file.zip
- SHA256 8ea2826afa6ad50069b514862d2f20e8af8f23e7a7ff7c2ae924106a70feaaca
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
File~-~.Document.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
File~-~.Document.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
300 seconds
Behavioral task
behavioral3
Sample
version.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral4
Sample
version.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
300 seconds
General
- Target file.zip
- Size 7.3MB
- Sample260828-x24drsseqf
- SHA256 8ea2826afa6ad50069b514862d2f20e8af8f23e7a7ff7c2ae924106a70feaaca
- MD5 900d1fb5d58d8493bee55b76d7bdd587
- SHA1 48d304bdc1ebb458941ec0f1c2bcf886c5436069
- SHA512 21915441de4260315d1112b83d583cf9e16ec938f205703245e941705d30244de5a17e5df7a99729409b2222eb50bd6fe21f959823195cfd3aa5c3ecc70399fd
- SSDEEP 196608:+jnsDeA7Bf/qo4SWCH4lC/ZLUWlzKewBW:EnMemyo4SW8LUWIewBW
- TLSH T11D763386CB051F4568DDEBF59A05C807F14EC902E2C48E60807068DFAB97EDDA55BCEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/version.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/version.dll
File Explorer
-
file.zip.zip 7.3MB
-
File~-~.Document.exe.exe 20.0MB
-
version.dll.dll 1.1MB
File~-~.Document.exe
- IMPHASH 87edbdfe442c3b8bd4ef4cf9789d4db7
- SHA256 4b840844ce458265427c1d9f11917bd94b84561ae7add3252e56cfb8f567e305
- MD5 183edf6dd1ef070eb3d386090354acaf
- SHA1 832e66d84888acdab6232662f19c2b33bd4990e6
- SHA512 9a21f13264d293579a15e48d999313d04966d9504b9578434594986f1a859e1f68a11bab56d6816db3abefc53ab109629de97229770ab8122cc1cfd7bc0373c8
- SSDEEP 196608:DrBXt5LXCuz9eL5FUtX48nvhbTWxszcRNdBMKSrXegGW9nsAy:nFt5LXCuz9eL5FUtX48nvoaQYtnsAy
- TLSH T11B27290567F98194F1F797349AB28787DA76BC416B34C68F0250620E1E73AE0DE7A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
26:8b:86:36:a7:9e:47:9c:dc:4d:ab:e5:96:43:4e:ec:27:e2:19:c6:bb:ff:ef:12:1e:7d:7e:8f:ab:35:bf:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR
Chains
Aug 22, 2025
CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR
Serial Number
34:49:da:f0:f2:43:ff:72:72:9a:17:60
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 13, 2025 - Jun 13, 2028
Subject
CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE
Serial Number
01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 11, 2025 - Dec 10, 2034
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 10, 2014 - Dec 10, 2034
Minor OS version
2
Major OS version
5
Entry point
8420256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\PandoraTV\Project\KMP\KMP64x\SRC\bin\KMPlayer_x64\KMPlayer64.pdb
dwmapi
DwmExtendFrameIntoClientArea
gdiplus
GdiplusShutdown
GdipDisposeImage
GdipFree
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusStartup
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipSaveImageToStream
GdipSaveImageToFile
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
uxtheme
EndBufferedPaint
GetCurrentThemeName
OpenThemeData
IsThemeBackgroundPartiallyTransparent
ord61
GetThemeSysColor
CloseThemeData
DrawThemeBackground
DrawThemeText
BeginBufferedPaint
BufferedPaintSetAlpha
GetWindowTheme
GetThemeColor
SetWindowTheme
GetThemePartSize
IsAppThemed
DrawThemeParentBackground
winmm
waveOutGetVolume
timeGetTime
timeSetEvent
timeKillEvent
timeBeginPeriod
timeEndPeriod
PlaySoundW
timeGetDevCaps
