CTS setup.zip
- SHA256 84594b679ec834ed150d4a1167d53e7a1d5e8379266dd6f9fdaee35c8c977aa1
Overview
overview
8Static
static
7CTS setup.zip
windows11-ltsc_2024-x64
1Setup.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1AddressBoo...pt.sql
windows11-ltsc_2024-x64
8DBCreationScript.sql
windows11-ltsc_2024-x64
3Data/Addressbook.dat
windows11-ltsc_2024-x64
3Data/Addre...ersion
windows11-ltsc_2024-x64
8Data/Global.dat
windows11-ltsc_2024-x64
8Data/Global.version
windows11-ltsc_2024-x64
3Data/Indexes.sql
windows11-ltsc_2024-x64
3Data/Local.dat
windows11-ltsc_2024-x64
3Data/Local.version
windows11-ltsc_2024-x64
3Data/Main.dat
windows11-ltsc_2024-x64
3Data/Main.version
windows11-ltsc_2024-x64
3Data/RegionA.dat
windows11-ltsc_2024-x64
8Data/RegionA.version
windows11-ltsc_2024-x64
8Data/RegionB.dat
windows11-ltsc_2024-x64
8Data/RegionB.version
windows11-ltsc_2024-x64
3Data/RegionC.dat
windows11-ltsc_2024-x64
3Data/RegionC.version
windows11-ltsc_2024-x64
3Data/RegionD.dat
windows11-ltsc_2024-x64
3Data/RegionD.version
windows11-ltsc_2024-x64
3GlobalDBOb...pt.sql
windows11-ltsc_2024-x64
3LocalDBObj...pt.sql
windows11-ltsc_2024-x64
8MainDBObje...pt.sql
windows11-ltsc_2024-x64
3RegionDBOb...pt.sql
windows11-ltsc_2024-x64
3UpgradeManager.exe
windows11-ltsc_2024-x64
1en/ClickTo...es.dll
windows11-ltsc_2024-x64
1ka/ClickTo...es.dll
windows11-ltsc_2024-x64
1ru/ClickTo...es.dll
windows11-ltsc_2024-x64
8tr/ClickTo...es.dll
windows11-ltsc_2024-x64
8zh/ClickTo...es.dll
windows11-ltsc_2024-x64
8Behavioral task
behavioral1
Sample
CTS setup.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
AddressBookDBObjectsCreationScript.sql
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral5
Sample
DBCreationScript.sql
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral6
Sample
Data/Addressbook.dat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral7
Sample
Data/Addressbook.version
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral8
Sample
Data/Global.dat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral9
Sample
Data/Global.version
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral10
Sample
Data/Indexes.sql
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral11
Sample
Data/Local.dat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral12
Sample
Data/Local.version
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral13
Sample
Data/Main.dat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral14
Sample
Data/Main.version
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral15
Sample
Data/RegionA.dat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral16
Sample
Data/RegionA.version
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral17
Sample
Data/RegionB.dat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral18
Sample
Data/RegionB.version
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral19
Sample
Data/RegionC.dat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral20
Sample
Data/RegionC.version
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral21
Sample
Data/RegionD.dat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral22
Sample
Data/RegionD.version
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral23
Sample
GlobalDBObjectsCreationScript.sql
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral24
Sample
LocalDBObjectsCreationScript.sql
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral25
Sample
MainDBObjectsCreationScript.sql
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral26
Sample
RegionDBObjectsCreationScript.sql
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral27
Sample
UpgradeManager.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
en/ClickToShip.resources.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral29
Sample
ka/ClickToShip.resources.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral30
Sample
ru/ClickToShip.resources.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral31
Sample
tr/ClickToShip.resources.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral32
Sample
zh/ClickToShip.resources.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
General
- Target CTS setup.zip
- Size 136.9MB
- Sample260816-qeptjaydma
- SHA256 84594b679ec834ed150d4a1167d53e7a1d5e8379266dd6f9fdaee35c8c977aa1
- MD5 80bdbaf5b47b97faa7be1318cbdb829b
- SHA1 e7239ee9cfabede1c56a1fd4f3de462320f71e6f
- SHA512 8b223936ed28d099e6af218f25c3b9fdff915359d34a5ac49979f3f31857f2c982c2aedb8574121ed089b1c2e479c0088dab74801798704316a62dd108d38243
- SSDEEP 3145728:3Dviv0Vnyi5Y6xOUxD1MZul5hrhMhI7FC0wku5QDPSz+ia7VFrTz:rEayiu6JUW52rQDkTa7VVTz
- TLSH T1196833E3C47B3C062F92AC2AEF05897AD5C8C07D7B676B9F0D155B6EF052012E296871
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack002/$PLUGINSDIR/AccessControl.dll acprotect - SmartAssembly .NET packer 6 IoCs
Detects SmartAssembly .NET packer.
