7f8ece7c8d8bcaf95687ec76d31fde425d1a0f65230fda4fa26dfb02c9b2ad77

Sharing

Copy URL Twitter E-mail

General

Target
7f8ece7c8d8bcaf95687ec76d31fde425d1a0f65230fda4fa26dfb02c9b2ad77
Size 131KB
Sample261006-v5fe1aswhy
SHA256 7f8ece7c8d8bcaf95687ec76d31fde425d1a0f65230fda4fa26dfb02c9b2ad77
MD5 f9762b118192d1409e6653ff4e272562
SHA1 f7441e43001bf8550bf5cf59f367a707114bbc8a
SHA512 0c5809f4f91b4a9b7b673a65873ab25fdfc79b249a6e56b931d57e72c55cecbdf914caa8a72a4aae9e807bd35082590f284d84dbfc46e3708ea14a50873eac3a
SSDEEP 3072:cNRyNlP92cap1FZQz8zCHVxw8RTcjO8aduB5oHaqMvygFbY:wRyNlP92cap1FZQzPw8RTcTUu7o6dy6
TLSH
T17AD37C8AF0C368FCC95BC13886A35530962574A90738397F1B94AB3A3D7A950872EF75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7f8ece7c8d8bcaf95687ec76d31fde425d1a0f65230fda4fa26dfb02c9b2ad77

File Explorer

7f8ece7c8d8bcaf95687ec76d31fde425d1a0f65230fda4fa26dfb02c9b2ad77

.exe 131KB

7f8ece7c8d8bcaf95687ec76d31fde425d1a0f65230fda4fa26dfb02c9b2ad77

IMPHASH 18865d11af44e77e8b994f36fcfe5f5d
SHA256 7f8ece7c8d8bcaf95687ec76d31fde425d1a0f65230fda4fa26dfb02c9b2ad77
MD5 f9762b118192d1409e6653ff4e272562
SHA1 f7441e43001bf8550bf5cf59f367a707114bbc8a
SHA512 0c5809f4f91b4a9b7b673a65873ab25fdfc79b249a6e56b931d57e72c55cecbdf914caa8a72a4aae9e807bd35082590f284d84dbfc46e3708ea14a50873eac3a
SSDEEP 3072:cNRyNlP92cap1FZQz8zCHVxw8RTcjO8aduB5oHaqMvygFbY:wRyNlP92cap1FZQzPw8RTcTUu7o6dy6
TLSH
T17AD37C8AF0C368FCC95BC13886A35530962574A90738397F1B94AB3A3D7A950872EF75
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

