Roblox-BloxFlip-Predictor-main.zip
- SHA256 847accb954c31422c9313aea50e04df499cd7def75355e2ffd18b52a4b28e744
Password
her
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Roblox-BloxFlip-Predictor-main/Predictor.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Roblox-BloxFlip-Predictor-main/mlib_image.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Roblox-BloxFlip-Predictor-main/updater/bdfilters.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Roblox-BloxFlip-Predictor-main/updater/libcurl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Roblox-BloxFlip-Predictor-main.zip
- Size 1.8MB
- Sample260820-sd9tessydy
- SHA256 847accb954c31422c9313aea50e04df499cd7def75355e2ffd18b52a4b28e744
- MD5 1efb2023ec095ef5a7d2add94df71c8d
- SHA1 2454f7c368d4d7549e0ac68f4634af882ad1afeb
- SHA512 b7eb4457cd6e39f6e0ae1ebad2f76be80bacbb6d2cb3ee2cb3e80fcd3c40919ab8551ea92c4c56af4427da1c6ba999d21501c1bed878b6c0dc5fe0754560e39a
- SSDEEP 49152:Wbas3QSXFqK91oOUaSWzWtTlQ6FK0liQcux+tpB1uHLkNK7Yo:Wbas3Qc8A1oajWtTlUUcXWP
- TLSH T1CD953347A4ADCE1FAC6CDEBF5B5144C887890F7117AAA4096D08BF73DEC31A9958D0C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 2 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/Roblox-BloxFlip-Predictor-main/mlib_image.dll unpack001/Roblox-BloxFlip-Predictor-main/updater/libcurl.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Roblox-BloxFlip-Predictor-main/Predictor.exe
File Explorer
-
Roblox-BloxFlip-Predictor-main.zip.zip 1.8MB
-
Roblox-BloxFlip-Predictor-main/Login-Keys.txt37B
-
Roblox-BloxFlip-Predictor-main/Predictor.exe.exe 490KB
-
Roblox-BloxFlip-Predictor-main/README.md957B
-
Roblox-BloxFlip-Predictor-main/Settings.json2KB
-
Roblox-BloxFlip-Predictor-main/license.md682B
-
Roblox-BloxFlip-Predictor-main/mlib_image.dll.dll 561KB
-
Roblox-BloxFlip-Predictor-main/updater/LICENSE7KB
-
Roblox-BloxFlip-Predictor-main/updater/README.md2KB
-
Roblox-BloxFlip-Predictor-main/updater/bdfilters.dll.dll 4.1MB
-
Roblox-BloxFlip-Predictor-main/updater/gup.xml.xml 4KB
-
Roblox-BloxFlip-Predictor-main/updater/libcurl.dll.dll 532KB
Roblox-BloxFlip-Predictor-main/Login-Keys.txt
- SHA256 c656f8e3970e334dbc6ac21919fbf5e1c049b065aa4c6df4041be6de32cddf3f
- MD5 8ac2b0861b4ac4edf7e79ea45aa7bc24
- SHA1 fd9995e5cc87c6c146121015dc03a53ed59ef4bf
- SHA512 c008bfdce760f71a38795d9f1d9fd63cf6c626830782ab8d2c17bdc6983dd532be3a20a34589e972c421765f3a16aceb04a02ccc1ee2a77d0e611e1481ef30ae
- MD5 SHA1 SHA512
Roblox-BloxFlip-Predictor-main/Predictor.exe
- SHA256 f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478
- MD5 9c9245810bad661af3d6efec543d34fd
- SHA1 93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d
- SHA512 90d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767
- SSDEEP 6144:3PkcFUUUQHs5TlOhDuy4VjmSO6/tU4j06xeJyCjvhsXZ4m05d0qCsfBLuWWCV/rr:3McWUUysz/NhKjJPhM4/5bV/rvgE3
- TLSH T11DB4CF09724740F1E27A9AF20648F93C873AD928CFF669575F714A3D97E214C0B7862E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
her
Minor OS version
0
Major OS version
6
Entry point
29747
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
145KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
329KB
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.kbvtrz
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Roblox-BloxFlip-Predictor-main/README.md
- SHA256 c6e09d360c9675c9a7d87642f18bc26f3b5c61403e83d7c93aef96d8c20c0e04
- MD5 0fe99e683326e19648632fe67478bf38
- SHA1 43ad9d48818368203509322bd96ae9ff3da7489f
- SHA512 cee4d72a552996129721dc92c3b193f03acd38111c1952b620e04ecacc373a4650a292cbfd32583039686864e592227f5a72e706ae6f8f4b4334fe30e75fadb7
