jaffacakes118_Some cracks and nifty things.zip
- SHA256 04e5656c04649b9880a2b3cc64dddba721a9598e337944ed90b17437ea92912f
Overview
overview
10Static
static
10989.exe
windows10-2004-x64
7989.exe
windows11-ltsc_2024-x64
6Annoying-r...er.exe
debian-12-armhf
1AnotherTest.exe
windows10-2004-x64
3AnotherTest.exe
windows11-ltsc_2024-x64
3BEASTY.exe
windows10-2004-x64
BEASTY.exe
windows11-ltsc_2024-x64
5CO2.exe
windows10-2004-x64
8CO2.exe
windows11-ltsc_2024-x64
8Claridonium.exe
windows10-2004-x64
3Claridonium.exe
windows11-ltsc_2024-x64
3Crypto$ucker.exe
windows10-2004-x64
7Crypto$ucker.exe
windows11-ltsc_2024-x64
7DCQPKX (2).exe
windows10-2004-x64
DCQPKX (2).exe
windows11-ltsc_2024-x64
FullMemory.exe
windows10-2004-x64
3FullMemory.exe
windows11-ltsc_2024-x64
3Gayware.py
windows10-2004-x64
3Gayware.py
windows11-ltsc_2024-x64
3HYDRA.exe
windows10-2004-x64
3HYDRA.exe
windows11-ltsc_2024-x64
3JVXB_Destructive.exe
windows10-2004-x64
6JVXB_Destructive.exe
windows11-ltsc_2024-x64
6MBRNOOTER.exe
windows10-2004-x64
MBRNOOTER.exe
windows11-ltsc_2024-x64
MadLocker.exe
windows10-2004-x64
3MadLocker.exe
windows11-ltsc_2024-x64
3Magellan.exe
windows10-2004-x64
Magellan.exe
windows11-ltsc_2024-x64
7Malware.exe.py
windows10-2004-x64
3Malware.exe.py
windows11-ltsc_2024-x64
3Money.exe
windows10-2004-x64
1Behavioral task
behavioral1
Sample
989.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
989.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
Annoying-randoizer.exe
Resource
debian12-armhf-20260127-en
debian-12-armhf
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
AnotherTest.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
AnotherTest.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
BEASTY.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
BEASTY.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
CO2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
CO2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
Claridonium.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Claridonium.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
Crypto$ucker.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
Crypto$ucker.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
DCQPKX (2).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
DCQPKX (2).exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
FullMemory.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
FullMemory.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
Gayware.py
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
Gayware.py
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
HYDRA.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
HYDRA.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
JVXB_Destructive.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
JVXB_Destructive.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
MBRNOOTER.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral25
Sample
MBRNOOTER.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral26
Sample
MadLocker.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
MadLocker.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
Magellan.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral29
Sample
Magellan.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral30
Sample
Malware.exe.py
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
Malware.exe.py
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
Money.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target jaffacakes118_Some cracks and nifty things.zip
- Size 16.5MB
- Sample260915-da8dvsbn8z
- SHA256 04e5656c04649b9880a2b3cc64dddba721a9598e337944ed90b17437ea92912f
- MD5 f519a95a682c517d6280b1e34d2c0399
- SHA1 4983e5db26bbb6af6b416a76e52d57da70bdf4ee
- SHA512 3d6776270411a2e317be0f75de802d6df2a4103bed9fde9d27d82ef8fec796ef15d3cf6b502c58a5c1d7d864cd3f2a8e98cb2aceb1fd440bb40e026aca380b14
- SSDEEP 393216:UPwo+mLdFSvVP51dEK6tDeZcHbefK3yuwqOeCAkSzdiYU5:UPwrUdFY551CK60SH9wqOV9hZ
- TLSH T1D607339DFE8C0806E475873F85CE5221DD3102A568534B06B3BE12FAD163AE3A777C5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
havoc
C2
-
192.168.192.129
Attributes
-
spawn
C:\Windows\System32\notepad.exe
C:\Windows\SysWOW64\notepad.exe
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
Signatures
- Family: Chaos
Ransomware family first seen in June 2021.
- Chaos Ransomware 1 IoCs
resource yara_rule static1/unpack001/Ransomware (4).exe family_chaos - Detects Havoc payload 1 IoCs
resource yara_rule static1/unpack001/Money.exe family_havoc -
resource yara_rule static1/unpack001/BEASTY.exe upx static1/unpack001/Server (2).exe upx static1/unpack001/windows vista key generation.exe upx static1/unpack001/xD.exe upx - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Crypto$ucker.exe pyinstaller - Unsigned PE 38 IoCs
Checks for missing Authenticode signature.
resource unpack001/989.exe unpack001/AnotherTest.exe unpack001/BEASTY.exe unpack002/out.upx unpack001/CO2.exe unpack001/Claridonium.exe unpack001/Crypto$ucker.exe unpack001/DCQPKX (2).exe unpack001/FullMemory.exe unpack001/HYDRA.exe unpack001/JVXB_Destructive.exe unpack001/MBRNOOTER.exe unpack001/MadLocker.exe unpack001/Magellan.exe unpack001/Money.exe unpack001/NOESCAPE (2).exe unpack001/Pentelonium.exe unpack001/Ransomware (4).exe unpack001/Server (2).exe unpack004/out.upx unpack001/Tuberculosis.exe unpack001/Unconfirmed 805456.exe unpack001/Virus (5).exe unpack001/Virus (6).exe unpack001/birdie.exe unpack001/cstorm.exe unpack001/dd.exe unpack001/destrbat.exe unpack001/helloworld_not_infected.exe unpack001/joe.exe unpack001/malware (10).exe unpack001/memed.exe unpack001/pcoptimizer.exe unpack001/sabrina.exe unpack001/svchost (6).exe unpack001/windows vista key generation.exe unpack005/out.upx unpack001/xD.exe
File Explorer
-
jaffacakes118_Some cracks and nifty things.zip.zip 16.5MB
-
989.exe.exe 78KB
-
Annoying-randoizer.exe.elf 8KB
-
AnotherTest.exe.exe 832KB
-
BEASTY.exe.exe 24KB
-
out.upx.exe 55KB
-
CO2.exe.exe 12KB
-
Claridonium.exe.exe 113KB
-
Crypto$ucker.exe.exe 4.5MB
-
Crypto$ucker.pyc707B
-
DCQPKX (2).exe.exe 15KB
-
FullMemory.exe.exe 39KB
-
Gayware.py1KB
-
HYDRA.exe.exe 179KB
-
JVXB_Destructive.exe.exe 112KB
-
MBRNOOTER.exe.exe 150KB
-
MadLocker.exe.exe 61KB
-
Magellan.exe.exe 167KB
-
Malware.exe.py1KB
-
Money.exe.exe 100KB
-
NOESCAPE (2).exe.exe 88KB
-
Pentelonium.exe.exe 209KB
-
Ransomware (4).exe.exe 35KB
-
SUPER_DEADLY_VIRUS.bat133B
-
Server (2).exe.exe 45KB
-
out.upx.exe 113KB
-
Train.vbs.vbs 657B
-
Tuberculosis.exe.exe 230KB
-
Unconfirmed 805456.exe.exe 506KB
-
Virus (4).bat281B
-
Virus (4).exe.lnk 1KB
-
Virus (5).exe.exe 66KB
-
Virus (6).exe.exe 2.1MB
-
adware.py.py .sh 2KB
-
birdie.exe.exe 293KB
-
cmdmaster.bat603B
-
cstorm.exe.exe 30KB
-
dd.exe.exe 334KB
-
destrbat.exe.exe 93KB
-
hello.bat919B
-
helloworld_not_infected.exe.exe 2KB
-
hoved.bat.bat 1KB
-
joe.exe.exe 174KB
-
kitn.jpg.jpg 252KB
-
kitn.py481B
-
maleware.bat.bat 1KB
-
malware (10).exe.exe 281KB
-
mbr_overwriter.py6KB
-
memed.exe.exe 2.6MB
-
pcoptimizer.exe.exe 2.7MB
-
reptilia.bat617B
-
sabrina.bat359B
-
sabrina.exe.exe 50KB
-
svchost (6).exe.exe 6.5MB
-
virus (4).py590B
-
virus (4).vbs.vbs 184B
-
windows vista key generation.exe.exe 196KB
-
out.upx.exe 407KB
-
xD.exe.exe 22KB
989.exe
- IMPHASH bc70c4fa605f17c85050b7c7b6d42e44
- SHA256 de565c1a5219ba854e5c34b1634603fe0f617cced7e54c0cea5c8b84d1cb535f
- MD5 7bc0b2d0e493d4de78d131252b6c0a48
- SHA1 f45d9fc3337ccadbba09e1c041e09ad64b1c8259
- SHA512 c1010585d6dbbe286194822a517d38e46801ce470fb65322919612a7bfc6f93e96e274c4cd291a54f035a923fe3c70ceaa300ff18bada35794ed46c2c04c93a3
- SSDEEP 1536:nrV6dKi1EVvbdeh3IriJinjx+xhs5gYgB7nG7+NOHJxF:rwdK6g8Iljx4u5tS7nG7BHfF
- TLSH T1E0733B1297E84433EDF22BB408F92283173ABCE15B7993DB268405D95DF26C4A97533B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
27088
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wextract.pdb
