30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af

Sharing

Copy URL Twitter E-mail

General

Target
30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af
Size 10.8MB
Sample260823-wp7d8atwey
SHA256 30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af
MD5 430a2b9e2bc00dfa7a47876c95544909
SHA1 4a6896edf2346e82cd35051f5174f42c860d1c62
SHA512 2d79df218364a93fd20be6bfdbb113495847b616d29360c5d112bf1c6738bd2b6d06d9d0dd57dea09118240e55efff8ecd13de842d8707b9f46d44ea133af0d1
SSDEEP 196608:vJ8yPWW/1Qcp2GPMf0GS+p5ELIP0PxO3L+6hJpRzBkPuONPh4tkewSTiVf8I6:vJ8yv/aA4H1g+0P2CmbkPuONPatzwuw6
TLSH
T12BB633946914EFB3E1F213B18DBD99B0575F3DA8A85E630395B532C2ECE77A25C010AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af
unpack001/$PLUGINSDIR/BCompare.exe
unpack001/$PLUGINSDIR/BCompare.tr

File Explorer

30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af

.exe 10.8MB
$PLUGINSDIR/7z.dll

.dll 1.3MB
$PLUGINSDIR/BC5Key.txt

568B
$PLUGINSDIR/BCDarkTheme.vsf

115KB
$PLUGINSDIR/BCUnRAR.dll

.dll 331KB
$PLUGINSDIR/BComp.com

.exe 122KB
$PLUGINSDIR/BComp.exe

.exe 116KB
$PLUGINSDIR/BCompare.exe

.exe 35.5MB
$PLUGINSDIR/BCompare.tr

.dll 426KB
$PLUGINSDIR/Patch.exe

.exe 120KB
$PLUGINSDIR/PdfToText.exe

.exe 1.1MB
$PLUGINSDIR/mime.types

53KB
$PLUGINSDIR/mscoree.dll

.dll 11KB

30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af
MD5 430a2b9e2bc00dfa7a47876c95544909
SHA1 4a6896edf2346e82cd35051f5174f42c860d1c62
SHA512 2d79df218364a93fd20be6bfdbb113495847b616d29360c5d112bf1c6738bd2b6d06d9d0dd57dea09118240e55efff8ecd13de842d8707b9f46d44ea133af0d1
SSDEEP 196608:vJ8yPWW/1Qcp2GPMf0GS+p5ELIP0PxO3L+6hJpRzBkPuONPh4tkewSTiVf8I6:vJ8yv/aA4H1g+0P2CmbkPuONPatzwuw6
TLSH
T12BB633946914EFB3E1F213B18DBD99B0575F3DA8A85E630395B532C2ECE77A25C010AC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/7z.dll

IMPHASH 798aaa6264af3f5296c893624ce39150
SHA256 dcf03cae509739d2242b4fb65eeaf52ad316f999c4934c5c971606b3ed742380
MD5 13c006e362a0d918db33667684cb9abd
SHA1 da784ebccdf9a1606117ad2dabd9e329ff6a160e
SHA512 f5a1273a249ac8e9b75db1918da6bf0d95622df336572211e800d225162acd54b83b674b3692cfab1106c893ac60dae2bb5e57843c12d421b785dbb0915d15e3
SSDEEP 24576:k0p4+kpYxuzmZlGU4j4j/M5TfhfYBSGZm9AE/0vA9g5eYoWbDuzY295MEYK:k06+kpYtGU48/MlfR648A9Em029WI
TLSH
T1BB559E11F7B1C0B4D58D5630862DBBBA50F8E729CA20A8D777C0BE6E6F319D2C235619
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

a5:9f:1c:14:e9:33:e3:4b:72:35:e5:b3:58:b7:d7:ff:a8:0e:d7:5d:e9:9f:dd:37:b8:51:5e:2d:4d:c0:49:9c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

Chains

Jul 6, 2026

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

Serial Number

c0:91:4b:62:f2:c4:fc:88:16:4e:6c:2b:24:a6:85:85

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 17, 2025 - Nov 16, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

952383

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

SysAllocStringByteLen SysAllocStringLen SysAllocString SysFreeString SysStringLen VariantCopy VariantClear

user32

CharPrevExA CharUpperW

msvcrt

_adjust_fdiv _initterm _onexit __dllonexit ?terminate@@YAXXZ ??1type_info@@UAE@XZ _except_handler3 _beginthreadex realloc strchr memset free malloc strlen wcscmp strcmp strstr memmove _CxxThrowException memcpy memcmp _purecall __CxxFrameHandler

kernel32

GetCurrentProcessId InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW ResetEvent SetEvent CreateEventW SetThreadAffinityMask ResumeThread WaitForSingleObject InterlockedIncrement GetVersion IsProcessorFeaturePresent GetModuleHandleW VirtualFree VirtualAlloc LoadLibraryW FreeLibrary QueryPerformanceCounter GetOEMCP DeleteCriticalSection GetVersionExW LocalFileTimeToFileTime WaitForMultipleObjects EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime FileTimeToDosDateTime DosDateTimeToFileTime GlobalMemoryStatus GetSystemInfo GetCurrentProcess GetProcessAffinityMask FileTimeToLocalFileTime FileTimeToSystemTime CompareFileTime GetLastError MultiByteToWideChar WideCharToMultiByte CloseHandle SetFileTime CreateFileW SetFileAttributesW CreateDirectoryW DeleteFileW SetLastError GetCurrentDirectoryW GetTempPathW GetTickCount GetCurrentThreadId GetFileInformationByHandle FindClose FindFirstFileW GetProcAddress GetModuleHandleA GetFileAttributesW ReadFile WriteFile

