f489354aa50968e53d42d5ce339f6368dedb7858a4ff43a1927b4338954a4
- SSDEEP 384:EHGiP0PYf9pHuGvATXlQRNq/EbUKxcneWuDlE:E9MQf90GvQXlQvAEcehD
- TLSH T14C62F806F1D2E47FC24EC5BA95E72332B8A07CD0B2653FAE6485FA316D80F71642995C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW
kernel32
CloseHandle
CreateEventW
CreateFileW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
msvcrt
isalnum
isspace
isxdigit
strcmp
tolower
DivertClose
DivertGetParam
DivertHelperCalcChecksums
DivertHelperParseIPv4Address
DivertHelperParseIPv6Address
DivertHelperParsePacket
DivertOpen
DivertRecv
DivertSend
DivertSetParam
WinDivertClose
WinDivertDllEntry
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
730B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
paid_clumsy/paid clumsy/Paid Clumsy/WinDivert64.sys
- IMPHASH 5c9956100a10f17fd6cacca768f3c364
- SHA256 208c092fe77f161c5a313b916d73fa7f6d10dd289bab8bb5dfb3d59aacb27f25
- MD5 3bd5ac2e9d96e680f5dbdd183a58c47d
- SHA1 83b08cb5e61c7b37bd710ea01196a26fc8f38610
- SHA512 6cccd7971f423f72f5dbd01a83a2d27bb2bde63c4d1f5e127d77cfa0df85c289a2c3cd95c110ce38b58b9ea9a49aad18ae50f352ac6b21740d0294f771fbcb78
- SSDEEP 768:R5VorUqgJs3/KtdrbYiZdNSRUYjbMUYOUaCdHUZ9fdCrYc:vVorUn9cRUuILLd07fdCU
- TLSH T1B3033B22A3F01449F9E3CA7456F69362EB31FC826720D7CF039590494F66BE5167A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
97:da:76:ff:9a:56:81:d7:d7:9f:b8:81:15:69:91:15:f6:21:9c:00
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nemea Mjukvaruutveckling AB,O=Nemea Mjukvaruutveckling AB,L=Stockholm,ST=Vastra Gotaland,C=SE
Chains
Nov 20, 2014
CN=Nemea Mjukvaruutveckling AB,O=Nemea Mjukvaruutveckling AB,L=Stockholm,ST=Vastra Gotaland,C=SE
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Nemea Mjukvaruutveckling AB,O=Nemea Mjukvaruutveckling AB,L=Stockholm,ST=Vastra Gotaland,C=SE
Serial Number
0a:42:f1:e3:68:68:b7:25:06:ea:50:77:bf:7b:bc:5b
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 18, 2014 - Sep 9, 2015
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Minor OS version
1
Major OS version
6
Entry point
20212
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\windivert\install\WDDK\amd64\WinDivert64.pdb
ntoskrnl.exe
RtlCopyUnicodeString
KeBugCheckEx
IoAllocateMdl
MmMapLockedPagesSpecifyCache
IoFreeMdl
MmBuildMdlForNonPagedPool
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExFreePoolWithTag
ExUuidCreate
ExAllocatePoolWithTag
ndis.sys
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisAllocateNetBufferListPool
NdisGetDataBuffer
NdisFreeNetBufferListPool
fwpkclnt.sys
FwpmCalloutDeleteByKey0
FwpsInjectNetworkReceiveAsync0
FwpmSubLayerAdd0
FwpsCalloutUnregisterByKey0
FwpsFreeCloneNetBufferList0
FwpsQueryPacketInjectionState0
FwpsFreeNetBufferList0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmFilterAdd0
FwpmEngineOpen0
FwpmTransactionAbort0
FwpsCalloutRegister0
FwpsInjectForwardAsync0
FwpmFilterDeleteByKey0
FwpmCalloutAdd0
FwpsInjectNetworkSendAsync0
FwpmTransactionCommit0
FwpsInjectionHandleCreate0
FwpsAllocateNetBufferAndNetBufferList0
FwpsInjectionHandleDestroy0
FwpmSubLayerDeleteByKey0
wdfldr.sys
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
540B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
246B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=136, version=30729,
count=42, id=1, productName=Unmarked objects,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
paid_clumsy/paid clumsy/Paid Clumsy/clumsy.exe
- IMPHASH 5d9c5772d914b87ab12e184aaa7a18de
- SHA256 cec8a6fef5f0bf498883ebe660d424b1e2afc27f2ad22f50c31b7e6dd4557bbc
- MD5 7dc39708095380c860eef36d46b63234
- SHA1 5a60bd8df7c34074d2b7e4b654c35c5141b28ffc
- SHA512 7cd4041f2d3f3ff2d427ec34ba77bde5f3ddc18beafa483b20c45dea2bcbad15efbf727f6d2a2a4eb6f6c7594631246f97d4da113ad1e80a2a2ed5567050a57a
- SSDEEP 24576:xlzx9EFDs6QUDlGu3bs+Gam3/vfOWFUjD0V3GIasU6t:bPEFY69ku3bJGam329c3GNsU6t
- TLSH T1C955E792B182ADE9D61571F445A6D2722234BC804622AF1725F4BF373E329D3EE47B0D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetUserNameA
OpenProcessToken
comctl32
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
ImageList_GetIconSize
ImageList_GetImageCount
InitCommonControlsEx
LBItemFromPt
MakeDragList
comdlg32
ChooseColorA
ChooseFontA
GetOpenFileNameA
GetSaveFileNameA
gdi32
Arc
BeginPath
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontA
CreatePatternBrush
CreatePen
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteObject
EndPath
ExcludeClipRect
FillPath
GetDeviceCaps
GetEnhMetaFileBits
GetMetaFileBitsEx
GetObjectA
GetObjectType
GetStockObject
GetTextExtentPoint32A
