20260904_065630_ftp_212.112.118.108_info.zip.zip
- SHA256 053e925e4647b0b405b61fb87c97fd4f4105c9ea7f4e3164cb1c49dad4175bc2
Password
infected
Overview
overview
10Static
static
7IMG001.scr
windows11-ltsc_2024-x64
7$PLUGINSDI...os.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/inetc.dll
windows11-ltsc_2024-x64
3$R9/NsCpuC...32.exe
windows11-ltsc_2024-x64
7$R9/NsCpuC...64.exe
windows11-ltsc_2024-x64
7$R9/Plugin...os.dll
windows11-ltsc_2024-x64
3$R9/Plugins/inetc.dll
windows11-ltsc_2024-x64
3$R9/Plugins/tftp.exe
windows11-ltsc_2024-x64
10$R9/Stubs/bzip2.exe
windows11-ltsc_2024-x64
3$R9/Stubs/...id.exe
windows11-ltsc_2024-x64
3$R9/Stubs/lzma.exe
windows11-ltsc_2024-x64
3$R9/Stubs/zlib.exe
windows11-ltsc_2024-x64
3$R9/makensis.exe
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
IMG001.scr
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/inetc.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$R9/NsCpuCNMiner32.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$R9/NsCpuCNMiner64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$R9/Plugins/ExecDos.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$R9/Plugins/inetc.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$R9/Plugins/tftp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$R9/Stubs/bzip2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$R9/Stubs/bzip2_solid.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$R9/Stubs/lzma.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$R9/Stubs/zlib.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$R9/makensis.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 20260904_065630_ftp_212.112.118.108_info.zip.zip
- Size 3.4MB
- Sample260905-yxtjfafg39
- SHA256 053e925e4647b0b405b61fb87c97fd4f4105c9ea7f4e3164cb1c49dad4175bc2
- MD5 4ba31264d27c759c4acfbc34feed67c4
- SHA1 9ab055cf886c4dfc9b5a71186ed30a97c3266711
- SHA512 7e692dd07e77e714d599fa0a60fc98881efd9766966a158603598f4a6f85979df27f4192cfa3f8fdcbd2869f1d505599a43bd1e6a8534e4526e2f5a4e8b15696
- SSDEEP 98304:7dakvH2lm6SUjtbc7CafA4g7SYZkmO4XXSWdi1gALFlg:7dfH2k6vbcffVUZLXDdi19Flg
- TLSH T17BF5332F3748F56967C9D14F2431E57E1105339A3A400AFA3C9D84E4489EB2BBDAFB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule static1/unpack003/$R9/NsCpuCNMiner32.exe vmprotect static1/unpack003/$R9/NsCpuCNMiner64.exe vmprotect - Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack002/IMG001.scr unpack003/$PLUGINSDIR/ExecDos.dll unpack003/$PLUGINSDIR/inetc.dll unpack003/$R9/NsCpuCNMiner32.exe unpack003/$R9/NsCpuCNMiner64.exe unpack003/$R9/Plugins/ExecDos.dll unpack003/$R9/Plugins/inetc.dll unpack003/$R9/Plugins/tftp.exe unpack003/$R9/Stubs/bzip2 unpack003/$R9/Stubs/bzip2_solid unpack003/$R9/Stubs/lzma unpack003/$R9/Stubs/zlib unpack003/$R9/makensis.exe - NSIS installer 6 IoCs
resource yara_rule static1/unpack002/IMG001.scr nsis_installer_1 static1/unpack002/IMG001.scr nsis_installer_2 static1/unpack003/$R9/Stubs/bzip2 nsis_installer_2 static1/unpack003/$R9/Stubs/bzip2_solid nsis_installer_2 static1/unpack003/$R9/Stubs/lzma nsis_installer_2 static1/unpack003/$R9/Stubs/zlib nsis_installer_2
File Explorer
-
20260904_065630_ftp_212.112.118.108_info.zip.zip.zip 3.4MB
-
20260904_065630_ftp_212.112.118.108_info.zip/meta.json379B
-
20260904_065630_ftp_212.112.118.108_info.zip/payload.zip 3.4MB
-
IMG001.scr.exe 3.4MB
-
$PLUGINSDIR/ExecDos.dll.dll 6KB
-
$PLUGINSDIR/inetc.dll.dll 21KB
-
$R9/NsCpuCNMiner32.exe.exe 1.4MB
-
$R9/NsCpuCNMiner64.exe.exe 1.5MB
-
$R9/Plugins/ExecDos.dll.dll 6KB
-
$R9/Plugins/inetc.dll.dll 21KB
-