advapi32
OpenProcessToken
GetTokenInformation
RegSetValueExA
EqualSid
RegQueryValueExA
LookupPrivilegeValueA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteValueA
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
RegCloseKey
kernel32
GetPrivateProfileIntA
GetFileAttributesA
IsDBCSLeadByte
GetSystemDirectoryA
GlobalUnlock
GetShortPathNameA
CreateDirectoryA
FindFirstFileA
GetLastError
GetProcAddress
RemoveDirectoryA
SetFileAttributesA
GlobalFree
FindClose
GetPrivateProfileStringA
LoadLibraryA
LocalAlloc
WritePrivateProfileStringA
GetModuleFileNameA
FindNextFileA
CompareStringA
_lopen
CloseHandle
LocalFree
DeleteFileA
ExitProcess
DosDateTimeToFileTime
CreateFileA
FindResourceA
GlobalAlloc
ExpandEnvironmentStringsA
LoadResource
WaitForSingleObject
SetEvent
GetModuleHandleW
FormatMessageA
SetFileTime
WriteFile
GetDriveTypeA
GetVolumeInformationA
TerminateThread
SizeofResource
CreateEventA
GetExitCodeProcess
CreateProcessA
_llseek
SetCurrentDirectoryA
GetTempFileNameA
ResetEvent
LockResource
GetSystemInfo
LoadLibraryExA
CreateMutexA
GetCurrentDirectoryA
GetVersionExA
GetVersion
GetTempPathA
CreateThread
LocalFileTimeToFileTime
SetFilePointer
GetWindowsDirectoryA
lstrcmpA
_lclose
GlobalLock
GetCurrentProcess
FreeResource
FreeLibrary
Sleep
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
MulDiv
GetDiskFreeSpaceA
ReadFile
gdi32
GetDeviceCaps
user32
GetDC
SendMessageA
SetForegroundWindow
MsgWaitForMultipleObjects
SendDlgItemMessageA
GetWindowRect
MessageBoxA
GetWindowLongA
PeekMessageA
ReleaseDC
GetDlgItem
SetWindowPos
ShowWindow
DispatchMessageA
SetWindowTextA
EnableWindow
CallWindowProcA
DialogBoxIndirectParamA
GetDlgItemTextA
LoadStringA
MessageBeep
CharUpperA
CharNextA
ExitWindowsEx
CharPrevA
EndDialog
GetDesktopWindow
SetDlgItemTextA
SetWindowLongA
GetSystemMetrics
msvcrt
memset
?terminate@@YAXXZ
_controlfp
memcpy
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_acmdln
_initterm
_amsg_exit
__p__commode
_XcptFilter
_errno
_vsnprintf
__setusermatherr
comctl32
ord17
cabinet
ord22
ord23
ord21
ord20
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=205, version=65501,
count=14, id=207, version=65501,
count=70, id=206, version=65501,
count=17, id=203, version=65501,
count=199, id=1, productName=Unmarked objects,
count=9, id=210, version=65501,
count=1, id=126, version=50727,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
Annoying-randoizer.exe
- SHA256 330bcd0ac6582e9a2dcc6da190da3dc2f7aa111889f8e078ef796614373bf485
- MD5 f1d5b240e962d5047e60e6282be11cb8
- SHA1 dc722268f8c3f7196a684633af504639142738c4
- SHA512 9077603661ca767e1b65293759d5f9c29a9a0dabed716a7a270a0e6f277b0b6ff0c93af945bdfa41c711ff61e5f144c1769a102dcef79819dc3ecf0a6bd12a9a
- SSDEEP 96:6+f6xn4waVShclpPkR18UxLQE7/malK+vmkQQlW:6oQMSyI18UJBdH
- TLSH T189024187FAD18E77CCC91239C6A327607372D88563C29B535108A6302EC77DD2DABA51
- MD5 SHA1 SHA512 SSDEEP TLSH
AnotherTest.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7470c387361448eb9884f4bf45c3ba24bc7eed061dce05c369fad1e419e69fb6
- MD5 ecb9e3478c247d6c72a6e03b95b121be
- SHA1 1c48acabb32c340e8023eb7b6d1802f412b64758
- SHA512 645feee2d3c710ccdb9d70490e58e308d976cc65cce3763ef0fc9a5cc5a461a2e17b4ac88d3943b2986940f0c8564e708b169417a97a7be85fd68f650cb10d1e
- SSDEEP 24576:72jyzSNsg4w5cokpsW942jyzSNsg4w5cokpsW942jyzSNsg4w5cokpsW942jyzSc:YyO/5BIhyO/5BIhyO/5BIhyO/5BI
- TLSH T1CC05D7231E1047B6DEAC4877F56B883702B66B7AD748314A27C9FF6C1EA3A395D13814
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
857630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\User\Documents\SharpDevelop Projects\AnotherTest\AnotherTest\obj\Debug\AnotherTest.pdb
mscoree
_CorExeMain
Name
.text
Size
830KB
Virtual Size
829KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BEASTY.exe
- SHA256 fca5992f7d3ec6da4095bd4d02da097d8ac3372f298a26e736b88567f6244e72
- MD5 22ccdec34bbac9ee821257f54c89c651
- SHA1 36b0a275601fce6f240ea3a55d1ec9b6d4bd9e24
- SHA512 8a119b071f0f2b87fdb7cd3821486803df510a2903ca9c9bfe14ed3d639cb42e16749686c4cb721d7f756fe0210f1986ac36bd92d6310f9a960596f848764e45
- SSDEEP 384:W3wA6S2LfoDAv9bF864ow/ZFKddemd4I/LsG9ifpe1anVeMpNN/+ohDiXDIv6A:vA6lfoDW96xFbaj4wMVeMpNN/Aiv
- TLSH T1A0B2BF495B446E5AC51C407B0D17EF94CEB0A9026F8D57EBAEF22A8F3EB23C46C51835
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71584
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
18KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=128, id=19, version=8078,
count=3, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
out.upx
- SHA256 309d506b4cd2aa9891398e2551c18437249c9bcd845e1ab50cd632c06e9f1554
- MD5 391b764be5e32277d157eba6036d5529
- SHA1 2c7a75874d3ad0637b2ab8814ccdd81b90f04838
- SHA512 92e450a77e5fe84998a0d21a0a109fb9e6b83896679d391008b00ee2be8691f3200948ef715abe1fb9575b338d70bf91f1a86cb3f355bf24c6ba52a3c53b1e7b
- SSDEEP 768:voNivVXEE8yJpkUGH6CjorErh5VEgkNlbWK8ER22bS4CIpm723AqimZMKFCs/s/T:SivVXnqUGH653WEAPOpI8ZiUMns/s/
- TLSH T16F43C30B65B8C396CE044FF108EAB6B5D57792B61F7CDF439F982E5B88226539D31028
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17177
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=128, id=19, version=8078,
count=3, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
CO2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 27bb600cb31866cb2dd56f4807064f80cbb7be2421da9923f72fbe401d942210
- MD5 5835d7c3afecf38ae19ff3b8a1c171d0
- SHA1 da0d0b4c8bff5e5e7d63cd84fdf160dd02755c40
- SHA512 ca4b23efd9ce2be384fa9734efa299398e09746b685847a155328f003ba98368ff9c7b8587ab37c7eb79743a50b1dddc9f6232a721b5f394440cdca90936c77d
- SSDEEP 192:JMqe0TPUXfjrQItQ6YTkBSlNC9UVTp80/Yc/75e:mQUnQItQTTk8lNOUVTp3/Yc/g
- TLSH T1D942081097E48276ED320AB238E75242CB73EB579D279BBE358C811B7F332424293361
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14530
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\黃氏家族\Desktop\我的資料夾\CO2\CO2\obj\Debug\CO2.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Claridonium.exe
- IMPHASH 56b045e682881f030b397b0c5bbe0410
- SHA256 6dd7aa9b0f8444bdddcc3e888cf75a800a9bb22bb776ffa1d8ce69880815766d
- MD5 edfdb30d1c7e59b33c75874f171ec42d
- SHA1 693142f6f3253ece72a8ef70aac71dbeef7c911f
- SHA512 18c75636950726c8f071f8041f22e8bc3e5fac49be8844b4011c7d21e7b521ee6cc0aa84210c644b05360d828b1c7585d9d66cb7c1d3d85f092e77bb1217c084
- SSDEEP 384:90/SDlVrSr7po6cSABX+9T5DJtQDqkSuO8ROeM7dhAE99Sjvb99SjvWpYn:97lVApySA9+T5D3Q+zsy7dd9Sbh9Sb
- TLSH T117B3A4439AEC3DC7C03863B0377B93D5C72EEDA5A196C11EA6D00285D8BE42779227D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10148
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ivan\source\repos\Claridonium\Release\Claridonium.pdb
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
ExitProcess
CreateThread
CloseHandle
TerminateThread
Sleep
VirtualAlloc
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
user32
ReleaseDC
GetSystemMetrics
MessageBoxW
GetDC
SetCursorPos
InvalidateRect
GetCursorPos
gdi32
CreateBitmap
CreateFontA
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchBlt
GetBitmapBits
DeleteDC
SetTextColor
TextOutA
SetBitmapBits
SetBkMode
Polygon
DeleteObject
CreateSolidBrush
BitBlt
winmm
waveOutClose
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
vcruntime140
_except_handler4_common
memset
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
cbrt
_CIfmod
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_set_app_type
_c_exit
_configure_narrow_argv
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_cexit
__p___argv
__p___argc
_get_initial_narrow_environment
_exit
exit
_initterm_e
_initterm
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=26706,
count=19, id=261, version=26706,
count=12, id=260, version=26706,
count=7, id=259, version=26706,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=83, id=1, productName=Unmarked objects,
count=1, id=265, version=27051,
count=1, id=255, version=27051,
count=1, id=151,
count=1, id=258, version=27051,
