22092026_1455_21092026_UTR_8718-9-2026.img.zip
- SHA256 c4518b3a7320927c6394ba0d0c390a61af3b5872bf26195299cc9771ef801017
Password
infected
Overview
overview
8Static
static
3ARPHADUMP.dll
windows10-2004-x64
8ARPHADUMP.dll
windows11-ltsc_2024-x64
8KBDMLT48.dll
windows10-2004-x64
3UTR_8718-9-2026.exe
windows10-2004-x64
8UTR_8718-9-2026.exe
windows11-ltsc_2024-x64
7UTR_8718-9...cx.lnk
windows10-2004-x64
3UTR_8718-9...cx.lnk
windows11-ltsc_2024-x64
3bcrypt.dll
windows10-2004-x64
3dpmodemx.dll
windows10-2004-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ARPHADUMP.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
300 seconds
Behavioral task
behavioral2
Sample
ARPHADUMP.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
300 seconds
Behavioral task
behavioral3
Sample
KBDMLT48.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
UTR_8718-9-2026.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
29 signatures
300 seconds
Behavioral task
behavioral5
Sample
UTR_8718-9-2026.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
300 seconds
Behavioral task
behavioral6
Sample
UTR_8718-9-2026.docx.lnk
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
UTR_8718-9-2026.docx.lnk
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
bcrypt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral9
Sample
dpmodemx.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
General
- Target 22092026_1455_21092026_UTR_8718-9-2026.img.zip
- Size 6.5MB
- Sample260922-saqldagg73
- SHA256 c4518b3a7320927c6394ba0d0c390a61af3b5872bf26195299cc9771ef801017
- MD5 d16bb54252f21e0df611b1b7fbb32c8d
- SHA1 3b30b94c9f2c6b62ac2bee80113a6b1fc1ce99aa
- SHA512 ea3e87a9cb0eac4c0798dcbae2fcf4ac0a316d00c07e4ed82458b92fc649d828be6283892c38c555b2107a0e130e73c47f9e9e67f5f51eb83ee7a047e9563a5e
- SSDEEP 196608:e7XEvkizOfBo6hvvruYlJmspZVmbgiYNPP:e32OpowHaYlJmyZ3iEPP
- TLSH T1AF66338634F236BCD2C9AD30134B614AAE2D1ECB7673D6B9D6C4546DB341C824C3E95B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/ARPHADUMP.DLL unpack002/KBDMLT48.DLL unpack002/dpmodemx.dll
File Explorer
-
22092026_1455_21092026_UTR_8718-9-2026.img.zip.zip 6.5MB
-
UTR_8718-9-2026.img.iso 9.9MB
-
316ab233-b6dd-49da-9fd2-16a0261844f1.dmp24KB
-
60502c0d-14c0-4814-ae4f-79c4c427dc26.cfg7KB
-
ARPHADUMP.DLL.dll 8.7MB
-
KBDMLT48.DLL.dll 7KB
-
UTR_8718-9-2026.EXE.exe 206KB
-
UTR_8718-9-2026.docx.lnk.lnk 441B
-
bcrypt.dll.dll 95KB
-
dpmodemx.dll.dll 8KB
UTR_8718-9-2026.img
- SHA256 7e3e3801f96886b8bee3740930babe22a0219270e8d68f1bc334bf6e8439aa48
- MD5 46888ea798b6c035f087c41eb2401b2a
- SHA1 7e9ac5de05eb10dd849430e176e47534f00edc7f
- SHA512 107379ada1f28d3fe11c251993f32c273d864676af52d95decab839446da3c8794b72d7b734a658f5e6437a5910db8ac60713546fdc66b962e1747c5d3d89629
- SSDEEP 196608:6Ee9s+bzqT+NGm57AofDhZgOZ9KeXZHOf/4O7NADtV6v+ud:jeG+5HAEFGOZ9KEZU7B
- TLSH T182A6F1063D4C046BE04A2330CD59A1F8F7AE6D603F6744873AF9FA1ABA33B415E5855B
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
316ab233-b6dd-49da-9fd2-16a0261844f1.dmp
- SHA256 bac3b65f45c19c637d678e06e1bbe30f56068a26092828b2e28faffc5ff2f390
- MD5 697a56a9a619ebc7558bcc689ee58b6a
- SHA1 f4135770fce36edd430c2f2258c0225413e8679b
- SHA512 3cfcddac2a598ed3c25cecc2e66a69c8ec81bf4e1e5d09c781eec36ef8b5761b1c41a9c56a31688c87f76483bbe936b3050956dfd9e9617ef3234f9673e036b6