resource yara_rule static1/unpack002/ClickToShip.exe SmartAssembly static1/unpack002/ClickToShipDBs.dll SmartAssembly static1/unpack002/ClickToShipImportPlugins.dll SmartAssembly static1/unpack002/ClickToShipLib.dll SmartAssembly static1/unpack002/ClickToShipReports.dll SmartAssembly static1/unpack002/UpgradeManager.exe SmartAssembly -
resource yara_rule static1/unpack002/$PLUGINSDIR/AccessControl.dll upx - Unsigned PE 16 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/AccessControl.dll unpack003/out.upx unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/UserInfo.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack002/ClickToShip.exe unpack002/ClickToShipDBs.dll unpack002/ClickToShipImportPlugins.dll unpack002/ClickToShipLib.dll unpack002/ClickToShipReports.dll unpack002/UpgradeManager.exe unpack002/en/ClickToShip.resources.dll unpack002/ka/ClickToShip.resources.dll unpack002/ru/ClickToShip.resources.dll unpack002/tr/ClickToShip.resources.dll unpack002/zh/ClickToShip.resources.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Setup.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Setup.exe nsis_installer_1 static1/unpack001/Setup.exe nsis_installer_2
File Explorer
-
CTS setup.zip.zip 136.9MB
-
Setup.exe.exe 137.1MB
-
$PLUGINSDIR/AccessControl.dll.dll 8KB
-
out.upx.dll 14KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/UserInfo.dll.dll 4KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
AddressBookDBObjectsCreationScript.sql13KB
-
ClickToShip.exe.exe 33.7MB
-
ClickToShipDBs.dll.dll 1005KB
-
ClickToShipImportPlugins.dll.dll 10.7MB
-
ClickToShipLib.dll.dll 14.4MB
-
ClickToShipReports.dll.dll 13.9MB
-
DBCreationScript.sql300B
-
Data/Addressbook.dat3KB
-
Data/Addressbook.version4B
-
Data/Global.dat17KB
-
Data/Global.version5B
-
Data/Indexes.sql553B
-
Data/Local.dat2KB
-
Data/Local.version6B
-
Data/Main.dat49KB
-
Data/Main.version6B
-
Data/RegionA.dat19.8MB
-
Data/RegionA.version6B
-
Data/RegionB.dat15.1MB
-
Data/RegionB.version6B
-
Data/RegionC.dat10.3MB
-
Data/RegionC.version6B
-
Data/RegionD.dat16.6MB
-
Data/RegionD.version6B
-
GlobalDBObjectsCreationScript.sql5KB
-
LocalDBObjectsCreationScript.sql7KB
-
MainDBObjectsCreationScript.sql313KB
-
RegionDBObjectsCreationScript.sql11KB
-
System.settings327B
-
Uninstall.exe.nsis31KB
-
UpgradeManager.exe.exe 9.9MB
-
en/ClickToShip.resources.dll.dll 3.8MB
-
ka/ClickToShip.resources.dll.dll 3.9MB
-
ru/ClickToShip.resources.dll.dll 3.9MB
-
tr/ClickToShip.resources.dll.dll 3.9MB
-
zh/ClickToShip.resources.dll.dll 3.8MB
Setup.exe
- IMPHASH e990dd07e89d04c53e337ab9b3f5e0cc
- SHA256 f841bd32b70e5df9bcedb886848b68481d56d6c8d044bc8eeb7fb0f4f472d8c1
- MD5 3c99a3252696a4a019ba5423c94af21f
- SHA1 6fd28a7079f338337a2c5dc31149788f47e511aa
- SHA512 0421a6018c8fbfcc10702dfc5d251c3587e0607beb1ef7b4ac61aaed8ee0a06702e98dfe14b77f89c52384cd5ebff370bd81ed7ec3a7c43fd7c57e011bd40d25
- SSDEEP 3145728:lXP+D0Dl+apQMJgcBllEdoZ57RNnJWxrouaS+TobpuFEaA55P1ly:Nm8+aKMv80597oboFA55dly
- TLSH T1B568339394BB780ADF92AC39DE15817AD590CC3C6E2B6B5B1E15796FB073003F296870
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
-
NSIS installer
PE Signature issue
Digest
6b:e8:30:c4:8f:5f:0b:ce:8d:7a:b2:b0:05:59:f9:aa:54:1d:a5:38:ed:43:84:c4:0a:f9:03:65:79:83:59:1c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Aramex International L.L.C,O=Aramex International L.L.C,L=Dubai,C=AE
Chains
Aug 14, 2026
CN=Aramex International L.L.C,O=Aramex International L.L.C,L=Dubai,C=AE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Aramex International L.L.C,O=Aramex International L.L.C,L=Dubai,C=AE
Serial Number
05:f5:7e:5c:01:78:f1:bc:b5:4f:68:56:39:10:f1:69
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 8, 2023 - Nov 7, 2024
Minor OS version
0
Major OS version
4
Entry point
12877
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
CompareFileTime
SearchPathA
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