Crypto$ucker.exe
- IMPHASH 1223c8fb37571fffdd876320296a7605
- SHA256 b96d49e2e30c976c9bc4629ed62a44474fc68f6e27de710ca448bbcfd858d5f7
- MD5 3b76ce32511f26113e75368faa9dd386
- SHA1 63d7c2e68c58b07733f44392bdbf5a267ad73eba
- SHA512 44cc1d5d43d80c3aa166c6922e7cbbc902cc66cfb0588c6fb9647e2e710a2371bb01c25d29b2a00a57c941eb8db808d2188802fdfee991a5f8619862392c6bb0
- SSDEEP 98304:b3odl7dI72nUn9TtEU/IgyJxB6IREAspHpceg2EQgY/iwYHFxBDTRMXVB:Kl70rnNeUAgyc2sp2lxd+lB
- TLSH T1F62612E5B9C4CDD0E2758D3660BD5C63893E3C2B8B9485DFB64C322644E78918623E7B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
42912
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
GetWindowThreadProcessId
ShowWindow
kernel32
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
WaitForSingleObject
FormatMessageW
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
GetLastError
WriteConsoleW
SetEndOfFile
Sleep
SetLastError
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableW
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
153KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
424KB
Virtual Size
423KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=186, id=261, version=30795,
count=20, id=260, version=30795,
count=3, id=253, version=33731,
count=20, id=259, version=33731,
count=19, id=260, version=33731,
count=38, id=261, version=33731,
count=7, id=257, version=30795,
count=116, id=1, productName=Unmarked objects,
count=25, id=260, version=33811,
count=1, id=258, version=33811,
Crypto$ucker.pyc
- SHA256 b36cfd57841ba4aa36b4b0aae3a9573f98281b0f48e7070f2ede0d9e066ec56f
- MD5 8a2bc37334746c7847f6aaee08d20984
- SHA1 e1243b45dda4c2f65ca4e64294f6a98eb038087c
- SHA512 bb29c785745a1156e92a1d798b6d88dd1550b722c6ce372edf423090a4abb162f0612613424a58611bdb006f726356da596c26fd91565be8518e6be275a0e794
- TLSH T16801C5E1952B6171D6ABB03063F5D0315CCA1B09016C1F5DEB0E509B88DD1D484E415E
- MD5 SHA1 SHA512 TLSH
DCQPKX (2).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 20de244689a259865cc608a4a11b1e34afe71ab7051e1bb36c095ee0afc31e09
- MD5 bad3aa315f53c5a0c88be813519cd12a
- SHA1 011495fe5151cac24b2d7cdf614a870cdf48a0cc
- SHA512 a8009d19c7fae954e46862e06efc61d68443c841b54b5c2ca3b2412f8aadec864d03ea2253f4ed5e8902571f9b5367bd0a1c8c640597036ae62651577f3bb072
- SSDEEP 192:R1wynQ9hINgVr1rL0y1XLWiVb2yPPWsf7o/0hMB84Ycekwur0M1Y4:RWynQ9Zd1XLWiHPtf7o/0hMBrYc3rFt
- TLSH T14762D411A3D88231D97A06735973D6358733AE5788639AAEB4CC7C0BBF7230147837A5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14930
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\yusuf\source\repos\Launcher\Launcher\obj\Debug\DCQPKX.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FullMemory.exe
- IMPHASH 7c6b404841863bcbafbed767668a0b9d
- SHA256 a489e7dc06ba4ef9572b66acfecf89c62d6b5c3d35b0ecb216aee2a4cd475498
- MD5 56dbd0fc7e98607b73306cf8551ba7d3
- SHA1 7c3c297a08636cd94a5f4e61f5970f85beec53ab
- SHA512 04be2153762e4a1ac20618d7a2980d7e92f4db7e951f9e754f30a4c2bf4f098443aafa2c8c9221584668d99a144869b30b7ef40c3acdb798cf2d6ddf0b6f2ed8
- SSDEEP 384:a26rrTM7Z0E5bnlEvXVAXWHfjMw2wPhNOW4FxRWBhD215x6c:L6nToZHplE/VAm/H/hgW4FKBhDfc
- TLSH T110031811B680C037F8EA01FFDAFE4DB5492CDD641F6A91D362D345E91A512DB2036B8B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
69667
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\USUARIO\Documents\Visual Studio 2019\Projects\FullMemory\Debug\FullMemory.pdb
kernel32
FreeConsole
GetCurrentProcess
GetProcAddress
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
RaiseException
IsDebuggerPresent
GetCurrentThreadId
TerminateProcess
vcruntime140d
__current_exception
__current_exception_context
memset
_except_handler4_common
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
__std_type_info_destroy_list
ucrtbased
strcat_s
_exit
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_controlfp_s
terminate
_wmakepath_s
_wsplitpath_s
__p__commode
__stdio_common_vsprintf_s
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
__setusermatherr
_set_app_type
_seh_filter_exe
_CrtDbgReportW
_CrtDbgReport
malloc
strcpy_s
_set_new_mode
_configthreadlocale
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
wcscpy_s
_set_fmode
Name
.textbss
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
512B
Virtual Size
282B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
265B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=30034,
count=25, id=261, version=30034,
count=13, id=260, version=30034,
count=5, id=257, version=27412,
count=68, id=1, productName=Unmarked objects,
count=1, id=261, productName=VS2019 v16.10.4 build 30040, version=30040,
count=1, id=255, productName=VS2019 v16.10.4 build 30040, version=30040,
count=1, id=258, productName=VS2019 v16.10.4 build 30040, version=30040,
Gayware.py
- SHA256 a52902b8228d79ae0ced95f08324d89680714189c57170399d24fdefd8944d7a
- MD5 2213c6369f533d9a1b34a371b71c4889
- SHA1 547aae18a5855b0c8c1fda57ce3b38a3a73cc9ca
- SHA512 7ed6d20068b05ab2008056d4c5643970df9d81f8601bd5e9eef8e8627b5fccb95d443bc098c9f4a561109cbc777a5c3e2757eb40ea0e7f8fbe8078977c0b5b26
- TLSH T13C31833415B020DAD917C05AB9F6762956A18507B412FF3A741C839E0FAB2036B86379
- MD5 SHA1 SHA512 TLSH
HYDRA.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5e36fc30f3cf95d9423598d6362564d030335558f06fedc82c9e62899532a1cc
- MD5 d0036022ac2200ba2c0433db9dee7411
- SHA1 8974d2288f4cece0c71ff271953192794e4a1337
- SHA512 41f38b519509a34ca4f18ee5b4c229d5b6e43fc9cadd212ba9aa4bf0269264e1a037b5d1c997fcb85f7ba77f6b6ff8ffdc1e7e951caeed799bc26795221336e0
- SSDEEP 768:CvSJgJlHehzTWq+FDWqH8y+LFcbb2jQWiqsAjFODzVOkLYmgp8L:CvB+Bqq+FyqHN+hNjI0FmzckzQ
- TLSH T1120465176FC4A8E9E860CB7CA352576273301E2AD67C6A89143FB57792316F36C36D20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\hp\Documents\SharpDevelop Projects\HYDRA\HYDRA\obj\Debug\HYDRA.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
JVXB_Destructive.exe
- IMPHASH 9904e09131b4996a7f8eb0b4bf31eb99
- SHA256 b68dfbca704824677abc4e1ed9138de1cedc4a55348792cf7c79e05422b82dd2
- MD5 161bed7f1311c6cd77e2dc2841f10689
- SHA1 de9cec3de77f120678988561785b9301ae5e1150
- SHA512 946e7d7d2190fb4b84c7be7064007893a36d082ca72e5b49552f55754bdce4549c48fb411b07c15db5ed4c6734843d16922bc1d2196c6c5b75b5a48504e11cb1
- SSDEEP 1536:S6Lfhj2qgm0bE0s2OZxSUHlZWSNvufcHhzAvDkpDM+RzcjsWNLC4TdH9dldrotEe:SmUYmLUHlQYvZHh8IDfRKLVJnsEP01P
- TLSH T1FFB36C1B73F630F9E1B68278C8514A25EB76B87207609FAF07A402951F272D18D3EF61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Surckre\Desktop\C++\C++\x64\Release\C++.pdb
kernel32
Sleep
CloseHandle
Beep
CreateFileW
SetFilePointerEx
WriteConsoleW
WriteFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
user32
GetSystemMetrics
MessageBoxW
GetDC
gdi32
BitBlt
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=140, id=261, version=30795,
count=10, id=260, version=30795,
count=9, id=259, version=34321,
count=16, id=260, version=34321,
count=40, id=261, version=34321,
count=7, id=257, version=30795,
count=95, id=1, productName=Unmarked objects,
count=1, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=151,
count=1, id=258, version=34435,
MBRNOOTER.exe
- SHA256 c494c4a9982d9a9ff134cc78680654841a36fc2fe7bf384c77c081be013075cf
- MD5 a4205a08c705075ab1d2130d6a79a490
- SHA1 1014d590f1318f7bd65043a7a9a9550322ce9cd5
- SHA512 812bd3236474d090dd527b6ad38b05861b91fcbe1b11d480daef15580ad6d278b027e3e22bb7dd327c484389f90b95f7388fa4836cca0a3da6e2bcf217cbbca2
- SSDEEP 3072:1JVD1zx0HrJvtuKm8wVKQ3+nBgBDFQID3RjfpbYOiTWNLkkk9:jWFvSH5FQ+hjf5YOuW
- TLSH T159E36C07B3D14CB7F0F30B789D56B225A43A7D102E35934E2FA48A0D2E2E6D45A1D79B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
77640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
61KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
MadLocker.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fcc4abe7e1fbd198ba67d74c0c7e367c1a80e43af50ad17dd28179e3855c9734
- MD5 4d7c7a9a52c682b5494748a903fc5446
- SHA1 35c097491537b90a3c964cc987b0d735b8333630