- SSDEEP 768:bwe+z/dL3LhhTOJicqrjcVcHVtz6tPPkBWQ5w:bx+z/dlX3cVcHetPPkXa
- TLSH T1AEB2D09CE38DD8AD6FBAAAC13D88324668B7DFE76300645463F8704E6D18A49C61717C
- MD5 SHA1 SHA512 SSDEEP TLSH
60502c0d-14c0-4814-ae4f-79c4c427dc26.cfg
- SHA256 e7c2911a1c6819564c4b880a089c21d47b26ec7bfddedeedf69cd64b558d2563
- MD5 30700c5a40209a8e8840f010bc56e5e1
- SHA1 8edcd9ef281ccd2862717a729105b9dab4087370
- SHA512 4b426d74bf5b7cff7107456ea3237aaa0a50f15ca0e0c53ce8f253c71ec8481d18c7b4c01ad5bbaa868cec82d08e950b89fad4b5992ed7a0d722bc133670b302
- SSDEEP 192:JCF3UiWz7M6SYHvNTlwZchvjFYHmGx59h/82s:JCF3Ui0ALmvvX9jFYHma59lBs
- TLSH T122F1C01E20F88FBEEDDF863E9BC5AE61638C9F4F5D400145A11640973BECB5E9C26016
- MD5 SHA1 SHA512 SSDEEP TLSH
ARPHADUMP.DLL
- IMPHASH 3d2745e17e508d9b8dcba8d7e1b2bf85
- SHA256 20e11d7e0ca3f756c57558dc95c089a7364f7f86e21201c0a1cf7464e8ff9d56
- MD5 7b35f82012893f82e6cef467e97300ce
- SHA1 cbee4b8ff5240beb740146546b73595af8276e23
- SHA512 208cfa98940f987f268b6ea8df24acdeaf861d3273274d2589ee73d729e2e5562c9880e97b080463c063eab48ab8f5f6a4451055446430b73a8258795ce963c4
- SSDEEP 196608:lEe9s+bzqT+NGm57AofDhZgOZ9KeXZHOf/4O7NADtV6v+ud:KeG+5HAEFGOZ9KEZU7B
- TLSH T16E96F1163D4C046BE00A2330CE59A1F8F7AE6C603E7744573AF9FA1ABA33B415E4955B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
1695248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\src\vctools\VC7Libs\Ship\ATLMFC\Src\QGBoxHyperVRepair\Release\QGBoxHyperVRepair.pdb
kernel32
GetCommandLineW
GetCommandLineA
QueryPerformanceFrequency
FreeLibraryAndExitThread
ExitThread
VirtualQuery
VirtualAlloc
GetSystemInfo
TerminateProcess
UnhandledExceptionFilter
FlsFree
FlsSetValue
SetStdHandle
GetConsoleMode
InterlockedFlushSList
RtlUnwind
GetCPInfo
GetStringTypeW
RaiseException
OutputDebugStringW
IsDebuggerPresent
HeapQueryInformation
GetFileType
GetStdHandle
FlsGetValue
SetFilePointerEx
LCMapStringW
GetTimeZoneInformation
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FindResourceExW
SearchPathW
GetProfileIntW
SystemTimeToTzSpecificLocalTime
LocalFileTimeToFileTime
GetFileSizeEx
GetConsoleOutputCP
GetFileAttributesExW
FileTimeToLocalFileTime
VirtualProtect
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
LocalAlloc
GlobalHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GetTickCount64
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CompareStringA
lstrcmpA
GetVersionExW
GetCurrentThread
GetWindowsDirectoryW
ReplaceFileW
SetFileTime
GetTempFileNameW
GetFileTime
GetDiskFreeSpaceW
GetCurrentDirectoryW
ResumeThread
SetThreadPriority
GlobalReAlloc
GlobalGetAtomNameW
GetThreadLocale
GetStringTypeExW
MoveFileW
lstrcmpiW
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFullPathNameW
FlushFileBuffers
FindFirstFileW
FindClose
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoW
VerSetConditionMask
FormatMessageW
GlobalFree
GlobalSize
GlobalAlloc
MulDiv
GlobalLock
GlobalUnlock
FileTimeToSystemTime
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryW
LoadLibraryA
LoadLibraryExW
GetModuleHandleA
FreeLibrary
GetCurrentThreadId
EncodePointer
OutputDebugStringA
CreateThread
CopyFileExW
SetFileAttributesW
OpenMutexW
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