$R9/Plugins/tftp.exe.exe 95KB
-
$R9/Stubs/bzip2.exe 34KB
-
$R9/Stubs/bzip2_solid.exe 34KB
-
$R9/Stubs/folder.ico52KB
-
$R9/Stubs/icon.ico60KB
-
$R9/Stubs/lzma.exe 33KB
-
$R9/Stubs/rar.ico9KB
-
$R9/Stubs/uninst766B
-
$R9/Stubs/zlib.exe 35KB
-
$R9/makensis.exe.exe 484KB
-
$R9/pools.txt500B
20260904_065630_ftp_212.112.118.108_info.zip/meta.json
- SHA256 46fdf1dd85a301e8983ccb46a058dec83c50d4fbb0e9b1327ec3f1ba6786940d
- MD5 eba1ea589764b17c179323d6b7c6f862
- SHA1 0c4037178c6156a921dea82b86d3b5b3bdffecec
- SHA512 700ce513c79e2d115692193b54af39ee54dccd7e0d855bfbd39c292a7046bd14173360a3fe7037902e06cbc2398e5e6359db6986a3a94e64d42f1e059d78b85e
- TLSH T14FE068D0706B10B3B4DC50BA1C5516851F85BF2F29C63A0123A3122818ADC0735F2E0D
- MD5 SHA1 SHA512 TLSH
20260904_065630_ftp_212.112.118.108_info.zip/payload
- SHA256 b914abc696286a639a847d2e3a4a36ff682f30a87b08c4ffc61f2e0cf5e7ec5f
- MD5 c3c561c20e48169f4906c6b0b135984b
- SHA1 aae73c86309c9198e8cc794f5dd3b1899f61e60d
- SHA512 2cf8e28faedb11009196510b00e82b682474edaf637019bdd6164b08ebbec39e6ef6cfcfbdfc1baa18bef3fb799bf5f90a2ce4ce8edac52d34af6f1013c96653
- SSDEEP 98304:SyrPvG3UNpYqQLpXhHHeanDebmPL+okjWa1luc:SyrPO3UDsdXp+z8+FWy7
- TLSH T1ABF53329C35BA51C444DD111B88E299A937D8D177E1E17314E43336CFE378AE3E8E2A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
IMG001.scr
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
- MD5 fbbcf1e9501234d6661a0c9ae6dc01c9
- SHA1 1ca9759a324159f331e79ea6871ad62040521b41
- SHA512 027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140
- SSDEEP 98304:M5VPnq1y5tQOM33ZNqCtBixHl54Oyjes1Ro6:2VPq1yLanrqTr43eON
- TLSH T1E8F533259387902DC0498230788B2B66D37ACC173D0A17225F4277ADFE375EB7E8E656
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Password
infected
Minor OS version
0
Major OS version
4
Entry point
12510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/ExecDos.dll
- IMPHASH 7dc70b16176744e9eb1a6b125a945c2f
- SHA256 42422d912b9c626ad93eb8c036ad82ee67cfa48cf75259c20c327eddd4cc376f
- MD5 d7b975049ec3aba50e4b7cc654a28214
- SHA1 25f2578945ebc9ac037fef7b7f94c5d48e42388b
- SHA512 f95f7875aeab586d42ee48029f7feed6e2fd8a7d106671e225ff5cf9ad83375f0ec3b8b288177c5d48b4c51eeddde687d67e7b07ad324e24059cff0a6516c270
- SSDEEP 96:31pNOe2w5QbJHsBiyw4uM4jEFVliuOtac32FOeSMV7WhWD:dj5Qb1sBPuijiu6avTyhW
- TLSH T18DD1B5797BE040B3D2B647303D72526793BDFC200B25E2AA4B571ACD2C90D54FD21BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
FlushFileBuffers
ReadFile
WriteFile
CloseHandle
DuplicateHandle
CreatePipe
PeekNamedPipe
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateThread
GetExitCodeThread
CreateProcessA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
lstrcmpiA
lstrcatA
lstrlenA
lstrcpynA
lstrcpyA
user32
SendMessageA
GetDlgItem
FindWindowExA
GetClassNameA
wsprintfA
exec
isdone
wait
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
338B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=2, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
$PLUGINSDIR/inetc.dll
- IMPHASH 2e4d94706c699d2da474aa823430b9a5
- SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
- MD5 d7a3fa6a6c738b4a3c40d5602af20b08
- SHA1 34fc75d97f640609cb6cadb001da2cb2c0b3538a
- SHA512 75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
- SSDEEP 384:oW4gLK82JvtosNCPhXKJ18hcEP1+f+pvMPbkdTg1Zahzs60Ac9khYLMkIX0+Gbyk:oW4i/2JloB5IQ9AhkwZaKRu
- TLSH T12DA207425B414AF3D3B60634707A33630769FE72246655DB86F32AC97878393EE36722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
12287
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
wininet
InternetErrorDlg