mixerSetControlDetails
waveOutSetVolume
kernel32
GetFileSize
LockFile
UnlockFile
lstrcmpiW
GetStringTypeExW
GetThreadLocale
lstrcmpA
GetProfileIntW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
VerSetConditionMask
VerifyVersionInfoW
FindResourceExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetSystemDefaultUILanguage
GlobalFlags
SetErrorMode
GetWindowsDirectoryW
SearchPathW
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
QueryActCtxW
QueryDepthSList
InterlockedPopEntrySList
GetModuleHandleA
GetThreadTimes
CreateActCtxW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetEnvironmentVariableA
FindFirstFileExW
GetConsoleCP
GetOEMCP
IsValidCodePage
ReadConsoleW
EnumSystemLocalesW
IsValidLocale
HeapQueryInformation
SetStdHandle
ExitProcess
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
RtlUnwindEx
InterlockedFlushSList
InterlockedPushEntrySList
LCMapStringW
SizeofResource
LockResource
LoadResource
FindActCtxSectionStringW
DeactivateActCtx
UnregisterWaitEx
ActivateActCtx
GlobalFindAtomW
GetModuleHandleExW
EncodePointer
GlobalSize
OpenThread
SetThreadContext
GetThreadContext
CreateToolhelp32Snapshot
OutputDebugStringW
GetStringTypeW
TryEnterCriticalSection
Thread32First
Thread32Next
HeapCreate
LoadLibraryA
GetTimeZoneInformation
SuspendThread
GetProcessAffinityMask
GetShortPathNameW
GetLongPathNameW
RemoveDirectoryW
CreateHardLinkW
MoveFileW
SetFileAttributesW
GetSystemDirectoryW
GetConsoleMode
TzSpecificLocalTimeToSystemTime
GetFileType
GetFileTime
SetFileTime
FlushFileBuffers
SetEndOfFile
SetFilePointer
IsDBCSLeadByte
GetCPInfo
CompareStringW
FoldStringW
AreFileApisANSI
DebugBreak
IsDBCSLeadByteEx
LocalAlloc
IsBadWritePtr
IsBadReadPtr
GlobalGetAtomNameW
FormatMessageW
FlushInstructionCache
QueryPerformanceCounter
QueryPerformanceFrequency
lstrlenW
SetThreadPriority
GetCurrentThread
GetThreadPriority
VirtualFree
VirtualAlloc
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
GetNumberFormatW
SetLastError
GetVersionExW
GetFileAttributesW
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
OutputDebugStringA
GetSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FormatMessageA
FreeEnvironmentStringsW
GetEnvironmentStringsW
DuplicateHandle
CreateThread
GetVolumeInformationW
RtlPcToFileHeader
QueueUserWorkItem
GetExitCodeThread
FindResourceW
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
GetTempFileNameW
DecodePointer
RaiseException
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetUserDefaultUILanguage
ReadDirectoryChangesW
GetOverlappedResult
CancelIo
GetACP
GetTimeFormatW
GetDateFormatW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileAttributesExW
GlobalDeleteAtom
GlobalAddAtomW
ResumeThread
ReleaseMutex
CreateMutexW
SetCurrentDirectoryW
HeapSetInformation
SetDllDirectoryW
DeviceIoControl
CreateFileA
WriteProcessMemory
ReadProcessMemory
IsDebuggerPresent
CopyFileW
SleepEx
FreeResource
lstrcmpW
GetModuleFileNameW
ResetEvent
GetDriveTypeW
GlobalAlloc
GetLocaleInfoA
LocalFree
GetCurrentDirectoryW
FindNextFileW
GetDiskFreeSpaceExW
FindClose
FindFirstFileW
SetSystemPowerState
SetThreadExecutionState
GetLocaleInfoW
TerminateThread
WriteFile
GetTickCount
SetEvent
CreateEventW
CreateDirectoryW
GetLocalTime
GetCurrentProcessId
CreateFileW
SetFilePointerEx
GetFileSizeEx
