herdr-windows-x86_64.zip
- SHA256 0ab3d0fe1434d55757997542b978c771d642987bb15a7130f4160f0db38821d5
Overview
overview
3Static
static
3conpty/arm...le.exe
windows10-2004-x64
conpty/arm...le.exe
windows11-ltsc_2024-x64
conpty/conpty.dll
windows10-2004-x64
1conpty/conpty.dll
windows11-ltsc_2024-x64
1conpty/x64...le.exe
windows10-2004-x64
1conpty/x64...le.exe
windows11-ltsc_2024-x64
1herdr.exe
windows10-2004-x64
3herdr.exe
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
conpty/arm64/OpenConsole.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
conpty/arm64/OpenConsole.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
conpty/conpty.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
conpty/conpty.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
conpty/x64/OpenConsole.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
conpty/x64/OpenConsole.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
herdr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
herdr.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target herdr-windows-x86_64.zip
- Size 8.0MB
- Sample260824-gzjnkstdnc
- SHA256 0ab3d0fe1434d55757997542b978c771d642987bb15a7130f4160f0db38821d5
- MD5 bd986324405b19ef1079f7f3186503b1
- SHA1 48151ae6d62a11819fa4637f1c177c07b8e195fb
- SHA512 6264eb55acfcbb8c94a373a887363270418b2819c17520dcd41b4eee909a231a0362f8ee678b395070bc22ecc041bd7a95906b9c8cb3ab50b5feaa7bbefed598
- SSDEEP 196608:O0izpUVdmkJ7BU3J0lM9XLg4/nVz3LMuM1astQpbk7uv:hiz8o8q2lOXHRoucEtkKv
- TLSH T17B8633463B95B9B04CF15BF867A4900FEA38007FA7EE50C5BE9D9F4C65028B2BF49518
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/herdr.exe
File Explorer
-
herdr-windows-x86_64.zip.zip 8.0MB
-
THIRD-PARTY-NOTICES/Microsoft.Windows.Console.ConPTY-LICENSE.txt1KB
-
THIRD-PARTY-NOTICES/Microsoft.Windows.Console.ConPTY-NOTICE.md22KB
-
conpty/arm64/OpenConsole.exe1.1MB
-
conpty/conpty.dll.dll 107KB
-
conpty/herdr-conpty.json450B
-
conpty/x64/OpenConsole.exe.exe 1.0MB
-
herdr.exe.exe 21.4MB
THIRD-PARTY-NOTICES/Microsoft.Windows.Console.ConPTY-LICENSE.txt
- SHA256 5d177f23ecfeb0ea8e050b6a5a16355e1ae9a0b286436ca8f83ed08b3795be6b
- MD5 93505fd4d147522f9e458dd88eb0a12c
- SHA1 5ed2d8e4e3bcdde0ed73ffa5b86840aea38b2c7b
- SHA512 8366bdc59864d254d525e540c15f6500727cecb288a62a73d6714def834f56ef7fc80adb19f049f3324f03fa22073f61bf127ed84e37c6cdb1a7e28249752597
- TLSH T15621931EB2590363289217625568ECC5F22BB18A7E7F1680347EF2091326068C6FF868
- MD5 SHA1 SHA512 TLSH
THIRD-PARTY-NOTICES/Microsoft.Windows.Console.ConPTY-NOTICE.md
- SHA256 e7fbaadee6ab20c28b87730a510ee5f5815d8fb4bd88d1d54d282dc2a74c0726
- MD5 7df3b5c9e237888022335847204e866a
- SHA1 6f8e21ac641e02b76f633e41720d15b117a18fde
- SHA512 a96fb66dfc9395d58ccc99e426c5e3a183f508df1173239772de995796d99af961c935487ca1a5ae40dd5f111c8688cc74bfbbcff02a137913df7aececf6d299
- SSDEEP 384:y3snrsErseSezYgMUB/YHYXR/VxEOYzYDrszrs5ezYgNY9Y9Y3Uxrszrs5ezYg4A:rnVXzYg9+4X1VKrz6ojzYgKaaExojzYu
- TLSH T155A2E86F720607661D9217916969F8C9F21FB05E7EAB2A48346EF308133B46CD5FF818
- MD5 SHA1 SHA512 SSDEEP TLSH
conpty/arm64/OpenConsole.exe
- SHA256 ed7622fd0d3bedc9ab9f122f5e58edf0def9e7999224f52dd395ba9f54edbe09
- MD5 b526dc55298384f1ea6b601fa2503d89
- SHA1 34322c9ec2d41e37a5b7690f7c38cc843e3df23c
- SHA512 6126723f09877123a49acf57ed14833906cbbac418939feb6533be8e524d8eae20730f75abc6a28046931d2c72a810a994d84fb3686304a7ef8316a3b06440d9