lstrlenW
GetEnvironmentVariableW
GetTempPathW
GetSystemDirectoryW
CreateProcessW
lstrcpyW
MultiByteToWideChar
CopyFileW
GetModuleFileNameW
WaitForSingleObject
ResetEvent
CreateEventW
GetCurrentProcessId
DeleteFileW
WriteFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
GetModuleHandleExW
CreateMutexW
SystemTimeToFileTime
GetLocalTime
ExitProcess
SizeofResource
WideCharToMultiByte
GetModuleHandleW
GetProcAddress
LocalFree
CreateDirectoryW
GetFileAttributesW
GetCurrentProcess
Process32NextW
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
DeviceIoControl
GetTickCount
Sleep
GetLastError
CreateFileW
SetLastError
FindResourceW
LoadResource
LockResource
FlsAlloc
user32
ReuseDDElParam
UnpackDDElParam
DestroyIcon
GetDesktopWindow
SetCursor
InsertMenuItemW
DestroyMenu
CreatePopupMenu
TranslateAcceleratorW
LoadAcceleratorsW
ReleaseCapture
GetActiveWindow
BringWindowToTop
CharUpperW
SetParent
IsZoomed
IntersectRect
DrawIconEx
OffsetRect
DrawFocusRect
SetWindowRgn
DrawStateW
DrawFrameControl
DrawEdge
EnumDisplayMonitors
SystemParametersInfoW
LoadCursorW
GetSysColorBrush
SetLayeredWindowAttributes
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuState
GetMenuStringW
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
ReleaseDC
GetDC
MapVirtualKeyW
GetKeyNameTextW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
IsDialogMessageW
SetWindowTextW
IsWindowEnabled
CheckDlgButton
DrawMenuBar
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetMenuItemInfoW
RegisterClipboardFormatW
SetClassLongW
GetMessageW
DestroyAcceleratorTable
EnableWindow
LoadBitmapW
GetClientRect
UpdateLayeredWindow
GetTopWindow
GetClassNameW
GetClassLongW
PtInRect
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
SetMenu
GetMenu
GetCapture
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
TrackMouseEvent
GetAsyncKeyState
SetCapture
SetTimer
KillTimer
GetSystemMenu
DeleteMenu
MessageBeep
GetCursorPos
WindowFromPoint
NotifyWinEvent
GetMenuDefaultItem
GetKeyState
SetFocus
GetDlgCtrlID
GetDlgItem
SetMenuDefaultItem
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
CopyImage
GetUpdateRect
LockWindowUpdate
SetRect
SetDlgItemTextW
FillRect
InflateRect
PostMessageW
GetParent
SetRectEmpty
CharNextW
LoadMenuW
GetSubMenu
SendMessageW
ScreenToClient
InvalidateRect
UpdateWindow
GetWindowRect
GetSysColor
MessageBoxW
IsChild
GetFocus
IsRectEmpty
LoadImageW
GetSystemMetrics
RedrawWindow
GetWindowThreadProcessId
GetWindowLongW
SetWindowLongW
SetWindowPos
EnumWindows
PeekMessageW
TranslateMessage
DispatchMessageW
CharUpperBuffW
ClientToScreen
RegisterWindowMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsWindow
IsMenu
DestroyWindow
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsWindowVisible
IsIconic
EnableScrollBar
MonitorFromPoint
CreateMenu
SendNotifyMessageW
UnionRect
CopyAcceleratorTableW
InSendMessage
IsClipboardFormatAvailable
GetIconInfo
SetCursorPos
ModifyMenuW
FrameRect
HideCaret
InvertRect
PostQuitMessage
SetWindowContextHelpId
MapDialogRect
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
PostThreadMessageW
WaitMessage
ShowOwnedPopups
SendDlgItemMessageA
RealChildWindowFromPoint
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
GetDoubleClickTime
CopyIcon
