Tax-202609070119.zip
- SHA256 2fc87c91bb369dee0b58a52eb5bc17753cc9a3598d553fb8bd86e8f5c19229a6
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Tax-202609070119.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax-202609070119.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
hdp_elev_shim.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
hdp_elev_shim.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
nw_elf.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
nw_elf.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target Tax-202609070119.zip
- Size 2.3MB
- Sample260911-pdb1lsem6w
- SHA256 2fc87c91bb369dee0b58a52eb5bc17753cc9a3598d553fb8bd86e8f5c19229a6
- MD5 9bf9345a211e4d1ca6262a8d508c3292
- SHA1 1365fb592873934b8e0c307b73329d606468a92d
- SHA512 2e359515fd0c4239b847206fbe7df5ce68114aa6258209ff92c992eca379f9c9e2062b437f05a18c936ac046e093b759321e0650fe67ef78db99ce6fd5729c69
- SSDEEP 49152:8YnvktU4knkt/rHltsb8UynLqICc0X1xAi1euEGsABA:8kvktUrkt/A84IQ1cVGsA2
- TLSH T124B53391D725F4F80CF85125BB650B67B2B2CA5B32931D2BB2817D0410F30EED99E69E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/nw_elf.dll - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/hdp_elev_shim.dll unpack002/nw_elf.dll
File Explorer
-
Tax-202609070119.zip.zip 2.3MB
-
Tax-202609070119.img.iso 3.8MB
-
Tax-202609070119.exe.exe 1.9MB
-
hdp_elev_shim.dll.dll 37KB
-
nw_elf.dll.dll 1.8MB
Tax-202609070119.img
- SHA256 308b1de0dcfed0f8380a15c46f1b753d0730e2ddf51a8fd1f8b2c7f9913d5332
- MD5 9607b4c64ccd64acfe914cc11134a89d
- SHA1 e4b5bb2f1a89a275decb436f1ca3ccdb442d9a45
- SHA512 92b7249601c4a9e6a79bc72e648dbd9ba2cf3b1cedbef45689734e2ae32dc288d6561f159fa59b688bcd41a544ca27cd40440c88f43476d4dd66a07a333c0948
- SSDEEP 98304:0k8h+71ukpsGrTo7U9uFnPR+B475AUooPRU8EpbExYYt3v24/pL4:MKsGJ9uF4qAUo
- TLSH T19506D000B622D075C8135479A01D933A3F716E164B2B46E3E7E4BED57FB22D1063BA9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Tax-202609070119.exe
- IMPHASH a42b22bce879affafd597006d2ed8fcf
- SHA256 4bfa832e0b5d59d5498d85071020167e97b06c69aa43cca2cfccd0c91d535c1d
- MD5 c7d924f8b54c44e1edaa87f9b280bf39
- SHA1 9d2f655e4320e82f3774d4fe6bbc18b5857dada3
- SHA512 db24aa1727eda71e59abd7af3f27e9d02cd7535e420829fbe2c06df2a6ce7caf56f2d4cef4576ee86902364fc4107b15fe75da46ec9f9ae8a26831ae15501aed
- SSDEEP 49152:RRyEN/rc7xPAr4ooPRU8EpbExYYBt3v24/pL4zp:RB475AUooPRU8EpbExYYt3v24/pL4d
- TLSH T197958D00B662D075C853A075A41CE3393E611E098B3B8AE3DBD57E957FB11C2173BA9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1d:ae:b7:87:e1:09:89:f3:77:4e:4f:9c:a5:20:29:36:31:52:de:7b:ca:03:dd:e3:45:52:58:a4:17:52:f2:9e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=浙江讯盟科技有限公司,O=浙江讯盟科技有限公司,L=杭州,ST=浙江,C=CN
Chains
Jan 10, 2024
CN=浙江讯盟科技有限公司,O=浙江讯盟科技有限公司,L=杭州,ST=浙江,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=浙江讯盟科技有限公司,O=浙江讯盟科技有限公司,L=杭州,ST=浙江,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=浙江讯盟科技有限公司,O=浙江讯盟科技有限公司,L=杭州,ST=浙江,C=CN
Serial Number
4e:9d:89:de:7f:f0:9d:4e:b3:66:cd:44:4c:7b:23:0a
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 24, 2023 - Oct 23, 2026
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL
Serial Number
09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Issuer
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2023 - Oct 30, 2034
Subject
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 31, 2021 - Sep 17, 2029
Minor OS version
1
Major OS version
5
Entry point
1103136
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\nw81_win32\node-webkit\src\outst\nw\initialexe\nw.exe.pdb
nw_elf
GetInstallDetailsPayload
IsBrowserProcess
IsExtensionPointDisableSet
SignalChromeElf
kernel32
AcquireSRWLockExclusive
AddVectoredExceptionHandler
CloseHandle
CompareStringW
ConnectNamedPipe
ConvertFiberToThread