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetOptionA
InternetQueryOptionA
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA
comctl32
ord17
kernel32
GlobalFree
GlobalAlloc
WideCharToMultiByte
LoadLibraryA
lstrlenA
lstrcatA
lstrcpyA
lstrcmpiA
MulDiv
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleA
GetTickCount
TerminateThread
CreateThread
SleepEx
lstrcmpA
lstrcpynA
CreateFileA
DeleteFileA
GetFileSize
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetLastError
WaitForSingleObject
user32
SendDlgItemMessageA
SetTimer
KillTimer
EnableWindow
UpdateWindow
RedrawWindow
SetWindowTextA
GetWindowTextA
GetClientRect
GetWindowRect
MessageBoxA
GetWindowLongA
SetWindowLongA
GetParent
FindWindowExA
LoadIconA
IsDialogMessageA
SystemParametersInfoA
SetDlgItemTextA
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
SendMessageA
PostMessageA
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
IsWindowVisible
CreateDialogParamA
GetDlgItem
get
head
post
put
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=81, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=2, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
$R9/NsCpuCNMiner32.exe
- IMPHASH 605c19578abec75fc74907473f752c23
- SHA256 a0eba3fda0d7b22a5d694105ec700df7c7012ddc4ae611c3071ef858e2c69f08
- MD5 3afeb8e9af02a33ff71bf2f6751cae3a
- SHA1 fd358cfe41c7aa3aa9e4cf62f832d8ae6baa8107
- SHA512 11a2c12d7384d2743d25b9e28fc4ea0c3e2771aca92875fd3350f457df66c66827d175f67108f1a56d958f3b1163f3a89eedb8919bf7973d037241a1e59231d5
- SSDEEP 24576:gWKqa4hnzP3w7L3rmZmpk7FSQFW2iJ+N07/TwYV1CdZdQ+4lT+iFgiGTtswAtdz:gSrwf3aZmpOFU2iQNIUc1LxGTtswgd
- TLSH T1C66523D22F67A174D08A073C732DF3BD117D60988A935EB0A68157EAF41F841399B36B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
2421845
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\CryptoNight\bitmonero-master\src\miner\Release\Crypto.pdb
ws2_32
__WSAFDIsSet
advapi32
AdjustTokenPrivileges
user32
GetWindowTextA
kernel32
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
g���Ɖ
�� �����B/���a�t����1
Zʔĭ�Ԋ�+_�3��DZ���{Sy5�$e�d�� Ԋ|5:L�2봬6���bm�2I��� ��_ą�چ<����%ٽ{Yy)�y��C�*�<E���-�Z�b�=ˤ���ȱ�,��/* |��������H����y��D��=�8< ì�r��o�t!�zMx��ÄnD�a��� دm��4�����}�7�!��� �C�^���E�����,�2��^T} �|����2k�8��:vz��
�a�T
��(���:҃��K#�z'XnN);o� �-ʨ�����y��BݏЩ���?�,:�� �v�b"]�/C�<$fn�'��!c�Ҿ6R�dȹd� !c!�j�lJ��vՃ�B��1C�6�M+'vk� �[ N�>K�]0�22����n�oa�E�A*a� p�j��L�M�ʦ�,�R>`=n�]%�J)���M!�[�<d*���\��h�4j]�,=r_���l���Q#:���4���a��i��}폎 �"���P�{dF͓��^�����Vmm�-ʭ�k��Fy���l�K !�5�p�O�еG�L{s��5�����j�w0��N��K�M[91�J(�-dH�eˬ�<.Ϭ0]a�l_"~!�^/� �g�&�4���PRA� �J�4 �Nʣ��8hj��Mt�^���C�`��/_T
�� ̑�e�KY�>������F �h�S����\�Y/^���Sp+�e��.��P
��3h�I�h5�B�S�ø���qՈ4n���3��s�2���*�= ����pm�pl�})��s ����xx��N��։z��P��}��H�V����vH��hm`�5f^��� �в�������Q֮�C*~fs�~�]O\x�
﴾����v2&�*�1t�R=5�xG|��>^.m� 풼k�� �����e���W�E���dRܐx�V�� !ݾo�������z8��L���2���C H<H' �����2"��G߮v!� �b�zv�����AK�x�/��p�|ĸ����T�-�q�R�M��j�>��H��Ы6.sf.��o�Kf
�C Ɓb��
}
k�Z���鱼��t�~�j�Z�q�prd�������!����n��PR/b��s����q�Bi)dv�QN����û���6&��8]�e���R�.���tk]�����!)_뎉}>R��Ρ �T }�O�E���l�\b�V��n�����E����:�Z��;`��t�� � ����'E������J`�ï1YU�Pg@t�
�f��.g���*���Xߜ<O�ʔ81��������&�����i�$Дr��������*]nH��w���VAe��s��4J0����h�:��,��h9�U�H *7r�J�m�ؠ9��|��Kq��02Ԧ��\�A8� �f� �C��-�^�L̾���"�p�N�n0�A�L2��N�� ��c��P�g�d���H�ם) T�H�/�8lu]flַ�o~��.U?�:V�M��Ca�}��
����B��ȕ�o����x��9m���n���|Nm$*r��B9Y�H���ǭwd���,���J�6��v��BO�!*�ѯ��d�� d��n!�,}/#���m��FR��hǜ����+�I�R�C�$�>
����P��T� �{��'[� ϑ~P0�t�)��6<vt�'�I*\Y���J5䩐�3sV���UJ�7