GetTextMetricsA
MaskBlt
PatBlt
Pie
Polygon
Polyline
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetDCBrushColor
SetPixelV
SetTextAlign
SetTextColor
TextOutA
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
CreateMutexA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCPInfoExA
GetCommandLineA
GetComputerNameA
GetConsoleWindow
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentThreadId
GetFileAttributesA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemDefaultUILanguage
GetSystemInfo
GetTickCount
GetVersionExA
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
InitializeCriticalSection
IsDBCSLeadByteEx
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LocalFree
MulDiv
MultiByteToWideChar
ReleaseMutex
SetCurrentDirectoryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__argc
__argv
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_setjmp
_time64
_unlock
_vsnprintf
abort
atof
atoi
calloc
exit
fclose
fopen
fprintf
fputc
fread
free
fwrite
getenv
isalnum
isalpha
isspace
localeconv
longjmp
malloc
memcmp
memcpy
memmove
memset
printf
realloc
rand
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strrchr
strstr
strtok
tolower
toupper
vfprintf
wcslen
ole32
CoInitializeEx
CoLockObjectExternal
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
DoDragDrop
OleInitialize
OleUninitialize
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
shell32
DragAcceptFiles
DragFinish
DragQueryFileA
DragQueryPoint
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA
ShellExecuteExA
Shell_NotifyIconA
user32
BeginPaint
CallNextHookEx
CallWindowProcA
CheckMenuItem
CheckMenuRadioItem
ClientToScreen
CloseClipboard
CreateIconIndirect
CreateMDIWindowA
CreateMenu
CreatePopupMenu
CreateWindowExA
CreateWindowExW
DefFrameProcA
DefMDIChildProcA
DefWindowProcA
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DragDetect
DrawEdge
DrawFocusRect
DrawFrameControl
DrawMenuBar
DrawTextA
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndDialog
EndPaint
EnumDisplayMonitors
EnumWindows
FillRect
FrameRect
GetActiveWindow
GetAsyncKeyState
GetCapture
GetCaretPos
GetClassInfoA
GetClientRect
GetClipboardData
GetClipboardFormatNameA
GetComboBoxInfo
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetFocus
GetForegroundWindow
GetKeyState
GetKeyboardLayout
GetMenuInfo
GetMenuItemID
GetMenuItemInfoA
GetMenuState
GetMessageA
GetMessageExtraInfo
GetParent
GetScrollInfo
GetSubMenu
GetSysColor
GetSystemMetrics
GetWindow
GetWindowInfo
GetWindowLongA
GetWindowLongPtrA
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
InflateRect
InsertMenuItemA
InvalidateRect
IsClipboardFormatAvailable
IsIconic
IsMenu
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadCursorA
LoadIconA
LoadImageA
MapVirtualKeyA
MessageBoxA
MessageBoxIndirectA
OpenClipboard
PeekMessageA
PostMessageA
PostQuitMessage
PtInRect
RedrawWindow
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
ScreenToClient
SendInput
SendMessageA
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetMenu
SetMenuInfo
SetMenuItemBitmaps
SetMenuItemInfoA
SetParent
SetRect
SetScrollInfo
SetScrollPos
SetTimer
SetWindowLongA
SetWindowLongPtrA
SetWindowPos
SetWindowTextA
SetWindowsHookExA
ShowCursor
ShowScrollBar
ShowWindow
SystemParametersInfoA
TrackMouseEvent
TrackPopupMenu
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
windivert
WinDivertClose
WinDivertHelperCalcChecksums
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertSend
WinDivertSetParam
Name
.text
Size
371KB
Virtual Size
371KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
154KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/97
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
paid_clumsy/paid clumsy/Paid Clumsy/config.txt
- SHA256 1c4fe8e692ad324e1198b3a59a78545c5fd19bce233ef4213ff3dd71a3ced3c6
- MD5 c7627dc13ff249a6695cc539a4f2d0db
- SHA1 7e7507760295e8e937d7e207cae580dd16a8f33c
- SHA512 77848ea461985fab9b102f98b70b33336746dfb493fb5f00b5071ebd277cdf1ffee99b4323a8654e1bc1439df67793b66f60ffac75aef8e1b7048c8612a9a43f
- TLSH T10D41EF5B6757A3193C3C5128B3DBED84CF56441E3895EC07B5B602CE9201FBEB61A780
- MD5 SHA1 SHA512 TLSH
paid_clumsy/paid clumsy/Paid Clumsy/vrpaid.ahk
- SHA256 df91d3e45c1fe784a09509109c3ff0a96ff71608bd15604668ba5d518a03fb5d
- MD5 c65c8323562f6dfc8799d93159f75feb
- SHA1 16843465453329a4ef50773e19928764cf8509f2
- SHA512 90ebd75629b26441a384977d63609c510a87121eef3eb92dbc68cc0618ccb20a69c29392bc40aed2e4ebe06e0ae24658050c06e87a16d3ebcd51c2fd24cf97b2
- TLSH T1B3F0261B3E4B61ED4B7413071941591B98CDD36D13A1E42532732F8C3711413476D57D
- MD5 SHA1 SHA512 TLSH