- SSDEEP 12288:ExRYWEFp1LpjEfNKsMSGPqOKvP6vqatto3v6FwhMI1FujuQxtALWZSDfNn0ndvyI:ExX6gxDDtedvHeTYH+4OxrOlRz
- TLSH T194355A64AB4CAC62E2C5D23CCD72CFF4303BF9648A308557B59A071EFCA5BD1DA94162
- MD5 SHA1 SHA512 SSDEEP TLSH
conpty/conpty.dll
- IMPHASH f0fb36a8f0e259be4112ab2198b75a13
- SHA256 39fba2713e2495117b1591ae8c32a3b904bea7aa66069cf7815e2844c76d75d8
- MD5 cbd0fe7c9db8514edbf32ad70e05529a
- SHA1 ddaa27185edd601f8c70d30aee78ebc9a6166b78
- SHA512 73f3ad180922ede0557261b17878fb57027bb13b33bbab2127fe7026c7cacf3310301a2981a34f45c6ec6d9670fcda9a29d70147d55e939b1b15efd834db7512
- SSDEEP 3072:UUaG9GGNczAYJCyrrCTeHGhJwbuzA6yiXFS:UUV9hNQAYRfCq7uzA6W
- TLSH T132B37C2BB6A800EAD0BB8179C4A35E46F77174754720A7CF2761835A1F23BD06E3E352
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
33:6c:cc:3c:b7:6f:98:c7:0d:61:51:32:82:d7:d5:79:f9:4a:74:98:30:db:22:09:93:50:5b:5a:3f:d3:48:98
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
43760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\bin\x64\Release\conpty.pdb
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
GetModuleFileNameA
LoadLibraryExW
FreeLibrary
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
ReleaseSRWLockExclusive
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
CreateProcessAsUserW
UpdateProcThreadAttribute
TlsSetValue
TlsGetValue
InitializeProcThreadAttributeList
GetCurrentProcess
GetCurrentThreadId
TlsAlloc
DeleteProcThreadAttributeList
TerminateProcess
TlsFree
api-ms-win-core-localization-l1-2-0
FormatMessageA
FormatMessageW
GetLocaleInfoEx
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
DuplicateHandle
SetHandleInformation
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_invalid_parameter_noinfo
_errno
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
abort
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
_callnewh
api-ms-win-crt-string-l1-1-0
strcmp
wcsncmp
strlen
strcpy_s
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-core-file-l1-1-0
FindFirstFileW
FindClose
CreateFileW
WriteFile
GetFileAttributesExW
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-file-l1-2-2
AreFileApisANSI
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
ClearPseudoConsole
ClosePseudoConsole
ConptyClearPseudoConsole
ConptyClosePseudoConsole
ConptyCreatePseudoConsole
ConptyCreatePseudoConsoleAsUser
ConptyPackPseudoConsole
ConptyReleasePseudoConsole
ConptyReparentPseudoConsole
ConptyResizePseudoConsole
ConptyShowHidePseudoConsole
CreatePseudoConsole
ReleasePseudoConsole
ResizePseudoConsole
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=35207,
count=10, id=260, version=35207,
count=44, id=261, version=35207,
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=128, id=1, productName=Unmarked objects,
count=5, id=265, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,
conpty/herdr-conpty.json
- SHA256 c8f499ad82c568e737d6bc7d0b583e3785d2f43af3d2c0cebb856076690533f5
- MD5 529311c1f2c38578ab4846745b8e134f
- SHA1 5d6643e1ec3c780f815d6a116ad86619b4b881c4
- SHA512 6260b9180599a6855c3edaf7fbddf86f5d9b136e281858f503a4bcc2300299a6fb217caf2f0225e60ae1968d8b98dc14cf98df0040169f317dd53851db25cdb1
- TLSH T1AEF02331CD84482333C4E9D00B0B809665C1ADD332C23D98B2459E0C1E18C3A307192C
- MD5 SHA1 SHA512 TLSH
conpty/x64/OpenConsole.exe
- IMPHASH d99f2b0e12cf28aee1b1f133f4dbd659
- SHA256 b7fd936c2668b87b9ecf7b3366dc6568afc1c6f981874cba3e955a1c35cf8160
- MD5 5d725f6986d630b96f880fd72db57dc5