SetFileAttributesA
lstrcmpiA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
GetTempPathA
GetWindowsDirectoryA
FreeLibrary
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
MulDiv
WriteFile
MultiByteToWideChar
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
192KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/AccessControl.dll
- SHA256 8a8f5bafc105186c85f14e017ab6da33ae8f88a9635e51756f90b6d95381d80d
- MD5 9f1a88b953fd2a2c23b09703b253186c
- SHA1 29d5a5a24e7f782a07e9f5d2ec1d1a6218fec737
- SHA512 10b3a812c92b7324bddcd23adf923fcaec2532f31bdd9fbf17494fc33f99aa0a0a48b94f1fdd6599fa0189567626a90b324a1d132bf9cb8b00a6afc547e64018
- SSDEEP 192:RmcLe8uWVNz5ZalBK/7rUlYg5q5LcywvX5:RJdNzMKXUlYg5qPq5
- TLSH T1E3029D8643A40179E8730BFC4FAD4C1A1B2EFFB0CBB1569D2158356F6820B1488B6F31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33616
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ClearOnFile
ClearOnRegKey
DenyOnFile
DenyOnRegKey
DisableFileInheritance
DisableRegKeyInheritance
EnableFileInheritance
EnableRegKeyInheritance
GetCurrentUserName
GetFileGroup
GetFileOwner
GetRegKeyGroup
GetRegKeyOwner
GrantOnFile
GrantOnRegKey
NameToSid
RevokeOnFile
RevokeOnRegKey
SetFileGroup
SetFileOwner
SetOnFile
SetOnRegKey
SetRegKeyGroup
SetRegKeyOwner
SidToName
Name
UPX0
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=48, version=9044,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=41, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 39b62bf74ace31d2d8041bf1748e3d83ad0b0b674dc7600b651164f748a38667
- MD5 5173088bda257c4f549247031a21caab
- SHA1 e6f3c1c3b1d5d53f6adb23cf9a264b8f5d0dc479
- SHA512 01f14c768ba2f9f11c5e344ba44b75dafe486e7742ca8896e0a985d80b71192336e2472f7a2be17801fe0c753bd1eddc8494af53dc436ab727ed3d0fa3c7ae9f
- SSDEEP 192:ThzPKgdc4SN+XIjjAZaK26N6dlJmclFcyw:ThzPM0/aAUF9
- TLSH T197629516AFF416FBE1A622B076D116338BADBA5400E15D674F564B892C10C86EFF9333
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4152
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=48, version=9044,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=41, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
- MD5 cf85183b87314359488b850f9e97a698
- SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
- SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
- SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
- TLSH T112327D19436481F3D5D1843D146A7ABB6F2C762196F44FD3CFB39880BE285C6AD79322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
835B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/UserInfo.dll
- IMPHASH cce05dea98cbac3a9d486b233588f528
- SHA256 2dbdb3abd5652302254466aefa0f40048832f2a39fbb8a63c97fda8116021ff9
- MD5 d41cf0e4d88c60408f3d5b97f49d40c0
- SHA1 1aa117b1ef998993f495833a08dd8cb12356be0f
- SHA512 35bf8f92d502a007838576c25aa25d1d7cc01a639df624cfb166085b51f1ba9cd4791c854f879e7b138492a3492365d88c0c5d7accfe5ac1e0e73685117f9209
- TLSH T1428160BB62A80CF3C0941BBB41D71CA713B6DC702792011E98470A9A34D4A6FED2E705
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4713
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersion
GetCurrentProcess
GlobalAlloc
GetCurrentThread
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynA
advapi32
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
GetAccountType
GetName
GetOriginalAccountType
Name
.text
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
673B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 38e7b5c3ee58b43a91f9679e94aabd09
- SHA256 4f69550bba4583ae5f4df10d3b2980b3d164eac21d45dba3496f9ed98a675f7c
- MD5 72ef340bc58f53d1a196581dcfb80f55
- SHA1 f4167ebd1adbb34e7b45a0d013885575c1bdf4fd
- SHA512 87919a3768a143dd80fb73c879342cc3ebf8935983af5bb499701559216048f5a0835a0f34c3f0e54f827ff1265b8bd2e369398b901c89303f92ffe6e8cc8d7e
- SSDEEP 96:3jp41CMj95rKhkfL5RkEdKkcxM2DjDf3GE/E9v5E9av+Yx4FndY7ndS27gA:3jujesS4HRE/K5MYxcdqn420