- TLSH T1641150BBAAF1364AEB02A587B6D311F2CE9E223981BCCF05E00D024C27850D8407F0DE
- MD5 SHA1 SHA512 TLSH
Roblox-BloxFlip-Predictor-main/Settings.json
- SHA256 0477071ba44749a30bdf3a47129d6ff29daf7acd804a4780b9341b0a3e2d1e04
- MD5 208145d69a913d91894d694cc91d8786
- SHA1 31a714e14dd2671ecec3f0946b3dfbd24548c458
- SHA512 9da1419d8ae3c3251411c7f54f32f591c5dd273b3b6e3e3d6a78c694ca20d1e24d964b49cd17cbaf2299e24343b815ff08d61c8425b5454dc678c73d4a50c620
- TLSH T12C418394AFBD2A52743F855852A89348DA3F5F00200883DF7A3AC49ACDF29D5D67F911
- MD5 SHA1 SHA512 TLSH
Roblox-BloxFlip-Predictor-main/license.md
- SHA256 ed9373ac40548960ab9e25596931cb02bb147a02c8de868f0df18cbaa16c41e9
- MD5 009b0ae82c653c00ecc28997c3db87f4
- SHA1 73a0cec9b74d30e7b51e19551a37aed9d50c7f5c
- SHA512 7c01f800040544b37f4e277514359e5d363e834dfd02e54c5eb0281da631ba71c127b3e1d65168472dbc264a40dd4a303a50064d2697c9641ae10058e7383610
- TLSH T13601105D1450C7B78C4012C97D4655CFE327AA53B1EC84D0110A935F8606E7616E64D8
- MD5 SHA1 SHA512 TLSH
Roblox-BloxFlip-Predictor-main/mlib_image.dll
- IMPHASH 6e21d83f5e6ff110ff2f01a63cf53a03
- SHA256 9fc49b3f6fd11a2b2b92748c24f21721d1011b1920d092e38af4021102125543
- MD5 5e1b7d0accb4275deab6312aa246cb3e
- SHA1 488a5cb9d9c0cf27824df32b9b76d4f67f6fb485
- SHA512 5a875dd4731e862f753ebb987593dc61d39dd3d3d13cded284de27dd09afa946fa96824ac194ec0dd45aa2ce0d56637a5522f49f28f3c89b7f5248d389b1b62e
- SSDEEP 12288:NtKMEr1LBBgPcvhwhtRtL+tKJZetu4zxLukaMevlOjPMat4+8NMutQaLqqiINw3X:NtKMEr1VBgPcvhwhtRtL+tkZezxLuQeS
- TLSH T111C45BC0CAEF64C5E84A1C3550627927DA24AB2D4615D7B2FBA49F03F871B03DC7A389
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Password
her
Digest
27:41:04:f2:42:5b:bd:6d:ea:69:d2:51:dd:e6:61:de:3d:81:a6:7c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US
Chains
Jun 22, 2016
CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US
Serial Number
12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 14, 2015 - Apr 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Minor OS version
1
Major OS version
5
Entry point
513789
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libmlib_image\mlib_image.pdb
msvcr100
__dllonexit
_unlock
_onexit
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
free
malloc
_lock
memset
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
j2d_mlib_ImageAffine
j2d_mlib_ImageConvKernelConvert
j2d_mlib_ImageConvMxN
j2d_mlib_ImageCreate
j2d_mlib_ImageCreateStruct
j2d_mlib_ImageDelete
j2d_mlib_ImageLookUp
Name
.text
Size
499KB
Virtual Size
499KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=38, id=1, productName=Unmarked objects,
count=6, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=68, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Roblox-BloxFlip-Predictor-main/updater/LICENSE
- SHA256 319917f5ccd09878db6f67c9a77dee846055644ca49eb535628b9e020a87261e
- MD5 8e3494bf8cf1967afd3b1016fbbe5bb0
- SHA1 b1608abb6e19ef60f4b9c52f6e05bf81cc97d0c2
- SHA512 11294efdbf6203801edfc8c4a55e106e80196ae65bb024359c3d105736251be5ed7a5a1e802cb492be112668e1c6a632eca4cbcf9be62775a82adf6e5ecb974e
- SSDEEP 192:HhKdfuB05iy5ylXFln0LxDvvzDyf1/rKpC:4dfsgi6uD0LlPs
- TLSH T11DF1EF6B970153B202E305416E4EA1CEE36AA07B36778D6438A9C25C177BC3493B76ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Roblox-BloxFlip-Predictor-main/updater/README.md
- SHA256 aef40520cf12a0842097e8cfbeb9d9128f52573e5f90ca12d4a0a9045978547e
- MD5 9f56b12cbffcfad543fb1f91e3955f1b
- SHA1 406e1423549a8f5e97d8d8e37d5e7f6f4da8194b
- SHA512 c09cbf4d7ac9e9f78bb1554c5c77d1e7943a4f6a937c5872c91ccfd38c2a0296850a0d125314d0030d948366e7f2529ea7d8cf28ab52a5170627738436d004a1