ConvertThreadToFiberEx
CreateDirectoryW
CreateEventW
CreateFiberEx
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateJobObjectW
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateRemoteThread
CreateSemaphoreW
CreateThread
DebugBreak
DecodePointer
DeleteCriticalSection
DeleteFiber
DeleteFileW
DeleteProcThreadAttributeList
DisconnectNamedPipe
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesEx
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalProcessorInformation
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHandleCount
GetProcessHeap
GetProcessHeaps
GetProcessId
GetProcessMitigationPolicy
GetProcessTimes
GetProductInfo
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDefaultLCID
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadId
GetThreadLocale
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultLocaleName
GetVersionExW
GetWindowsDirectoryW
HeapAlloc
HeapDestroy
HeapFree
HeapReAlloc
HeapSetInformation
HeapSize
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeProcThreadAttributeList
InitializeSListHead
InitializeSRWLock
IsDebuggerPresent
IsProcessorFeaturePresent
IsThreadAFiber
IsValidCodePage
IsValidLocale
IsWow64Process
K32EnumProcessModules
K32GetModuleFileNameExA
K32GetModuleInformation
K32GetPerformanceInfo
K32GetProcessMemoryInfo
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
LockFileEx
MapViewOfFile
MoveFileW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PeekNamedPipe
PostQueuedCompletionStatus
PrefetchVirtualMemory
QueryDosDeviceW
QueryInformationJobObject
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSemaphore
RemoveDirectoryW
ReplaceFileW
ResetEvent
ResumeThread
RtlCaptureStackBackTrace
RtlUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetDefaultDllDirectories
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFilePointerEx
SetHandleInformation
SetInformationJobObject
SetLastError
SetNamedPipeHandleState
SetProcessDEPPolicy
SetProcessMitigationPolicy
SetProcessShutdownParameters
SetStdHandle
SetThreadAffinityMask
SetThreadInformation
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SleepEx
SuspendThread
SwitchToFiber
SwitchToThread
SystemTimeToTzSpecificLocalTime
TerminateJobObject
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
UnregisterWaitEx
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteProcessMemory
lstrlenA
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ntdll
RtlInitUnicodeString
GetHandleVerifier
GetPakFileHashes
IsSandboxedProcess
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
203KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
329B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CPADinfo
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
malloc_h
Size
512B
Virtual Size
243B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
262KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
hdp_elev_shim.dll
- IMPHASH 98c3e89fe51e399a2831910c76227206
- SHA256 8cf64ffbecb9bf4e73b37a6680b4c50d3da672c8382bdb9c1ea4d5901822195d
- MD5 e4060b8c0563b9a3724d4752228c004e
- SHA1 c88c0e1f3b61ca33e0b07d10e8e124f4cf5276d3
- SHA512 73aac81cf8de4a72031def0913ca6991fac5a2b95e9392629e3022dec477ef34ae1172370765313e27ede081f0a6995456e420b37ea2630c70405cdb22dd323f
- SSDEEP 384:308T78sSSlWCARFbO/hwVV0zC9l3N4YCHSZodk4WuZht9twkrwjRuZoijtBKYkOn:p0pO/crv94NyZodkgZ9txUaF+1o
- TLSH T17503D529ED26E137D34D5C30E90A5E29DE75ACB6EFD17083FB805ED608949D4BB38206
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
17269
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetEnvironmentVariableW
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
GetTempPathW
CloseHandle
GetLastError
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateThread
GetCurrentThreadId
OpenThread
SuspendThread
CreateProcessW
OpenProcess