SubtractRect
EnumChildWindows
GetNextDlgGroupItem
GetComboBoxInfo
GetTabbedTextExtentW
GetWindowRgn
MapVirtualKeyExW
IsCharLowerW
DrawIcon
DestroyCursor
InvalidateRgn
GetLastActivePopup
gdi32
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextAlign
StartDocW
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CopyMetaFileW
CreateDCW
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetTextMetricsW
CombineRgn
CreateEllipticRgn
Ellipse
GetBkColor
SelectClipRgn
CreatePolygonRgn
Polygon
Polyline
GetMapMode
SetRectRgn
DPtoLP
CreateDIBSection
CreateRoundRectRgn
GetDIBits
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
GetWindowOrgEx
Rectangle
RoundRect
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetRgnBox
OffsetRgn
GetCharWidthW
CreatePalette
GetPaletteEntries
GetViewportOrgEx
LPtoDP
EnumFontFamiliesExW
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetNearestPaletteIndex
GetSystemPaletteEntries
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextFaceW
SetPixelV
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetDeviceCaps
GetCurrentPositionEx
ExcludeClipRect
Escape
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
PatBlt
CreateRectRgnIndirect
CreateBitmap
SetTextColor
SetBkColor
DeleteDC
CreateFontIndirectW
DeleteObject
GetStockObject
GetTextExtentPoint32W
GetTextColor
GetClipBox
GetObjectW
msimg32
AlphaBlend
TransparentBlt
winspool.drv
OpenPrinterW
DocumentPropertiesW
ClosePrinter
GetJobW
advapi32
RegCreateKeyExW
CreateServiceW
CloseServiceHandle
OpenServiceW
RegEnumValueW
RegEnumKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
SetFileSecurityW
GetFileSecurityW
RegQueryValueExW
RegOpenKeyExW
RegSetValueW
RegDeleteTreeW
RegCreateKeyW
RegSetValueExW
OpenSCManagerW
RegCloseKey
ConvertSidToStringSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
DeleteService
ControlService
QueryServiceStatusEx
StartServiceW
shell32
ShellExecuteExW
SHGetFileInfoW
DragQueryFileW
DragFinish
ExtractIconW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHAppBarMessage
ShellExecuteW
SHAddToRecentDocs
SHBrowseForFolderW
SHGetMalloc
SHGetFolderPathW
comctl32
ImageList_Draw
InitCommonControlsEx
ImageList_AddMasked
shlwapi
PathFileExistsW
PathRemoveFileSpecW
PathIsUNCW
PathFindExtensionW
PathFindFileNameW
StrFormatKBSizeW
PathStripToRootW
uxtheme
GetCurrentThemeName
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
DrawThemeText
IsAppThemed
GetWindowTheme
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetThemeSysColor
ole32
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
IsAccelerator
CoCreateInstance
CLSIDFromString
CoUninitialize
CoCreateGuid
CoInitialize
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CLSIDFromProgID
GetClassFile
CoDisconnectObject
OleCreateStaticFromData
CreateFileMoniker
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
OleSetMenuDescriptor
OleFlushClipboard
OleIsCurrentClipboard
OleGetIconOfClass
OleLockRunning
OleSetContainedObject
OleSaveToStream
OleSave
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleDestroyMenuDescriptor
OleCreate
CreateItemMoniker
CreateGenericComposite
CreateILockBytesOnHGlobal
GetHGlobalFromILockBytes
WriteClassStm
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