- TLSH T10412F8675A0011B3E9A36239306A2D3F8B7C9325D0A37C02C677AE562AF431A7D3A355
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc
user32
DestroyWindow
CallWindowProcA
SetCursor
GetPropA
CharPrevA
MapWindowPoints
DrawFocusRect
GetWindowLongA
GetClientRect
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
LoadCursorA
RemovePropA
DrawTextA
gdi32
SetTextColor
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=55, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
AddressBookDBObjectsCreationScript.sql
- SHA256 9834ddc70c6c776583d126ed87ee290ed6ecf0cddfdebbce34b4c76b3cdb6493
- MD5 863b746408af11780900372ca286e050
- SHA1 ad577c51c107059c1b2464beeb71532fc0b536d4
- SHA512 06eb169b4effbba93ef11cbffbc6f685fd91e3b852e724d7dbc447da18f3cc043c3c306c62fcffd70203de6e89fccd781d35a39d38026e982a5d89ed572caadd
- SSDEEP 96:QdjRA9WBHDFq63BqfjuAM5VNRNw2XABycE2cZiyM6ijuA39DyM6/juAXlyM6Bjuu:Qppk63BwcyL79UAH+BhXC4e
- TLSH T16952B25267FC25187877BE85EFBCC0389F2AB9E45D3AC91D01A1514F05F1E04AA62BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
ClickToShip.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 00f07ed6dcbce60a0139699b7f872f3afa9d0401fb23878921099d90877080eb
- MD5 145951d9b2f50f7b81127c80d6650ea1
- SHA1 eef4c548cedda7ce655edfc02c75ca05ccbe4a6b
- SHA512 08a7de15c7d237c9762d00ad9ef06fd82cc559ff350d889cba81cf6999b8088a55e6758b4014f67508699fde00f1b4a4d6612cb335ad70831e7468ce257ac033
- SSDEEP 393216:o5ud9gVBFKQlJIhZtVwO8ZA3JBqV3/FmHtMLUuAOOZruTDGhSS1SLLDSCIEq9R:dktxdZAZkFmHtMI6O3R1GLDSFf
- TLSH T1957701203796D619D4BE07720C35A1D153FABE1ABF58CA4E752A732C5C727138F12BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35155258
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
33.5MB
Virtual Size
33.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
190KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ClickToShipDBs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 170946d705170a472f8b0cf56183b01075f35c2fb8445b2bac50da78e23a0f6f
- MD5 1507aa91cdaef7859fc7ffd4b5caa2ea
- SHA1 3e7e5a27de6591336070a0e1cd69111a2baf816d
- SHA512 e419a2f145ce6839c70958d8fdd8fb4abac262422be9a840a5e98196a2e4f7fd9824e3ad0c84f3074390b80b97202d5567c055ea054ca8433b9a2142edadbf4e
- SSDEEP 24576:nkSkU1AplYvGQPHtr5QIoLTc2GUQZ4XHMh:kpXefHdeNTNmi8h
- TLSH T194258C11F7EE6908F4B3AAB46FB4C4568A7EBA6C1E38C11F2914515F04B1A808F35B77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1035518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1003KB
Virtual Size
1003KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1004B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ClickToShipImportPlugins.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a22191d008ecb977665f35bdce89e5e612983222eeeda50ea51f1cde358f3c4
- MD5 921dfa15ce324119e28f0ef607e7931a
- SHA1 2a1075ca86846a9d8b2aaeda91e11a21cfe9f4cd
- SHA512 f06b1a856b2d41d62dadf6e5ef48a66079344ae609f2c4f5eae026c1d9d2a41acf8994b850ff633a8b9bf7937e27f7ca1e843ad783bc5e7f5af38b2a863fd25a
- SSDEEP 196608:2bIBSvg8N5k7Xc8GrQ+rnRpu0QJ53uxzBNfzW6k11QxkSkFKKFpxno2F/GQgPY+u:20Svg8N0sHrrrnRgTyzrLs1K+xo6OPYL
- TLSH T120B6333CE2C49E51DEB73F3AED11B1A00AD9A6A1118BC89F0CC5139C0719B4EDBA595F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11246586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10.7MB
Virtual Size
10.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ClickToShipLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a2884dfa14d9a1f84a9067fd309982941d1c65f40cb384c323f9e9c4ed33483
- MD5 ce474eb02cca7f451af5a17f00d6a4f1
- SHA1 679f1730b0f942157cdc8c0144029babbda23c08
- SHA512 7428ce7e5eedfe7a4f936f7dac48a55ef755c098754a36fc21a3a545997116faad83c49899b48e83e92e3d32d39b4a2922bacbd44a6a5409729daef483dc6437
- SSDEEP 393216:59tHJqi6FaDeJijA9eu5l9XkDfgkSDWjBI:BJqi7Fj+J4gkSDv
- TLSH T165E6336023D8B2AEC97E4B365AB6453FCBE497025A64E7971B0565BC3083BB2CC015E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15087190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14.4MB