InitializeCriticalSection
LoadLibraryExW
GetCurrentThreadId
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
WideCharToMultiByte
GetUserDefaultLCID
GetTempPathW
MulDiv
lstrcpyW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
FreeLibrary
GetLastError
GetFullPathNameW
GetCurrentProcess
SetPriorityClass
DeleteCriticalSection
Sleep
DeleteFileW
CloseHandle
TerminateProcess
GetExitCodeProcess
ReadFile
PeekNamedPipe
CreateProcessW
GetStdHandle
CreatePipe
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
GlobalFree
GlobalUnlock
GlobalLock
user32
IsDialogMessageW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
IsWindowEnabled
GetNextDlgTabItem
WinHelpW
SetScrollInfo
GetLastActivePopup
GetWindowTextLengthW
GetWindowTextW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
SetMenu
SetFocus
IsChild
GetClassInfoExW
GetClassInfoW
GetMenuState
GetMenuStringW
GetIconInfo
GetDCEx
SetWindowRgn
GetScrollInfo
GetClassLongPtrW
GetWindowRgn
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
InvertRect
CreateDialogIndirectParamW
EndDialog
DialogBoxParamW
CharUpperW
CharLowerW
CharToOemBuffW
CharToOemA
OemToCharBuffA
CharLowerBuffW
DestroyWindow
RegisterClassW
GetAsyncKeyState
GetQueueStatus
DestroyMenu
TrackPopupMenu
GetMessageW
GetMessagePos
UnregisterClassW
SendNotifyMessageW
EnumDisplayDevicesW
SetWindowTextW
GetMenu
SetLayeredWindowAttributes
GetDlgCtrlID
TranslateMessage
GrayStringW
DrawTextExW
TabbedTextOutW
GetDlgItemTextW
MoveWindow
FindWindowExW
CreateWindowExW
IntersectRect
UnregisterHotKey
RegisterHotKey
RegisterRawInputDevices
SetMenuItemBitmaps
GetRawInputDeviceList
GetRawInputData
SetWindowPlacement
GetWindowPlacement
ShowWindow
AllowSetForegroundWindow
DefWindowProcW
LockWindowUpdate
ChangeDisplaySettingsExA
MsgWaitForMultipleObjectsEx
SetClassLongPtrW
GetDoubleClickTime
TrackMouseEvent
EnumDisplayMonitors
RedrawWindow
SetPropW
GetWindowLongPtrW
GetClassNameW
GetWindowDC
CallWindowProcW
GetMenuInfo
RemovePropW
SetWindowLongPtrW
GetPropW
CallNextHookEx
DispatchMessageW
GetMessageTime
GetWindowThreadProcessId
SetWindowsHookExW
UnhookWindowsHookEx
EndPaint
BeginPaint
GetClipboardData
GetPriorityClipboardFormat
SetParent
MonitorFromRect
DestroyIcon
FindWindowW
MsgWaitForMultipleObjects
DrawMenuBar
CheckMenuItem
AppendMenuW
RemoveMenu
CreatePopupMenu
ChangeDisplaySettingsExW
EnumDisplaySettingsW
IsMenu
MessageBeep
CheckMenuRadioItem
SetWindowLongW
SetRectEmpty
InsertMenuW
DeleteMenu
EnableMenuItem
SetMenuInfo
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
LockWorkStation
ExitWindowsEx
SystemParametersInfoW
GetMenuCheckMarkDimensions
LoadBitmapW
SendDlgItemMessageA
WaitMessage
MapDialogRect
CharNextW
IsClipboardFormatAvailable
BringWindowToTop
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
GetSystemMenu
SetWindowContextHelpId
ShowOwnedPopups
CopyImage
RealChildWindowFromPoint
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
GetActiveWindow
GetTopWindow
GetForegroundWindow
MonitorFromPoint
GetMonitorInfoW
GetWindowLongW
AdjustWindowRectEx
GetMenuItemRect
GetSubMenu
SetForegroundWindow
IsIconic
PostThreadMessageW
ChangeWindowMessageFilter
EqualRect
LoadMenuW
RegisterWindowMessageW
PostQuitMessage
GetFocus
GetAncestor
DrawStateW
DrawFocusRect
DrawIconEx
ToUnicodeEx
GetKeyboardState
NotifyWinEvent
