sqlite-tools-win-x64-3530400.zip
- SHA256 f46ee2475de4cbe287e6e5f7d43c838796b14e7379cd216bdbb28d391429f9fc
Overview
overview
3Static
static
3sqldiff.exe
windows10-2004-x64
1sqldiff.exe
windows11-ltsc_2024-x64
1sqlite3.exe
windows10-2004-x64
1sqlite3.exe
windows11-ltsc_2024-x64
1sqlite3_analyzer.exe
windows10-2004-x64
1sqlite3_analyzer.exe
windows11-ltsc_2024-x64
1sqlite3_rsync.exe
windows10-2004-x64
1sqlite3_rsync.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sqldiff.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
sqldiff.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
sqlite3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
sqlite3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
sqlite3_analyzer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
sqlite3_analyzer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
sqlite3_rsync.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
sqlite3_rsync.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target sqlite-tools-win-x64-3530400.zip
- Size 6.3MB
- Sample260825-wvg2hsac97
- SHA256 f46ee2475de4cbe287e6e5f7d43c838796b14e7379cd216bdbb28d391429f9fc
- MD5 fb0300c76060601893d7f4628e8ec9ea
- SHA1 ffe50e9c0e0e6ca0f465253dd8cbdfcc57268cb5
- SHA512 2d5046729ae856d75be48764bffec0efb07cac93ea3f7f590367c7bc2d434ec70c8524d45d30e5035bf850f6f692b831055b73b57fa138af7ae9bd21daf451df
- SSDEEP 98304:oc9pIai+042gV5wOITIIolbSPxji4LSOWlkeNbpxn6nlQ+y+EZhqKsr6G:oidZ2QwLIIol+5ji4LSOWlkSrSy+evsN
- TLSH T18D66333F6403786915C0E7A4403A37637972BB2F2296A4E6BF6D5EF1534ADA709138C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/sqldiff.exe unpack001/sqlite3.exe unpack001/sqlite3_analyzer.exe unpack001/sqlite3_rsync.exe
File Explorer
-
sqlite-tools-win-x64-3530400.zip.zip 6.3MB
-
sqldiff.exe.exe 3.1MB
-
sqlite3.exe.exe 3.8MB
-
sqlite3_analyzer.exe.exe 4.3MB
-
sqlite3_rsync.exe.exe 3.0MB
sqldiff.exe
- IMPHASH 04bb1e533b96ef86fb2469a0e060f239
- SHA256 c21117bef137119cad08d15f16ed488d8ac42613aebf6ee93bf9aab526626762
- MD5 e72d50f077e4798a04e513cedbbfcb10
- SHA1 9a4ef3979fe85c471c5ae59371657a00b509dba1
- SHA512 88c4d867c4a5606d8382dc2808d9e510b3a6b8992e900acfb30d1e0d8c2944aa43a26332cc6068358c68ebb967a26e7af874729bedd4f6bcca0b16d347a38b39
- SSDEEP 49152:mDft0jIeNRideM79pa4+7Z8dCXYCM4DPr2KQHB1lw:GMqtdCXXDP9Qhw
- TLSH T17CE57C5BB3B901D9D177C17E8A5A4747EBB2B404472097DF0594C6A92F23EE30ABE324
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13116
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Dan\Desktop\work\sqlite\bld\sqlite_bld_dir\2\sqldiff.pdb
kernel32
MultiByteToWideChar
WideCharToMultiByte
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
FreeLibrary
GetModuleHandleW
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
ReadConsoleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
GetModuleFileNameW
WriteConsoleW
DuplicateHandle
CreateProcessW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
GetCurrentThread
SetConsoleCtrlHandler
GetExitCodeProcess
CreatePipe
SetStdHandle
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
RtlUnwind
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
378KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
1024B
Virtual Size
863B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=30795,
count=178, id=261, version=30795,
count=33, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=3, id=257, version=30795,
count=141, id=1, productName=Unmarked objects,
count=41, id=261, version=33218,
count=16, id=260, version=33218,
count=18, id=259, version=33218,
count=4, id=260, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
sqlite3.exe
- IMPHASH 1002e10b0a30a98cf79e6a465eefb16c
- SHA256 5da2398d4913b893bd1ea578d85403b3a83a06fabf9d2303ca9f63ef0849fc6f
- MD5 e4f0808819e11f47f4d89b82f6b06d5a
- SHA1 4491ce0c2f16118dc6e76ea3d1b32df9000377a5
- SHA512 e937ac537c5b4f3238f21465cd82701e6246da51587354f3771d63b138288a70c76bbd860707a0e7e3b8a836b9465546f7cd5f70a1c11d7e33a2438b1bd3ad76