- TLSH T1CD51531B8CAED23117B0C54162880AB6F71E403A67854854BC39805C57F2D26EFBF7AD
- MD5 SHA1 SHA512 TLSH
Roblox-BloxFlip-Predictor-main/updater/bdfilters.dll
- IMPHASH 27f07fb2c76df7e3ac5b98f25b3ec3e4
- SHA256 9cbc29696ad2d582e251bf9c4be5cce618753fa43551d2474e1ae5cc5e1245e5
- MD5 ed730387fdcd684b756601b863c47417
- SHA1 c49ed6d0d46facf4ceaeb21f5d6bfdf9e3587fde
- SHA512 e32df727799d33922c6e92f94a7bdb0bc2772d6a6636d15e285d94d3ae4661062e5bc89ec3546b76ec853398f88d972f461327ef687f89093acf1096560d5c3f
- SSDEEP 98304:Xl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KChvvvveo:XuqYuQxqYfHYosUiJoviVKvvvvJ
- TLSH T10B167DC3E6FF52E0D4551874203FB92BA6346B0A810CE6A2F1D56F1AFC377825AA7345
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
her
Digest
45:06:2b:f0:1d:27:89:a9:02:53:7b:c9:d5:f6:5e:18:8a:74:16:c5:67:8a:7d:20:ea:63:3a:79:67:0b:15:c5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Bandicam Company,O=Bandicam Company,L=Seoul,ST=Seoul,C=KR
Chains
Jan 26, 2017
CN=Bandicam Company,O=Bandicam Company,L=Seoul,ST=Seoul,C=KR
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Digest
93:f0:9b:79:8a:97:12:82:09:13:a2:12:d6:8a:ac:56:4b:e9:34:4d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Bandicam Company,O=Bandicam Company,L=Seoul,ST=Seoul,C=KR
Chains
Jan 26, 2017
CN=Bandicam Company,O=Bandicam Company,L=Seoul,ST=Seoul,C=KR
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Bandicam Company,O=Bandicam Company,L=Seoul,ST=Seoul,C=KR
Serial Number
6b:1d:d3:51:47:33:be:24:c6:cc:e8:81:6d:d7:a4:a0
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 4, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
0
Major OS version
5
Entry point
260066
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
e:\w\devel\CAP\bandifilters\bin\bdfilters.pdb
comctl32
ord17
kernel32
lstrcmpW
CreateEventA
CloseHandle
WaitForSingleObject
CreateThread
SetEvent
GetProcAddress
GetModuleHandleA
WideCharToMultiByte
GetACP
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrlenW
GetCurrentThreadId
GetTickCount
InterlockedIncrement
FreeLibrary
InterlockedDecrement
GetLastError
lstrcpynW
GetVersionExA
GetSystemInfo
VirtualAlloc
VirtualFree
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
SetFilePointer
MultiByteToWideChar
lstrlenA
DisableThreadLibraryCalls
GetCurrentProcess
GetModuleFileNameA
LoadLibraryA
VirtualQuery
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
IsValidCodePage
GetOEMCP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
WriteFile
GetCurrentProcessId
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
HeapAlloc
HeapFree
ExitThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetModuleHandleW
TlsGetValue
SetLastError
user32
DestroyWindow
DefWindowProcA
wsprintfA
ShowWindow
GetWindowLongA
SetWindowLongA
CreateDialogParamA
MoveWindow
LoadStringA
GetDesktopWindow
GetWindowRect
LoadStringW
InvalidateRect
advapi32
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyA
shell32
ShellExecuteA
ole32
StringFromGUID2
CoUninitialize
CoFreeUnusedLibraries
CoCreateInstance
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CreateAudioDecoder
CreateVideoDecoder
CreateVideoDecoder_mjpeg
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
297KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=166, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=239, id=125, productName=VS2005 build 50727, version=50727,
count=2554, productName=Unmarked objects (old),
count=35, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=120, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=168, id=1, productName=Unmarked objects,