Name

.text

Size

1005KB

Virtual Size

1005KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/BCUnRAR.dll

IMPHASH f650df5b9d7e05ee5a4f68cce3e8cc66
SHA256 2a6bf612d52020e1479e9308a5ecd5e382f9f7b799e169a174a834c6e9bf4188
MD5 9a3f047220d30830e211cb0f02a04b08
SHA1 c335c723560d6fb416758c0e561e37826e174e71
SHA512 887b39ba298567a0a9bc0453c0c7e21bd2d481937dfc89c63388ddbcb9e27d1f522f8b7f127bc3ae0dee9eaf98a84d808f03a32cc94847f6368cc4f4edbd9c61
SSDEEP 6144:TR9op0t7ou7sLTUhCNc2U7gG9/gE1zQ5LmayLzlHtla3YNFFKdwevH9:V9oGt17mTUUy2Usg/7QIDz5tL6wevH9
TLSH
T18C74AF30B993C0B2E99E0970782D9FABAD3D6B601F7194CBE3D04CF65D202D16736969
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

0c:f7:94:1a:03:34:15:45:3a:d4:b4:31:0c:a8:2f:b2:29:a9:c6:57:a9:be:18:54:35:f6:ac:56:d8:26:21:3b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 109885,CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e436861726c6f7474656e62757267,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jun 27, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:8b:08:39:9e:c7:03:62:3c:72:cd:20:77:ad:65:d9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2023 - Aug 7, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

211760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Projects\WinRAR\rar\build\unrardll32\Release\UnRAR.pdb

kernel32

DeviceIoControl CreateHardLinkW GetLongPathNameW GetShortPathNameW MoveFileW FlushFileBuffers ReadFile SetEndOfFile SetFilePointer WriteFile CreateDirectoryW GetFileAttributesW SetFileAttributesW GetCurrentProcessId FindClose FindFirstFileW FindNextFileW GetVersionExW GetCurrentDirectoryW GetFullPathNameW GetModuleFileNameW FoldStringW FreeLibrary GetProcAddress CreateEventW GetCurrentProcess SetThreadPriority CloseHandle GetSystemDirectoryW LoadLibraryW SetThreadExecutionState InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW CreateThread GetProcessAffinityMask FileTimeToLocalFileTime LocalFileTimeToFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime CompareStringW MultiByteToWideChar WideCharToMultiByte GetCPInfo IsDBCSLeadByte DecodePointer HeapSize GetConsoleOutputCP SetFilePointerEx GetStringTypeW GetProcessHeap GetCommandLineW SetFileTime RemoveDirectoryW DeleteFileW CreateFileW Sleep SetLastError GetLastError AreFileApisANSI GetConsoleMode GetFileType GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException RtlUnwind InterlockedFlushSList EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW QueryPerformanceFrequency ExitProcess GetModuleHandleExW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW SetStdHandle HeapReAlloc FindFirstFileExW IsValidCodePage WriteConsoleW

user32

CharLowerW CharToOemBuffW CharToOemA OemToCharBuffA OemToCharA CharUpperW

advapi32

LookupPrivilegeValueW FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken SetFileSecurityW

Name

.text

Size

260KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/BComp.com

IMPHASH d3fe232a4a197c12c33e6126930b0eed
SHA256 d8d9d88a203feb473761b54f0979520d405baf198ea2eee59833a8e1e0359cc9
MD5 dafc26d851aaf5dc61202241b4a8bb82
SHA1 a6e84f72733951274496e775b36f357047ef6304
SHA512 d488cbe586ca7e8e71d5eb24fc9f5071edc2bd74e5b7489610d823698c14cf560fe81f9deb87371b2231a4ac3de8b5213f1df56d4a770bf83a1d88a483767955
SSDEEP 3072:Lc3qMW05nHiKF3p6pDrt4FqHDehyIHybuQ7RiWBG7k:Lc3bRndhqqtQ7RiWBG7k
TLSH
T1A3C35B037FD04031E0660B7A6FF9A6559E7BB9313932885FE2AD4A4D0EF6BC0581935B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

e1:fd:cd:a2:9f:42:ce:1f:f7:e1:d2:d0:10:05:81:ca:e9:53:84:4c:44:f0:d8:db:f3:d9:39:65:99:df:a8:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