��,y�9��ʰ� �7�[��د��!��RH��֝ ���P6��'��W;����>��=Q2����@P:�Ԙ��/�� @2b��B��Y�⾍�0{��;���iiuáAp [�m��Zu���F���*��������(� &�π�r
ׅ@����8 ��٪�l�K�ԣ�����ʘ t-�$�6��u��Һ�S\��6��'���D�d���0���ϖ�@�P���x���T� ��F/ħ<�O�;����â*���zy��o�f�3#֓1z��ҚG,��Y-�ysQ�Ƕ��?��=������
��Ow�d'��:K.$��4���� ����S4�@��y1��d����
�F�7�E-�xq:�T��nW>w4�8y��Y����M��8I�l(b�u���4l��L�
P��hr���R^=odž�0T�� -��{�ea iaݍ���p%�G�HZf"�袟�A�3m˪�����]��� �<CY�dq��=��O�'(�8�� :��Z�wD]ɛ�����.������z`-��hP�G
�E�ݶ���;���)�]E(D8;����;H�m�v�r�5�,F����ln�э��B� n�� ZB��ݧ�4�NҾ[ F�d�m�����jzC��w�<hw ����w�A"�LZ��C/�l�7m�]��|=*�� ���%y#�L��Q�e����� iX9�w@"³
|��g�3���A��,��D��ƀ�U��"HDV�����s��Բ)Y5ңy��*���ܵ/�uz
�ܐ����FGuL4Pr��,�w'�f_�C���;y�`��Q` o���E��x��;�&���g���u?�u�K��` �¾N�5{��Y��B7� ?�_��`���?���Yp�{ 9��C) �����SY�|�:s�ן�� �s������w�wϠVHEY�-���i�20Y~}����%I���*bȀ ��7��Α��ZQ�u26��X�[g���$dr�`^���2H����ʎ�V��ݷ�O���TQ�U�t��d�uׯg*�� |ṿ ����������t�ڨ�{|�H�3��S���3�(� _���H�:�kd�
8�^o��rU'g��Ly��U�벳����m��Ok�����k�
��S����vx�Jh�I��&�4���Y�a��ɧG ��VE�F� e�[;3�.�F������\�S�����絙����9J����o(��V��� ����q�8�1L06�]���=�6e����+��r_��R�>eH�c���Z��ȱ���8�n��@�E�Z��d��Vz��f���#�=(������z 34X �3Y3 k�Ҳ� ���s�K���+���%�|M#������eB3/1�=��5\��
Name
.text
Size
Virtual Size
636KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
2B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
Virtual Size
961KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp1
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=37, id=205, version=50929,
count=9, id=185, version=30716,
count=223, id=1, productName=Unmarked objects,
count=10, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=135, id=207, version=50929,
count=244, id=206, version=50929,
count=26, id=211, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
$R9/NsCpuCNMiner64.exe
- IMPHASH de374bd0d52433ab46e2fe7e4daf1ffe
- SHA256 d0326f0ddce4c00f93682e3a6f55a3125f6387e959e9ed6c5e5584e78e737078
- MD5 eedb9d86ae8abc65fa7ac7c6323d4e8f
- SHA1 ce1fbf382e89146ea5a22ae551b68198c45f40e4
- SHA512 9de3390197a02965feed6acdc77a292c0ef160e466fbfc9500fa7de17b0225a935127da71029cb8006bc7a5f4b5457319362b7a7caf4c0bf92174d139ed52ab5
- SSDEEP 24576:Mf79KQimeoyEgM8dSGDeCAQ4GYwEkYEDI3BiiVzKJo23bvH5xh8wtDzgClYAdC51:b3EciPG9E/LBVeJo2Vsw57lYAA51
- TLSH T12C7533DB854E31CBC243C770A5FF1E641022274AD1209349E37A279E8A9F2E5B7D9E74
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
2
Major OS version
5
Entry point
3285642
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\CryptoNight\bitmonero-master\src\miner\x64\CPU-Release\Crypto.pdb
kernel32
LCMapStringW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
advapi32
AdjustTokenPrivileges
ws2_32
select
�P hŶޘj�u0�ik�תE��ð,/�J��f���p0u誌8�5 ��
&{��(W U� y�� ��}b6
�4ˋ��=���i� �S�-i& ��
�:p�V3��s��]�)�t��V(7��H ��3ӫt��h���->9]&mo
��qщ�o�K�!��7�DQ�Fc�T.�y�d.k�O �(|�����m,o��0�^z�.˧CD� ̼�����ғ{�� j�K|9�;�����F���]�: ���l�|<�
��� �; �g�{j�J�a�y�
DGĈ��i��_�'��$-1+T�����_0h�q�r�4���Πr�~S��۱��. �6 !�8��V��/���y\^߯I �cL���;.�9]�#;&n� �JeF���YI��s7���+vH���<B��w$��W뫝����[�JӅL�#��F�T���Pz�5]/� <��|O���J��z7:�ד~�1f/g���8���a����5 �r��G�r��8Uf ��� u�-F�Ɩ�^RZD�<6���3� �X ��<�8^z�R�^����TP=�7 *�p��E+z ?����� )��]�M3p�X�6��2�vQ ����W �䠐Ǿ�&� �� k���&��$Qt�e�-�s�A&���Bm3o#ެ6�SО?�D&D�3�"OM3<��|���ѷ�N6 5�3����u�R�H�X Y���獼E��[�M��9�;5|��j�e�bJ�����n݃�dF��Q3/u" ڣ��� [?#��g���a�*��.���Nj�{����ŸD1�������]F��š4���0�fuw�x���5{��Y�L��x9���7���Z��Ww-��?���
��[��3���v��L �!��s��R����-;|cm~�RA� �&���� ﭠ��Pf8�����M���� �:��������B�iE� ��8R��+}�vى�
E���oT:�jLˎ?�:` �~ �i�F3B�M��$�NϧC�{`da'<�qE}q�2�\�? ��=~��F\����l���6����d�Rw
�P7���d����$��������u��5Q��
�@/?$"� ��h�J�Ǡ1�]�p^�t"��2▾���h�%�q^@,���r!�9p����51�g(���'��G� 8 b������_�_`C�>��cu���9�s�TH-�pb��f����#�4X&�ș&d ��3��lp������g|���ѹ`����}��=��I],��!\?rZ����b_e �Sw��� �Y�G�_]�jτ��iP� ��=ʊrO~�ZU[�c�D�������� =��+��� ��c\?ծ��-Y�:Gx��#� �Gs�ת�b�S�Oo���aU����[ ��9f��T��1$xML�R� V�]�5=~O�2$��2���������8�� ��b�8�deOP����}o�A VGc�(��}R@^�T·\���(�a7
y�Xv�m��]Y�A�j�@��D]�t����i� �l��G��5���wŗ�/�����R�]� �][���ٮ�Uz�m(�˵W,[��{p�{oC#��Xn�%qK��{ �� i;!)�.�mi �����/f�� >T�rc9L�X�� ��p�C����ۖ�`��+tY��Tc�
�G:`
�6����D��1����,N2����ͥ �YΈ�
4s�E �3ݧ
:Q1�(�:F#&Tf���ø[^��uD`�N�&��3&A����p�� �zF�Fq�^j^'�W֘��6' "�
��a-)^��U�a��$
V�xZt�X�K`_��bl��F��DV������\4� �pB;���.8��j�@�@�o 栅*b�=cV�A�~e��#D�� �6 Hk�ˡ.VÍ��E6��KȽ���I��p�B�*p��wX�i��&p1 �+o�N�ޡL�$O� �
F�t��� �h;E1�
�@ ��y0�`q��h�i�D�"[ᬚ�x�����/��o�ʜ���gs7),A ����t!�BD���R��+%nE˟%p��4tksC�"�ӵ������ \f&
�=z ��� $���#%��B����v�Eĸ�
,0,?���@~^8�龪z���1j���k��=��s7y Yޯw��!�Đ�#��ĭÞ�~��B��LK�!�R�{8h�!�n� ��� ��Byvy��U���7O�w�vT����P�E:$N��wWy�'���ƽrk�5$C3��7����N\���Ф����;��"�ʻ5��y�֧�� +�ڷ�Y��c%�8���j]{����L��~�����_�'���d[KX��kD���"�%G�: ��K���N��&?�5�����Ŏ �il���#cC3o-
��9!��I̫V�~o��E� ��˸4����Xo�4���� ��}yU��3 f5WK��B=ʞ���=��c���� ��<��TK�.s#W��#���� ��7~��2ϓ�)���=��T.uM,���K<1;q.�3^\y &�Ow�� j
�>�}�yڬ��k�x�*��3}�m-<�0-í�zK\��Q8Qe��\
Ψ�~��ڂ��bK��� Oy�VY�0�.ˣ=l��0�? ��$x C��u��C���7y�!�9��Q������z�g��沃P���(�q�q4�����0�����~�i���T�0O�`2��ηP�A��<h�C���f��ߖ���@Δ�Ү8�a�/9�*�s��Ǹ����J3|g,�(^�ͥ8uu)>#R�����
�N���t���m���0E.�¹S�D�6w��R5\؆�2?�"Q\I{%U|�0��P�����0�vAĬB-�t��r�e{���NzW|�Hq�|H]��ߞ�m �(���_A s��r�F�+�6�����k��
�����ڬv(rB�H� �`�a�j�*���:O? ���e<��N2p�� D+rs����GL�5� D�T{��Wf���:V�˅�6O�LI�,���U�� ?e �p�
d1ءܨL�#�>�u���;�}Ҭ�B����L�9G sF5��ǒ�#����4�~�����^jM�Qn�<lk����K�l�h���� ��@��_�L��\���ZT9_ )�e�S���?��Π,�>�
Name
.text
Size
Virtual Size
668KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
2B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp1
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=14, id=205, version=50929,
count=10, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=134, id=207, version=50929,
count=243, id=206, version=50929,
count=224, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=26, id=211, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
$R9/Plugins/ExecDos.dll
- IMPHASH 7dc70b16176744e9eb1a6b125a945c2f
- SHA256 42422d912b9c626ad93eb8c036ad82ee67cfa48cf75259c20c327eddd4cc376f
- MD5 d7b975049ec3aba50e4b7cc654a28214
- SHA1 25f2578945ebc9ac037fef7b7f94c5d48e42388b
- SHA512 f95f7875aeab586d42ee48029f7feed6e2fd8a7d106671e225ff5cf9ad83375f0ec3b8b288177c5d48b4c51eeddde687d67e7b07ad324e24059cff0a6516c270
- SSDEEP 96:31pNOe2w5QbJHsBiyw4uM4jEFVliuOtac32FOeSMV7WhWD:dj5Qb1sBPuijiu6avTyhW
- TLSH T18DD1B5797BE040B3D2B647303D72526793BDFC200B25E2AA4B571ACD2C90D54FD21BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
FlushFileBuffers
ReadFile
WriteFile
CloseHandle
DuplicateHandle
CreatePipe
PeekNamedPipe
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateThread
GetExitCodeThread
CreateProcessA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
lstrcmpiA
lstrcatA
lstrlenA
lstrcpynA
lstrcpyA
user32
SendMessageA
GetDlgItem
FindWindowExA
GetClassNameA
wsprintfA
exec
isdone
wait
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
338B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=2, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
$R9/Plugins/inetc.dll
- IMPHASH 2e4d94706c699d2da474aa823430b9a5
- SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
- MD5 d7a3fa6a6c738b4a3c40d5602af20b08
- SHA1 34fc75d97f640609cb6cadb001da2cb2c0b3538a