- SHA1 d7ff78662fd09ea559fd24e3c37e19143cebaf9f
- SHA512 31362400daa6e8abc6af4d1f2329bbbf51cb8d4ace2d8b018ccf2bdd2fa6a2d9f0082d9c7fe9d3670e453188976514506cdbaa6b0445f719aa4512f3e3898d8e
- SSDEEP 24576:MadD7LlHZ/1iOD3T2OcIm+whOM9F+/bdwDl2:/rlHxfGO5BgOMixq4
- TLSH T1A5356B1AAAA915E8D47FD0B9C543C91BF6B27C4203758BCB06E18A562F677E01F3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c1:af:5f:63:55:44:b7:42:48:44:04:c3:4e:fa:0f:8d:dd:07:d9:75:2b:02:cc:fa:7a:ef:4e:3d:33:f4:0f:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
147632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\__w\1\s\bin\x64\Release\OpenConsole.pdb
api-ms-win-core-libraryloader-l1-2-0
LockResource
LoadResource
GetModuleFileNameA
LoadLibraryExW
LoadStringW
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
FindResourceExW
FreeLibrary
LoadLibraryExA
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
CreateEventExW
SetEvent
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockShared
WaitForSingleObjectEx
OpenSemaphoreW
DeleteCriticalSection
CreateMutexExW
AcquireSRWLockShared
ResetEvent
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetProcessTimes
UpdateProcThreadAttribute
TerminateProcess
CreateThread
GetCurrentProcessId
OpenProcessToken
ExitProcess
InitializeProcThreadAttributeList
GetCurrentThreadId
CreateProcessW
GetCurrentProcess
TlsAlloc
TlsGetValue
GetStartupInfoW
TlsSetValue
TlsFree
SetProcessShutdownParameters
ExitThread
DeleteProcThreadAttributeList
api-ms-win-core-localization-l1-2-0
GetCPInfo
GetLocaleInfoEx
GetUserDefaultLocaleName
FormatMessageW
FormatMessageA
GetACP
GetOEMCP
IsValidCodePage
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
SearchPathW
GetEnvironmentVariableW
GetStdHandle
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoResumeClassObjects
IIDFromString
CoRegisterClassObject
CoRevokeClassObject
CoAddRefServerProcess
CoReleaseServerProcess
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-l1-1-0
RoRegisterActivationFactories
RoRevokeActivationFactories
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsIsStringEmpty
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
InitOnceExecuteOnce
WakeByAddressSingle
Sleep
WakeByAddressAll
WaitOnAddress
WakeAllConditionVariable
ntdll
NtQueryVolumeInformationFile
NtQueryInformationFile
api-ms-win-crt-runtime-l1-1-0
_c_exit
terminate
_exit
exit
_initterm_e
_initialize_onexit_table
_register_onexit_function
_initterm
_invoke_watson
_errno
_get_wide_winmain_command_line
_invalid_parameter_noinfo
_crt_atexit
_cexit
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_configure_wide_argv
_seh_filter_exe
abort
_set_app_type
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf_s
__stdio_common_vswprintf
_set_fmode
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
strcpy_s
strlen
wcsnlen
strcmp
towlower
wcscpy_s
wcsncmp
api-ms-win-crt-convert-l1-1-0
wcstoul
wcstol
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
ext-ms-win-uiacore-l1-1-0
UiaReturnRawElementProvider
UiaHostProviderFromHwnd
oleaut32
VariantInit
SafeArrayCreateVector
SafeArrayPutElement
SysStringLen
VariantClear
SysFreeString
SysAllocString
SafeArrayDestroy
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryW
api-ms-win-shcore-scaling-l1-1-1
SetProcessDpiAwareness
GetDpiForMonitor
api-ms-win-ntuser-sysparams-l1-1-0
SystemParametersInfoW
GetSystemMetrics
GetMonitorInfoW
