wiztree_4_32_portable[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
wiztree_4_32_portable.zip
Size 3.8MB
Sample260905-wvddbsfc26
SHA256 92d4701110bc0de7b43eb27e51ed5c625f3374e8813edfb4c03cc0698fb511bb
MD5 4125f96f8eb93fc86b09da5e5032bc45
SHA1 35c2a55616948df38e24cea311ce34dd549e5c4b
SHA512 a3dd87f56b2952ff94d75bde6e5fb6580a747dea412704e1b21a06bb434a4e4ae8c594ba30bb0f25994dd1d7c7d707d29dd3e552bc2a4028b9d34737f6ecefaf
SSDEEP 98304:PPPgoM1jgAed8p0EzroXW1aE9g+Sk02mAJ6nQpn4T7YyVwTqZeW3:HPtwjg8BuWEyg+10NcppnqMlmMg
TLSH
T1D3163379A24EBF524C0AA420A5891E52C3FADF774AA9742CC23E8EF54CD4F910D4D1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
unpack001/wiztree/WizTree64.exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/wiztree/version.dll

File Explorer

wiztree_4_32_portable.zip

.zip 3.8MB
wiztree/WizTree64.exe

.exe 10.5MB
wiztree/version.dll

.dll 23KB

wiztree_4_32_portable.zip

SHA256 92d4701110bc0de7b43eb27e51ed5c625f3374e8813edfb4c03cc0698fb511bb
MD5 4125f96f8eb93fc86b09da5e5032bc45
SHA1 35c2a55616948df38e24cea311ce34dd549e5c4b
SHA512 a3dd87f56b2952ff94d75bde6e5fb6580a747dea412704e1b21a06bb434a4e4ae8c594ba30bb0f25994dd1d7c7d707d29dd3e552bc2a4028b9d34737f6ecefaf
SSDEEP 98304:PPPgoM1jgAed8p0EzroXW1aE9g+Sk02mAJ6nQpn4T7YyVwTqZeW3:HPtwjg8BuWEyg+10NcppnqMlmMg
TLSH
T1D3163379A24EBF524C0AA420A5891E52C3FADF774AA9742CC23E8EF54CD4F910D4D1E7
MD5 SHA1 SHA512 SSDEEP TLSH

wiztree/WizTree64.exe

IMPHASH cd6bd29e5e200cee2f7763f04ee163f7
SHA256 6bffb6b63d96ff19824641e8ced04e5e0f648696073d82a508f1bb1a21e7eb46
MD5 e0597271a9bd8f89f04eaed75bd6087f
SHA1 cbd5b3726886ee55f6946f28979e8597dd6c9174
SHA512 71a1fc1260c6a3f682978e3b24f74036c20f5cc4e6e85c942f581a7f638c5e25fde6ac36ae9c781a766cee3e022206a5fe0dbeb56d4e83b58610cd947e12a0bd
SSDEEP 98304:uPLDf45144u3yAEnZOEs62gtryFre0x7jhqrG:ODf45KFIZ3XtryFre0xQrG
TLSH
T139B66D2F72A8C12DC26EC27EC1A78F50ED33B0B51736C2FB129052655F16AC49E7E265
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

d8:72:f6:93:92:d3:23:62:48:5a:07:9b:ac:7e:04:ad:b6:62:a9:e5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1988665,CN=Antibody Software Limited,O=Antibody Software Limited,ST=Bay of Plenty,C=NZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e5a

Chains

Aug 4, 2026

SERIALNUMBER=1988665,CN=Antibody Software Limited,O=Antibody Software Limited,ST=Bay of Plenty,C=NZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e5a

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=1988665,CN=Antibody Software Limited,O=Antibody Software Limited,ST=Bay of Plenty,C=NZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e5a

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

SERIALNUMBER=1988665,CN=Antibody Software Limited,O=Antibody Software Limited,ST=Bay of Plenty,C=NZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e5a