- SHA512 a64bb12ab7c9e5351507f208fad6bdd907f517699c6b18ab639c69d043f4050e1811b3d6e36d672322273793b391622f9e56e24b1924365e1b121fd86cc409f7
- SSDEEP 1536:klB+v0benrMJozFl3I022222/022222Y:k2JrzI022222/022222Y
- TLSH T1E953D5E326774527E7744B7A3CBFB9D0B2F298C1E48DA3E536E56F523164380B19021A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\awaken\source\repos\Ransomware\obj\Debug\Ransomware.pdb
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Magellan.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
- MD5 dcea41cf1d8e08ba9cf571fdb21f1db4
- SHA1 da14f6d77d84da5e4290a28ce04e215d7cbfb937
- SHA512 d094aad5cd856683e551a519039c183ba440052639f82c0fc9e9124714f4bd843f83fa5a400386add08ed30b1dfb51c095e0055c96f601bca0c18acff5bcaf2f
- SSDEEP 3072:ia6Q7bFVzmHQg9Ug644RrO4gGBGhFxwzhk24UoobktbVZ:pz7bFVzvgP4O4bBG/qzhk+abV
- TLSH T138F3F26872FC6272E2BFC27645A6BE44572111B72B26FB6B0CC5E3F938137C54B20419
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
176414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
164KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Malware.exe.py
- SHA256 3a809c96943ac96d183ef716071b6366a224987eb84a732c239bc3f100b13a59
- MD5 ee6121eaee729d7c3cb30da73aad4916
- SHA1 2eaf28bc7924bef2aff121e24982a73811d9ef89
- SHA512 a4e94372cfcb784da961826e352af6bc6252cf7ac3b831f11857ce1280933bfe901ff666b8393fd2addb6014f45c90598c6ba502b0762152606f58499dc913f6
- TLSH T185210016DE94362849C599288F86C883E71DD8FE0E7830307D4D890CAF6C663976CE7E
- MD5 SHA1 SHA512 TLSH
Money.exe
- SHA256 c78a4f88b376d8ce9586f536980c25b1bef6a1abcd3dfa4b3ca6aa82588a241d
- MD5 bf1ff917788f34aa5b23bda3d75addb3
- SHA1 37bae62fad9742186f9deaa08d8f914c2fbd246f
- SHA512 a31457d3417faba1ba0348dcf1e42bb8538e1209303a7adad5d329fa74c4142c3d3279585a1275cc12e383b67c9147d51163bd63d16a0a6fe61afc4393b7e91e
- SSDEEP 1536:/kpoalOYktfCM83v2IYEVE/kGE5+Kb+LwoMSJZNR5FOa3b:uFITtfCML2VE/kOXMSJZjPOa3b
- TLSH T111A39503E2A720FEC4A9C1B447CF7232FAB3B45C61346A0E5710CB652F62AB1767D659
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Havoc payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
97248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
94KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
54B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
236B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
NOESCAPE (2).exe
- IMPHASH 1e2e2ecb4d93f1ff65b44ec294ad861c
- SHA256 a3be9fcbd28cda0c23634a7f2e229f721f88612a35db5f6477f8a43e7347ef10
- MD5 61f35bea304940d2f0b580d311751a9c
- SHA1 a248b39e9edb09493fe3e9b0c7dc664faddf8cb1
- SHA512 345a7d2565d695c1ad9a153963d03c3019fcc65b2a6b16257e6c1ffbeaad53c46271d6f9e2e40e3ca37bf39e1ffcb5e9b0916468e9c089ba8ec88747f6c2bbce
- SSDEEP 1536:t7f65g9OX2CLGAApICdOk/dYLAZXdlItBGTjeIOlnToIfSWOV:5nlVICUkLrGGTINTBfSj
- TLSH T160937E41F2D242F7EAF2057201A5717F9735A7388B24D9DBC34C2D42AA13AD1A67C3E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsicmp
wcslen
wcscpy
wcscmp
wcscat
memcpy
tolower
malloc
free
kernel32
GetModuleHandleW
HeapCreate
GetStdHandle
SetConsoleCtrlHandler
HeapDestroy
ExitProcess
WriteFile
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
EnumResourceNamesW
GetTempFileNameW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetNativeSystemInfo
GetShortPathNameW
GetWindowsDirectoryW
GetSystemDirectoryW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
Sleep
GetProcAddress
GetVersionExW
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
PeekNamedPipe
TerminateProcess
GetCurrentProcess
DuplicateHandle
CreatePipe
CreateProcessW
GetExitCodeProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
SetUnhandledExceptionFilter
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
DeleteFileW
GetTempPathW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject
user32
CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
DestroyWindow
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
EnableWindow
GetSystemMetrics
CreateWindowExW
SetWindowLongW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
gdi32
GetStockObject
comctl32
InitCommonControlsEx
shell32
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
winmm
timeBeginPeriod
ole32
CoInitialize
CoTaskMemFree
shlwapi
PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
Name
.code
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Pentelonium.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c0fcd21924e2d51865f4a97943204b7b326f0639915bb5cc7e5d2956a4dcd995
- MD5 dbfa7fab6c527bfff652cef86c1e53d3
- SHA1 59b8be757ab1641278da8740f582a6c1f1e953cf
- SHA512 40ecdc46d221258e88b9832bd34c21c8d2eac09db65e6d989a25a2c516a27a400b9fcedd61e5695a0e7ff46acf3eefbe759f27547a221a43dda889679aecdb3b
- SSDEEP 6144:s2j9RGnvCd7rn/kVP1uu+9D/dLDb5bvxq:TT1b81uu+9rdLDb5bw
- TLSH T12924074671944050E693A170CEC7A73283161C1C7382E2C2A6F47D6B79EDAFBFA425DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15398
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\jaybu\source\repos\Pentelonium\obj\Release\Pentelonium.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
201KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ransomware (4).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e86124d645258b8c4ae50bb4b8c93f3cfd8130b161ed7526bded020065e986f4
- MD5 3141e9897f750c7b5d0b51f644d63010
- SHA1 812e7fb43952d07ea7b29f0f8e3406d408b56e77
- SHA512 67297eefd2d3a901abc2421cc762e08866ea4519bf191ddf765ee6949421feb8b2f37f3b414d7cbb5669cf26782ff7eb1541c6dcbf2815b196de8e3b1143c3af
- SSDEEP 768:wqo2lMDFxp0DFN0/r9cZ3fcx6SOBLiIYpqLQndtg/xeo:Xo2SahN0/r9cRcISO7Lgda/Ao
- TLSH T199F295143AFF5029F3B7AF785FF0749A4B7EBA136E0A955C248602090923F89DD61736
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SUPER_DEADLY_VIRUS.bat
- SHA256 d7486bdc615015913b7d26fcd20fbc587b0f5c8bd5cc93da85193dd37c0d922f
- MD5 e8c82dd69d097b254ee75b1ed4fe8e20
- SHA1 68b529be1113b24329cb77b81713877b7f8a1057
- SHA512 079e77ca8f1054267d906898c3203cd7a6b930e351aa26f3d39bf23a66cd923df13ea9436e42703eb4edb1b119b23328d2359def48628b26c67f9a613847b52c
- TLSH T1DAC02BE39E27B5270D2815F561079D9A347C108C1C53A1008CC7502020678E60020020
- MD5 SHA1 SHA512 TLSH
Server (2).exe
- SHA256 df8e9be57620f16463dcbaa42b8aa23a2b78a8b55f6f8a596715b081b4deb53f
- MD5 0bcc096b4794e09ba917956364d1186c
- SHA1 51b464becbde8f9b20b807f5e6aa9c63b0ca1c91
- SHA512 b15ebecb40bcc9e7434024c8075dd38bef177e2ec7ae2b39efa629f3185b9bb723ca982a41d64ab72bd67223524f4bf57662aa5793150bfc4d8cbe4c9dc88e05
- SSDEEP 768:/gJ9CMXjr1Mx9Vq6Ks4CLK1rMwYLArBhoIgEKLiP4v0BJ/nXX:/gz1qgls1O6wmIUO4v0BJ/nX
- TLSH T1ED23D092DFD004B1F50E5B324C7FDA1916766CACC77AA26E59D0743A9939260033773E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
179312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
36KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 ae34fa855464c7ffb98ae64404fcd3eb43aaa9808e3518dcadfe1eb6b1c41807
- MD5 7187116f4397d72f8fe563bb366c4dfd
- SHA1 59c9f688a03e68286c8475670c8fbb05aa34f459
- SHA512 a5e1c9e1abb8052a094d80bc2aeb2cfc51f17fc9be082d22c342627ca7ae425dfafe97c46b2977cf3773f11daee51dab7b1af705c0e95e39333bbefe7f5d62c4
- SSDEEP 1536:OgxRYfppp+i5Uhg2dS4xE1IiHXoI0HuMciu+YUUYGu+O0uMciu+YUUYGu+O78HtX:2TpUd5xm/HX5IX
- TLSH T19AB3935667A04178D56D8579CBA28703A532B8740FEE8FDB0CB32215FE27AD0CF39A51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
85680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
22KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
404B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Train.vbs
- SHA256 41b7e99bb498ee10cff7da44c0e45c19f2f0c103afe8da51ed79b5ba55678f96
- MD5 6b791a87db5b1dc038539c6116b1584f
- SHA1 2cb7b881feed6b6b09bc04c44becb6fed429f6f7
- SHA512 852d445a3d582a3d8d971acdd75f868817a35f578a332558055a84d92fc714648d9be55d65d64851251fb79239624a62dce2d2e18002cd6169a639af83b29913
- TLSH T1A9017B39339095EE50AEA27E7346C0556276D7FA9100D9104B986E987B280920739FC6
- MD5 SHA1 SHA512 TLSH
Tuberculosis.exe
- IMPHASH 8b28e54d1c692f0cf49db233b95a8b60