count=5, id=109, productName=VS2005 build 50727, version=50727,
count=59, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=62, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Roblox-BloxFlip-Predictor-main/updater/gup.xml
- SHA256 d3e6404c7286961cbab82d4c49f82bcb166db9b5a13eacaa0eeb59a0709a0c14
- MD5 b023cc4d768b34a5401f317479740a53
- SHA1 4ca45db707b120bca9cb6cd8404b9e6ecabdb2d2
- SHA512 82829b0d22cdb857cf1d299a9898d1862b61cd3c22eb05cb638391d3a54b12d5dd7a824ef838a9453e2c2b85c516eacad18b6d19221ad24f0bcedc2fff942e25
- SSDEEP 96:rrxgFDl+72Y+WbPRkrm1+U4ZkG6QrABYUCJ8PYPwJrkFI:rVgFhunzbpka1+UL2sBCPwJrkFI
- TLSH T1FA91954F5BDCC3770C3112A178AE5191D33405F972B4500538A88197A36AEB2BBBF7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Roblox-BloxFlip-Predictor-main/updater/libcurl.dll
- IMPHASH 5358152c0d79f70fd94d03415e08ddbe
- SHA256 79f567797066f6206ea870ffda11cf92612aea0ee3a26582be38ddd0fd51fa53
- MD5 8da7e810e0f12b16fe6087aadda7a69c
- SHA1 e76539074da170bf52a9cc06863ff8cb498c76e6
- SHA512 7d9d40e501c9128cb81af785091aaca60b8b92af57a69f1f498bd810431e3521f9431161f8c3e4061b7e0ba2c3dfc8034e66bc4c05f5e39941623b04d367775d
- SSDEEP 6144:y6NI7/hgoJrPOkFVuW6ZoiPPnk/9AAQIPGBxTShA9ZvT6QKob6LHywHFE1P+wTt4:u/ZhPxVOdk/4IPETvzhHuzE1P+wTt4
- TLSH T1B9C48CA9B7B407B9E5A7C138C5538607E6B2B4651350E7CF43A48B7A2F23BE1163B710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Password
her
Digest
d7:72:1f:92:20:53:08:c6:de:a0:a9:f2:a3:a6:84:7c:d4:2a:1c:24
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Chains
Feb 14, 2021
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Serial Number
01:34:25:92:a0:01:0c:b1:10:9c:11:c0:51:9c:fd:24
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 3, 2019 - May 11, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
288240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
ntohl
htonl
gethostname
ioctlsocket
freeaddrinfo
getaddrinfo
sendto
recvfrom
select
__WSAFDIsSet
WSAIoctl
WSASetLastError
socket
setsockopt
getsockopt
getpeername
connect
closesocket
WSACleanup
WSAStartup
ntohs
listen
htons
getsockname
bind
accept
WSAGetLastError
send
recv
wldap32
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord143
advapi32
CryptDestroyHash
CryptGenRandom
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
normaliz
IdnToAscii
crypt32
CertFreeCertificateContext
kernel32
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
HeapReAlloc
FlushFileBuffers
LCMapStringW
CompareStringW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetACP
HeapAlloc
HeapFree
GetConsoleCP
WriteFile
ReadConsoleW
GetConsoleMode
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetEndOfFile
GetFileAttributesExW
GetStringTypeW
GetTimeZoneInformation
HeapSize
WriteConsoleW
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetTickCount64
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
GetLastError
PeekNamedPipe
WaitForMultipleObjects
FreeLibrary
GetProcAddress
SleepEx
SetLastError
FormatMessageA
Sleep
CloseHandle
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
RaiseException
VerifyVersionInfoA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetFilePointerEx
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info
Name
.text
Size
387KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=25203,
count=6, id=259, version=25203,
count=169, id=261, version=25203,
count=6, id=199, version=41118,
count=7, id=259, version=24123,
count=21, id=261, version=24123,
count=19, id=260, version=24123,
count=13, id=257, version=25203,
count=173, id=1, productName=Unmarked objects,
count=126, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,