Serial Number

81:23:2f:e4:83:2f:5a:ea:c9:c6:de:08:bc:f7:8e:69

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 21, 2023 - Sep 20, 2026

Minor OS version

Major OS version

Entry point

7999952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mpr

WNetGetConnectionW

winmm

timeGetTime

oleacc

LresultFromObject

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comdlg32

FindTextW GetSaveFileNameW GetOpenFileNameW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_SetDragCursorImage ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

shell32

SHBrowseForFolderW DragAcceptFiles ord18 SHGetFileInfoW SHGetFileInfoA ILCreateFromPathW SHGetDesktopFolder SHFileOperationW SHFileOperationA ShellExecuteW SHMultiFileProperties DragQueryFileW SHGetSpecialFolderLocation Shell_NotifyIconW SHGetSpecialFolderPathW ShellExecuteExW ShellExecuteExA ILGetSize SHGetPathFromIDListW SHGetDataFromIDListA SHGetDataFromIDListW DragFinish SHGetMalloc ILFree ILClone SHAppBarMessage

user32

CopyImage MoveWindow SetMenuItemInfoW GetMenuItemInfoW DefFrameProcW CharToOemBuffW GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect ClipCursor SendMessageA IsClipboardFormatAvailable EnumWindows ShowOwnedPopups GetClassInfoExW GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW EnumChildWindows GetScrollBarInfo UnhookWindowsHookEx SetCapture GetCapture CreatePopupMenu LoadMenuW ShowCaret GetMenuItemID DestroyCaret CharLowerBuffW PostMessageW IsZoomed SetParent DrawMenuBar InvalidateRgn GetClientRect IsChild IsIconic CallNextHookEx ShowWindow SetForegroundWindow GetWindowTextW GetAsyncKeyState IsDialogMessageW DestroyWindow RegisterClassW EndMenu CharNextW GetFocus GetDC SetFocus ReleaseDC SetScrollRange DrawTextW PeekMessageA MessageBeep LockWindowUpdate RemovePropW AttachThreadInput GetSubMenu DestroyIcon IsWindowVisible PtInRect DispatchMessageA UnregisterClassW GetTopWindow SendMessageW GetMessageTime NotifyWinEvent GetComboBoxInfo GetWindowLongPtrW SetWindowLongPtrW CreateMenu LoadStringW CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW CharLowerBuffA EnumClipboardFormats ScrollDC GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetMenu GetMenuState GetMenu SetRect GetKeyState IsRectEmpty ValidateRect IsCharAlphaW GetCursor KillTimer BeginDeferWindowPos WaitMessage TranslateMDISysAccel GetWindowPlacement GetClipboardFormatNameW CreateIconIndirect GetMenuItemRect CreateWindowExW GetDCEx InsertMenuItemA PeekMessageW MonitorFromWindow RegisterDeviceNotificationW GetUpdateRect MessageBoxA SetTimer AllowSetForegroundWindow WindowFromPoint BeginPaint RegisterClipboardFormatW MapVirtualKeyW OffsetRect IsWindowUnicode DispatchMessageW TrackPopupMenuEx CreateAcceleratorTableW DefMDIChildProcW GetSystemMenu SetScrollPos GetScrollPos InflateRect DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup GetCursorInfo GetSystemMetrics CharUpperBuffW SetClassLongPtrW GetClassLongPtrW ClientToScreen SetClipboardData GetClipboardData SetWindowPlacement GetMonitorInfoW CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow ToAscii EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW GetMenuItemInfoA ActivateKeyboardLayout GetParent CreateCaret MonitorFromRect InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW EmptyClipboard GetDlgItem AdjustWindowRectEx IsWindow DrawIcon EnumThreadWindows InvalidateRect SetKeyboardState GetKeyboardState ScreenToClient DrawFrameControl IsCharAlphaNumericW BringWindowToTop SetCursor CreateIcon RemoveMenu SubtractRect GetKeyboardLayoutNameW OpenClipboard TranslateMessage MapWindowPoints EnumDisplayMonitors CallWindowProcW CountClipboardFormats CloseClipboard DestroyCursor CharUpperBuffA CopyIcon PostQuitMessage ShowScrollBar EnableMenuItem DeferWindowPos HideCaret EndDeferWindowPos FindWindowExW MonitorFromPoint LoadIconW SystemParametersInfoW GetWindow GetWindowRect InsertMenuW IsWindowEnabled IsDialogMessageA GetMenuDefaultItem FindWindowW DeleteMenu GetKeyboardLayout

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SafeArrayPutElement GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement GetActiveObject SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantCopyInd VariantChangeType