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
GlobalSize
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalAlloc
GlobalFree
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-registry-l1-1-0
RegOpenCurrentUser
RegGetValueW
RegCloseKey
RegQueryValueExW
RegEnumValueW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetTickCount64
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetWindowsDirectoryW
ext-ms-win-uiacore-l1-1-1
UiaGetReservedMixedAttributeValue
UiaRaiseAutomationEvent
UiaGetReservedNotSupportedValue
propsys
PropVariantToInt16
PropVariantToBoolean
PropVariantToUInt32
api-ms-win-shell-namespace-l1-1-0
SHCreateItemFromParsingName
api-ms-win-core-path-l1-1-0
PathCchRemoveExtension
api-ms-win-core-registry-l2-1-0
RegCreateKeyW
RegOpenKeyW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
api-ms-win-core-file-l1-1-0
FindClose
FindFirstFileExW
FindNextFileW
ReadFile
WriteFile
CreateFileW
FindFirstFileW
GetFileAttributesExW
api-ms-win-core-sidebyside-l1-1-0
CreateActCtxW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
user32
FillRect
UnhookWindowsHookEx
GetIconInfo
ScrollDC
ScrollWindowEx
InvertRect
IsWindowVisible
CopyImage
ReleaseDC
GetDC
GetKeyState
VkKeyScanW
MapVirtualKeyW
PrivateExtractIconsW
GetWindowInfo
PostMessageW
SendMessageW
LoadIconW
DispatchMessageW
GetWindowLongW
GetCaretBlinkTime
LoadImageW
CloseClipboard
EmptyClipboard
GetClipboardData
OpenClipboard
SetClipboardData
RegisterClipboardFormatW
CheckRadioButton
GetMessageW
CheckDlgButton
SetDlgItemTextW
SendDlgItemMessageW
GetDlgItemTextW
IsDlgButtonChecked
AdjustWindowRectEx
DialogBoxParamW
GetWindowThreadProcessId
SetFocus
SetActiveWindow
EnableScrollBar
SetScrollInfo
GetWindowRect
SetLayeredWindowAttributes
IsZoomed
GetDpiForWindow
OffsetRect
SetWindowLongW
GetCursorPos
GetClientRect
MapWindowPoints
ClientToScreen
TrackPopupMenuEx
SendMessageTimeoutW
SetWindowTextW
BeginPaint
EndPaint
SetForegroundWindow
SendNotifyMessageW
GetSystemMenu
LoadMenuW
GetKeyboardState
GetForegroundWindow
AppendMenuW
GetDoubleClickTime
MonitorFromWindow
SetMenuItemInfoW
SetWindowPos
EnableMenuItem
ToUnicodeEx
IsWindow
GetSysColor
DefWindowProcW
KillTimer
SetTimer
ShowWindowAsync
GetWindowLongPtrW
ShowWindow
SetWindowsHookExW
ScreenToClient
SetCapture
GetKeyboardLayout
MonitorFromRect
LoadCursorW
NotifyWinEvent
DestroyWindow
IsIconic
SetWindowLongPtrW
CreateWindowExW
EndDialog
RegisterClassExW
DestroyIcon
ReleaseCapture
gdi32
GetObjectW
GetCharWidth32W
StretchDIBits
ExtCreatePen
DeleteObject
CreateFontIndirectA
AddFontMemResourceEx
CreateSolidBrush
PolyBezier
TranslateCharsetInfo
CreateCompatibleDC
SetGraphicsMode
IntersectClipRect
SelectClipRgn
GetTextFaceW
SetStretchBltMode
LineTo
ModifyWorldTransform
SetWorldTransform
SetTextColor
MoveToEx
PatBlt
ExtTextOutW
GdiFlush
BitBlt
CreateCompatibleBitmap
SetBkColor
SetDCBrushColor
GetGlyphIndicesW
RemoveFontMemResourceEx
DeleteDC
GetCharABCWidthsW
GetTextExtentPoint32W
CreateFontIndirectW
SelectObject
GetTextMetricsW
GetStockObject
GetOutlineTextMetricsW
shell32
DragFinish
ord102
DragQueryFileW
winmm
PlaySoundW
imm32
ImmDisableIME
usp10
ScriptIsComplex
ScriptStringAnalyse
ScriptStringOut
ScriptStringFree
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_aligned_malloc
calloc
malloc
_callnewh
_aligned_free
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
lround
lroundf
roundf
ceil
ceilf
floorf