AmIDebugged__76oader_1361 BlockETW__76oader_2889 CheckHardwareBreakPoints__76oader_1377 CreatedInterrupt__76oader_1405 CurrentAssembly__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZclr_20 Dl_1006632971_ Dl_1006632978_ Dl_1006632987_ Dl_1040196654_ Dl_1325402019_ Dl_1325402022_ Dl_1325402032_ Dl_1325402394_ Dl_1325402432_ Dl_1325402449_ Dl_1325403025_ Dl_1325403125_ Dl_1358959256_ Dl_1375732128_ Dl_1845493930_ Dl_1845493933_ Dl_1845493941_ Dl_1979711490_ Dl_2097164572_ Dl_2097164687_ Dl_2097164689_ Dl_2097165950_ Dl_2097166620_ Dl_436208173_ Dl_436208175_ Dl_452985005_ Dl_452986304_ Dl_452986340_ GetPPEB__76oader_331 GetSyscallStub__76oader_1001 Kernel32ThreadInitThunkFunction__76oader_1593 LPWSTRtoLowercase__76oader_266 MultiByteToWideChar__76oader_755 MyCloseHandle__76oader_751 MyCreateFileA__76oader_963 MyGetComputerNameExA__76oader_1437 MyGetCurrentProcessId__76oader_741 MyGetCurrentThreadId__76oader_753 MyGetDiskFreeSpaceExA__76oader_1439 MyGetFileSize__76oader_964 MyGetModuleHandleA__76oader_747 MyGetModuleHandleW__76oader_748 MyGetProcAddress__76oader_745 MyGetProcessHeap__76oader_744 MyGetThreadContext__76oader_749 MyGetTickCount__76oader_757 MyGlobalMemoryStatusEx__76oader_1438 MyLdrLoadDll__76oader_401 MyOpenProcess__76oader_742 MyOpenThread__76oader_752 MyReadFile__76oader_966 MyRtlAddVectoredExceptionHandler__76oader_746 MyRtlAllocateHeap__76oader_965 MyRtlInitUnicodeString__76oader_256 MySetThreadContext__76oader_750 MySleep__76oader_756 MyVirtualAllocEx__76oader_740 MyVirtualProtect__76oader_743 MyWaitForSingleObject__76oader_754 NTIarithmeticdefect__cT9c9bHlHSpA1QTnKbHjnIkA_ NTIarrayL48OO48_safearrayboundT__nKvO7wXZAsroXb0Wz9b7Rmw_ NTIarrayL48OO494957_uint5452T__wa4ExhM0I5D0wQQmyrXAHA_ NTIarrayL48OO5149_byteT__vEOa9c5qaE9ajWxR5R4zwfQg_ NTIbool__VaVACK0bpYmqIQ0mKcHfQQ_ NTIbyte__k3HXouOuhqAKq0dx450lXQ_ NTIcatchableerror__qrLSDoe2oBoAqNtJ9badtnA_ NTIchar__nmiMWKVIe46vacnhAFrQvw_ NTIcstring__S9agCYBinaYZnGWcjTdxclg_ NTIcy95struct49__ROud78kqeHjXYisn4jhtaw_ NTIcy__wDff8zKdhpvos9c7lBHUPSQ_ NTIdecimal95union4995struct49__79a7mES62JQ1oSE6vhkv3Mg_ NTIdecimal95union49__WGoXHqhEWH1qpRGdTEgBIQ_ NTIdecimal95union5095struct49__ndD9aJVbTCK7WcNNlcFDdRQ_ NTIdecimal95union50__AHLY3ntS3ifZxbjvCnrSYw_ NTIdecimal__7lwbcpbVYQOsyXq5rL9casA_ NTIdefect__LbeSGvgPzGzXnW9caIkJqMA_ NTIdouble__w9bl9a1ul9ctRJWiMl9cNnIMvg_ NTIecb__FqrsHsObEDvZPY9aUEY69aCA_ NTIexception__XEycrCsme5C8CVWAYEcdBQ_ NTIfloat__C875xFvYpI7aGybrDGHIaQ_ NTIidispatch__25afB9aQxduZVFt1Yu6YBbw_ NTIidispatchvtbl__m6cgE8u5k2W48yvpP0M9cVg_ NTIint__rR5Bzr1D5krxoo1NcNyeMA_ NTIint__xHTZrq9aYs6boc9bCba0JbpQ_ NTIioerror__iLZrPn9anoh9ad1MmO0RczFw_ NTIirecordinfo__o7mu6JCMnDiOC4fiz5Cxtw_ NTIirecordinfovtbl__Rtoycx0FzRmTEejgGZss8w_ NTIiunknown__GaCOTm3fAeQng3LkqGK9cpw_ NTIiunknownvtbl__jF4R4hWZYkQD9a5uVek42vg_ NTIkeyvaluepair__2wauyaneUIEXFZnckdv0OQ_ NTIkeyvaluepairseq__QyuekR9bgDQj4oxD9cw0z4fw_ NTIlong__sVg18TP9cLifHyygRe9cro9aA_ NTIlonglong__Aav8dQoMlCFnZRxA0IhTHQ_ NTIobject__bgqUsBxgItehc5QiMv6WmA_ NTIoserror__BeJgrOdDsczOwEWOZbRfKA_ NTIoverflowdefect__9cxMi1BPLc3UKt9br86bGfGQ_ NTIprocLself58ptridispatch_dispidmember58dispid_riid58refiid_lcid58lcid_wflags58word_pdispparams58ptrdispparams_pvarresult58ptrvariant_pexcepinfo58ptrexcepinfo_puargerr58ptruintT58hresultLOstdcallOT__HMTIlg0ibX9c3DUxZWiFDlg_ NTIprocLself58ptridispatch_itinfo58uint_lcid58lcid_pptinfo58ptrptritypeinfoT58hresultLOstdcallOT__PJRj0uRX50rVBId5wxoWWg_ NTIprocLself58ptridispatch_pctinfo58ptruintT58hresultLOstdcallOT__zezkKyqfMpGrdLXfsTMoKg_ NTIprocLself58ptridispatch_riid58refiid_rgsznames58ptrlpolestr_cnames58uint_lcid58lcid_rgdispid58ptrdispidT58hresultLOstdcallOT__vTmQiiZaMJLP5PVxP1nC6g_ NTIprocLself58ptrirecordinfoT58pvoidLOstdcallOT__tl4K6HbRH9akfWlpgfxzhhQ_ NTIprocLself58ptrirecordinfo_pbstrname58ptrbstrT58hresultLOstdcallOT__CiNRVOLKE0o4du7TW0veXA_ NTIprocLself58ptrirecordinfo_pcbsize58ptrulongT58hresultLOstdcallOT__9bUQLlQzyTYq9cn1PPQoncWg_ NTIprocLself58ptrirecordinfo_pcnames58ptrulong_rgbstrnames58ptrbstrT58hresultLOstdcallOT__3flVhatAuo2wDQ3pLqPtWw_ NTIprocLself58ptrirecordinfo_pguid58ptrguidT58hresultLOstdcallOT__szvo7XZUqIEvn15njypZnQ_ NTIprocLself58ptrirecordinfo_pptypeinfo58ptrptritypeinfoT58hresultLOstdcallOT__lgbxIcoFlqaRoc8l1J5x6A_ NTIprocLself58ptrirecordinfo_precordinfo58ptrirecordinfoT58winboolLOstdcallOT__UrLfbkx3jYpl8aTT7EGhew_ NTIprocLself58ptrirecordinfo_pvdata58pvoid_szfieldname58lpcolestr_pvarfield58ptrvariantT58hresultLOstdcallOT__a8wuVcgf8JFBdtyIlUvAGg_ NTIprocLself58ptrirecordinfo_pvdata58pvoid_szfieldname58lpcolestr_pvarfield58ptrvariant_ppvdatacarray58ptrpvoidT58hresultLOstdcallOT__V5FpwH0D4atxA49a8FYaWEg_ NTIprocLself58ptrirecordinfo_pvexisting58pvoid_pvnew58pvoidT58hresultLOstdcallOT__ZI1jobj8DmvwFnbiO6qPCg_ NTIprocLself58ptrirecordinfo_pvnew58pvoidT58hresultLOstdcallOT__79cx3unW0Z6BgDnOrcHfitQ_ NTIprocLself58ptrirecordinfo_pvsource58pvoid_ppvdest58ptrpvoidT58hresultLOstdcallOT__ymDIUs9akB6qYPB24WgIOaQ_ NTIprocLself58ptrirecordinfo_wflags58ulong_pvdata58pvoid_szfieldname58lpcolestr_pvarfield58ptrvariantT58hresultLOstdcallOT__LKhTenaIJkf6RxVNrDi3BA_ NTIprocLself58ptriunknownT58ulongLOstdcallOT__3MBg39aXrFJCcyBWUf6B79aQ_ NTIprocLself58ptriunknown_riid58refiid_ppvobject58ptrpointerT58hresultLOstdcallOT__9bWBI5aELdW2XHTbyYNjFXQ_ NTIptrbstr__Pdw3MEiEie9cIIBXdRF4aZg_ NTIptrbyte__cG1a2XAxsP28AUq2q9aXnNg_ NTIptrchar__9b60r3P3z08159cCfYvgtoSg_ NTIptrcy__jXbtSxLfw0itmjWsMdWfNw_ NTIptrdecimal__tOyFM5VpR5CfoueNblK2NQ_ NTIptrdouble__dHulNBWhJTS79cd5h9cp4OHg_ NTIptrfloat__K9c5mNCKsxyPa9bhQF1Un42w_ NTIptridispatch__kYuJ1yXKaTDKM1gBNBYZMA_ NTIptridispatchvtbl__D2nH2Oqivmr8QTsU9aLjsOQ_ NTIptrirecordinfo__3WT32ZAg6wsc9ay7tyclJnQ_ NTIptrirecordinfovtbl__7VzmdWawVAQPByb1qFKRtA_ NTIptriunknown__UyU8VSOcMgg7fdJy7SxeGw_ NTIptriunknownvtbl__RE27JCE9bOJX1xy12IDcHnA_ NTIptrlong__9awHbpuyuG8AxbsaqeBLKDQ_ NTIptrlonglong__qTZjETMuYhaATb9arhin3WA_ NTIptrolechar__9arplNu1iE9bhlDxcL6A4PMw_ NTIptrptridispatch__9cAC89c2ntOozT6m3udvMQRQ_ NTIptrptriunknown__8MnBU5BrvTao0wsQ9alw3AQ_ NTIptrptrsafearray__SD30oco7TmqisM1c9brwQSg_ NTIptrsafearray__DTydpwcrqtIWM70d0MgBsw_ NTIptrshort__BjHmAJOH9agj4KRxOkanazQ_ NTIptrvariant__k5zDQ9aqJXQRCQNlOgs85Ow_ NTIpvoid__vr5DoT1jILTGdRlYv1OYpw_ NTIrefexception__vU9aO9cTqOMn6CBzhV8rX7Sw_ NTIrefioerror__HMIVdYjdZYWskTmTQVo5BQ_ NTIrefobject__9bPJdGN9a1246RoUed9bXT9bSw_ NTIrefoserror__9clYsYwyjCqe2PFTuCI3Ubg_ NTIrefoverflowdefect__r8GBEWywN07B3Rat3azS4Q_ NTIrefreraisedefect__uG62cfJZ15c2siK3CKLmnQ_ NTIrefvariantconversionerror__sSrF5S0WQBiSGAvsVyZTJQ_ NTIreraisedefect__E0L0wGYS1gPD81VLstNO2g_ NTIrijndaelcontext__uzMEyYcUmtQ6HTVQxlfmCQ_ NTIrootobj__ytyiCJqK439aF9cIibuRVpAg_ NTIsafearray__DKskJgJKqdiGvU7qvx1u8A_ NTIsafearraybound__MAW7pPwMg9cUv0ZH0AE2pzQ_ NTIseqLbyteT__6H5Oh5UUvVCLiakt9aTwtUQ_ NTIseqLstackzeqxbentryT__uB9b75OUPRENsBAu4AnoePA_ NTIseqLutf4954charT__9aKpvUh0ca6Bp9cKAwrowqUg_ NTIseqLvariantT__3a0Lf6u9aPn9bq0V0eQ07mtw_ NTIshort__kDPg4wXyR8DDyA0MeEjIsw_ NTIstackzeqxbentry__oLyohQ7O2XOvGnflOss8EA_ NTIstring__77mFvmsOLKik79ci2hXkHEg_ NTItable__MyiXBZqHlwtVNEEvYnEmjg_ NTItableref__mmbDGmie1Vw3nGJ9cRqQG7w_ NTIuint5452__wMtfD88jmrPZwfzTH9c8e9cA_ NTIuncheckedarrayLutf4954charT__Tyd4y3haUOOHTj71TPIRag_ NTIvalueerror__yoNlBGx0D2tRizIdhQuENw_ NTIvariant58objecttype__FBSF3pWyJz9clqwLRXzZTsA_ NTIvariant95union4995struct4995union4995struct49__DtI9bsEAgJB3Tyh5MHrgkrw_ NTIvariant95union4995struct4995union49__DjJ9a9aNjdVJoA2NlSK7Lz7Q_ NTIvariant95union4995struct49__c8Wtv5nqLcM2jwvHc9cTY9bg_ NTIvariant95union49__Sr5LLwiwjGCKhbDlb25pAQ_ NTIvariant__UPxdF8T9b3GRPNZqBCwEDkw_ NTIvariant__VYnrN9cMJav8fTNB7Pu9bPZw_ NTIvariantconversionerror__Y4pKacDNXcA9boOh7ryibHg_ NTIvartype__M4na42GvebBMnI5wV9cYMxg_ NTIwidecstringobj__4HwedE75WPfqZSQ0Cq2OUg_ NaturalToInt32__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZwinstr_49 NimMain NimMainInner NimMainModule NtAllocateVirtualMemory__76oader_795 NtClose__76oader_778 NtCreateSection__76oader_876 NtCreateThreadEx__76oader_810 NtFreeVirtualMemory__76oader_914 NtMapViewOfSection__76oader_901 NtProtectVirtualMemory__76oader_857 NtReadVirtualMemory__76oader_929 NtWriteVirtualMemory__76oader_842 Null__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZclr_18 OpenMoreMaxPIDProcess__76oader_1512 PreMain PreMainInner RVAtoRawOffset__76oader_967 Rcon__OOZOOZOojhbleZpkgsZojhcrypto4548O54O50ZojhcryptoZrijndael_6 SYSCALL_STUB_SIZE__76oader_771 SinkVtbl__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_7122 Sink_AddRef__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_7021 Sink_GetIDsOfNames__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_7048 Sink_GetTypeInfoCount__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_7037 Sink_GetTypeInfo__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_7041 Sink_Invoke__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_7057 Sink_QueryInterface__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_7003 