OleRun
CreateStreamOnHGlobal
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
DoDragDrop
OleGetClipboard
CoInitializeEx
CoGetClassObject
CoRevokeClassObject
CoRegisterMessageFilter
OleCreateMenuDescriptor
OleTranslateAccelerator
oleaut32
SysFreeString
SysStringLen
SafeArrayDestroy
VariantInit
VariantCopy
VarBstrFromDate
LoadTypeLi
OleCreateFontIndirect
VariantTimeToSystemTime
VariantClear
SysAllocString
SystemTimeToVariantTime
VariantChangeType
SysAllocStringLen
oledlg
OleUIAddVerbMenuW
OleUIInsertObjectW
OleUIEditLinksW
OleUIConvertW
OleUIBusyW
gdiplus
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
oleacc
AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject
imm32
ImmReleaseContext
ImmGetOpenStatus
ImmGetContext
winmm
PlaySoundW
GetArphaApp
GetArphaCrashDump
GetArphaCrashReport
GetArphaJamDump
GetArphaService
GetArphaUtils
SSOLUIControlStartEngine
SetWindowLocalDump
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
440KB
Virtual Size
439KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.腾讯0
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=259, version=27412,
count=38, id=260, version=27412,
count=207, id=261, version=27412,
count=3, id=262, version=27412,
count=35, id=257, version=27412,
count=828, id=1, productName=Unmarked objects,
count=25, id=259, version=35721,
count=19, id=260, version=35721,
count=404, id=261, version=35721,
count=14, id=265, version=36257,
count=1, id=256, version=36257,
count=1, id=255, version=36257,
count=1, id=258, version=36257,
KBDMLT48.DLL
- SHA256 18092b68f4d009b7d9cd721ab10deb27216301e1b4b6cd324acf9beea2ce96f5
- MD5 0025cbb9f5559a57ceb0515ca13ce0bb
- SHA1 3bfecba64e48a6240b2dc92ec882b630fb920a9c
- SHA512 cc264feb59f91ed38dd8eded8f599757390bac6529486d9271a141dbdd2bfbd5a81249a85f1f926f6a5610fb96f69fa46863ac035983b7ee161bfac6238948ce
- SSDEEP 48:S3unweAAgynkYIoaZMVk1jvHRQzuXt8i1+zOkRI//l5zVUNc6szecRKx9QyZWNu1:HN1aZkkJv8Kbku/LyNcbaccHW3VWwYv
- TLSH T15AE12141DFF98639F1FFC73458A66A3E75297C1194F3CB6A0080115B186B5019F6AF3A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
wkbdmlt48.pdb
KbdLayerDescriptor
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=264, version=28900,
count=1, id=256, version=28900,
count=1, id=260, version=28900,
count=1, id=255, version=28900,
count=1, id=258, version=28900,
UTR_8718-9-2026.EXE
- IMPHASH 9206bd4a402561582018ceda38bf9057
- SHA256 b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2
- MD5 8521949e487368f1708d68ffcc581665
- SHA1 a2c753371ba79eb673ff4987d9044af9c7a1b89b
- SHA512 7722abb534f11dc71ac0797d881eb5c2dee524e19d99c219697efa1037164d92a23a5f098f76e5471f1bcfbcb05b44c497ba85f724267cb70591a448af4358ba
- SSDEEP 6144:UJgVV8K6VGrE8y3CtcKn6yv8zRkDVn5iJg:SGQ8y3CtcoRv6i
- TLSH T1CE247C1536D1CC72EAE3083564E8D676597DBA703FA649D7A384033D7E207C12F38A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
ea:50:13:7f:e4:7d:27:0d:23:23:86:d6:4b:0b:6c:35:3f:46:08:10:27:24:37:57:66:08:8d:64:c0:d6:f6:12
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91440106327556625Y,CN=广州宁静海信息科技有限公司,O=广州宁静海信息科技有限公司,STREET=天河区高普路38号624房（仅限办公）,L=广州市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094755414e475a484f55,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 25, 2022