- SHA512 75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
- SSDEEP 384:oW4gLK82JvtosNCPhXKJ18hcEP1+f+pvMPbkdTg1Zahzs60Ac9khYLMkIX0+Gbyk:oW4i/2JloB5IQ9AhkwZaKRu
- TLSH T12DA207425B414AF3D3B60634707A33630769FE72246655DB86F32AC97878393EE36722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
12287
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
wininet
InternetErrorDlg
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetOptionA
InternetQueryOptionA
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA
comctl32
ord17
kernel32
GlobalFree
GlobalAlloc
WideCharToMultiByte
LoadLibraryA
lstrlenA
lstrcatA
lstrcpyA
lstrcmpiA
MulDiv
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleA
GetTickCount
TerminateThread
CreateThread
SleepEx
lstrcmpA
lstrcpynA
CreateFileA
DeleteFileA
GetFileSize
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetLastError
WaitForSingleObject
user32
SendDlgItemMessageA
SetTimer
KillTimer
EnableWindow
UpdateWindow
RedrawWindow
SetWindowTextA
GetWindowTextA
GetClientRect
GetWindowRect
MessageBoxA
GetWindowLongA
SetWindowLongA
GetParent
FindWindowExA
LoadIconA
IsDialogMessageA
SystemParametersInfoA
SetDlgItemTextA
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
SendMessageA
PostMessageA
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
IsWindowVisible
CreateDialogParamA
GetDlgItem
get
head
post
put
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=81, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=2, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
$R9/Plugins/tftp.exe
- IMPHASH 3d5bc8b157ed27e9ead41fe3a3e8d3e0
- SHA256 73ddf0df4e9e3866511ef9eae421b11615b81491d0db1d4a7ed19441e368ecef
- MD5 21e42b4fdb800644335dd8cc95826c7b
- SHA1 23ec304fab33af1cacf0a167aeb7465631286128
- SHA512 7fe97cc38afea51b8b8776c860d49d3cac92df63f6acd4f647056a6210288ac387d499e8f6f281cdd31d73e6f1218bc08baa696b0c7c8d33d55543875c1be7b6
- SSDEEP 1536:NW7lchydMBUxt/lP8KB1R88EKaoLQWAmcTGI7Unt:MChye+x38KrRLMUnt
- TLSH T123931B95FF4700F0EE1706F014ABE76E6632E501983A9DEED7C95E439CE1E92044C6AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
wininet
FtpFindFirstFileA
FtpGetFileA
FtpPutFileA
InternetCloseHandle
InternetConnectA
InternetFindNextFileA
InternetOpenA
InternetSetOptionA
kernel32
AddAtomA
CloseHandle
CreateEventA
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
DeleteFileA
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FindAtomA
GetAtomNameA
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
InterlockedDecrement
InterlockedExchangeAdd
InterlockedIncrement
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
_write
__getmainargs
__p__environ
__p__fmode
__set_app_type
_beginthread
_beginthreadex
_cexit
_endthread
_endthreadex
_ftime
_iob
_onexit
_setjmp
_setmode
abort
atexit
calloc
exit
fclose
fopen
fprintf
fputc
fputs
free
fscanf
fwrite
longjmp
malloc
memcmp
memcpy
memmove
memset
printf
rand
realloc
signal
sprintf
srand
strcmp
strcpy
strlen
strstr
time
vfprintf
Name
.text
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
$R9/Stubs/bzip2
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 a32a41c520aa1d08d8e5cbc18c1994f92d47bede5cb8d3aca761579d242d249d
- MD5 7ac2315d458a6c78f81f7167b164ef37
- SHA1 f501956f346fe7ac49454f5eae54907eeb247f1d
- SHA512 00802299e1161ac3a3849678a0515e2ed4548a9c1397635fb546683a525f2dbaab8b90875d81821bc66b76c6669a309922284e818f510fb0d81d0c317458919b
- SSDEEP 768:FqVnDX38+t1ehxQ7unyskUplx3tUeLTjWfgeOVGM4jjfS3XJvai:kjs+t1ehxQuntkULceeM4sXJz