Virtual Size
14.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1004B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ClickToShipReports.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 84dccd3af75f4920d0532356b7c62616842eed93fb7239cb69ce1eb5f9d795e9
- MD5 65441071d24caba4aae087da4a6100ff
- SHA1 df9ae3dd5e7045c5b04cd4f8e4afbcbb393e0e78
- SHA512 323133ca2a3a6cf644a75321ef8490769a3c77df914c52867d2442e2a84ec74353ea23e85598e10d59bb15a1efb3b6067463b47b3626d14ec2d8e71262f80dc6
- SSDEEP 196608:xU/Miwy4R3aUIeapeZme2COxT3Co66YwxXZpwzrSW5ooFVywKp0CMg076PsVFsaT:xTDKnHe21xuoQwOGCJSp0uqy7Ognv
- TLSH T1F1E6123037349F7BD03D25A443A5190E43F6B987026DF9ABBDD51EC266E0F906712AB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14543268
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13.9MB
Virtual Size
13.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
DBCreationScript.sql
- SHA256 ae2dc9c777d72bf2b3f813e12cb3c819fa5a04fd10d75883cb7e75aa78629ce8
- MD5 35ee91ab419749e2c0fffd7e6573016e
- SHA1 032d52196e70acdd598752245ab65ccd32f01945
- SHA512 0b32f4cec805faf26fbe4843067bdfb73e289097b66476232290b7f9a12bd3675950b82100c8476c0a7db3d70f31514f066889c77898cf1128e2c81576996c07
- TLSH T10EE0C27BF4852212554B7EA786152A5BA13D462508F94EDA7A14393C46332408FA5E8E
- MD5 SHA1 SHA512 TLSH
Data/Addressbook.dat
- SHA256 d5056e587a2260d27b2d516f1c6d2a64a011eee31ce1b4344f868f9a69ec627c
- MD5 b0145b44ba9e769ac9631541be7c27dd
- SHA1 a53d1b73c8340ba89a28a294a1111729a23ac751
- SHA512 f0d4c29c7be554de90a32bf44b4d474db1c3a5bf26a49a24ceaf9a9d457d4f7e03b29c7ee89d0ebf868ce4690b5a33d29b79755840fcb8867dc997ac102ab297
- TLSH T1FA516D65FDA401598B7F0D6D28B008EED7DE7290741F909A8B6C00E17F944CB7E63279
- MD5 SHA1 SHA512 TLSH
Data/Addressbook.version
- SHA256 8d284220975da66c6cba4a32aaedfa0b897187d86ed9f7a2419c9bd10a103505
- MD5 a8c6dd982010fce8701ce1aef8a2d40a
- SHA1 31d9ddeaa80bc88c1f3117b9724726ebcc7fc72d
- SHA512 b12f77cce9ddaf2455a296f4cd435f153e9a080ad839082193dd8a85965742773853674715edace7cfa1d0633e68224acd57eb896525a8999db463256dd46f56
- MD5 SHA1 SHA512
Data/Global.dat
- SHA256 ff428abe4576efc313c6072fe8803955fd12499e49ef0a14a001e9db6b26444c
- MD5 07f2babeb72444d6ebeb2d7effc4a1a2
- SHA1 9affd628007a91c4e10a214130b10f83419cf15c
- SHA512 80b5e9a504308b47e54d08d1c74cd5e996da027b88146ff0758040cb51c46d697d50fda04530f4367b44885facdb7f973bc265159121d04d0a0a718fe66bb299
- SSDEEP 384:Ft9zDmTWG2hGZ9mnHdYpLBYaAu443IQioAARsiPhzg9yb3/56g5OZxcGD7jBR:5zST4OQncBYaTtI3ssshAE3/Mgwv5BR
- TLSH T1C282D0DDE8F2C9DEDA0543AC63F8786B7AB0515706B45083162094E4E1AAFE9E2D9C10
- MD5 SHA1 SHA512 SSDEEP TLSH
Data/Global.version
- SHA256 d89d2994c6d535dcef86b8dbc8d969574f0f0f5725790c679ea2c4089192659e
- MD5 de9c6f8b18f02d811449fd4b88c985c5
- SHA1 948ad26ad8b7279e2813f4c43f9a34afda24adb0
- SHA512 572a1876daa78ec0997151c84d1e29172fd34681d6d362dd440a4527f963a64966357b9d71a79273aedf51c1c248ac009ef13d08f10958d71434ad5c13b82812
- MD5 SHA1 SHA512
Data/Indexes.sql
- SHA256 4d082299ea6dc4de1035be41ecc9e05e10925dfd5b6703935a850727c3b0c870
- MD5 8b251427ef54893fa0ea19c7fed563f9
- SHA1 0e400e4478e6adb80d8976b72af54a178ad910f0
- SHA512 3fec8777cd64e34e0c3a0000bec3520dc11b4ec866bef59ac7c3dccd2c32e37543865ed6e797055028e099e90a075a35c1d9307e8ad574bfae23d8795ad1c6d5
- TLSH T1D5F0540790CC759AB32676117E578530D6647811C60C7DF617A469723EC368D8C5ECFA
- MD5 SHA1 SHA512 TLSH
Data/Local.dat
- SHA256 7eb7d12bd33f0140f6a99368f766ee790ec312ac1e3cb4bd2cc84a15b7a8bfa9
- MD5 d7b3005be79c5844846b2921a12cd57c
- SHA1 7da56c0eaf7b78ddb8e3e1749496c3c24f811c3c
- SHA512 54fbf57b634ad2c9fa61299a45bbad99fda012c834bee25ec163c2197439eb2a8d6b2fe0365b54c7b9eb8b02400632c2cafa8597b01613f9ada8e1c124f23845
- TLSH T188514C922897B29D264F75DE88B33ACB11475B67364B3A51073816825C65BD34E1D1C1
- MD5 SHA1 SHA512 TLSH
Data/Local.version
- SHA256 f9c60617dc64848907cec9b3e8fac3db200a7c2dd406cc0691b36f3a9f8f3819