Sink_Release__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_7029 UNICODEminusgtstring___OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZwinstr_191 UTF8minusgtwstring___OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZwinstr_120 VEHHandler__76oader_1402 WSAID_ACCEPTEX__windowsZwinlean_713 WSAID_CONNECTEX__windowsZwinlean_712 WSAID_GETACCEPTEXSOCKADDRS__windowsZwinlean_714 Wait__76oader_2896 X5BX5D___76oader_1042 X5BX5D___76oader_1711 X5BX5D___76oader_26 X5BX5D___76oader_980 X5BX5Deq___76oader_39 X5BX5Deq___OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_2028 X5BX5Deq___OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_2127 accelerated_sleep__76oader_1468 addChar addChunkToMatrix__system_3955 addHeapLink__system_4048 addInt__stdZprivateZdigitsutils_164 addInt__stdZprivateZdigitsutils_167 addQuoted__pureZos_541 add__system_2308 add__system_4154 align__system_1624 alloc0Impl__system_1745 alloc0__system_4776 allocAvlNode__system_4023 allocImpl__system_1743 alloc__system_4772 allocator__system_4871 amp___76oader_1663 at___76oader_113 atmLoaderdotojh_DatInit000 atmdotdotatsdotdotatsdotojhbleatspkgsatsojhcryptominus0dot6dot2atsojhcryptoatsrijndaeldotojh_DatInit000 atmdotdotatsdotdotatsdotojhbleatspkgsatsugoodminus3dot9dot4atsugoodatsclrdotojh_DatInit000 atmdotdotatsdotdotatsdotojhbleatspkgsatsugoodminus3dot9dot4atsugoodatsclrdotojh_Init000 atmdotdotatsdotdotatsdotojhbleatspkgsatsugoodminus3dot9dot4atsugoodatscomdotojh_DatInit000 atmdotdotatsdotdotatsdotojhbleatspkgsatsugoodminus3dot9dot4atsugoodatscomdotojh_Init000 atmdotdotatsdotdotatsdotojhbleatspkgsatsugoodminus3dot9dot4atsugoodatsincatsobjbasedotojh_DatInit000 atmdotdotatsdotdotatsdotojhbleatspkgsatsugoodminus3dot9dot4atsugoodatsincatswinbasedotojh_DatInit000 atmdotdotatsdotdotatsdotojhbleatspkgsatsugoodminus3dot9dot4atsugoodatsincatswincondotojh_DatInit000 atmdotdotatsdotdotatsdotojhbleatspkgsatsugoodminus3dot9dot4atsugoodatsincatswindefdotojh_DatInit000 atmdotdotatsdotdotatsdotojhbleatspkgsatsugoodminus3dot9dot4atsugoodatsincatswinuserdotojh_DatInit000 atmdotdotatsdotdotatsdotojhbleatspkgsatsugoodminus3dot9dot4atsugoodatswinstrdotojh_DatInit000 atmdotdotatsojhminus1dot6dot8atslibatsstdatsprivateatswin_setenvdotojh_DatInit000 atmdotdotatsojhminus1dot6dot8atslibatssystematsiodotojh_DatInit000 atmdotdotatsojhminus1dot6dot8atslibatssystematsiodotojh_Init000 atmdotdotatsojhminus1dot6dot8atslibatssystematswidestrsdotojh_DatInit000 atmdotdotatsojhminus1dot6dot8atslibatssystemdotojh_DatInit000 atmdotdotatsojhminus1dot6dot8atslibatswindowsatswinleandotojh_DatInit000 atmdotdotatsojhminus1dot6dot8atslibatswindowsatswinleandotojh_Init000 billionIncrements__76oader_1497 burnMem__OOZOOZOojhbleZpkgsZojhcrypto4548O54O50ZojhcryptoZutils_316 c_longjmp__systemZansi95c_39 calcHard__76oader_132 calcSomething__76oader_315 calcTheThings__76oader_60 cfgspawn__76oader_183 cmdCount cmdLine comTrace__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_76 