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

advapi32

RegSetValueExW RegSetValueExA RegConnectRegistryW RegEnumKeyW RegCreateKeyW GetUserNameW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegOpenKeyW RegReplaceKeyW GetTokenInformation RegCreateKeyExW RegLoadKeyW RegEnumKeyExW RegDeleteKeyW RegOpenKeyExA RegOpenKeyExW OpenProcessToken RegDeleteValueW RegFlushKey RegQueryValueExA RegQueryValueExW RegEnumValueW ConvertSidToStringSidW RegCloseKey RegRestoreKeyW

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpConnect WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpWriteData WinHttpSetCredentials WinHttpQueryDataAvailable WinHttpSetOption WinHttpSendRequest WinHttpQueryOption

kernel32

GetFileType RtlUnwindEx QueryDosDeviceW GetACP GetStringTypeExW CloseHandle LocalFree GetCurrentProcessId SizeofResource VirtualProtect ReadProcessMemory TerminateThread QueryPerformanceFrequency IsDebuggerPresent FindNextFileW GetFullPathNameW VirtualFree GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW GlobalSize WriteProcessMemory RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy FileTimeToDosDateTime ReadFile GetUserDefaultLCID GetDiskFreeSpaceA FindFirstFileA GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW OpenMutexW lstrlenA CreateThread CompareStringW CopyFileW lstrcpyA MapViewOfFile CreateMutexW LoadLibraryA GetVolumeInformationW ResetEvent MulDiv CreateFileA FreeResource GetDriveTypeW GetVersion RaiseException GlobalAddAtomW FormatMessageW OpenProcess SwitchToThread GetExitCodeThread ReadDirectoryChangesW OutputDebugStringW GetCurrentThread GetFileAttributesExW IsBadReadPtr LockResource LoadLibraryExW FileTimeToSystemTime GetShortPathNameW GetCurrentThreadId MoveFileExW UnhandledExceptionFilter GlobalFindAtomW VirtualQuery GlobalFree VirtualQueryEx Sleep EnterCriticalSection SetFilePointer ReleaseMutex GetStringTypeExA LoadResource SuspendThread GetTickCount WritePrivateProfileStringW lstrcmpiA FindNextFileA GetFileSize GlobalDeleteAtom GetStartupInfoW GetFileAttributesW InitializeCriticalSection VerLanguageNameW GetThreadPriority GetCurrentProcess GlobalLock SetThreadPriority VirtualAlloc GetTempPathW GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread SearchPathW GetLogicalDriveStringsW GetVersionExW GetModuleHandleA VerifyVersionInfoW HeapCreate GetWindowsDirectoryW DeviceIoControl LCMapStringW SignalObjectAndWait GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage GetConsoleOutputCP UnmapViewOfFile GetConsoleCP lstrlenW CompareStringA QueryPerformanceCounter SetEndOfFile WaitForSingleObjectEx HeapFree WideCharToMultiByte MultiByteToWideChar FindClose LoadLibraryW SetEvent GetLocaleInfoW CreateFileW EnumResourceNamesW GetSystemDirectoryW GetDriveTypeA DeleteFileW IsDBCSLeadByteEx GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile CreateFileMappingW ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW GetPrivateProfileStringW WaitForMultipleObjectsEx GetThreadLocale SetThreadLocale

shfolder

SHGetFolderPathW

ole32

CreateDataAdviseHolder StgCreateDocfileOnILockBytes OleRegEnumVerbs CoCreateInstance OleGetClipboard OleSetClipboard IsEqualGUID OleFlushClipboard CreateStreamOnHGlobal OleIsCurrentClipboard CreateILockBytesOnHGlobal CoGetClassObject CoInitialize OleDraw CoTaskMemAlloc DoDragDrop StringFromCLSID CoMarshalInterThreadInterfaceInStream RevokeDragDrop IsAccelerator CoGetInterfaceAndReleaseStream CoUninitialize ReleaseStgMedium RegisterDragDrop OleInitialize ProgIDFromCLSID CoInitializeEx OleUninitialize CoDisconnectObject CoTaskMemFree OleSetMenuDescriptor