log10
lrintf
pow
powf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
d2d1
ord1
dwrite
DWriteCreateFactory
dxgi
CreateDXGIFactory2
d3d11
D3D11CreateDevice
d3dcompiler_47
D3DReflect
D3DCompileFromFile
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-file-l1-2-2
AreFileApisANSI
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
Name
.text
Size
737KB
Virtual Size
736KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
206KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=1, id=261, version=35228,
count=97, id=261, version=35207,
count=6, id=260, version=30795,
count=14, id=257, version=30795,
count=145, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=514, id=1, productName=Unmarked objects,
count=178, id=270, version=35228,
count=1, id=255, version=35228,
count=2, id=151,
count=1, id=258, version=35228,
herdr.exe
- IMPHASH 53a1a4c714de2b9b995e69f6344ee427
- SHA256 467682cdb5fa482c54897c6b9c96a5300a3516a72ef70ec3d009e16fadb131b3
- MD5 95f133e2413a2a91c71d3bfd67e3f56e
- SHA1 0c2dc0d4e67b828ddd28c9cadaf6cc6d5aa971e1
- SHA512 8cbe8476f55da1c2f18ba8dba09d6ce7c1823a3e0c2cb86ff1a1d92fe7d42af022e10e6e003a97ebd083d699d684415ba422c8bfd1c0db83547fd1e89fdd16c9
- SSDEEP 196608:xswsCu2YBpwesfkCW5Ls+yYF8Zz6GE8Ch:ueu2YBEVW5Ls+JAS8
- TLSH T19A37F711BB8ED95CD15BC8B0834A4B324A3530DB1A35BABF60DC55753FEFAB41A28718
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16825660
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
herdr.pdb
kernel32
LocalAlloc
GetTempPathW
GetModuleHandleA
DisconnectNamedPipe
ConnectNamedPipe
ReleaseSemaphore
CreateFileW
DeleteProcThreadAttributeList
ExitProcess
RtlVirtualUnwind
RtlLookupFunctionEntry
SetConsoleTextAttribute
ReadFile
SetFilePointerEx
WriteFile
Sleep
RtlCaptureContext
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
Module32Next
Module32First
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetConsoleMode
SetConsoleCtrlHandler
CreateSemaphoreA
PeekNamedPipe
DuplicateHandle
GetProcessId
CreateProcessW
GetModuleHandleW
CreateNamedPipeW
LoadLibraryExW
FlushFileBuffers
GlobalAlloc
GetOverlappedResult
VirtualQueryEx
GetConsoleWindow
QueryFullProcessImageNameW
SetNamedPipeHandleState
WaitNamedPipeW
ReadFileEx
QueryInformationJobObject
IsProcessInJob
GetCurrentProcess
CreateDirectoryW
SleepEx
GlobalUnlock
GlobalSize
GlobalLock
WriteFileEx
RegisterWaitForSingleObject
UnregisterWaitEx
GetNamedPipeInfo
ReadProcessMemory
Process32NextW
Process32FirstW
ResumeThread
OpenThread
Thread32Next
Thread32First
CreateToolhelp32Snapshot
AssignProcessToJobObject
CloseHandle
CreateJobObjectW
TerminateProcess
GetExitCodeProcess
GetFileType
ReadConsoleInputW
WaitForSingleObject
GetConsoleMode
GetStdHandle
GetProcessTimes
CreatePipe
CompareStringOrdinal
OpenProcess
InitializeSListHead
FormatMessageW
GetLastError
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocalFree
GlobalFree
HeapAlloc
HeapFree
GetProcessHeap
IsProcessorFeaturePresent
GetConsoleScreenBufferInfo
FreeLibrary
GetProcAddress
SetInformationJobObject
WaitForMultipleObjects
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleActiveScreenBuffer
CreateConsoleScreenBuffer
WriteConsoleW
GetNumberOfConsoleInputEvents
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FreeEnvironmentStringsW
SetLastError
GetFullPathNameW
ExpandEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentThreadId
FindNextFileW
GetFileAttributesW