contains__pureZstrutils_1631 contains__system_4230 copyString cstrToNimstr currException__system_2558 dataPointer__system_5290 dbezppajmykrqtexlgltc__76oader_350 dealloc deallocImpl__system_1747 dealloc__system_4780 decryptLate__76oader_1645 decrypt__76oader_2241 decrypt__76oader_2400 dectext__76oader_201 del__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_1057 del__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_212 del__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_310 del__system_4163 digits100__stdZprivateZdigitsutils_2 dollar___pureZos_521 dollar___systemZdollars_3 dollar___systemZwidestrs_260 dollar___systemZwidestrs_324 dollar___system_2715 echoBinSafe eltsqolwqapmtcnp__76oader_506 enctext__76oader_189 enlarge__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_2453 envkey2__76oader_185 envkey__76oader_184 eqdestroy___OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_167 eqdestroy___systemZassertions_23 errorMessageWriter__system_2518 excHandler__system_2557 excl__system_4283 fill__pureZstrutils_1405 find_syscall_address__76oader_971 fn__76oader_1594 framePtr__system_2556 freeBigChunk__system_4491 freeHugeChunk__system_4531 free__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_18 fsLookupTable__system_3823 gEnv gSystemRng__OOZOOZOojhbleZpkgsZojhcrypto4548O54O50ZojhcryptoZsysrand_56 g_ntTraceEventBufferPtr__76oader_1580 gcFramePtr__system_2559 getBigChunk__system_4512 getBottom__system_4007 getHugeChunk__system_4527 getSmallChunk__system_4535 get_function_address__76oader_309 get_library_address__76oader_306 globalRaiseHook__system_2291 hresult__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZclr_19 hresult__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_80 hwnd__76oader_1440 incl__system_4261 incrSeqV3 inet_ntop_real__windowsZwinlean_803 initTable__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_1947 init__76oader_1798 intSetGet__system_4191 intSetPut__system_4213 iobcpcejakw__76oader_1416 isHeapGrowable__76oader_1365 isInitialized__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_81 isObj isOpenArrayStringable__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZwinstr_559 is_dll__76oader_369 keySchedule__76oader_1879 kkeilvxcjbylnenqtxff__76oader_400 llAlloc__system_3981 loadLib__pureZdynlib_3 localInstance__pureZtimes_1453 localRaiseHook__system_2294 lstrcmpiW__76oader_282 main main__76oader_1620 manualStrStrIA__76oader_489 minus___76oader_551 mnewString moveMemory__76oader_15 newOSError__pureZos_445 newObj newObjNoInit__system_4835 newSeq newSeq__OOZOOZOojhbleZpkgsZojhcrypto4548O54O50ZojhcryptoZutils_268 newSeq__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_7078 newSeq__stdZprivateZwin95setenv_36 newTable__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_1913 newVariant__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_3284 newWString__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZwinstr_66 newWideCString__systemZwidestrs_231 