SERIALNUMBER=91440106327556625Y,CN=广州宁静海信息科技有限公司,O=广州宁静海信息科技有限公司,STREET=天河区高普路38号624房（仅限办公）,L=广州市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094755414e475a484f55,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=91440106327556625Y,CN=广州宁静海信息科技有限公司,O=广州宁静海信息科技有限公司,STREET=天河区高普路38号624房（仅限办公）,L=广州市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094755414e475a484f55,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=91440106327556625Y,CN=广州宁静海信息科技有限公司,O=广州宁静海信息科技有限公司,STREET=天河区高普路38号624房（仅限办公）,L=广州市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094755414e475a484f55,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Digest
b9:46:97:c8:f8:6f:dc:67:4a:fe:a8:e1:eb:ea:d8:e4:a1:d9:b9:d9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91440106327556625Y,CN=广州宁静海信息科技有限公司,O=广州宁静海信息科技有限公司,STREET=天河区高普路38号624房（仅限办公）,L=广州市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094755414e475a484f55,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 25, 2022
SERIALNUMBER=91440106327556625Y,CN=广州宁静海信息科技有限公司,O=广州宁静海信息科技有限公司,STREET=天河区高普路38号624房（仅限办公）,L=广州市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094755414e475a484f55,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=91440106327556625Y,CN=广州宁静海信息科技有限公司,O=广州宁静海信息科技有限公司,STREET=天河区高普路38号624房（仅限办公）,L=广州市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094755414e475a484f55,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=91440106327556625Y,CN=广州宁静海信息科技有限公司,O=广州宁静海信息科技有限公司,STREET=天河区高普路38号624房（仅限办公）,L=广州市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094755414e475a484f55,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:15:4b:5a:c3:94
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 1, 1998 - Jan 28, 2028
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 27, 2021 - Jun 28, 2032
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=91440106327556625Y,CN=广州宁静海信息科技有限公司,O=广州宁静海信息科技有限公司,STREET=天河区高普路38号624房（仅限办公）,L=广州市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094755414e475a484f55,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
18:c0:f9:30:6b:46:48:7d:00:38:49:71
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 2, 2021 - Nov 3, 2022
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 27, 2021 - Jun 28, 2032
Minor OS version
1
Major OS version
5
Entry point
48583
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release\arphaCrashReport.exe.pdb
arphadump
SetWindowLocalDump
GetArphaCrashReport
GetArphaUtils
shlwapi
PathFileExistsW
PathStripPathW
PathRemoveFileSpecW
kernel32
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FindResourceExW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
HeapFree
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalFree
lstrcmpiW
GetPrivateProfileStringW
CreateFileW
GetFileAttributesExW
GetFileSize
ReadFile
CloseHandle
CreateProcessW
HeapReAlloc
HeapAlloc
GetProcAddress
HeapDestroy
GetLastError
RaiseException
DecodePointer
LCMapStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FlushFileBuffers
SetFilePointerEx
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
WriteConsoleW
IsDebuggerPresent
gdi32
CreateFontW
GetStockObject
advapi32
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
shell32
ExtractIconExW