- SHA256 a10bb5e2737b905515b66381e77ccd0eb92a7ef2db6b304d26e97fb986e87be3
- MD5 9ee9ac3cd8a6acdd92316254ee7664d0
- SHA1 a0d57b9a8479d2227f01b4bd4086cc1ca5bf1b96
- SHA512 9e9fa5daeaaa6a3abb7ce42a36de08abd5088bfdb72b2a99a98cb3c34e5d1ebce620cc51f6423b712e0ced84eb6c50483e39e19501770f6f64f4d8b933fc8c7e
- SSDEEP 3072:pG2N+CAquk6zA4/UyGgY4yHKvuwLTHxt8lfo7aet2nn3E4kvvKBkYkp2t840c0ys:ONOkp23Zoz2uLT1YXa
- TLSH T113345CD6E9829DD3F415233985F6F734023EEFC06A828B1B68317D35B243A527E94687
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
BitBlt
CreateCompatibleDC
CreateDIBSection
CreateEllipticRgn
CreatePolygonRgn
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
PlgBlt
Polyline
SelectClipRgn
SelectObject
SetStretchBltMode
StretchBlt
kernel32
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_fmode
_initterm
_iob
_lock
_onexit
_unlock
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
rand
signal
strlen
strncmp
vfprintf
user32
DrawIcon
GetDC
GetDesktopWindow
GetSystemMetrics
GetWindowRect
InvalidateRect
LoadIconA
MessageBoxW
RedrawWindow
ReleaseDC
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/4
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1024B
Virtual Size
754B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Unconfirmed 805456.exe
- IMPHASH 0e4d306cf8c6dda04181685be90db0c4
- SHA256 a45a358e6f4baf873d6d31b6620b30f956bf31fb5e242c8a47fa09ce35f18883
- MD5 ae3432722a8acdcdde36f26afc079903
- SHA1 c5b6c3a9ea2c8133bf07a5e0036030cdef92c555
- SHA512 ccd195d54d05dfe7239b19949af3ad899e2ad24fc7794a3bb1231461ca4adc37d0f9aa973e7e6759b120161d70f7c0085fcf22dc42dbfb3c13658d4dfa2d2570
- SSDEEP 6144:zeLSd2W+LBuWknzSNASXP8T6enmSvxR4JBc7kxwVOJxNzBehLmNdHkCPl4FvYKpd:6SgynzSXPRlVxNzch65apNZUMMnW0L
- TLSH T1A4B49E22BA85D031D1B241318FE9EA7365BCBD310F2199CB73C81B5D0EB55D26A35B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
177884
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Projets\vbsedit_source\vbsedit_source\Release\mywscript.pdb
kernel32
FileTimeToLocalFileTime
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
SystemTimeToTzSpecificLocalTime
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
LCMapStringW
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetStringTypeW
HeapQueryInformation
VirtualQuery
VirtualAlloc
GetSystemInfo
GetModuleHandleExW
GetCommandLineA
RtlUnwind
OutputDebugStringW
GetCurrentProcess
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
VirtualProtect
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FileTimeToSystemTime
GetCurrentProcessId
SetErrorMode
GetVersionExW
GetCurrentThread
lstrcmpA
CreateEventW
SetEvent
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
FreeLibrary
GetSystemDirectoryW
GetCurrentThreadId
EncodePointer
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryW
GetProcAddress
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
SetLastError
OutputDebugStringA
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
HeapFree
GetModuleHandleW
GetCommandLineW
WriteFile
SetConsoleOutputCP
GetConsoleOutputCP
GetFileType
FlushFileBuffers
SetFilePointer
ReadFile
CloseHandle
GetExitCodeProcess
WaitForSingleObject
ExitProcess
LocalFree
GetStdHandle
CreateThread
Sleep
ExpandEnvironmentStringsW
GetModuleFileNameW
FormatMessageW
GetLastError
GetACP
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
WriteConsoleW
SetEnvironmentVariableA
SizeofResource
user32
IsWindowEnabled
ShowWindow
PostQuitMessage
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetCursorPos
GetMessageW
GetMonitorInfoW
MonitorFromWindow
WinHelpW
LoadIconW
CallNextHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
GetWindowLongW
PtInRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
SetWindowTextW
GetWindowRect
GetWindowTextW
RemovePropW
GetPropW
SetPropW
GetScrollPos
RedrawWindow
ValidateRect
EndPaint
BeginPaint
GetForegroundWindow
UpdateWindow
SetMenu
MessageBoxW
GetActiveWindow
MsgWaitForMultipleObjects
PeekMessageW
GetMenu
EnableWindow
GetCapture
GetKeyState
GetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
GetWindowThreadProcessId
GetSystemMetrics
GetDC
ReleaseDC
GetSysColorBrush
LoadCursorW
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
AdjustWindowRectEx
ClientToScreen
TranslateMessage
DispatchMessageW
GetClientRect
SetRectEmpty
OffsetRect
GetParent
GetSubMenu
GetMenuItemID
GetMenuItemCount
UnhookWindowsHookEx
RegisterWindowMessageW
GetMessagePos
GetMessageTime
SendMessageW
PostMessageW
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsWindow
IsMenu
DestroyWindow
DestroyMenu
RealChildWindowFromPoint
SetCursor
InvalidateRect
KillTimer
SetTimer
SetForegroundWindow
CharUpperW
gdi32
Escape
GetClipBox
GetStockObject
PtVisible
RectVisible
RestoreDC
SaveDC
SelectObject
SetMapMode
DeleteObject
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
DeleteDC
CreateBitmap
SetTextColor
SetBkColor
GetDeviceCaps
winspool.drv
DocumentPropertiesW
ClosePrinter
OpenPrinterW
advapi32
RegEnumValueW
RegSetValueExW
RegDeleteValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
CreateProcessWithLogonW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
shell32
ShellExecuteW
shlwapi
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
ole32
CoTaskMemFree
CoInitialize
StringFromGUID2
CoGetObject
CoCreateInstance
CLSIDFromProgID
CoDisconnectObject
CoUninitialize
CoCreateGuid
CLSIDFromString
oleaut32
LoadTypeLi
SysStringLen
LoadRegTypeLi
VariantChangeType
SysAllocStringLen
LoadTypeLibEx
SysAllocString
VariantClear
VariantCopy
VariantInit
SysFreeString
oleacc
LresultFromObject
CreateStdAccessibleObject
Name
.text
Size
275KB
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.giats
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=241, version=40116,
count=162, id=243, version=40116,
count=25, id=242, version=40116,
count=2, id=261, version=23013,
count=10, id=206, version=65501,
count=1, id=207, version=65501,
count=1, id=208, version=65501,
count=25, id=203, version=65501,
count=562, id=1, productName=Unmarked objects,
count=22, id=259, version=24123,
count=20, id=260, version=24123,
count=133, id=261, version=24123,
count=9, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Virus (4).bat
- SHA256 aa235521f6cc2af3af1c20c389302de840dc7c6d551ea282f07b4c9aa6947f48
- MD5 14cf4996a5df9125b45893f9321994ba
- SHA1 5d07f3c5d09ff53485268531f21b56705390d1c7
- SHA512 552d849d76d38802a5a3427aa564e4ed9a138ca3b8b3a29ebc6ad75db5eba939bfe6b7eda3e92e32c99e6d64ea85bcf53bc3ae2a3e4067dfacd4da6896559285
- TLSH T16ED092CA65AF038CA0331CC47BD320FB860FB12B1911C849610EC4C5D9B198604A39F3
- MD5 SHA1 SHA512 TLSH
Virus (4).exe
- SHA256 84ed2753432e8f24540df867be339740c430756d1afdfb913b4ac64ba569d19a
- MD5 0d7f5f3b254f56b315fd4359fc607a08
- SHA1 88570b3a915a3b6cd0a42b46b88fcd23aca24364
- SHA512 77e0a30575bea9e0698bd2f807767acf3550a52f6d7517c2c2020e39f6eb2d5d84aa0462c7438fa6772057583631aac7c368c4d4e359e3b7c8b6e568f62094cb
- TLSH T16421030A05E11765C3728F365077F310CA32B593FCA79FAD40D54AC80C40125B8B9E3E
- MD5 SHA1 SHA512 TLSH
Virus (5).exe
- IMPHASH efdbc783bb236e141b862095fa7d00aa
- SHA256 c76293b5f6b327722a8f817ce7c6972823ba411c8ce8294467be835a27a01a35
- MD5 45266c4e4e2358922e71840272f69152
- SHA1 c157629ba1e6f650461e492a628a96c547eb6f33
- SHA512 c0bd5a2cbb3561cacb3d28cca736162cfee100f98c58c66fde1e49e46f8146b4fa314ced9dbe74cd29b286ed1d16aab28111648c89277180ed174328ae96155f
- SSDEEP 1536:pfHg26ixadXhBoYKVwTe/W40xWxu6fbgLSVglOIhcU:ZAFdXIYMwTe/W40UfZKlOS
- TLSH T1AB637C6E639414D9C7B6D1F5C262230ED274B0665B1083CF5B78E38A2F774D29B39392
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
memset
memcpy
malloc
free
strncpy
strncmp
_strnicmp
strlen
strcmp
memmove
sprintf
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetShortPathNameA
HeapDestroy
ExitProcess
GetTempFileNameA
FindResourceA
LoadResource
SizeofResource
GetExitCodeProcess
HeapFree
HeapAlloc
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
CloseHandle