newWideCString__systemZwidestrs_257 nextPowerOfTwo__pureZmath_171 ojhGetProcAddr ojhLeaveFinally ojhLoadLibrary ojhLoadLibraryError ojh_program_result nsuFindChar nsuFindStr nsuFindStrA nsuInitSkipTable nsuToLowerAsciiChar officeFileCheck__76oader_1474 onUnhandledException__system_2743 ord__systemZwidestrs_8 ortho__OOZOOZOojhbleZpkgsZojhcrypto4548O54O50ZojhcryptoZrijndael_152 osErrorMsg__pureZos_419 osLastError__pureZos_474 outOfMemHook__system_2296 ownArgv__pureZos_1592 ownParsedArgv__pureZos_1593 plus___76oader_157 plus___76oader_31 plus___76oader_534 plus___76oader_985 pluseq___76oader_274 procAddrError ptrDecText__76oader_187 ptrEncText__76oader_186 putEnv__pureZos_491 pwndem__76oader_2949 raiseEIO__systemZio_96 raiseExceptionAux__system_2858 raiseExceptionEx raiseOSError__pureZos_471 raiseOutOfMem__system_3696 raiseOverflow rawAlloc__system_4556 rawDealloc__system_4685 rawInsert__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_2761 rawNewString rawNewStringNoInit removeChunkFromMatrix2__system_3946 removeChunkFromMatrix__system_3916 reportUnhandledErrorAux__system_2744 reportUnhandledError__system_2847 requestOsChunks__system_4435 reraiseException resizeString setEnvImpl__stdZprivateZwin95setenv_17 setLengthStr showErrorMessage__system_2528 skew__system_4144 splitChunk2__system_4481 splitChunk__system_4486 split__system_4147 strDesc__system_2403 subWord__OOZOOZOojhbleZpkgsZojhcrypto4548O54O50ZojhcryptoZrijndael_411 symAddr__pureZdynlib_30 thisisStrange__ojhstrenc_4 toHex__pureZstrutils_737 toNimStr toString__76oader_48 typeDesc__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_1880 typeStr__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_1884 ufqcwhkgtvpemnvuftf__76oader_1514 unhandledExceptionHook__system_2299 utcInstance__pureZtimes_1452 varTrace__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_79 vcErrorMsg__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZcom_1887 versionInfo__76oader_182 vezagjqnabklklotbwjykgzt__76oader_347 ugoodConverterBOOLToBoolean__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZutils_5 ugoodConverterBooleanToBOOL__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZutils_2 ugoodConverterITypeInfoToIUnknown__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZincZobjbase_27567 winstrConverterBSTRToLPWSTR__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZwinstr_663 winstrConverterCStringToPtrChar__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZwinstr_669 winstrConverterStringToLPWSTR__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZwinstr_700 winstrConverterStringToPtrChar__OOZOOZOojhbleZpkgsZugood4551O57O52ZugoodZwinstr_666 writeToStdErr__system_2523 writeWindows__systemZio_205 ws2__windowsZwinlean_804 ws2k12__76oader_169 wvncxkpedroikrmfuyxal__76oader_374

Name

.text

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

7f8ece7c8d8bcaf95687ec76d31fde425d1a0f65230fda4fa26dfb02c9b2ad77

kernel32

msvcrt

generic