GetLocalTime
GetTickCount
DisableThreadLibraryCalls
CopyFileW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
vcruntime140
__std_type_info_destroy_list
memset
_CxxThrowException
memmove
memcpy
__CxxFrameHandler3
wcschr
__std_exception_copy
__std_exception_destroy
_except_handler4_common
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-convert-l1-1-0
wcstoul
api-ms-win-crt-stdio-l1-1-0
fgetws
fclose
__stdio_common_vswprintf
_wfopen_s
__stdio_common_vsprintf
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initterm_e
_execute_onexit_table
_seh_filter_dll
_initterm
_initialize_onexit_table
_cexit
CapabilitiesRequestAndCapabilitiesReply
DXVA2CreateDirect3DDeviceManager9
DXVA2CreateVideoService
DXVAHD_CreateDevice
DegaussMonitor
DestroyPhysicalMonitor
DestroyPhysicalMonitors
GetCapabilitiesStringLength
GetMonitorBrightness
GetMonitorCapabilities
GetMonitorColorTemperature
GetMonitorContrast
GetMonitorDisplayAreaPosition
GetMonitorDisplayAreaSize
GetMonitorRedGreenOrBlueDrive
GetMonitorRedGreenOrBlueGain
GetMonitorTechnologyType
GetNumberOfPhysicalMonitorsFromHMONITOR
GetNumberOfPhysicalMonitorsFromIDirect3DDevice9
GetPhysicalMonitorFromTarget
GetPhysicalMonitorsFromHMONITOR
GetPhysicalMonitorsFromIDirect3DDevice9
GetTimingReport
GetVCPFeatureAndVCPFeatureReply
OPMGetVideoOutputForTarget
OPMGetVideoOutputsFromHMONITOR
OPMGetVideoOutputsFromIDirect3DDevice9Object
RestoreMonitorFactoryColorDefaults
RestoreMonitorFactoryDefaults
SaveCurrentMonitorSettings
SaveCurrentSettings
SetMonitorBrightness
SetMonitorColorTemperature
SetMonitorContrast
SetMonitorDisplayAreaPosition
SetMonitorDisplayAreaSize
SetMonitorRedGreenOrBlueDrive
SetMonitorRedGreenOrBlueGain
SetVCPFeature
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=35403,
count=10, id=260, version=35403,
count=17, id=261, version=35403,
count=4, id=257, version=35403,
count=3, id=257, version=33145,
count=68, id=1, productName=Unmarked objects,
count=1, id=261, version=35723,
count=1, id=256, version=35723,
count=1, id=255, version=35723,
count=1, id=258, version=35723,
nw_elf.dll
- IMPHASH 5dac5b186aaa4b847a04dcb5846cc432
- SHA256 f586d4c364cfc479ccf6348512e1acae73169fde71a9fe502bc59637322cc7f4
- MD5 2ee801e9eb55563fc1a4e85a34bf6667
- SHA1 7a45e03084303dc788e400bed69e9d68f0036039
- SHA512 b94504f11efd3cdb01d79db6e8d211b66946dcfc09e81a2bc6756033c29d008b6d490e61fa62e6da29fcdf897a92b4bef359fa35077fb3439d691bd68c4efb7d
- SSDEEP 49152:ok8h+Wmt1Lakxr6NZGrTo7+p9x4DrlnPapU26O:ok8h+71ukpsGrTo7U9uFnPRi
- TLSH T17E95F114B7290D59DA374DBCD0EB09971766FDA30A82031E27F086DBEE963A1441BF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4263
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
nw_elf.pdb
kernel32
GetEnvironmentVariableA
GetModuleFileNameA
LoadLibraryA
CreateThread
CreateFileA
CloseHandle
GetCurrentProcess
GetTempPathA
GetLocalTime
SetFilePointer
WriteFile
FlushFileBuffers
VirtualFree
SetFileAttributesA
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetDiskFreeSpaceExA
CreateDirectoryA
SetEnvironmentVariableA
CreateProcessA
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
GetLastError
GetProcAddress
FlushInstructionCache
CopyFileA
GetSystemDirectoryA
DeleteFileA
MultiByteToWideChar
GetCurrentProcessId
SetLastError
ExitProcess
GetTickCount
GlobalMemoryStatusEx
GetNativeSystemInfo
Sleep
VirtualProtect
VirtualAlloc
GetModuleHandleA
advapi32
RegSetValueExA
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
user32
GetWindowTextA
EnumWindows
ntdll
RtlGetVersion
shell32
ShellExecuteA
GetInstallDetailsPayload
IsBrowserProcess
IsExtensionPointDisableSet
SignalChromeElf
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
21B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
964B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