Chains

Oct 3, 2024

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

a3:57:d6:2a:e7:36:b2:da:d3:92:c2:12:3d:ef:82:b8:4f:f8:12:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

Chains

Oct 3, 2024

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

Serial Number

d6:86:9e:e0:70:f2:58:87:75:30:41:82:1f:9d:c4:8d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 16, 2022 - Dec 15, 2025

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

82336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey

user32

LoadStringW MessageBoxA CharNextW CreateWindowExW TranslateMessage RegisterClassW PeekMessageW MsgWaitForMultipleObjects MessageBoxW LoadStringW DispatchMessageW DefWindowProcW CharUpperW CharToOemW

kernel32

lstrcmpiA LoadLibraryA LocalFree LocalAlloc Sleep VirtualFree VirtualAlloc GetACP GetSystemInfo GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte SetCurrentDirectoryW MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCurrentDirectoryW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileW CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW WriteFile WideCharToMultiByte WaitForSingleObject VirtualQuery SetEvent ResetEvent OutputDebugStringW OpenProcess LocalFree IsValidLocale GetVersionExW GetThreadLocale GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLastError GetFileAttributesW GetExitCodeProcess GetEnvironmentVariableW GetDiskFreeSpaceW GetCommandLineW GetCPInfo FreeLibrary FormatMessageW FindFirstFileW FindClose EnumSystemLocalesW EnumCalendarInfoW CreateProcessW CreateFileW CreateEventW ReplaceFileW CompareStringW CloseHandle

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.text

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

19KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

154B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/BComp.exe

IMPHASH ea95338398cd876eacac2c497dd49e80
SHA256 3136cccf101a7210e3d530b09b635ee70bd645127eb914941bdcc9b58abc3ced
MD5 7508ac91f32709ae8fb76df339518d89
SHA1 44a44903c5f2e0d9360f0a2107a8a392a9b75e8a
SHA512 bffb4219ac8837ba8fddd7b56d80da57b546f2c08330228d731e697b11810919322b94205afad1a5e9331c07e22d1cc91019fe8a915acc7c28aa5507e2f5379f
SSDEEP 3072:osHaM/wHVH6aARD1yyCDMu37RixMBjI7yW:osHL/w1Yq37RixMBjI7yW
TLSH
T19CC36C13BBC00431E1D70BB96CE96725DE7FFB303A22586F62A94A4A0EE57C15D1931B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

ee:72:1d:9b:cf:61:1d:f3:0f:06:7a:58:a5:45:0b:66:10:05:ce:c5:c8:77:a2:d3:b0:d9:7f:d6:92:8d:99:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

Chains

Oct 3, 2024

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

ca:90:a1:32:53:41:26:c0:d3:90:68:8e:f3:57:8d:72:07:9a:d3:ed

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

Chains

Oct 3, 2024

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

Serial Number

d6:86:9e:e0:70:f2:58:87:75:30:41:82:1f:9d:c4:8d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 16, 2022 - Dec 15, 2025

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

78240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey

user32

LoadStringW MessageBoxA CharNextW CreateWindowExW TranslateMessage RegisterClassW PeekMessageW MsgWaitForMultipleObjects MessageBoxW LoadStringW DispatchMessageW DefWindowProcW CharUpperW

kernel32

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

shell32

ShellExecuteW

Name

.text

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

19KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

154B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/BCompare.exe

IMPHASH 26c71715fd494b165c3c3d4bf918f257
SHA256 620f93d52cb819b154d5492a29d20441b232440996691b720ef2e9ab90117a2d
MD5 fd8b0918e4c406c23408ff61aa65ae63
SHA1 f844b327d590d13566462d465d5092d7a95827b0
SHA512 f921520af88a811cbb159eedd78a7cd0e502fb1d4c66f8ec69a24bd34980a86c652b8f3e332cd4a1f751c50347e8e37867d922e69cf9c82bcf3808b39fbd8686
SSDEEP 393216:KJ/+1Dn/7yvsiMCawXyA4it9N9Yhz2c4iERhz0w4NlPsJ8tG2IhejKLAYo5SCnF0:NSXfr0w4NlW2KLyIQtpLdpviBF
TLSH
T1B7876C16B3469136D857197ACC6FDAA0343EBDB01A2488EF37E47F3E1E397422916607
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20172252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

mpr

WNetGetLastErrorW WNetEnumResourceW WNetGetUniversalNameW WNetGetConnectionW WNetCloseEnum WNetAddConnection2W WNetAddConnection3W WNetCancelConnection2W WNetOpenEnumW

winmm

PlaySoundW

shlwapi

PathCreateFromUrlW SHCreateStreamOnFileW StrRetToBufW UrlCreateFromPathW SHStrDupW

wininet

InternetCloseHandle InternetCrackUrlW InternetReadFile InternetErrorDlg HttpOpenRequestW HttpSendRequestW InternetConnectW InternetOpenW HttpQueryInfoW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comdlg32