SetWaitableTimer
CreateWaitableTimerExW
GetConsoleOutputCP
MultiByteToWideChar
ReadConsoleW
GetModuleFileNameW
SetEnvironmentVariableW
DeleteFileW
DeviceIoControl
GetFinalPathNameByHandleW
ReleaseMutex
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
WideCharToMultiByte
SwitchToThread
GetSystemInfo
FindClose
FindFirstFileExW
CopyFileExW
lstrlenW
GetCommandLineW
GetEnvironmentVariableW
GetCurrentDirectoryW
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetWindowsDirectoryW
GetSystemDirectoryW
GetEnvironmentStringsW
GetFileInformationByHandleEx
GetFileInformationByHandle
CancelIo
GetSystemTimePreciseAsFileTime
LockFileEx
GetCurrentProcessId
CreateEventW
CreateThread
QueryPerformanceCounter
QueryPerformanceFrequency
HeapReAlloc
SetFileTime
SetFileInformationByHandle
MoveFileExW
K32GetModuleFileNameExW
ole32
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
combase
CoIncrementMTAUsage
oleaut32
SysFreeString
GetErrorInfo
SysStringLen
SysAllocStringLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
propsys
InitVariantFromBooleanArray
InitVariantFromInt32Array
InitVariantFromDoubleArray
InitVariantFromStringArray
InitVariantFromInt16Array
InitVariantFromBuffer
user32
GetKeyboardLayout
DestroyWindow
SendMessageTimeoutW
GetForegroundWindow
GetClipboardData
CloseClipboard
GetWindowThreadProcessId
OpenClipboard
SetClipboardData
SendInput
RegisterClipboardFormatW
EmptyClipboard
LoadIconW
CreateWindowExW
ToUnicodeEx
shell32
CommandLineToArgvW
ShellExecuteW
Shell_NotifyIconW
ntdll
NtQueryObject
NtQueryInformationFile
NtDeviceIoControlFile
NtSetInformationFile
NtQueryVolumeInformationFile
NtCreateFile
NtFreeVirtualMemory
RtlNtStatusToDosError
NtAllocateVirtualMemory
NtLockFile
NtCreateSection
NtClose
NtQueryInformationProcess
NtWriteFile
NtReadFile
RtlEqualUnicodeString
NtCreateNamedPipeFile
NtOpenFile
RtlQueryPerformanceFrequency
NtMapViewOfSection
NtUnmapViewOfSection
RtlWaitOnAddress
RtlGetFullPathName_U
imm32
ImmGetDefaultIMEWnd
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
WakeByAddressAll
ws2_32
send
recv
WSAGetLastError
getsockopt
closesocket
advapi32
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
IsValidSid
AddAce
GetAce
InitializeAcl
GetAclInformation
FreeSid
GetSecurityDescriptorControl
SetSecurityDescriptorControl
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
SetSecurityDescriptorGroup
GetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
RegOpenKeyExW
RegEnumValueW
RegCloseKey
bcryptprimitives
ProcessPrng
vcruntime140
__C_specific_handler
__current_exception_context
__std_terminate
__CxxFrameHandler3
_CxxThrowException
__current_exception
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
api-ms-win-crt-math-l1-1-0
powf
__setusermatherr
pow
api-ms-win-crt-heap-l1-1-0
malloc
_msize
free
_set_new_mode
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_seh_filter_exe
_set_app_type
_register_onexit_function
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
_c_exit
__p___argv
_cexit
_initterm
terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
16.3MB
Virtual Size
16.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
572KB
Virtual Size
571KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=25, id=261, version=35207,
count=11, id=257, version=33145,
count=364, id=1, productName=Unmarked objects,
count=438, productName=Unmarked objects (old),
count=1, id=258, version=35228,