SetCursorPos
GetMenuDefaultItem
EnableScrollBar
HideCaret
CopyIcon
DrawIcon
SetMenuDefaultItem
ModifyMenuW
CharUpperBuffW
UpdateLayeredWindow
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
GetUpdateRect
SubtractRect
CreateMenu
GetComboBoxInfo
DestroyCursor
GetRawInputDeviceInfoW
IsZoomed
IsCharLowerW
GetKeyboardLayout
MapVirtualKeyExW
GetKeyNameTextW
MapVirtualKeyW
RegisterClipboardFormatW
GetKeyState
GetSysColorBrush
GetCursorPos
DrawFrameControl
OffsetRect
WindowFromPoint
FrameRect
FillRect
CopyRect
MonitorFromWindow
SetTimer
KillTimer
PeekMessageW
UpdateWindow
SetActiveWindow
GetDesktopWindow
SetRect
UnionRect
GetSysColor
GetDlgItem
LoadIconW
GetSystemMetrics
InflateRect
GetWindowRect
SetWindowPos
DrawTextW
IsRectEmpty
DrawEdge
ReleaseCapture
SetCapture
GetCapture
ScreenToClient
ClientToScreen
SetCursor
ReleaseDC
GetDC
InvalidateRect
PtInRect
MessageBoxW
IsWindow
PostMessageW
MapWindowPoints
GetClientRect
IsWindowVisible
GetWindow
LoadCursorW
wsprintfW
CreateAcceleratorTableW
DestroyAcceleratorTable
CloseClipboard
SetClipboardData
EmptyClipboard
GetParent
OpenClipboard
LoadImageW
SendMessageW
EnableWindow
OemToCharA
gdi32
CreatePatternBrush
GetClipBox
GetObjectType
IntersectClipRect
RestoreDC
SaveDC
SelectPalette
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
SetWindowExtEx
SetWindowOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
AddFontResourceW
GetTextCharsetInfo
GetRgnBox
CreateEllipticRgn
Ellipse
Polygon
Polyline
CreateRoundRectRgn
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
SetPixel
RoundRect
ExtFloodFill
SetPaletteEntries
GetBoundsRect
PtInRegion
GetViewportOrgEx
CreateHatchBrush
SetPixelV
GetTextFaceW
GetICMProfileW
GetCurrentObject
TranslateCharsetInfo
EnumFontFamiliesExW
AddFontMemResourceEx
CreateFontW
RemoveFontMemResourceEx
CombineRgn
CreateRectRgn
EnumFontFamiliesW
GetTextMetricsW
GetTextColor
ExtSelectClipRgn
CreateBitmapIndirect
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetBkColor
DPtoLP
GetViewportExtEx
GetWindowExtEx
GetMapMode
LPtoDP
SetViewportExtEx
SetViewportOrgEx
CreateDCW
ExcludeClipRect
SetBkColor
FrameRgn
CreateRectRgnIndirect
CreateCompatibleBitmap
CreateBitmap
LineTo
MoveToEx
CreateSolidBrush
GetDeviceCaps
DeleteObject
GetObjectW
CreateCompatibleDC
StretchBlt
BitBlt
GetStockObject
CreateFontIndirectW
SelectObject
CreateDIBSection
CopyMetaFileW
PatBlt
CreatePolygonRgn
GetPixel
GetWindowOrgEx
FillRgn
SetRectRgn
OffsetRgn
GdiFlush
OffsetViewportOrgEx
SelectClipRgn
AbortPath
GetPath
EndPath
CloseFigure
BeginPath
SetMapMode
DeleteDC
SetStretchBltMode
Rectangle
SetBkMode
SetTextColor
GetTextExtentPoint32W
CreateDIBitmap
SetDIBColorTable
CreatePen
msimg32
GradientFill
AlphaBlend
TransparentBlt
winspool.drv
OpenPrinterW
ClosePrinter
DocumentPropertiesW
advapi32
RegSetValueA
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExA
RegCreateKeyExW
RegDeleteKeyA
RegDeleteKeyW
RegEnumKeyW
SetFileSecurityW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CryptDecrypt
CryptDestroyKey
CryptEncrypt
CryptDeriveKey
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegCloseKey
RegSetValueW
RegQueryValueW
RegQueryValueA
RegOpenKeyW
RegOpenKeyA
RegCreateKeyW
RegCreateKeyA
RegFlushKey
RegSetValueExW
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumValueW
RegEnumValueA
RegEnumKeyExW
RegEnumKeyExA
RegDeleteValueW
RegDeleteValueA
shell32
ShellExecuteW
ExtractIconW
SHChangeNotify
DragQueryFileW
DragFinish
DragAcceptFiles
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW
SHAddToRecentDocs
ExtractIconExW
SHGetFolderPathW
SHParseDisplayName
SHOpenFolderAndSelectItems
SHFileOperationW
SHGetSpecialFolderLocation
SHGetFileInfoW
SHGetDesktopFolder
SHAppBarMessage
ShellExecuteExW
comctl32
ImageList_Remove
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_GetIcon
FlatSB_ShowScrollBar
FlatSB_EnableScrollBar
InitializeFlatSB
ImageList_AddMasked
ImageList_Draw
ImageList_Add
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragEnter
ImageList_BeginDrag
_TrackMouseEvent
ImageList_GetImageInfo
shlwapi
PathStripToRootW
StrFormatByteSizeW
PathSkipRootW
PathStripPathW
PathFindExtensionW
PathFileExistsW
PathCombineW
PathRenameExtensionW
PathRemoveFileSpecW
PathRemoveExtensionW
PathMakePrettyW
PathIsDirectoryW
PathAddExtensionW
PathAddBackslashW
StrCmpLogicalW
SHCopyKeyW
StrRetToStrW
PathRelativePathToW
PathCanonicalizeW
PathAppendW
PathRemoveBackslashW
PathIsRelativeW
PathIsPrefixW
PathFindFileNameW
PathIsUNCW
UrlUnescapeW
PathIsURLW
StrFormatKBSizeW
ole32
CreateStreamOnHGlobal
OleLoadFromStream
OleSaveToStream
OleFlushClipboard
OleIsCurrentClipboard
OleInitialize
OleUninitialize
StringFromGUID2
DoDragDrop
OleLockRunning
CoUninitialize
CoInitialize
CoWaitForMultipleHandles
CreateItemMoniker
GetRunningObjectTable
CLSIDFromString
MkParseDisplayName
CreateBindCtx
PropVariantClear
OleDestroyMenuDescriptor
CoTaskMemAlloc
CoTaskMemFree
OleTranslateAccelerator
IsAccelerator
CoRevokeClassObject
CoRegisterMessageFilter
StringFromCLSID
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CLSIDFromProgID
CoCreateGuid
OleGetClipboard
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
ReleaseStgMedium
OleDuplicateData
CoFreeUnusedLibraries
CoInitializeEx
OleCreateMenuDescriptor
CoCreateInstance
oleaut32
VariantTimeToSystemTime
VariantCopy
SafeArrayDestroy
LoadTypeLi
OleCreateFontIndirect
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
OleCreatePropertyFrame
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
VariantInit
SysAllocString
VarBstrCmp
SysFreeString
VarBstrFromDate
SystemTimeToVariantTime
SysStringLen
oledlg
OleUIBusyW
ws2_32
WSACleanup
WSASetLastError
WSAGetLastError
WSAAsyncSelect
select
WSAStartup
accept
listen
shutdown
recvfrom
recv
ntohs
gethostbyname
socket
sendto
bind
send
inet_ntoa
inet_addr
htons
htonl
getsockname
getpeername
connect
closesocket
wininet
HttpQueryInfoW
InternetSetStatusCallbackW
InternetQueryDataAvailable
InternetQueryOptionW
InternetSetOptionW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetErrorDlg
InternetReadFileExW
InternetCrackUrlW
InternetSetFilePointer
HttpEndRequestW
HttpSendRequestExW
HttpAddRequestHeadersW
InternetGetLastResponseInfoW
InternetWriteFile
InternetGetConnectedState
InternetOpenW
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetCanonicalizeUrlW
oleacc
LresultFromObject
CreateStdAccessibleObject
AccessibleObjectFromWindow
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
Name
.text
Size
8.8MB
Virtual Size
8.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
123KB
Virtual Size
495KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