- MD5 995a542016f07e2c925304e77afd57cd
- SHA1 234dd7552e0f9f683157d1f3997f02a40fb5be9e
- SHA512 96add48c6c543c7a4b9b31e58cf9d2efd160a64ef731851b09e04e4aa0100dc6ba86d7982f584cf8e35ef67362ae8077953d6a9407f32348b013b1f78c63aaf5
- MD5 SHA1 SHA512
Data/Main.dat
- SHA256 a88a25157fb87346df7743566845b52db9bb7397a7e8f48d8e9fed75971e15c3
- MD5 902d83a93b0b59bc29caa62efbf2d3bb
- SHA1 7386befbc32fce8eefbefb4b45f4f75a46c55068
- SHA512 2c44ec2b20ade0d980f7e786f97dee47aa39f8ab2bc04e1e3c29dd66e83d1b08e05437d873e8ef3e7f493268bbb978e78404ff8fd217ddbbb413a0a191bcd3cb
- SSDEEP 768:RKfG7Z/IYj7cXmI1QhdOjQ9ZUMJTUEtTHniNWDQGVG2IJdChiHh/QQLSabVXcr/1:kfogVLr2ZnIiniNWDQBfJdqvZWo
- TLSH T1B333022EFD956947031492042D3760870F1C29F55AE239A2AD8F2606F62BF9FC35C395
- MD5 SHA1 SHA512 SSDEEP TLSH
Data/Main.version
- SHA256 e01bed5384800f061b66025d79f0609b15a34f6fd306be37eb5fcb7c0d9bc6b3
- MD5 787d5c87045daab10586993671834d3f
- SHA1 17a193718dbfd2f3cf043015d1573e45799b9a33
- SHA512 7c41dd5190fc2a15af47ada9ab313c057918974a3c5d0a48a53876f78ddf9d344fa6456bd815b49e7f8cc2ebaa2eca48666c26994f48acdc2e53daee36689808
- MD5 SHA1 SHA512
Data/RegionA.dat
- SHA256 18cda20211e41cd5f365312007d879c2769f0f3e0691b774fc375bc6ca1f7891
- MD5 5ba464735dc0f7088849b8d20c9412b4
- SHA1 41e6f97216567f67caf9a1e1dd1540af8be32b9d
- SHA512 0eb8343375a829c9c4d45730e990a77442cbd941027f972f159a85c2e9b146fcddd718e748d97e517120eed73a3f30e2e1efff37524a58b331beb92cdb1f8628
- SSDEEP 393216:BW0SihLQS/79iKWRoYm5/JWtRIQLjH4piLJzPKQBr0xtUI2FWgnC3SHoZnjGnI:YFAQS0nE6dLjH4AziQ4tr2ogmSHM5
- TLSH T1862733EC68EF01A89515F3FF2CAA439CCA627DFBCD90A767D82948922F559E4310D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Data/RegionA.version
- SHA256 dacf2bed952aaed68d7449e6ad3d3ba21bab958c0f08f93a4f65b98c9473a00d
- MD5 02ec41f2fdb82dd864251ca70c9c467d
- SHA1 d6c779510d88ef9860dee46a51c4c539f7bf2422
- SHA512 6db1de2070c32729f1c40e01b17b687df9da3e26f05c203595df800c827c46a72fb1d11c9b58036860524d202f70c6d9625e6dc095a05598c6d6a2d9cbefb84c
- MD5 SHA1 SHA512
Data/RegionB.dat
- SHA256 80ffefb454c9e7849026f54371538e50688232fe5658977d426c939d2396e0e5
- MD5 b24840eb30e9760c88c60b7f8c172fd5
- SHA1 7e1ad2d579f5e247b74571e4052ddd1e78a02e58
- SHA512 671fe54f73f1ffa6652d77fd0b7abd0379d7c3ae3f4e89559fba993ce838d41fc55cc3de7469646888f33d26997d81bac7e356891e193af297d10fa30a5be6ec
- SSDEEP 393216:7m/lofuhhli8/yjJKimoU+nAM2CzNa0+qkG6nZT05qFXCY:7mtqudi8/WCY2CzNaDy6nZT05sv
- TLSH T15FF63384C249FCB48D3B99A5ED9AA67FF11C037D056864206CDDD48CFA7849838B4FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Data/RegionB.version
- SHA256 4e9e25ef6c8e342291e150f747922d05b5304ad5d1b6e4cd588c287902376c8f
- MD5 4195b6c57ad34089d4e482ca6b18cc8c
- SHA1 c43ac200e4118c5ffc5ca07714f18aeecd22dc29
- SHA512 dffc492f09705bf6a9cdaf54dc4d5e7b25a386e9c007fd2562911faef190ab152d92387820c4c3c9d0c663c112232d42b28ea740ad2456c69dac8082a143e980
- MD5 SHA1 SHA512
Data/RegionC.dat
- SHA256 ba2c52f2d9706c896cd9216fb3d2897f9217af49ea193503d15bcdeb82936f02
- MD5 b4be32a877097a66c1839a17336f7e18
- SHA1 0f11ed31e6f791745f319ab3791b1c5f9299fedc
- SHA512 3487adf63aa102b60e0dbc44ca25e6f0f910c0c866f1d515153f451985f2cbf39e730b8ec497ca37ff15a4e9cdb323d592365c7fbc2cb465a9210020622870c2
- SSDEEP 196608:tEuGJ+Dfwt0/HtkLrsLxf+P6DV9wSTi/gvQ0XbhT/0kKW:t4gfwt06Zk9rTi/2Q0rhT00
- TLSH T1E6B633F351CC676F095EA826549061D67ADD4C97230ACBE23A813B6E5F144B3A3CF886
- MD5 SHA1 SHA512 SSDEEP TLSH
Data/RegionC.version
- SHA256 39e8c5070f478968d3a9bd8fe2c802ca7c64a413ee024859883854c3f65bdb50
- MD5 8b2b8d2146c566d5cadf7c4d09818857
- SHA1 26fb3d5973cd11fcbf9e039783846e7ef8c2d239
- SHA512 46b95bc2568b2b76e4b91a1c27e802624f7d8e0e3a643e276a4ed3a5e46a0fb31a0a178b339b098e16416b79b1292631c7e9a4112b9a8a5c98582a10de58a83d
- MD5 SHA1 SHA512
Data/RegionD.dat
- SHA256 835a48176bc40964619bada0b0866e4bdd2bdfd5fb00cfe825d9e082ba124df1
- MD5 fdde183239f13306ef1cfad26e363f50
- SHA1 e407f420611b4442533985125999484cfef3f085