ShellExecuteW
CommandLineToArgvW
ole32
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoTaskMemRealloc
oleaut32
VarUI4FromStr
user32
IsWindowVisible
ShowWindow
PostThreadMessageW
PostMessageW
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
GetWindowLongW
MapWindowPoints
GetWindowRect
GetClientRect
SetDlgItemTextW
GetDlgItem
EndDialog
SetWindowPos
SendMessageW
SetWindowLongW
CharNextW
CreateDialogParamW
DestroyWindow
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
UnregisterClassW
CheckDlgButton
IsDlgButtonChecked
GetActiveWindow
SetTimer
KillTimer
GetWindowThreadProcessId
LoadIconW
IsDialogMessageW
DialogBoxParamW
EnableWindow
SetWindowTextW
UpdateWindow
IsWindow
comctl32
InitCommonControlsEx
Name
.text
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=143, id=261, version=26213,
count=19, id=260, version=26706,
count=18, id=259, version=26706,
count=51, id=261, version=26706,
count=19, id=260, version=26213,
count=18, id=257, version=26213,
count=3, id=257, productName=VS2017 v15.9.11 build 27030, version=27030,
count=169, id=1, productName=Unmarked objects,
count=7, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
UTR_8718-9-2026.docx.lnk
- SHA256 d3d3929ef17a89a6da0579aae72a42a1041f28a653f9130025dadfb015fc67af
- MD5 6b2267e2d48993186cf772984ca25b80
- SHA1 6ff6215bb15481dc2b521d75cb8cec83ed2e210c
- SHA512 89ff93bd82350433522bfbf1260147c8a67eec710c1f865116fa95ad8eae0ca2a1cfc61932b46620927e313437d46fc847cc80892b917ae14311d5318e17526f
- TLSH T12FF0E62C8D547B21D250E175FC8EFA53F6721EC1EAE50F7204C146D9542F113B945F2A
- MD5 SHA1 SHA512 TLSH
bcrypt.dll
- IMPHASH b6a247bebbe359a2c85c40344e34ab03
- SHA256 f68419d8fd7f39c7fd9367505b5c8b4c562ed07f6e14b8dd9919f70b21a7017e
- MD5 52ec24eac47b68f5e982510d2e90159f
- SHA1 a009c03783c3ed5c71272917ffc1fc652152477e
- SHA512 f174fdf05c0ae2323cdb3f2a29676ea2acda8e0e99a029e2dc4dc102628b93a900c83a4f5f4c14d3e3a02621fed338aeb8eb4761e7981ce2640ec70659bdb4e9
- SSDEEP 1536:6fMKYvyCKlcTiDm/ky+1LmpX4npN7uuodEXyLwndCbd7mMcPN:6dYvZKqTiDmctSonpNSuSECwQd+l
- TLSH T1CA936D41B9D848B1EDE1217C21EEB67A677EA3A00B6066C7830467DFAC91BD15F3124F
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
6c:04:2a:9d:38:45:6f:8c:1d:ea:cb:46:4a:d2:c7:60:e9:81:b6:aa:fd:29:2c:ab:18:f3:bd:31:ec:66:2f:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 8, 2021
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:2264-E33E-780C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4a:a4:f7:31:c4:ff:22:a2:49:00:00:00:00:01:4a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
38416
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bcrypt.pdb
ntdll
RtlInitUnicodeString
NtClose
NtQueryValueKey
RtlAllocateHeap
NtQueryInformationProcess
RtlDeleteCriticalSection
RtlDeleteResource
RtlAcquireResourceShared
RtlReleaseResource
RtlEnterCriticalSection
RtlInitializeResource
RtlAcquireResourceExclusive
RtlInitializeCriticalSection
RtlLeaveCriticalSection
NtOpenKey
NtDeviceIoControlFile
NtOpenFile
RtlNtStatusToDosError
RtlCompareUnicodeString
_wcsicmp
RtlImageNtHeader
RtlUnwind
EtwTraceMessage
memcpy
RtlUnhandledExceptionFilter
NtTerminateProcess
EtwEventRegister
EtwEventUnregister
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