356KB
Virtual Size
356KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.giats
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7.6MB
Virtual Size
7.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=241, version=40116,
count=211, id=243, version=40116,
count=59, id=242, version=40116,
count=1, id=135, version=30729,
count=2, id=261, version=23013,
count=43, id=260, version=24123,
count=15, id=259, version=24123,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=3, productName=Unmarked objects (old),
count=1, id=136, version=30729,
count=1, id=173, version=30319,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1115, id=1, productName=Unmarked objects,
count=452, id=261, version=24123,
count=759, id=265, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
version.dll
- IMPHASH 646c07495faeebb13032d76fa50e826a
- SHA256 4cebc91bb721bcca059b0ac117129179daf6a9e316fcee2dc2c23231e7d6cebd
- MD5 ec0443fa4c60a1304e5d5a96d7d56f95
- SHA1 22856d8fb5e9b51f64f2533a2d75873a95dbc02b
- SHA512 9ebb32cee317d888d9dc5e7f4ef6fad6431666a95a2517ac8d7cf165ea4002cb3150a1e98a305697fa0df8291b8bf99623338ede4e779c6a43c420b840bfe1ba
- SSDEEP 24576:KgB1c74GMgE0dQuYuOvp6wGfm8TRIWWvDwnPFRBNchbZUuV:K61cLMH0dS9mrRqzk
- TLSH T1AF45F15453C441F1E0B9CA748A23A66DD27B3D1E0750AEFF03B04A6DBF36BC99529E42
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
148352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
FileTimeToSystemTime
GetTimeZoneInformation
GetLocaleInfoW
WriteConsoleW
CloseHandle
CreateFileW
lstrlenW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
GetSystemDirectoryW
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
FormatMessageW
GlobalUnlock
GetModuleFileNameW
DisableThreadLibraryCalls
LocalReAlloc
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
ExitProcess
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
LCMapStringW
GetCurrentProcessId
WriteFile
QueryPerformanceCounter
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetDateFormatW
IsProcessorFeaturePresent
HeapAlloc
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeFormatW
GetBinaryTypeW
user32
EndPaint
PostMessageW
ShowWindow
LoadIconW
GetWindowThreadProcessId
MoveWindow
EnumWindows
GetWindowRect
InvalidateRect
GetClassNameW
DrawTextW
GetSystemMetrics
EndDialog
gdi32
GetDeviceCaps
DeleteObject
DeleteDC
CreateCompatibleDC
GetTextMetricsW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
shell32
SHGetKnownFolderPath
ole32
CoInitializeEx
CoUninitialize
CoTaskMemFree
shlwapi
PathFileExistsW
PathFindFileNameW
PathIsRelativeW
comctl32
ImageList_Create
ImageList_Destroy
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
Name
.text
Size
217KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
833KB
Virtual Size
833KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33145,
count=15, id=260, version=33145,
count=6, id=259, version=33145,
count=9, id=259, version=35721,
count=14, id=260, version=35721,
count=40, id=261, version=35721,
count=1, id=262, version=33145,
count=17, id=257, version=33145,
count=128, id=1, productName=Unmarked objects,
count=1, id=261, version=36248,
count=1, id=259, version=36248,
count=1, id=256, version=36248,
count=1, id=255, version=36248,
count=1, id=151,
count=1, id=258, version=36248,