GetCurrentProcess
TerminateProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetVersionExA
Sleep
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
SetLastError
GetCurrentDirectoryA
SetCurrentDirectoryA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
shlwapi
PathQuoteSpacesA
user32
MessageBoxA
SendMessageA
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
GetForegroundWindow
EnableWindow
EnumWindows
DestroyWindow
GetSysColor
GetSysColorBrush
CreateWindowExA
GetWindowLongPtrA
PostMessageA
CallWindowProcA
SetWindowLongPtrA
SetFocus
GetWindowTextLengthA
GetWindowTextA
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetPropA
GetParent
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRect
GetSystemMetrics
GetActiveWindow
GetWindowRect
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
SetCursorPos
LoadImageA
SetCursor
MapWindowPoints
MoveWindow
SystemParametersInfoA
GetKeyState
SetCapture
GetCursorPos
ReleaseCapture
EnumChildWindows
GetClientRect
FillRect
DefFrameProcA
GetFocus
IsChild
GetClassNameA
gdi32
GetStockObject
SetTextColor
SetBkColor
CreateSolidBrush
DeleteObject
comctl32
InitCommonControls
InitCommonControlsEx
Name
.code
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Virus (6).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 962e494636294fdad2abe32ecc2ec5b976a5172242be97aec13525190dcc11ea
- MD5 00b7e6e38937d2eed0ea9740e5bbe1da
- SHA1 d3d4c36578c8de494c0bd4d6446cf5a493c9d282
- SHA512 bc2f0e4161ade496fe93c45c828d5449297a1ae099fd09ddfee79581c07b25b6749fd56f33be83d72aeafe7c4d1403dd3785cf2e118eb6089a97e4587e184186
- SSDEEP 49152:R6GetJd4ebbuKJQvVOv+4ZnCPW3uDYZ6O61wm9UdsFXtx:UGe7qIuKJQvVOvBmW3uYZ6O6J
- TLSH T104A5333CBAC5224AD462EAFDE23767105FB007321833DF4D399A61B1C1E3D636457AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2157662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.1MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
adware.py
- SHA256 e68f6dbf05ea5c6cb5e456fa0e3104806cc832bbdb9b44b92dd2e82e2c2fb01d
- MD5 e216e648400aba5952a7615ab8fbc9b6
- SHA1 fa9274133f631ccae86d1b2b9f8bbd020be6a66e
- SHA512 38b576f773d721f7b8a2f6f5d5a6b544de397c6938dedea694b08a6f80b2f15e6ea8fe9bea31463c9d5497c2111b06ba2894e5bb82392c4eaafd5d05cd3ea81a
- TLSH T18441ED13F96B8D676073203A4B2F7B89FB1505A72262452A7C6CC1186F31427E1D89EC
- MD5 SHA1 SHA512 TLSH
birdie.exe
- IMPHASH ec175680921a2715662de338b92377d1
- SHA256 eff8cfdf1f27fe009d880b00c0fc9e273e4b91cd71de15d57c053a562c58e417
- MD5 fd2911f2635e01d72aa8ed4a53d656d3
- SHA1 d58c1ed9d644edf13017a0f9b40170c23c2f8d6b
- SHA512 7a6f06cc05e974015e9e02340a5a8c42974b278f518daa6b9140cf94b67d92bdb0ae74ab93fc226f58311da531f38a49381a5844a92411be87e595d850f41005
- SSDEEP 6144:p7MgojAlxm4hO/rYBmyh10T9eff95ieEA1LgdvB5wG:RMpA10rYoGiT905iWaPSG
- TLSH T1E554E002B7E9517BE0B8177809F257676336BCA06BBAA3DF834208695C335D06D39367
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegDeleteValueA
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
FreeSid
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyA
RegQueryInfoKeyA
kernel32
lstrcatA
GetFileAttributesA
lstrlenA
lstrcmpiA
GetPrivateProfileStringA
GetCurrentProcess
GetPrivateProfileIntA
lstrcpyA
GetModuleFileNameA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
_lclose
_llseek
_lopen
GetWindowsDirectoryA
CreateDirectoryA
GetSystemDirectoryA
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
LoadResource
CreateMutexA
GetLastError
SetEvent
CreateEventA
SetCurrentDirectoryA
TerminateThread
ResetEvent
CreateThread
GetVersionExA
FormatMessageA
FreeLibrary
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
LoadLibraryA
FreeResource
LockResource
SizeofResource
CreateFileA
ReadFile
WriteFile
LocalAlloc
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetTempFileNameA
GetSystemInfo
GetDiskFreeSpaceA
FindResourceA
GetDriveTypeA
GetVolumeInformationA
GetCurrentDirectoryA
LoadLibraryExA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
LocalFree
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
GetStdHandle
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapFree
HeapAlloc
VirtualAlloc
GetLocaleInfoA
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
CloseHandle
lstrcpynA
SetFilePointer
RtlUnwind
gdi32
GetDeviceCaps
user32
PeekMessageA
LoadStringA
GetDesktopWindow
wsprintfA
ExitWindowsEx
CharPrevA
CharNextA
SetWindowLongA
GetWindowLongA
CallWindowProcA
GetDlgItem
SetForegroundWindow
SetWindowTextA
SendDlgItemMessageA
GetDlgItemTextA
EnableWindow
SendMessageA
SetDlgItemTextA
DispatchMessageA
MsgWaitForMultipleObjects
MessageBoxA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
ShowWindow
DialogBoxIndirectParamA
MessageBeep
EndDialog
comctl32
ord17
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
203KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
cmdmaster.bat
- SHA256 b61efb13b172dd304479b5364fe4ae8f9c4f77a23fc798f6c470c515462cd79e
- MD5 fc63bf2f8e91e364f94bdb0b243233dd
- SHA1 b954523abd917bc8f0eb5ca7b5fdd64e466cdb54
- SHA512 a31472c50bbedce527aa12453fbb84d281c33976f5240740b1f46cc9e15af6cbaa83daad9be78b2191bb55b97030bcd5e9af94e45e3384d7480aaf0fe3dc51a7
- MD5 SHA1 SHA512
cstorm.exe
- IMPHASH 976a981c88c278eee9a51ee6e969a023
- SHA256 201c43e3035b50287c8b0179a05589a47ca878ae8f3b72d644c4c5cd0a261ad9
- MD5 32eacff54d4b2e585c1036bf63827200
- SHA1 844ee78cc2e83d854428b987efe3f3902a96a427
- SHA512 d4903d1019ac7eb0f5a0f77cb8853355625139943f107cfd0491d80485813252b2cf630036e10388da693a5eafdfe939b441f404584df08b53a81ee44f9e5923
- SSDEEP 384:fpNTc7fqq7TUd+vg6Le6lqAiOGQ4EhxYpPK1:o3vgJqpbxf
- TLSH T199D250E97DE44DC6EE11527E95EBC2623A3CF5E08B0347576B3075361B03EA23AD8246
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
calloc
exit
fclose
fopen
free
fscanf
fwrite
memcpy
putchar
puts
remove
signal
system
vfprintf
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/14
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
169B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
512B
Virtual Size
209B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
dd.exe
- SHA256 2f3d16ef80d336ff1d270af9c101443a6426600b6d7c6506d984cdbdc7c6e8f9
- MD5 168b73cc0f3d8c92c98c5028aec770df
- SHA1 7efcd6af6a0fda490b42e0ed4c5aa969079040d1
- SHA512 eed96b1d013e597bb9495918fee5260a8e17c5ba710315c4f7d3f92202a65a9751ad14248c5c7d88aeae9162ecd10a11c2806385268d18ceaa6bbf692ad5c421
- SSDEEP 6144:4GstW634w/+YvExOLm3hfpH2NqdMsBIdvHy/+o2tIxwgCQ:utroO+YvEkLmYzPda+f6Of
- TLSH T135746C73B6A04437D123267CDD1B9BB4983EBE103E2815866FED1D4C8F396923A25397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
296196
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
289KB
Virtual Size
288KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
destrbat.exe
- IMPHASH 5877688b4859ffd051f6be3b8e0cd533
- SHA256 996b55b93c67a907b47811f52e3efba18f0470326abc81099f59d206b3f58b27
- MD5 a84b546298eac79f8cd05418ba051d3e
- SHA1 56348d194de7f0bd27503fe720cd2ad7ab77a7c1
- SHA512 ae44e497eebc75421a8748802102db85e8243252943398a0ffd0dacbb90c37e49362757da98c0b1833d402fbb3e0ba5792b72596b09cf927442684c572441304
- SSDEEP 1536:T7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfWxwYcdOx:Pq6+ouCpk2mpcWJ0r+QNTBfWmYco
- TLSH T12E937D45F3D201F7E9E10A7100A6712FE73967249724A8DBC34C3D829953AD5AA7C3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
free
_wcsicmp
wcslen
wcscpy
wcscmp
memcpy
tolower
wcscat
malloc
kernel32
GetModuleHandleW
HeapCreate
GetStdHandle
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
GetExitCodeProcess
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetNativeSystemInfo
GetShortPathNameW
GetWindowsDirectoryW
GetSystemDirectoryW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
Sleep
GetProcAddress
GetVersionExW
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
DuplicateHandle
RegisterWaitForSingleObject
user32
CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
DestroyWindow
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