LdrDisableThreadCalloutsForDll
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwEventWrite
RtlFreeHeap
wcsncmp
_alloca_probe
memcmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
api-ms-win-core-processthreads-l1-1-0
SetThreadStackGuarantee
GetCurrentProcess
OpenProcessToken
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-1-0
PrivilegeCheck
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemDirectoryW
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
VirtualAlloc
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
BCryptAddContextFunction
BCryptAddContextFunctionProvider
BCryptCloseAlgorithmProvider
BCryptConfigureContext
BCryptConfigureContextFunction
BCryptCreateContext
BCryptCreateHash
BCryptCreateMultiHash
BCryptDecrypt
BCryptDeleteContext
BCryptDeriveKey
BCryptDeriveKeyCapi
BCryptDeriveKeyPBKDF2
BCryptDestroyHash
BCryptDestroyKey
BCryptDestroySecret
BCryptDuplicateHash
BCryptDuplicateKey
BCryptEncrypt
BCryptEnumAlgorithms
BCryptEnumContextFunctionProviders
BCryptEnumContextFunctions
BCryptEnumContexts
BCryptEnumProviders
BCryptEnumRegisteredProviders
BCryptExportKey
BCryptFinalizeKeyPair
BCryptFinishHash
BCryptFreeBuffer
BCryptGenRandom
BCryptGenerateKeyPair
BCryptGenerateSymmetricKey
BCryptGetFipsAlgorithmMode
BCryptGetProperty
BCryptHash
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptKeyDerivation
BCryptOpenAlgorithmProvider
BCryptProcessMultiOperations
BCryptQueryContextConfiguration
BCryptQueryContextFunctionConfiguration
BCryptQueryContextFunctionProperty
BCryptQueryProviderRegistration
BCryptRegisterConfigChangeNotify
BCryptRegisterProvider
BCryptRemoveContextFunction
BCryptRemoveContextFunctionProvider
BCryptResolveProviders
BCryptSecretAgreement
BCryptSetAuditingInterface
BCryptSetContextFunctionProperty
BCryptSetProperty
BCryptSignHash
BCryptUnregisterConfigChangeNotify
BCryptUnregisterProvider
BCryptVerifySignature
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=28900,
count=99, id=1, productName=Unmarked objects,
count=6, id=259, version=28900,
count=7, id=260, version=28900,
count=1, id=256, version=28900,
count=21, id=264, version=28900,
count=1, id=255, version=28900,
count=1, id=258, version=28900,
dpmodemx.dll
- IMPHASH e0bd3263fd5ea99b1d0c2f6f5194cc24
- SHA256 6472e68238639b56ee3e0251cb33fe49ff6bcc9baba4573d50c913660290be0f
- MD5 8e2eee594df35fbcbef1d0bd4739475f
- SHA1 5a9d68f3c2a7452946f763ec6c5e275436131a9b
- SHA512 4882748fd761976c65172f2e223c53f0d2c95f3ade8dce31ef7e23e168c5210944b9c101ab30eaf69cf4aaf4e45f518b6eb668c85102825de90e7cf0b1265cef
- SSDEEP 96:9hGZ64xoCcbQMcy9Emzshq/qHGUhaUls4EW5uWwdbaG:7G3RmQw0sqHGU8UlaW5uWiaG
- TLSH T12F02C55AF75446B9FAEE1BB854BE1A27113EB9200FE147D31951120E2CE59C1FC74722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
10
Entry point
5648
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
stub.pdb
msvcrt
_except_handler4_common
_XcptFilter
_initterm
malloc
free
_amsg_exit
kernel32
Sleep
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=28900,
count=13, id=260, version=28900,
count=20, id=1, productName=Unmarked objects,
count=5, id=257, version=28900,
count=1, id=256, version=28900,
count=2, id=264, version=28900,
count=1, id=255, version=28900,
count=1, id=258, version=28900,