PrintDlgExW ChooseFontW ChooseColorW GetSaveFileNameW GetSaveFileNameA PrintDlgW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

shell32

SHGetSettings DragAcceptFiles SHGetInstanceExplorer ILFindLastID SHGetFolderPathW SHGetFileInfoW ILRemoveLastID SHGetDesktopFolder SHFileOperationW ShellExecuteW ShellExecuteA ILCloneFirst DragQueryFileW SHGetSpecialFolderLocation Shell_NotifyIconW ILCombine SHGetDataFromIDListW ShellExecuteExA SHGetPathFromIDListA SHGetPathFromIDListW DragFinish ILGetNext SHGetMalloc ILFree ILClone SHAppBarMessage SHAddToRecentDocs

urlmon

CoInternetCreateSecurityManager

user32

CopyImage MoveWindow SetMenuItemInfoW GetMenuItemInfoW DefFrameProcW SetCaretPos DrawTextA GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect UnregisterClassA ClipCursor SendMessageA IsClipboardFormatAvailable EnumWindows ShowOwnedPopups GetClassInfoExW GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW EnumChildWindows SendMessageTimeoutA SendNotifyMessageW GetScrollBarInfo UnhookWindowsHookEx SetCapture GetCapture ChildWindowFromPointEx CreatePopupMenu ShowCaret GetMenuItemID DestroyCaret CharLowerBuffW PostMessageW SetWindowLongW DrawMenuBar SetParent IsZoomed GetClientRect IsChild LoadImageA SendDlgItemMessageW ShowCursor IsIconic CallNextHookEx CloseDesktop ShowWindow SetForegroundWindow GetWindowTextW PostThreadMessageA DestroyWindow IsDialogMessageW RegisterClassW EndMenu CharNextW GetFocus GetDC GetThreadDesktop SetFocus ReleaseDC CreateWindowExA GetClassLongW GetMessageA DrawTextW SetScrollRange PeekMessageA MessageBeep SetClassLongW SetRectEmpty LockWindowUpdate RemovePropW AttachThreadInput GetSubMenu OpenInputDesktop EqualRect DestroyIcon IsWindowVisible FlashWindowEx DispatchMessageA PtInRect UnregisterClassW GetTopWindow SendMessageW GetMessageTime GetComboBoxInfo CreateMenu LoadStringW CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW CharLowerBuffA SetWindowLongA EnumClipboardFormats GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetMenu GetMenuState GetMenu SetRect GetKeyState IsRectEmpty ValidateRect GetCursor GetWindowTextA KillTimer WaitMessage RegisterClassA TranslateMDISysAccel GetWindowPlacement GetClipboardFormatNameW CreateIconIndirect GetMenuItemRect CreateWindowExW ChildWindowFromPoint GetMessageW GetDCEx DrawCaption PeekMessageW MonitorFromWindow RegisterDeviceNotificationW GetUpdateRect AnimateWindow MessageBoxA SetTimer AllowSetForegroundWindow WindowFromPoint BeginPaint RegisterClipboardFormatW MapVirtualKeyW OffsetRect IsWindowUnicode DispatchMessageW CreateAcceleratorTableW DefMDIChildProcW GetSystemMenu SetScrollPos GetScrollPos InflateRect DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup CallWindowProcA GetSystemMetrics SetWindowTextA CharUpperBuffW GetClassNameA ClientToScreen SetClipboardData GetClipboardData SetWindowPlacement GetMonitorInfoW CheckMenuItem CharUpperW UnregisterDeviceNotification DefWindowProcW GetForegroundWindow EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx FindWindowA LoadKeyboardLayoutW ActivateKeyboardLayout GetParent CreateCaret MonitorFromRect InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW EmptyClipboard GetAncestor GetDlgItem AdjustWindowRectEx DrawIcon IsWindow EnumThreadWindows InvalidateRect GetKeyboardState OemToCharBuffW DrawFrameControl ScreenToClient BringWindowToTop SetCursor CreateIcon RemoveMenu AppendMenuW GetKeyboardLayoutNameW OpenClipboard TranslateMessage MapWindowPoints EnumDisplayMonitors CallWindowProcW CountClipboardFormats CloseClipboard DestroyCursor PostMessageA UpdateLayeredWindow CharUpperBuffA CopyIcon PostQuitMessage ShowScrollBar EnableMenuItem LoadImageW HideCaret FindWindowExW MonitorFromPoint LoadIconW SystemParametersInfoW GetWindow DefWindowProcA GetWindowLongW GetWindowRect InsertMenuW PostThreadMessageW IsWindowEnabled IsDialogMessageA GetMenuDefaultItem FindWindowW DeleteMenu GetUserObjectInformationW GetKeyboardLayout

version

GetFileVersionInfoSizeW GetFileVersionInfoSizeA VerQueryValueW VerQueryValueA GetFileVersionInfoW GetFileVersionInfoA