EnableWindow
GetSystemMetrics
CreateWindowExW
SetWindowLongW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
gdi32
GetStockObject
comctl32
InitCommonControlsEx
shell32
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
winmm
timeBeginPeriod
ole32
CoInitialize
CoTaskMemFree
shlwapi
PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
Name
.code
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
hello.bat
- SHA256 b64588ed4bbde06156ffb953ea6804099a450f2ad588f86015bdb54e5a3697e1
- MD5 476fc45b5522466fd7b38fd125c941a2
- SHA1 dcde8b62b2420cfa21beb711cb5274adb488b442
- SHA512 8de93cbcf30f6f5591c5cb4772fc7019c2bccb0880834fa1a57c3be349042f70f735cf7441a3b9f45002d57252d13d8e02b6da89761eca249325b608cf7cf061
- TLSH T15911B3F1312640120C7635FB6C67F76E7FC6A24FD94858E03B0E44BBC70A8E262880C4
- MD5 SHA1 SHA512 TLSH
helloworld_not_infected.exe
- IMPHASH 541160bce55bf5030f1053d9ca2f310b
- SHA256 1e6c6ca0bf28973bd796f58825dd8f731bd524f72b5c66535015f9fae7a0c7e3
- MD5 eddbce34a0acf0b17fb1cc5f2177adab
- SHA1 6c0a0975f0c36497cfe99a19f239a1758fa653d2
- SHA512 dc1a6d6eaa2ceccc986b103ec56ba9db51e168cf24f552c9491eb25028cec6131c009776909d81a67096db4837298b307587e87afa1e7a209b92f5ef700b1038
- TLSH T12E516857C3898CFAD0DC83B01FC79115B4BB083823F782110DF9841BB471A6464B9F9A
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxA
kernel32
ExitProcess
Name
.text
Size
512B
Virtual Size
38B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
146B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=19, version=8078,
count=1, id=18, version=8444,
hoved.bat
- SHA256 de339b64b9196d73029c057091d1e6802cc58d8451ee77b2dddcec4c9f532b99
- MD5 cba6cd27354fa0c101ac650d951de1b7
- SHA1 139b0d2521ff15ff92c3f782a2799504e1afda4a
- SHA512 033af89f748cc12aa5691c2eb9fd87cfa82940ee900c34c81aacd436598c09e33476019007244321da1fd5a4fb6fdb3338e871a1f344fe1a9ee8a8fc84bc556f
- TLSH T18311806D86FB61C5DD35899C7C280E1E4D3F80A2730FA15E3AC0C4296406DDF93AA49F
- MD5 SHA1 SHA512 TLSH
joe.exe
- IMPHASH ec175680921a2715662de338b92377d1
- SHA256 4d9d672e5d2392acf99deb598d36fd258b36ebc8b060c35e326df994b2af7c2b
- MD5 8b8026e10cd61e970b88e3e7795550a5
- SHA1 ee714e1d0b649144fc41f7d651975d59ca63b531
- SHA512 d9b06d9b10a49fde96d20535228475e0aa830618773b3758235e5a881e05a44f7197d0573c9d167283f82770030841b8c17423115528413db6d8a697e13ba7e9
- SSDEEP 3072:pW7MOD/o+yAlmRqTeP4hkBjhas4u3JT5FenhDcAd9WTTABOWdmW2LRXpw1Wt/G:Q7MgojAlxm4hO/wGAd9WIBONW2LhpSyG
- TLSH T16D049D02B6E9957BE0B9077809F74B672735BCA05BB693EF834108691C335E06E3532B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegDeleteValueA
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
FreeSid
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyA
RegQueryInfoKeyA
kernel32
lstrcatA
GetFileAttributesA
lstrlenA
lstrcmpiA
GetPrivateProfileStringA
GetCurrentProcess
GetPrivateProfileIntA
lstrcpyA
GetModuleFileNameA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
_lclose
_llseek
_lopen
GetWindowsDirectoryA
CreateDirectoryA
GetSystemDirectoryA
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
LoadResource
CreateMutexA
GetLastError
SetEvent
CreateEventA
SetCurrentDirectoryA
TerminateThread
ResetEvent
CreateThread
GetVersionExA
FormatMessageA
FreeLibrary
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
LoadLibraryA
FreeResource
LockResource
SizeofResource
CreateFileA
ReadFile
WriteFile
LocalAlloc
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetTempFileNameA
GetSystemInfo
GetDiskFreeSpaceA
FindResourceA
GetDriveTypeA
GetVolumeInformationA
GetCurrentDirectoryA
LoadLibraryExA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
LocalFree
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
GetStdHandle
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapFree
HeapAlloc
VirtualAlloc
GetLocaleInfoA
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
CloseHandle
lstrcpynA
SetFilePointer
RtlUnwind
gdi32
GetDeviceCaps
user32
PeekMessageA
LoadStringA
GetDesktopWindow
wsprintfA
ExitWindowsEx
CharPrevA
CharNextA
SetWindowLongA
GetWindowLongA
CallWindowProcA
GetDlgItem
SetForegroundWindow
SetWindowTextA
SendDlgItemMessageA
GetDlgItemTextA
EnableWindow
SendMessageA
SetDlgItemTextA
DispatchMessageA
MsgWaitForMultipleObjects
MessageBoxA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
ShowWindow
DialogBoxIndirectParamA
MessageBeep
EndDialog
comctl32
ord17
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
85KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
kitn.jpg
- SHA256 ef9619581d33f093a624f9a065cf0bb5be03beb0dc2b1ebe6c848b822aee60e2
- MD5 cf1c49599968d5a4dc4a45620cd8472e
- SHA1 0f7d329d2487d980c4de4fa46d863668db2b039c
- SHA512 3e22176c0599f6973bc353984d6044b747bb367ea28c22a4baba040c7ea47721ba7241f10022b331f8cbd8c9e98dd6b01355215b7b6dce345ce538b3a6121938
- SSDEEP 6144:SYBNr5KSk6Zus+0BdNShxvXSm6s4+fWFOzKZtAF1:SYB5MSWf0WxvS0zKZtAF1
- TLSH T1F2447C538C089B97546883F97E131EAD6F5E2B1CD9817AEF01761ECB7E242220C9F51E
- MD5 SHA1 SHA512 SSDEEP TLSH
kitn.py
- SHA256 f69dae231818b489336bd6d2ff44f993dd5a0cd0edd05ce93d2b380916fccf46
- MD5 23b68e551cb250c61e616d57d05c8565
- SHA1 fed81efe112eb2c1a10ff008d9dbc395e62d07f5
- SHA512 dcfdf6296bee25b62830e1206322b99d85cb308c84a7d82d364e1555117a58c3beed68ede379ee9c254817b3a7db5b243fa4c8df6ec18aad2cdfe62ccb849ed6
- TLSH T122F0D4B3758D110D8F90516CC5C679BE23263C1977867C40F271C260ED71A342696C19
- MD5 SHA1 SHA512 TLSH
maleware.bat
- SHA256 15a17915219fa72fa565f0f1b87635e3e75896490ccbc51c79795f615efb8696
- MD5 3b837fbe05d23da67ba647074ea3b938
- SHA1 9c1c3a47099d51457994474a6913abfed7666d99
- SHA512 4092cc69771e9b6a51372d83d9b26dc070bfd098919db86c5c4cf7284e6b842f69d0b503db85687dfc7024ddd04ec5b498e12230c1bfa9399a1cb0b5b42a9263
- TLSH T1CE116D2D86FBA195CD25499C7C281E1A493F80A2731FA15E3AC0C4295506DDF93AA49F
- MD5 SHA1 SHA512 TLSH
malware (10).exe
- IMPHASH 538e71c8e9020851ddfc9f266f85d91f
- SHA256 b8ee8f2aee0138be45beda3d1c66601aac84ab818861cc1596914e531ca16880
- MD5 bbbbdc1ac7be3fd368f4eb5bea41360a
- SHA1 6f59ce70420971d8957a486a81c7414e149fe614
- SHA512 a421e728f8777d0e0ed6d5780b391378b9bddc6a84fb8591f8ea347fba211d478b6b8c6eee282c3240f3647897e89fdc5c3f59b7a0564e71ba6870f48ca7b4e1
- SSDEEP 6144:Lcqq8y/1MW5WqEomz38Wf6SacL2yRiWWqlCTVt+:CnqnHLLXylnRtNTv+
- TLSH T19F542B90F692FDBAE9558FBD14F11309529EE2C0E71DEB333860FD2C0159A5C86B364A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_iob
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf
user32
MessageBoxA
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/4
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
213KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
1024B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
mbr_overwriter.py
- SHA256 8b05960c4a621f7b26b3017be05e4c7f4a6895256dd60bbb0ede608963745ae1
- MD5 ac8ae72e6cb2067772c2f4187f202935
- SHA1 83245bf421da917ce544755ecd7335d42bbac1f1
- SHA512 e056f6d15ff442f24fe6ca8dbc83803da01097a7ef16aeee0e61ebf8ecb6e95d77c5bed064d73083adae8440f7decd85f31a07c7e907e86dac4b40a1dcb66a99
- SSDEEP 96:sK58Ssivci5K3zR7wCRmdYs1xXg4mLExX6QMNbqQruxbCSZpZtHgrmIo:A4ci5K3zBkSUq98CSP3AU
- TLSH T14ED120C2BB4C12E93D9F55ACDB5A9492931E817C53E442C57E8D804CD3D60560E2B7AE
- MD5 SHA1 SHA512 SSDEEP TLSH
memed.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 319f7c621f6c7c21bd06c34ea05d8eb08326a28a9e778203eeba18c6defb591d
- MD5 039f54eafb7321aad71402267a4b248b
- SHA1 47dba14d434b703b55f78f71f153a00fd53bafe1
- SHA512 d51860dfcaebd8e747c7edd2af1f9fbccaf1541aee6074c79c5cd18fd34e94099badabee3a1b49422446dc1811385fc24d37fcb5af4a3ef52b3ad332429eacab
- SSDEEP 49152:Fdb+Ms6hCQezu0CwtWmiYs08VXkr9zKYpRjxMcK/BVOzgcIM+JTp0xvQyS:HbtrhCQYCwjiXRqY4IcK/sIJ1p8S
- TLSH T10BC5337B1F079AE7E41924B080DA62731735069917BDF89E054A7D1332627C3AE37EE4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2746870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\hyneks pc\source\repos\memed\memed\obj\Debug\memed.pdb
mscoree
_CorExeMain