- SSDEEP 49152:VRFusMP91jTW4cOQQQZcFn2gfAdBvOoqLo+XPttFlXD4KAThsxdQsZOD:VisMFtTWlyVXPtdEThsR
- TLSH T19D168C5BB7B801E9D0B7C17E864A475BEB71B4040720A7DF15D886A52F13EE21EBE324
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15181
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Dan\Desktop\work\sqlite\bld\sqlite_bld_dir\2\sqlite3sh.pdb
kernel32
GetStdHandle
SetCurrentDirectoryW
CreateFileW
FindClose
FindFirstFileW
SetFileTime
DebugBreak
CloseHandle
GetCurrentProcess
GetCurrentProcessId
GetSystemTime
GetSystemTimePreciseAsFileTime
FreeLibrary
GetProcAddress
LoadLibraryA
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
SetConsoleCtrlHandler
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcessHeap
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetStringTypeW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
DuplicateHandle
CreateProcessW
GetFileType
GetModuleFileNameW
WriteConsoleW
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFileAttributesW
FindFirstFileExW
FindNextFileW
CreateDirectoryW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
GetCurrentThread
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetExitCodeProcess
CreatePipe
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetCurrentDirectoryW
SetStdHandle
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
RtlUnwind
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
540KB
Virtual Size
539KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
41KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
1024B
Virtual Size
863B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=30795,
count=202, id=261, version=30795,
count=33, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=3, id=257, version=30795,
count=156, id=1, productName=Unmarked objects,
count=41, id=261, version=33218,
count=18, id=260, version=33218,
count=18, id=259, version=33218,
count=12, id=260, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
sqlite3_analyzer.exe
- IMPHASH 02fa53c9d359df9345d599cbf4fbf1a6
- SHA256 b83298cc2f87f666bad01bf69ccec9b505d3c23ebb7a3a66b46ae1991a5913e6
- MD5 3216f4800cfc12983d70a1c01d6adb15
- SHA1 a73138f4c507d2206efde1ca9e2bb210c429d5b2
- SHA512 161c7546d5f8018aa3e79c7b05e5a5f91dc40bbb0774170cec71665b8d4cced583722a1c826ae4653f713870892800cf6c947aa562b3373e0eb4c2fcfb495553
- SSDEEP 98304:obplk3Y8NBxJJZ6eRCrMWjauOPIlwics:Glk313xLzWjauOPIlw7
- TLSH T14A268D47B3A400ECD47BD17CC6569B07EBB2B4191324A7DB15A086A62F23EE11BBF315
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3159408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Dan\Desktop\work\sqlite\bld\sqlite_bld_dir\2\sqlite3_analyzer.pdb
netapi32
NetGetDCName
NetApiBufferFree
NetUserGetInfo
user32
wsprintfA
WaitForInputIdle
SetTimer
RegisterClassW
DispatchMessageW
GetWindowLongPtrW
UnregisterClassW
SendMessageW
CreateWindowExW
PostQuitMessage
SetWindowLongPtrW
DestroyWindow
PostMessageW
DefWindowProcW
GetMessageW
MessageBeep
MessageBoxW
CharLowerW
wsprintfW
KillTimer
TranslateMessage
MsgWaitForMultipleObjectsEx
PeekMessageW
advapi32
RevertToSelf
AccessCheck
EqualSid
GetNamedSecurityInfoW
GetSecurityDescriptorOwner
ImpersonateSelf
OpenProcessToken
GetFileSecurityW
OpenThreadToken
GetSidIdentifierAuthority
GetTokenInformation
GetUserNameW
ws2_32
WSAStartup
WSAGetLastError
setsockopt
getnameinfo
ioctlsocket
freeaddrinfo
htons
getsockopt
recv
gethostname
getservbyname
inet_ntoa
connect
socket
send
getsockname
getpeername
WSAAsyncSelect
listen
shutdown
select
closesocket
bind
accept
getaddrinfo
ntohs
userenv
GetProfilesDirectoryW
kernel32
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetConsoleOutputCP
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetCommandLineW
GetCommandLineA
GetTimeZoneInformation
GetFileSizeEx
SetFilePointerEx
SetStdHandle
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetConsoleCtrlHandler
GetStringTypeW
GetDateFormatW
ExitProcess
FreeLibraryAndExitThread
ResumeThread
ExitThread
GetModuleHandleExW
RtlPcToFileHeader