uiautomationcore

UiaReturnRawElementProvider

oleaut32

SafeArrayPutElement SetErrorInfo GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SysAllocString SafeArrayCreate CreateErrorInfo SafeArrayGetElement GetActiveObject SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex SysStringByteLen VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

msvcrt

isupper toupper memchr memcmp memcpy memset sprintf strlen strcpy strcat iscntrl _open isgraph isxdigit _close islower tolower strncmp strerror _read isalpha isalnum isprint _lseek isspace _vsnprintf ispunct _write

advapi32

CryptExportKey RegEnumKeyA CryptDecrypt CryptEncrypt CryptDestroyKey CryptImportKey CryptDestroyHash RegUnLoadKeyW CryptReleaseContext RegSaveKeyW CryptVerifySignatureW RegReplaceKeyW CryptDuplicateKey GetTokenInformation RegCreateKeyExA RegCreateKeyExW CryptAcquireContextW SetSecurityDescriptorDacl RegEnumKeyExW AdjustTokenPrivileges CredReadW LookupPrivilegeValueW RegOpenKeyExA RegOpenKeyExW AllocateAndInitializeSid RegDeleteValueW RegDeleteValueA CredFree RegFlushKey RegEnumValueW RegQueryValueExA RegQueryValueExW CryptContextAddRef CryptHashData InitializeSecurityDescriptor RegRestoreKeyW RegSetValueExA RegSetValueExW RegConnectRegistryW CryptGetUserKey GetUserNameA GetUserNameW DeregisterEventSource RegQueryInfoKeyW RegQueryInfoKeyA CryptGenRandom CryptGetHashParam CryptSetHashParam RegisterEventSourceW CryptSignHashW CryptDeriveKey CryptSetProvParam CryptGetProvParam RegLoadKeyW CryptGetKeyParam CryptSetKeyParam GetSecurityDescriptorControl RegDeleteKeyW CryptGenKey OpenProcessToken FreeSid ReportEventW GetNamedSecurityInfoW SetNamedSecurityInfoW RegCloseKey CryptCreateHash

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpOpen WinHttpGetProxyForUrl

kernel32

SetFileTime GetFileType GetFileTime GetACP GetExitCodeProcess LocalFree CloseHandle SizeofResource GetCurrentProcessId Beep TerminateThread IsValidCodePage IsDebuggerPresent FindNextFileW GetFullPathNameW ReplaceFileW GetCPInfoExW GlobalSize GetSystemTime SetUnhandledExceptionFilter GetTempPathA EnumSystemLocalesW GetTimeZoneInformation FileTimeToLocalFileTime GetVersionExA FreeLibrary HeapDestroy DosDateTimeToFileTime GetUserDefaultLCID GetDiskFreeSpaceA FindFirstFileA SetLastError GetModuleFileNameW GetLastError GlobalAlloc GlobalUnlock CompareStringW CreateThread CreateMutexW LoadLibraryA ResetEvent GetVolumeInformationW RaiseException FindFirstChangeNotificationW FormatMessageW FoldStringW GetCurrentThread GetLogicalDrives CreateFileMappingA IsBadReadPtr ExpandEnvironmentStringsW GetComputerNameA LoadLibraryExW MoveFileWithProgressW FileTimeToSystemTime GetShortPathNameW EnumSystemCodePagesW VirtualQuery GlobalFindAtomW VirtualQueryEx Sleep SetFilePointer FlushFileBuffers LoadResource SuspendThread GetTickCount WaitForMultipleObjects OpenFileMappingA FindNextFileA GetFileSize GetStartupInfoW GetFileAttributesW LocalSize VerLanguageNameW GetThreadPriority SetThreadPriority VirtualAlloc AttachConsole GetSystemInfo GetTempPathW LeaveCriticalSection GetLogicalDriveStringsW GetModuleHandleA HeapCreate _lclose VerSetConditionMask GetDiskFreeSpaceW GetUserDefaultUILanguage GetConsoleOutputCP GetModuleFileNameA CompareStringA CopyFileA HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent GetLocaleInfoW FormatMessageA _lwrite GetLocalTime WaitForSingleObject VirtualUnlock DeleteCriticalSection SetErrorMode GetComputerNameW IsValidLocale LoadLibraryExA LocalAlloc GetPrivateProfileStringW WaitForMultipleObjectsEx SetFileAttributesW QueryDosDeviceW GenerateConsoleCtrlEvent VirtualProtect UnlockFile CreateSemaphoreW SetEnvironmentVariableW ReadProcessMemory OpenFileMappingW lstrcmpiW QueryPerformanceFrequency FlushInstructionCache VirtualFree GetThreadContext GetProcessHeap GetTempFileNameA HeapAlloc ExitProcess GetFileAttributesA FindNextChangeNotification GetCurrentDirectoryA _lread GetLongPathNameW RtlUnwind GetCPInfo GetCommandLineA GetStdHandle GetModuleHandleW TryEnterCriticalSection GetWindowsDirectoryA FileTimeToDosDateTime ReadFile CreateProcessW lstrcpynW FindResourceW LockFileEx CopyFileW lstrcmpA MapViewOfFile MulDiv CreateFileA GetLocaleInfoA FreeResource GetVersion GetDriveTypeW DeleteFileA SetThreadExecutionState MoveFileW GlobalAddAtomW OpenProcess SwitchToThread GetExitCodeThread OutputDebugStringW LocalFileTimeToFileTime GetFileAttributesExW SetNamedPipeHandleState GlobalMemoryStatusEx CreateDirectoryA TerminateProcess LockResource GetPriorityClass GetCurrentThreadId RemoveDirectoryA UnhandledExceptionFilter MoveFileExW _llseek CreateEventA GlobalFree SetFileAttributesA SetVolumeLabelW EnterCriticalSection ReleaseMutex GetStringTypeExA GetTempFileNameW GlobalDeleteAtom GetCurrentDirectoryW SetCurrentDirectoryW InitializeCriticalSection GlobalLock GetCurrentProcess GetCommandLineW DuplicateHandle GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW GetWindowsDirectoryW DeviceIoControl LCMapStringW FindFirstFileW CreateProcessA UnmapViewOfFile GetConsoleCP FindResourceA _lcreat lstrlenW SetEndOfFile QueryPerformanceCounter CopyFileExW lstrcmpW CreateMutexA ReleaseSemaphore SystemTimeToFileTime CreateFileW EnumResourceNamesW GetSystemDirectoryW DeleteFileW IsDBCSLeadByteEx FindCloseChangeNotification FreeConsole FindFirstChangeNotificationA GetEnvironmentVariableW WriteFile GetOEMCP GetFileInformationByHandle FindFirstFileExW CreateFileMappingW CreateNamedPipeW ExitThread CreatePipe TlsGetValue GetDateFormatW ExpandEnvironmentStringsA TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage GetOverlappedResult EnumCalendarInfoW RemoveDirectoryW SetConsoleCtrlHandler GlobalMemoryStatus CreateEventW SetThreadLocale GetThreadLocale