- TLSH T131F27D1622F1887BF5B6073149B7BB36F7BBD600011155636B742FAB2D31243DE2A28E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$R9/Stubs/bzip2_solid
- IMPHASH 099c0646ea7282d232219f8807883be0
- SHA256 5a9ecc6d9dbd32c54507496f022ecca949e18235bb0865e1aa345eb84e6af0cf
- MD5 0a108faf2f740e2b1a97d64985fdd1b4
- SHA1 e349e668f756ea4b9460bcb2be54504dc357d3d1
- SHA512 3f27d919d40dfbd431c1516a8803178d5e699f91856e8f9616b7f3fdc755af863f25c29cf08191775ab04d1457a0db8741e1697a66bd2c84252de58942c16faf
- SSDEEP 768:/Jyky/Nki4Q/JRQ/RZ49ylKR2e7jbEcIKFvGmjXO3XJOai:hiki4Q/JR2RZ49A1ecjXJ+
- TLSH T1CAF27D1661F1C87BF5AA473249B3BB3AF7B7D600051156531B602F6B6E31243DE2B28E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12863
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$R9/Stubs/folder.ico
- SHA256 bef53904908769ceeb60f8e0976c3194e73534f00f4afb65497c2091121b98b2
- MD5 bbf9dbdc079c0cd95f78d728aa3912d4
- SHA1 051f76cc8c6520768bac9559bb329abeebd70d7c
- SHA512 af110c52c983f1cf55b3db7d375e03c8c9308e3cf9ee1c154c2b25cb3f8299f0c0ba87b47445f09f98659eb536184c245887a341733c11af713e9ecc15288b5d
- SSDEEP 1536:y3i6EBXR2n7dqnfiVDIHMPV0+l/SLOUp4:8eiVD+EmUSLOUp4
- TLSH T1EC338C26B786D991D51260B54005D3760301FE32BAAD97C73E61FD8FBE782928373A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
$R9/Stubs/icon.ico
- SHA256 9658fe1598581f8b9410f74f2ec6dc861a6827d4adf41f8494d8629ab9818367
- MD5 7d0235756df111aeae2600d12bc6fa6b
- SHA1 82d44ef66c49adcc08b0856de9c37fd95bd12ed2
- SHA512 18664048c787dc30461698c36a567c723a5a5efa203e09ae743e456096b8c24f8d4244bbeb777ff438c4f97c589146f8c014e24d821134cb9bd62dd83416cacd
- SSDEEP 768:5JIpxPXbplHfPtUwJowhs1LBEyKTsSIu1n+sHs1eNjcfgJdmepWndoDSJTze2zu7:5Gpx/9l/7RyVcTIuGeNjcfgfu6Ds5hfM
- TLSH T1E753C0A2F384D0D4D02E81F41413DB708713BC36B59A896B3AE5FD4F3D151D6A622E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
$R9/Stubs/lzma
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 b72d402fce699b21bbf0a4a86ab9fb7f8a083aeacd4f797be7a7f6f91ef93d62
- MD5 9557ea4608e64b857c1125eb41ba7429
- SHA1 d7276eccc032919c84fc05f206d3cdd0b40fe1fb
- SHA512 8eb238cd34668c12779553b7ef15cbeb4d8dd7aac36b5f044c680b83b04f7e2564905625e14ae5c5e06e4e9b5ccdb1663a08aa63a95e176266d59924061a6ce8
- SSDEEP 768:/ip/4K0wirQK33PaH81Fej4w0kGvFONg4jjfS3XJWai:6Zr0wirt3/aEecbsg4sXJW
- TLSH T11BF25B9636F1843BE55607304AB7EB7AFBB7A200162156576F601F7E3D21282CE1938F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12491
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
247KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$R9/Stubs/rar.ico
- SHA256 a7ef8781a56f07a7d8dcceb21eec53ba8a2b7aa4e0e0189edc7c4f4726a5ab05
- MD5 026f40c3ab0068845b6198600bb4a0a8
- SHA1 2dc1e159d9a40274b807e12fe9ff7ea61674ec4f
- SHA512 54cc2cdda37fc1bb9684c38e69dbb13cdfa6c06d5c6982fa8febdb29c33ff4fa7c39f649ca7b2e6ab452ed34aa2389aaabe242e2ccf3f431e428c61ae657b6ad
- SSDEEP 96:LOuLCJei0gKCmTIXf5EbJqrHTHnC47EvqbV9u8iVXpPbmyP+qM4c:L7KeXgzmoBE4rzHVIybVUzTNPLM4c
- TLSH T1D522A38D7E03C42FC98A25388907CAB9DA747E609C2252BA3690FF2FBCB5254D419597
- MD5 SHA1 SHA512 SSDEEP TLSH
$R9/Stubs/uninst
- SHA256 ba82bb5d90262417a18cec6631bbd8b880020eb159b45f264a9145196dfb8f3a
- MD5 4023b710d3b47d9101c27f5da22aa5ef
- SHA1 305c101062c424e728b393409ccf43d5295634a7
- SHA512 03ecea5fd46d4e9f79440a4ec5af3d27f1a60716e5579a1d38d684a1e42d1604fa6bed146eabf2fc2398d5898e67575cfde1ae0cbcd9c9a78c743f95eb366acc
- TLSH T1E101811A3908918DD8C80B378FA797FC9C60457B5A55CA6397A3FB9B5C70211778286C
- MD5 SHA1 SHA512 TLSH
$R9/Stubs/zlib
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 c96383fe97a213140741bf5df71f322753200c094cb22db634e050d2be744a4f