api-ms-win-crt-string-l1-1-0

memset

gdi32

Pie SetPaletteEntries SetBkMode GetRandomRgn CreateCompatibleBitmap GetEnhMetaFileHeader CloseEnhMetaFile RectVisible AngleArc ResizePalette SetAbortProc SetTextColor GetTextColor StretchBlt RoundRect SelectClipRgn RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx SetPixelV CreatePalette CreateDCW CreateICW PolyBezierTo GetStockObject CreateSolidBrush GetBkMode Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits CreatePenIndirect GetEnhMetaFilePaletteEntries SetMapMode GetMapMode CreateFontIndirectW PolyBezier LPtoDP EndDoc GetObjectW GetCurrentObject GetWinMetaFileBits SetROP2 GetEnhMetaFileDescriptionW ArcTo CreateEnhMetaFileW Arc CreateRectRgnIndirect SelectPalette SetGraphicsMode ExcludeClipRect MaskBlt SetWindowOrgEx CreatePatternBrush EndPage DeleteEnhMetaFile Chord SetDIBits SetViewportOrgEx GetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect PatBlt SetEnhMetaFileBits Rectangle SaveDC DeleteDC BitBlt SetWorldTransform FrameRgn GetDeviceCaps GetTextExtentPoint32W GetClipBox GetClipRgn Polyline IntersectClipRect CreateBitmap CombineRgn SetWinMetaFileBits CreateDIBitmap GetStretchBltMode CreateDIBSection SetStretchBltMode GetDIBits ExtCreateRegion LineTo GetRgnBox EnumFontsW CreateHalftonePalette SelectObject DeleteObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW OffsetRgn GetMetaFileBitsEx SetBkColor GetBkColor CreateCompatibleDC GetBrushOrgEx GetCurrentPositionEx SetDCPenColor GetNearestPaletteIndex CreateRoundRectRgn GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetPixel EnumFontFamiliesExW StretchDIBits GetPaletteEntries

ntdll

NtOpenFile NtClose NtQueryDirectoryFile RtlInitUnicodeString

Name

.text

Size

7.8MB

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

652KB

Virtual Size

651KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

961KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

115B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

664B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

109B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

355KB

Virtual Size

354KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

400KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

wiztree/version.dll

IMPHASH 479e96cdcdf3f6015debb6a85c3c1c7a
SHA256 ef687a13ac3226838a0688892e0f988e816733bdb41828c42a12cda4c9766140
MD5 ccba473ffebadcd4b9cb7b94d26490e6
SHA1 869b64c75d28f8973153800e6cce2e8bdb52ad40
SHA512 dc3dd0621d43cb8d24bc07e487a3ef5b093ba4b317b17ae2f9d54534e4052c293d519e7d3309ac5d530382d02134562dd80103ffe9c1d450a519e787f21aa97c
SSDEEP 384:kH66u/GcVFx+73L2mT/xcimI1hdRLwHTCFK36mcVPxIiTrx1jUNha/W8vLW:kH6X/GcVFqbfT/xcimIDd7w36mcVPxIm
TLSH
T1D9B2084AA38669ADC85BE378A9F71B72B77479580660CF3D4120C17D3DB3A04A13EB64
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

GetTokenInformation OpenProcessToken

comctl32

InitCommonControlsEx

crypt32

CryptBinaryToStringA

gdi32

GetDeviceCaps

kernel32

CloseHandle CreateFileA CreateProcessA DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExitProcess GetCurrentProcess GetLastError GetLocaleInfoA GetModuleFileNameA GetProcAddress GetSystemDirectoryA GetTempPathA InitializeCriticalSection LeaveCriticalSection LoadLibraryA QueryPerformanceCounter Sleep TlsGetValue VirtualProtect VirtualQuery WriteFile lstrcatA lstrcatW lstrcpyW lstrlenA

msvcrt

__iob_func _amsg_exit _initterm _lock _unlock abort calloc fprintf free realloc strlen strncmp vfprintf

ole32

CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString SysStringLen

shell32

SHGetFolderPathA ShellExecuteExA

shlwapi

PathCombineA

user32

GetDC GetSystemMetrics ReleaseDC wsprintfA

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption

winmm

timeGetTime

ws2_32

WSACleanup WSAStartup

Name

.text

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

612B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

wiztree_4_32_portable.zip

wiztree/WizTree64.exe

mpr

winmm

oleacc

winspool.drv

comdlg32

comctl32

shell32

user32

version

oleaut32

wtsapi32

advapi32

winhttp

kernel32

shfolder

ole32

api-ms-win-crt-string-l1-1-0

gdi32

ntdll

generic

wiztree/version.dll

advapi32

comctl32

crypt32

gdi32

kernel32

msvcrt

ole32

oleaut32

shell32

shlwapi

user32

winhttp

winmm

ws2_32

generic