crypt32

CertDeleteCertificateFromStore CertAddEncodedCertificateToStore CertDuplicateCertificateContext CertFreeCertificateContext CertCloseStore CertOpenStore CertOpenSystemStoreW CertEnumCertificatesInStore CertGetCertificateContextProperty CertSetCertificateContextProperty

wsock32

select setsockopt getsockopt WSACleanup gethostbyname bind closesocket WSAGetLastError WSASetLastError connect inet_addr getpeername sendto send ntohs htons WSAStartup __WSAFDIsSet getsockname socket recv inet_ntoa ioctlsocket shutdown recvfrom

ole32

OleRegEnumVerbs CoCreateGuid CoCreateInstance OleGetClipboard IsEqualGUID CreateStreamOnHGlobal CreateILockBytesOnHGlobal CoGetClassObject CoInitialize OleDraw CoTaskMemAlloc DoDragDrop StringFromCLSID RevokeDragDrop IsAccelerator CoUninitialize ReleaseStgMedium RegisterDragDrop StgOpenStorage OleInitialize ProgIDFromCLSID StgOpenStorageOnILockBytes OleUninitialize CoInitializeEx CoDisconnectObject StgIsStorageFile CoTaskMemFree OleSetMenuDescriptor

gdi32

Pie SetBkMode TextOutA CreateCompatibleBitmap GetEnhMetaFileHeader CloseEnhMetaFile RectVisible AngleArc ResizePalette SetAbortProc SetTextColor GetTextColor StretchBlt CreateFontA RoundRect SelectClipRgn RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx SetPixelV CreatePalette CreateDCW CreateICW CreatePen PolyBezierTo GetStockObject CreateSolidBrush GetBkMode Polygon MoveToEx ResetDCW PlayEnhMetaFile Ellipse StartPage GetBitmapBits GetTextExtentPoint32A StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits CreatePenIndirect GetEnhMetaFilePaletteEntries SetMapMode CreateFontIndirectW PolyBezier LPtoDP EndDoc GetObjectW GetCurrentObject GetWinMetaFileBits SetROP2 GetTextExtentExPointW GetEnhMetaFileDescriptionW ArcTo GetTextFaceA CreateEnhMetaFileW Arc CreateRectRgnIndirect TextOutW SelectPalette SetGraphicsMode ExcludeClipRect SetWindowOrgEx MaskBlt CreatePatternBrush EndPage DeleteEnhMetaFile Chord SetDIBits SetViewportOrgEx GetViewportOrgEx CreateRectRgn RealizePalette CreateFontW SetDIBColorTable GetDIBColorTable OffsetClipRgn CreateBrushIndirect PatBlt SetEnhMetaFileBits CreateEllipticRgn Rectangle DeleteDC SaveDC BitBlt SetWorldTransform FrameRgn GetDeviceCaps GetTextExtentPoint32W GetClipBox Polyline StartDocA IntersectClipRect CreateBitmap CombineRgn SetWinMetaFileBits CreateDIBitmap GetStretchBltMode CreateDIBSection SetStretchBltMode GetDIBits ExtCreateRegion LineTo GetRgnBox EnumFontsW CreateHalftonePalette DeleteObject SelectObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetBrushOrgEx GetCurrentPositionEx SetDCPenColor GetNearestPaletteIndex SetTextAlign GetTextAlign CreateRoundRectRgn GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetPixel EnumFontFamiliesExW StretchDIBits GetPaletteEntries