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WriteConsoleW
PeekConsoleInputW
ReadConsoleW
GetConsoleCP
SetConsoleMode
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
GetModuleHandleW
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
DebugBreak
RaiseException
RtlUnwind
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
DeleteCriticalSection
GetModuleFileNameA
GetModuleFileNameW
GetEnvironmentVariableW
GetEnvironmentVariableA
GetVersionExW
GetACP
GetProcAddress
lstrcmpiA
SearchPathW
GetCurrentProcess
GetStdHandle
GetShortPathNameW
SetThreadPriority
CreatePipe
PeekNamedPipe
DuplicateHandle
CreateEventW
GetExitCodeThread
SetEvent
TerminateThread
CreateThread
ResetEvent
CreateProcessW
GetTempFileNameW
GetExitCodeProcess
GetConsoleMode
GetCommState
GetFileType
SetHandleInformation
GetComputerNameExW
QueryPerformanceFrequency
CreateDirectoryW
GetVolumeInformationW
FindFirstFileW
FindFirstFileExW
FindNextFileW
lstrlenW
DeviceIoControl
RemoveDirectoryW
SetFileTime
CreateHardLinkW
FindClose
GetFileInformationByHandle
GetCurrentThread
GetWindowsDirectoryA
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileStringA
GetVolumeNameForVolumeMountPointW
GetVolumeInformationA
SetFileAttributesW
GetLogicalDriveStringsA
CopyFileW
MoveFileW
FreeLibrary
LoadLibraryExW
SleepEx
PurgeComm
GetCommModemStatus
SetupComm
BuildCommDCBW
EscapeCommFunction
ClearCommError
GetOverlappedResult
SetCommTimeouts
SetCommState
Name
.text
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
624KB
Virtual Size
623KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
31KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
161KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=259, version=30795,
count=184, id=261, version=30795,
count=1, productName=Unmarked objects (old),
count=46, id=260, version=30795,
count=3, id=253, version=33218,
count=41, id=261, version=33218,
count=17, id=260, version=33218,
count=18, id=259, version=33218,
count=13, id=257, version=30795,
count=255, id=1, productName=Unmarked objects,
count=168, id=264, version=33523,
count=1, id=260, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
sqlite3_rsync.exe
- IMPHASH 8b8f20094251a219de441d97e6abb001
- SHA256 6025aecc035207f5148c8dccf0a7d18ff113ee9283a813eb8e171bbb4dc6986c
- MD5 b0aa3f73868556da126ace100a4231d8
- SHA1 94dbf8d53ddfc2ada5cddca4975c82144d174df7
- SHA512 6434fb171e867b476058b4324148e5ba0a17ce885480d0a8880f3af80348b311dccc814192a5409b796371de5fc4ce114606ca58d455b380acc4b86e5eaa4adf
- SSDEEP 49152:bgJJ5Mg+Zb2jyZY3kyMVZLmVY8pDiKm0IL8gLbQWTRpUCm:U3+iMG7MVZLmNpc0W3U
- TLSH T1E5E58C4AB3B910DDD067C17CCA4A575BEBB2B404132597DF459086A92F23EE64EBF320
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13711
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Dan\Desktop\work\sqlite\bld\sqlite_bld_dir\2\sqlite3_rsync.pdb
kernel32
GetStdHandle
CloseHandle
SetHandleInformation
CreatePipe
CreateProcessW
MultiByteToWideChar
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
GetModuleHandleW
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
GetSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WriteConsoleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
SetStdHandle
GetFileType
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentThread
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
SetConsoleCtrlHandler
RtlUnwind
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
366KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
35KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
1024B
Virtual Size
863B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=30795,
count=161, id=261, version=30795,
count=33, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=3, id=257, version=30795,
count=132, id=1, productName=Unmarked objects,
count=1, id=253, version=33218,
count=40, id=261, version=33218,
count=17, id=260, version=33218,
count=18, id=259, version=33218,
count=2, id=260, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,