- SHA512 1c05f315ed275ab58a02b2cbfbe995ca593a5860f9203db58ef90fa406af08cfb760d52bdd2f97624c367fc942aa1cfbf8157f595c7149c14a766460c64ff347
- SSDEEP 393216:hfhDAgSu/SgFw0em77L9Zcn6xbG4o17WQzYY4bKp:hJDAgSuagFFTT9dxS4eOWp
- TLSH T1DE07335FEDD0C2F630C90D8573A03644B9CD0CBEA76A0A729A55CB3A07E265DA4C6D37
- MD5 SHA1 SHA512 SSDEEP TLSH
Data/RegionD.version
- SHA256 18234b145d7aada4d4162db556732201d9635a0fda4c281dc79ed70441c2c262
- MD5 ee6797ef7b265ab4f7157bb953f98e67
- SHA1 a892c49aa8124544c3afcc8686a3fa04cb79b494
- SHA512 0e571f10233b47602acb446ea85823ec9d7915bd9dcad0b373c97278a5621f4edbfca63b3860a7c61b777dba8130cac8b1bc2dfc1581dddd7f92114fd30626ce
- MD5 SHA1 SHA512
GlobalDBObjectsCreationScript.sql
- SHA256 33c279ffeb5c6c0fc28295df71c54650030fc525fca7584bb3dcb5f10e462755
- MD5 59f4f84f636d2ba4838bb4805747aea6
- SHA1 21c07280e2b28d95f0ea1fbf05b6fb450dab4edd
- SHA512 ec3952cfe5c2fe193282fa995048d40ba86609779ccb0aa9d0a0d619d4e9ad3093f1d8d396a70f4f39b9826ce7b1f2442d16543ce2c2006110d209b6f6e7fcfb
- SSDEEP 96:Qdj1A9WBHDFq63BJjyASlITy6gyc6IjyAnDbvdT25cfCv9jyj6fDZ:QpNk63B9vHADU5Z
- TLSH T105C19342A7F869087877F985DFA8C4789F23B6A5553ACD1D01D1018B02F6A047BD7BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
LocalDBObjectsCreationScript.sql
- SHA256 3e3b8cb9d249308d3e74dea3f82511e0da073ae99789048e35a951775b278f34
- MD5 51299c5138b384eaf3a9090399b7dc4d
- SHA1 7649116b2dc103a16386413e472cbc4f4e45fb26
- SHA512 7691af7d29679c02ede5ff81a0eb11f089cd14c72155756710cebfd36531025bbe0c0b16ff240a9c60fb4942550ccb6bd9b1ebc37e6c22b4f9561e78dd27cd40
- SSDEEP 96:VjUAnDMTSPyM6fDzdj2A9WBHDFq63BojUAnDERyM6fD3jUAnDycEy/f6fDnjUAYs:RVoSozp+k63BMVEGTVyI+jH
- TLSH T101F1D102A3FC291C7966F581DFA9C5789B2775E9523ECA1E01D0018F02F5A083B87BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
MainDBObjectsCreationScript.sql
- SHA256 3510f9bc9d5e54d8357817f37f0b84eb58766493e154805d19a21d8cda2e1cf4
- MD5 7e7fffa0070855cd84c76a2fb1f1c9fa
- SHA1 2b813412915c5da5ac8dfcdc9de1fdffc5d9c9dd
- SHA512 979823fbcdcf6ee7cac89e402d45befd73c943f8a8ccf87c5093e58674b68222b7d0c6648e805087d8881bf46c3b89622b4c2b6e4ec60bd20e8785347ebc8d30
- SSDEEP 3072:0xbQWn1hZ/rBLF8hdEhgTP0+Y0nnMcRn9KI6bwh2U0skqSdrbrbrbrLbLT7DrzbG:3
- TLSH T1DD64B412E7FD6918F8B3BE84EFB8C4699B3ABA981D3DC11E0190550F05F1A049B65B73
- MD5 SHA1 SHA512 SSDEEP TLSH
RegionDBObjectsCreationScript.sql
- SHA256 d45ff52b041b99cba22a1d5985fca3c8050fbf81de71236b619cccc5542f1a6f
- MD5 68f9db7dcabb849c64769269dea4d790
- SHA1 ddfef55be060c579519f77f3374cabdae8a866e1
- SHA512 7881933d5f11ba01ac0b9d4c1dca0e35eb5d2fe339bfb78859d78e6ddbf4b1c35ba55d0fbb1ad10e15067921296bb3ab8708d654adece4c76445e993d9a74660
- SSDEEP 192:LwR0w9J4rwGG1z53k63BiwFvwBG5wrfwI1wOYHd:LNd+53ZBiiR8fHE
- TLSH T14A329003B3FC29087976F985CBA9C4789B2676E8553FCA1D11D1018F02F5A482B96BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
System.settings
- SHA256 e39ab203221d708fa3f947f3dc5082f2d4ba53df4d2adee8a35e78ee61a06fd2
- MD5 802a1bd801b28b0d4689f025d080c9d7
- SHA1 d18a2e294a08cd5d5b841b4f9b48278c09911fa4
- SHA512 c8787f0c08194f3894816d0ed8505a540ee177e635b2fb5a5ec8bf6f77b84b502bf26d10b8cf96c4d52f08bca57fa04b5e92cf594c06f9190fc3c0a2f120e026
- TLSH T1EBE026C882C42C43C3F581AAF701602063E2F23F94A08D247C905A570025A9962D3167
- MD5 SHA1 SHA512 TLSH
Uninstall.exe.nsis
- SHA256 2ffc83043e6cffe692bd7371b30729956024d67bfcfa1133ab45566502566e93
- MD5 d46e8df26ffb531ba6d0473e5fc13e92
- SHA1 12b28bfc1f33bca38ff7dcc93f377063c3ef79a7
- SHA512 ef4a8309fb88214b11c50694e464c9cbfb9ada61aa50238191dc7677baa51e9559ce2ae05198ce9e029da7dafc14e576326e3233709732bbeb0fdb0fa344ce61
- SSDEEP 768:R312kvyeGFQEbtLLyzKNUfsVlpdyzbBdi1fsM/rnbchjwOO:Rl2khGF/LLyAusbyvBdiT/ff
- TLSH T149E2E10AF5B70972DC536F1C804027CF8BCA1A934579DF571A8BF622B583768BAF1056
- MD5 SHA1 SHA512 SSDEEP TLSH
UpgradeManager.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2728c51105423e491bd0344fa25043064b540db4449cbbad953b3f2a9ba80862