Name

.text

Size

19.2MB

Virtual Size

19.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

900KB

Virtual Size

900KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

225KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

167B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

13.9MB

Virtual Size

13.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.debug

Size

97B

Virtual Size

97B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/BCompare.tr

SHA256 3c6076a1ec2cc7b66c2edfa877d15a4187852b58985805a148534bcf3f086007
MD5 2acf82fa9b989ebc173200bfe51cc567
SHA1 e502369eadd064d33fd43ff960dd5701f984b228
SHA512 9e0d49038c40889b995748525a42d4f230de08047ef4185f5d64f934cb48dc00a03cd2bdc6b30479edd636c99c46328eedd47fc9ed281836e41acb35e0fb50f4
SSDEEP 6144:QrHCBmlfif/WapJuxYK9jAqPq4ajJMttiE56CHlxu86GEsm0L7m4:QLC3TDSq4aWZxwsm0L7m
TLSH
T12094F94263ED2268FAFB7B352EB509650E76BE64F879C64C1254848E0DB5F04C8B2737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Patch.exe

IMPHASH 5902f4c16f29b0d4b5a876cdf14a33be
SHA256 8a6363e1377bd084add68445f796c83609ba27bd1b0a06cb339ac92f0b91ee0c
MD5 2bce1ca54d031facd5b10d5bd45f5d15
SHA1 00fa8972a4a4169df3b5aa27a05f6151a5278d7f
SHA512 872524c7463ad7b4d04eb52db4eb82b50175b71627d2deabe6a5d4cc151f50802279b26363f73e861ebc50e2e728322271b4c3d78abb92acd6e5a19df556e93b
SSDEEP 3072:hIlX/11v+v6C62aktjgJlWLQjpeOMwas+:ulP11v+0zkjilWLSeOMwz+
TLSH
T1A5C37BC7F2D7C1B0C08209F1026AA735A971FD78D824CDD7F7A079B554BA88259AE39C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

8b:45:15:5e:75:85:a2:14:ab:80:2d:64:50:7b:c9:a9:6d:fe:9e:0d:2d:ec:af:fc:47:50:ec:1d:b8:9f:94:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Scooter Software Inc,O=Scooter Software Inc,POSTALCODE=53705,STREET=Ste 104+STREET=625 N Segoe Rd,L=Madison,ST=Wisconsin,C=US

Chains

May 12, 2017

CN=Scooter Software Inc,O=Scooter Software Inc,POSTALCODE=53705,STREET=Ste 104+STREET=625 N Segoe Rd,L=Madison,ST=Wisconsin,C=US

CN=COMODO SHA-256 Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Digest

ad:12:31:f6:cc:4f:12:d6:a6:22:0f:18:69:50:57:c1:bc:06:3c:07

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Scooter Software Inc,O=Scooter Software Inc,POSTALCODE=53705,STREET=Ste 104+STREET=625 N Segoe Rd,L=Madison,ST=Wisconsin,C=US

Chains

May 12, 2017

CN=Scooter Software Inc,O=Scooter Software Inc,POSTALCODE=53705,STREET=Ste 104+STREET=625 N Segoe Rd,L=Madison,ST=Wisconsin,C=US

CN=COMODO SHA-256 Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=COMODO SHA-256 Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

ed:72:df:71:20:8f:78:36:d0:ab:00:9f:ca:97:e0:1f

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 22, 2014 - May 30, 2020

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=Scooter Software Inc,O=Scooter Software Inc,POSTALCODE=53705,STREET=Ste 104+STREET=625 N Segoe Rd,L=Madison,ST=Wisconsin,C=US

Serial Number

3d:90:00:bb:44:34:96:8e:08:07:0c:93:b6:70:d4:ed

Issuer

CN=COMODO SHA-256 Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 15, 2016 - Jan 14, 2019

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

Major OS version

Entry point

4736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/PdfToText.exe

IMPHASH 9aa7a44c34a821da86a8f77d18e08b57
SHA256 67a303d968debe74f9dac49609f3a04304e3b83f3591aa7cce42f8b65f6b07c7
MD5 c76bee533e70c34395054ea2563ecbab
SHA1 5691aa0e59846c9ec80580ba76326468190390de
SHA512 1a29a814c297126ff1d7c2fabcc090dade98abcd0d18a1070a1ac6225bb794e4a09f1b005f2fc8768aa7deeda3e5f3d36ac57ed512a86c6993ea18deef0f20b0
SSDEEP 24576:tDrofvb/XFad2QY8TzJEeovboAOM8ktUPInokE9rlE0kUENz1Vw:e/X6JEeovboytB70lE0kUENI
TLSH
T1BE358D10F58324B7D4510130216EA727A638EA190B2959EFA7E47E7C5D3A3D12F3B27B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

f6:7a:88:d8:44:30:cb:c8:d8:d5:f9:6a:97:e7:56:a7:03:d2:49:22:f4:e3:d0:63:6a:5b:fb:62:4d:c7:f8:e7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