- MD5 346d3c8665f307a06aba85f8745360e8
- SHA1 de87ba7e2553f0efd531d30d6a5997dab9a6bc2f
- SHA512 6d9910251618226bfd94c94661b86db0b6c07d5dbc5445cbd0ae7bd34fc42e0b2af53fbd14b57969cda9deb747dae7837209eb4c61b4b130b0170f584b839aa2
- SSDEEP 768:x0gFJMBrbxJQJFiXDYwQ5NTdKqP5sCOfZ7jrG0D3cjfS3XJQai:xfYBrbzmFizYwUK1G0DRXJQ
- TLSH T142F28E06B7F1897BE596473105B3BB7AFBBBC10016211A035BB41FBE3C612839D1A24E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12538
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$R9/makensis.exe
- IMPHASH 40bd841bb48fa751c8ce412b2db2cb61
- SHA256 572a6f9cb5b37b6eec13b578d346c2568ce3ec88bb711d75dac9e82fc01c8860
- MD5 e79833cb0d7b2573819ded2122b57bdd
- SHA1 71ead8cd4a95704a0cade630bb3ce280af7e028e
- SHA512 4b023e60392ead0691621a1306286fda6cdc4c447f164c8f249c59db2500d8b98514d93c7a7e8d3cfd60818d2ca74e84ec24163492765b6c17fe94ea0385bd69
- SSDEEP 12288:LhHlj+wtKJVIo9ZoACV6sil8+eSycI+Tt0XCyzLHWj:Lxl+0KJVpneV6siy+I+TtcCyzLHW
- TLSH T178B4AF117DB580B5CD46B1B00DBE9B767678D6960B228BC3B7C4DD382E234B1A33725A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
338927
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
DeleteObject
GetTextExtentPoint32A
SelectObject
CreateFontIndirectA
CreateCompatibleDC
GetObjectA
DeleteDC
user32
wsprintfA
CharNextExA
SendMessageA
CharNextA
CharPrevA
IsWindow
GetDC
MapDialogRect
DestroyWindow
CreateDialogIndirectParamA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
kernel32
GetCurrentDirectoryA
GetLocaleInfoW
SetEndOfFile
GetExitCodeProcess
SetStdHandle
SetEnvironmentVariableA
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
CreateEventA
CloseHandle
ResetEvent
WaitForSingleObject
SetEvent
WaitForMultipleObjects
CreateThread
GetModuleHandleA
FindClose
FindNextFileA
FindFirstFileA
IsValidCodePage
SetPriorityClass
GetCurrentProcess
OpenEventA
GetSystemInfo
CreateFileMappingA
CreateFileA
GetTempFileNameA
GetTempPathA
MapViewOfFile
UnmapViewOfFile
FlushViewOfFile
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
CreateProcessA
GetFileAttributesA
GetFileSize
GetFullPathNameA
GetModuleFileNameA
GlobalFree
GlobalAlloc
SetLastError
GetLastError
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
VirtualFree
GetProcAddress
RtlUnwind
RaiseException
HeapFree
DeleteFileA
HeapAlloc
HeapReAlloc
ExitProcess
TerminateProcess
SetConsoleCtrlHandler
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
SetUnhandledExceptionFilter
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
IsBadWritePtr
WriteFile
ReadFile
SetFilePointer
FlushFileBuffers
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
LoadLibraryA
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsValidLocale
GetLocaleInfoA
SetCurrentDirectoryA
Name
.text
Size
383KB
Virtual Size
383KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
69KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=6, id=12, version=7291,
count=31, id=14, version=7299,
count=19, id=11, version=8047,
count=153, id=10, version=8047,
count=119, id=1, productName=Unmarked objects,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=30, id=49, version=9044,
count=7, id=48, version=9044,
$R9/pools.txt
- SHA256 8689fd11c63754aeabb202d7e1db3e5fe896f4e4e3597d4bfed58950f3110bb9
- MD5 5137876455f2fd0c032ceed6fdbe49cb
- SHA1 a33210e43247b1f04f51a341e5be79f769acc941
- SHA512 3deef3848e340a0a631a8969ebabfde22a9a5c69a0c2ec2ad7e2e745800a593591f173c5611b573be7ea87261459d97680e85b13da73e39a8aabdfbfc7609761
- TLSH T13EF0672DAF40673492483E02B05AE002F89631C5FE0E8670C72CAF73A0C89D8B8209E4
- MD5 SHA1 SHA512 TLSH