- MD5 eaf34f893c0047434abaa3b26fd7d236
- SHA1 4698d111ba97c202f418f4a886b4f0434b5561cf
- SHA512 93137a8f06c7d1eded46787e7feb77b3784d83df462ff279b68c5dcdfeb8404a26e8c4629a0249f3b1602e7b35dec0386ebda42cb63360bc74a73c163fe4335d
- SSDEEP 196608:2EFuompywM0sJYzUI643CPPS65rFz6fXctweETySFEGrM:2EUvDM0s2R7yPa67z6fXAwe02GI
- TLSH T1B2A62221B3E8E50CE4BB5A708B78942982B9FD0A1E39E74F5111769F2C717019F62B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10167718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
9.7MB
Virtual Size
9.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
190KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
en/ClickToShip.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 414a6562e8c0d3a39e2b6fd3c0436303ef9fa9a70fc07b65c67bcd55292dfa33
- MD5 755e99dfc2dde7ce4feb5f435e27d464
- SHA1 77d9b008a477734c1b4b3a6fd3199f55e0c91f24
- SHA512 8214a125653e6902a5316b12121146a2d52186fc250fe423c2940f2d206860275ca42ad8f1db8d1d330a25e3f7b8185f8073d77fabf7678c7f1e4adefbc022e2
- SSDEEP 24576:8eaxeaaeameaHeaO+nbeaQeaBeaceaW/vea4eajeaGeapeaEea3eameaveaDeavF:HncwDp+nyCxKj+E9EFad4lrr
- TLSH T12D061903BA85D71ED06916324E76F5B50276FD486D69DC9BF236B39E2A333835E02702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4004250
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ka/ClickToShip.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 93c228b619f86c0f9791eaef34bcca3088d0f0c4a3767bc06a4579b715b92147
- MD5 9bc54f7640b60f8cd4557975957492d4
- SHA1 208af18ade0b5e66cf767edd93c2ba5baa0d2bc5
- SHA512 b86b0d6d4800b40e1941e400c12658e84de8d60c39ff4c1923de39ab8e6d1add49fcd3834e2ff93fecf9950f12f3a0603fe0be026d6ccae317a99ba8db4ae33b
- SSDEEP 24576:Gea1ea1easeaIeaPe+eaoeaUeavea3eaveaHteaSeaueaceaoeaIeajeadeaNea:pp9WikeR8IDbZPekAu4n9r
- TLSH T1221628027AC5D71ED46906320A76F6B50236FD49AD68D8AFF236B39E39333435E12712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4103003
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ru/ClickToShip.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 478c1aee079db9e83d4bfa643567e28d04f7172e97f62811b75779ccd4501108
- MD5 4892971234a5cd73fa3d057175955d6f
- SHA1 909c9a84a2e8367cf6e640c7e2f38114229e606f
- SHA512 e7fb37782c2858115e70d32c8290ddb4a6b9d6a71b156ba1a625162bae520c5dcc4bb32f943e9f864666c69f46907378c9c88ec63abd113ce4a36c65ac01ed23
- SSDEEP 24576:6eaAeaMeaUeaheafeaqeaaeaQeaRweaNeaaeaneaweaqeaTeaNea9eaueaIea:986yfb68+0nux4MnRLwM
- TLSH T134163903BA85D71ED06916324E35F9B50636FD686E29DC9BF236B76E25733438E02702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4075388
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
tr/ClickToShip.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8b39f16593688c76b21f6445cb055b73055288e72d7da2772cfae66e71520495
- MD5 3f6128d127b1379e3a979028292f59f9
- SHA1 884a4d6f4c211233a3f0ed77a4541f3374b68143
- SHA512 447a2cca329961370ecfc8e04865fafc545eea1e245c3c3777fa3ca07839ca5e7991cee060d5a178354f43cd280a71f97cc7b3fbdf2667e1d206a55f94b1d2b1
- SSDEEP 24576:beaueabeaNeadeaTJAea7eaheageaFeaweavteaDeaDeageaAeaJeaneakeaeea:yaH3/mJb5Nmf4J9j4M5DSY
- TLSH T119162A03BA85DB1ED0690A324E76F5B50276FD446D29DC9BF236B35E2A333835E02716
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4045834
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
zh/ClickToShip.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 394c124a73880d5af27817ab6cd3be416a225e828d2bc16b54b6cf6446942b10
- MD5 7dd8d9a1e7b63bec9d7c7ff6b4a99596
- SHA1 77e1fc1f87a0f16a0d84597311fe0741f3ffe3dc
- SHA512 40d9def4368cebfb567bbbbe6e026329bc977a7fd0c3154bb56ca52aec9190077474fd297b7053e8c638f23de7a86dd9298fb7a552374c517c0f5728248aba6e
- SSDEEP 24576:Deauea4eaJeaMea3g92eameadeageaiea7eaF6eaaeaTea/WeaneapeaGeaMea5F:qaM9Wmgvq5E2TwUlu53q27
- TLSH T13F162A03BA85DB1ED0690A324E76F5B50276FD546D29DC9BF236B39E29333835E02712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4039102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