Chains

Dec 8, 2025

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Scooter Software Inc,O=Scooter Software Inc,ST=Wisconsin,C=US

Serial Number

c0:91:4b:62:f2:c4:fc:88:16:4e:6c:2b:24:a6:85:85

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 17, 2025 - Nov 16, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

542715

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryA TlsAlloc TlsGetValue TlsSetValue GetVersionExA FreeLibrary GetModuleFileNameA GetModuleFileNameW GetProcAddress GetCommandLineW DeleteCriticalSection GetFullPathNameA GetCurrentProcessId GetCurrentThreadId LocalFree MultiByteToWideChar SetEndOfFile HeapSize CreateFileW GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW LeaveCriticalSection EnterCriticalSection GetFileAttributesW InitializeCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException GetLastError SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsFree LoadLibraryExW ReadFile ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType CloseHandle GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx DecodePointer FlushFileBuffers ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

shell32

CommandLineToArgvW SHGetFolderPathA

ole32

CoCreateInstance CoInitialize CoUninitialize

Name

.text

Size

678KB

Virtual Size

677KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

191KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

204KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/mscoree.dll

SHA256 98fee95037c3ae116e5561d50a59be85155a19cd405a321f34ef8f4893d35405
MD5 b0036024a67ced8ae916c80d72394a02
SHA1 a0cebaa1ef530e90319ccd0615e682a4890c8f49
SHA512 bed450731718713ccfee9967391e7cbb2692fa84223d72c8d6cdf1bb04766439a069dc7fb6cc6304acfcbb1a3e58f68cb8934283caf1101b4c53a76dc634a3a9
SSDEEP 96:dX66dTwGynjPPm2mnHFQcqEVdup4dise+KejvaIWcaiOg23EGX04zwNkmm2mnHFB:+lnjPu2EP7j+g23vp2E1g2vpx7jJFPd
TLSH
T1B54209A25B786651FAD28FB051EAE6379D31B7C1FB58819D30A9C0A83DC17D0297841F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

da:b2:71:ef:93:82:5a:d7:1f:1f:40:b9:66:8c:d4:81:71:ce:3a:99:7d:10:e6:3a:f6:37:d8:c9:75:6c:20:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Scooter Software Inc,O=Scooter Software Inc,POSTALCODE=53705,STREET=Ste 104+STREET=625 N Segoe Rd,L=Madison,ST=Wisconsin,C=US

Chains

Sep 8, 2016

CN=Scooter Software Inc,O=Scooter Software Inc,POSTALCODE=53705,STREET=Ste 104+STREET=625 N Segoe Rd,L=Madison,ST=Wisconsin,C=US

CN=COMODO SHA-256 Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Digest

e7:6c:e7:28:72:42:29:9e:23:26:c2:b5:e7:7f:7a:15:df:a4:3e:c6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Scooter Software Inc,O=Scooter Software Inc,POSTALCODE=53705,STREET=Ste 104+STREET=625 N Segoe Rd,L=Madison,ST=Wisconsin,C=US

Chains

Sep 8, 2016

CN=Scooter Software Inc,O=Scooter Software Inc,POSTALCODE=53705,STREET=Ste 104+STREET=625 N Segoe Rd,L=Madison,ST=Wisconsin,C=US

CN=COMODO SHA-256 Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/7z.dll

oleaut32

user32

msvcrt

kernel32

generic

$PLUGINSDIR/BC5Key.txt

$PLUGINSDIR/BCDarkTheme.vsf

$PLUGINSDIR/BCUnRAR.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/BComp.com

oleaut32

advapi32

user32

kernel32

version

generic

$PLUGINSDIR/BComp.exe

oleaut32

advapi32

user32

kernel32

version

shell32

generic

$PLUGINSDIR/BCompare.exe

mpr

winmm

shlwapi

wininet

winspool.drv

comdlg32

comctl32

shell32

urlmon

user32

version

uiautomationcore

oleaut32

wtsapi32

msvcrt

advapi32

winhttp

kernel32

crypt32

wsock32

ole32

gdi32

generic

$PLUGINSDIR/BCompare.tr

generic

$PLUGINSDIR/Patch.exe

kernel32

msvcrt

msvcp60

generic

$PLUGINSDIR/PdfToText.exe

kernel32

shell32

ole32

generic

$PLUGINSDIR/mime.types

$PLUGINSDIR/mscoree.dll