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
pcoptimizer.exe
- IMPHASH baa93d47220682c04d92f7797d9224ce
- SHA256 7049dfc316319e209c701a7cb8636352dea88d201e8ae647c3762be2d2d8fb96
- MD5 ffd505b7e0be4c68ba739659a100cd68
- SHA1 0f5433616e43e1e1ec3a96bb6e63c68288d5a925
- SHA512 4fc71583c1989448b5e74e2bffa867f6792e5639d4959c7eff2819d0a55175724ca4c1025ed7b3cb1eb6ac0c28f8a70057505bb390c91da53ad8bf3059e56c57
- SSDEEP 49152:3H9jfBAkLEbYVDitFCn58hKZG/dYWMTd8cE+/u6z:NjfBAkAbYVDitMn58h915MTd8D+/uG
- TLSH T186D5C4D365C9628FD48A16B9902ACC4AD81DCFAF871008C79D78747ABD7ECC0D16AD27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2867200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
lstrcpy
comctl32
InitCommonControls
Name
Size
240KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
mezvpvzo
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
nsttanzr
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
reptilia.bat
- SHA256 dedcd3ce9cfa2d73e9834257801c7719230ab88e050adb51a2065548f9b4960c
- MD5 84e627e4dd5fa2f0fe76372a8ae4a242
- SHA1 cbabdfc8f24e71ec5e583fab779846507d023147
- SHA512 691a51c6cb5dc49909250032599b8c8d4dd6494b7e6596711b7bc05f00b394ef95586fafdcb58eb967d912920cbff29c8b091d2a7bc371f4b3d4f2df128e7d53
- TLSH T18BF0C4DB414318960F8E29A5C0867BF9B76111DAC45180EE8644B4488DDBBE324C95DA
- MD5 SHA1 SHA512 TLSH
sabrina.bat
- SHA256 2f89ffac54078f9c354cd05fc06d2e9eb38a3fc520ff367a7fc81e7cf1afc8c1
- MD5 703045e9cc09be65118a59a0258ea323
- SHA1 ecff420443fdea9a1b35e3f8bc2cd1ee4ed268d4
- SHA512 e5673f887be0ae69096f8ad783efd29b7715d4645b5290b2bfd6954f712268af7eda8606a342fbbe4de6001c86843d51bc3b2458972fb1dddca34a945108042f
- TLSH T19AE0EA1AFDD18C95445DE08DB08381E4E339CA4B111D5CDD449BB130D9FC0C51A2DC8E
- MD5 SHA1 SHA512 TLSH
sabrina.exe
- IMPHASH fa323101ea3a95c49e1498c5880a9ef7
- SHA256 620265f2e8acafaefc0f18fd1cbb00aa6fbbe25b7d45f3923bd6693385eac7aa
- MD5 a89eb17877991b7a48e0925c1df129a4
- SHA1 5a4bf42e5d0f26bcc34c8367c77cf624b39df9f2
- SHA512 d77f402e9c97d445e1cda8ae85d9292695fbb04452f67efb7b5f6105887b996eabcd580fd3a38fad0e80350eced5715e87b2182c443797bb86bcad9af6bc78c1
- SSDEEP 768:8OiEO7OvsT0AhR7Za4PP3lLuzZPKqmcFQjTTqk:85OvQ3h1Za4PP3lLuBZmwQjTTqk
- TLSH T14A33F7867AA58CE7EA81573D84DBC33A573CF5818B234B93B73CBA345B133A12195346
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
_strdup
_stricoll
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_fpreset
_fullpath
_iob
_isctype
_onexit
_pctype
_setmode
abort
atexit
calloc
free
fwrite
malloc
mbstowcs
memcpy
realloc
setlocale
signal
strcoll
strlen
system
tolower
vfprintf
wcstombs
libgcc_s_dw2-1
_Unwind_Resume
__deregister_frame_info
__register_frame_info
libstdc++-6
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7compareEPKc
_ZNSolsEPFRSoS_E
_ZNSolsEi
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1Ev
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev
_ZNSt8ios_base4InitC1Ev
_ZNSt8ios_base4InitD1Ev
_ZSt3cin
_ZSt4cout
_ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
_ZSt7getlineIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RNSt7__cxx1112basic_stringIS4_S5_T1_EE
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
__gxx_personality_v0
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/14
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
303B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
svchost (6).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4b8f74bf6846cd722b24d0bb74fa6c40967767f04e0e5105a0a931b7a83348d7
- MD5 46ab64cf9c4f34c012dabe9e19c371d2
- SHA1 4c4ab39959390bc20fef2a884779ba70b787a708
- SHA512 bd28f70fad73c33af3ed471bcff6610d3a9254e569745887f9c2b8d6a8d059c70ce9395a684f64fce95b22ed956bb2d37b9e7a121a3ec404039d097b24c19c96
- SSDEEP 98304:usOoRmj6gWlzzdtRjL8H1C4EqTRP6Gxes0P3xYWxU5Mi6DHXLvO6zAJu:NOehg+tRjggit6ce/YtaL
- TLSH T1DF66DF02B690C025F8BA06B66D7EE168593D7DA11F24C0D733C47BEE6A766D06C3172B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6776618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
6.5MB
Virtual Size
6.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
!Sugar
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
virus (4).py
- SHA256 ca733e5c6ccb44ce9ac914a3c6b65ce55b68acb6030dccdac93f9a0c09f5bc88
- MD5 085ea3c2b91815e53a8d78580a646391
- SHA1 ab20160ed38dbaa15623695fb3a398b9135b2caf
- SHA512 21418554365b6fd1d63271036ce6940097ac10c4ea9cffc72c89dc866734f0af1e5267d5d8212a47d319b8641e389d433488002d8f12d54c1207a2464365c622
- TLSH T1FFF041CB900C119CE9C9BE74E28C14E3DBB7E2C27F818D34A20D01B856204CA06E0563
- MD5 SHA1 SHA512 TLSH
virus (4).vbs
- SHA256 c55b4e02141548338d47c7b8199d24031d77e7bf256654f3e354fd03d9f6064b
- MD5 d590485f11ad7a972b2b65c9904c5e06
- SHA1 b8ea6aa95a54cdfa2566a544cc49512a8188109a
- SHA512 f6cc82c2963dba7ee8a36e2ea58804c12ac8d433628d635e88028293d80f81b32cfb156f816955017dcf71e99cbcdd0c7ea5dddd37f6ba7e9591ad5c902606a4
- TLSH T164C00288A9C3C25E6206F1F595E55898EB805075E31E80687BEEEC45B1953CC6E1A446
- MD5 SHA1 SHA512 TLSH
windows vista key generation.exe
- SHA256 1e70aca1cab3a7143cd228e283c06104de791013b800abd0439bc2570324aeea
- MD5 e90ccd10cfd0db2a50cdc82fda66a1b6
- SHA1 ccf87a25af4c9b7fbc94803b3cbe48a729c7d15c
- SHA512 9b0b9d6f004d6f2722d674b19b7d9e360fdca2fa93d8ee1d9fae17072c5456cbc90fd0e981f92bc36a2ec79baf0e87d93a1d5a32456dad0ce69eb225ad1ecd94
- SSDEEP 6144:LTnjnvrDiMNb1LSlZCgb5OQx0MciQGKAabe9RMJGtkW:LHn3dtYb5O0ci1+kRMbW
- TLSH T1BB14129933C4DDC5C0A2C2FAA74FC4B51E2CB6E2496A556659D8B01F3C73B6098C429F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
501856
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
187KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=105, version=2067,
count=12, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=37, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=150, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=8, id=95, version=2179,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=8, id=109, productName=VS2005 build 50727, version=50727,
count=4, id=25, version=9210,
count=21, id=93, version=2179,
count=442, id=1, productName=Unmarked objects,
count=47, id=100, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
out.upx
- SHA256 5231886a8c937c744e7ccdf698bd633c72e2790dcc8e2fce74b3261284ed08b1
- MD5 ec55a7c765255d50749b74da8f756ec9
- SHA1 b089f97e98359fcb12994982722a462580edf2e8
- SHA512 71b4f5c8cc6efa073ae88b250369614b131263bc4b829abb80aa3ce40d1f2d97290a86e25728bb0bbeb77235ccf65b9f0b699e6b2dae810182f3a98526a07df5
- SSDEEP 12288:knRFtj2zJfUbLXEftfLtA8RKO1WHVaTwe7V:SRFtj2dfU3XEFrR41+we5
- TLSH T13A948D2B3ED1D075E16261B6EF25E72272A9EB3009328D43A7D02EDC67735C19739A07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
298592
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
340KB
Virtual Size
339KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=105, version=2067,
count=12, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=37, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=150, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=8, id=95, version=2179,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=8, id=109, productName=VS2005 build 50727, version=50727,
count=4, id=25, version=9210,
count=21, id=93, version=2179,
count=442, id=1, productName=Unmarked objects,
count=47, id=100, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
xD.exe
- SHA256 362a499e843e0c82fbe5ca95013b9a3b6e3cdd308f91cf03329fa4af7aea77cc
- MD5 3371469a63a0e31a3534e5cb870caaf3
- SHA1 075786b3ba608a79cb8bf9f5eec9c99eb942dbd6
- SHA512 b82a31f4c7de0ec25209309ae52f29044be86c6be234002c734dad75082510e61f73ec09ddeb49da420417cb483ea62a0c3642956080a615f9971d959f69bbb8
- SSDEEP 384:dbCEXMMADQIrUeNFwx9E5xtT6fkCMst8AdxIiv4dK8y8KG8szTO4Am7UnwtzwGW9:N1NAUsbxtT6sFst/3IrdlLUwWknbcuye
- TLSH T17BA2CF52D4EB8E26C38F013F5A9FF72A4D50225FE7758B41B5AC302B0C11B989C3A276
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
58256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE