jaffacakes118_samples.part016.rar
- SHA256 29f4c74eaccdba73d514a3bd227f9fa4b4db86f661defc047bf7609704418ab0
Overview
overview
10Static
static
1000270d016c...bd.dll
windows10-2004-x64
1000270d016c...bd.dll
windows11-ltsc_2024-x64
100225a30270...24.exe
windows10-2004-x64
30225a30270...24.exe
windows11-ltsc_2024-x64
3125f75320c...3c.exe
windows10-2004-x64
10125f75320c...3c.exe
windows11-ltsc_2024-x64
3133e003cc5...22.elf
ubuntu-18.04-amd64
3134de049f7...93.msi
windows10-2004-x64
10134de049f7...93.msi
windows11-ltsc_2024-x64
9148c2d55d3...57.exe
windows10-2004-x64
10148c2d55d3...57.exe
windows11-ltsc_2024-x64
10151e21dde7...80.msi
windows10-2004-x64
10151e21dde7...80.msi
windows11-ltsc_2024-x64
9158ca8d131...c7.exe
windows10-2004-x64
9158ca8d131...c7.exe
windows11-ltsc_2024-x64
7160dd5158f...f6.exe
windows10-2004-x64
10160dd5158f...f6.exe
windows11-ltsc_2024-x64
1166f41385b...f3.exe
windows10-2004-x64
10166f41385b...f3.exe
windows11-ltsc_2024-x64
7188b2408a0...99.exe
windows10-2004-x64
10188b2408a0...99.exe
windows11-ltsc_2024-x64
10195cdde8bc...d3.exe
windows10-2004-x64
3195cdde8bc...d3.exe
windows11-ltsc_2024-x64
3213d6a4c5a...59.exe
windows10-2004-x64
10213d6a4c5a...59.exe
windows11-ltsc_2024-x64
10227aff885f...0c.exe
windows10-2004-x64
10227aff885f...0c.exe
windows11-ltsc_2024-x64
10231bba5652...e9.exe
windows10-2004-x64
10231bba5652...e9.exe
windows11-ltsc_2024-x64
10244ed096d2...6d.elf
ubuntu-18.04-amd64
3259f9ec106...c4.exe
windows10-2004-x64
1259f9ec106...c4.exe
windows11-ltsc_2024-x64
1Static task
static1
39 signatures
Behavioral task
behavioral1
Sample
00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
125f75320c80d5b4d73c000058f26e92207d28a3d7d88551041f7a62f2a59e3c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
125f75320c80d5b4d73c000058f26e92207d28a3d7d88551041f7a62f2a59e3c.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
133e003cc510e3d2d0c7df70a603448605641256c88ce64a3bcabb762295d622.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
134de049f7ef48728b0a126b5f440494817d577c3fbdb92792afa15ae08f1393.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral9
Sample
134de049f7ef48728b0a126b5f440494817d577c3fbdb92792afa15ae08f1393.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
Behavioral task
behavioral10
Sample
148c2d55d317029444578d478aeedcc834cffa4db695702adc8add568b517557.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral11
Sample
148c2d55d317029444578d478aeedcc834cffa4db695702adc8add568b517557.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral12
Sample
151e21dde7bb3ce31c04e25638e7513f83e19cbd0a7549a574d97339c9486f80.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral13
Sample
151e21dde7bb3ce31c04e25638e7513f83e19cbd0a7549a574d97339c9486f80.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral14
Sample
158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral15
Sample
158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral16
Sample
160dd5158fa00a537fee81df13e8bc4eb14a464806aa3bb3e252a7c435dfcff6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral17
Sample
160dd5158fa00a537fee81df13e8bc4eb14a464806aa3bb3e252a7c435dfcff6.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral19
Sample
166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral20
Sample
188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral21
Sample
188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral22
Sample
195cdde8bc2a98f3583f9647171a5b47d9f577f4ffd5805bb3367b012f3428d3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
195cdde8bc2a98f3583f9647171a5b47d9f577f4ffd5805bb3367b012f3428d3.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral25
Sample
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
227aff885f792fe1bcc142a13b7148482ad8c576fd75e0d92abedb0c7cdc520c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral27
Sample
227aff885f792fe1bcc142a13b7148482ad8c576fd75e0d92abedb0c7cdc520c.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
231bba5652f6fbdbab3016362fb7925fc4e4489fff5e6a4a98c37fba5bd0cfe9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral29
Sample
231bba5652f6fbdbab3016362fb7925fc4e4489fff5e6a4a98c37fba5bd0cfe9.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
Behavioral task
behavioral30
Sample
244ed096d26ae952b472dfbfbd27c6eed8db08e02ba6b5239236ef4d5a977e6d.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
259f9ec10642442667a40bf78f03af2fc6d653443cce7062636eb750331657c4.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
259f9ec10642442667a40bf78f03af2fc6d653443cce7062636eb750331657c4.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target jaffacakes118_samples.part016.rar
- Size 15.0MB
- Sample261011-v21a1ax18l
- SHA256 29f4c74eaccdba73d514a3bd227f9fa4b4db86f661defc047bf7609704418ab0
- MD5 214d4cedf3736dba9a07180b49647d1d
- SHA1 30dbc3ccc094841291bba8cf528e1302ab1e6494
- SHA512 4db8258bb535aaa04687f3029cfc4ed2662a118f9184d43aa8d953cf6dd40e9cc28451e39cbc7bcc78132a52976822d0b1aeddb7e3a6dc1852cadd4242761238
- SSDEEP 393216:dnAlaI7GszqxXW58JM1B6PEQ9TUzf0hePIg8R0212LjzxBhqhiMu8+:dTkd8OP6EGTUzf0gl8R0212/zH4hb
- TLSH T127F633E5BEDE4057DADB81D23225B26F3DD38B3838C7E5A1E10616977F5A08C059838B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
sussysdfffdfff343.duckdns.org:1604
Mutex
-
DC_MUTEX-DXHFDUX
Attributes
-
gencode
iwGlEqUj3Ymx
-
install
false
-
offline_keylogger
true
-
persistence
false
rc4.plain
Extracted
Family
-
limerat
Wallets
-
False
Attributes
-
aes_key
666
-
antivm
true
-
c2_url
https://pastebin.com/raw/pJAz8H7W
-
download_payload
true
-
install
true
-
install_name
explorer.exe
-
main_folder
False
-
payload_url
True
-
pin_spread
true
-
sub_folder
False
-
usb_spread
true
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
92.138.188.75:7006
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
true
-
install_file
anydesk.exe
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
shinolocker
C2
-
https://shinolocker.com/
Attributes
-
command
powershell /c "echo '$$$$$$Offensive Test Ransomware$$$$$$'>of.txt;notepad of.txt;vssadmin delete shadows /all /quiet"
-
extension
.shino
-
extensions
bmp jpg jpeg png wmv avi mov mp4 mp3 wav ppt pptx doc docx xls xlsx docx
-
registry_key
Software\ShinoLocker
-
useragent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Signatures
- Family: BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
- Family: Chaos
Ransomware family first seen in June 2021.
- Family: ChupaCabra
ChupaCabra is a Windows ransomware written in C#.
- Family: Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
- Family: LegionLocker
Ransomware family active in 2021.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Family: MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
- Family: Makop
Ransomware family discovered by @VK_Intel in early 2020.
- Family: NoCry
NoCry is a Windows ransomware written in C#.
- Family: NominatusCrypto,NominatusStorm
NominatusCrypto aka NominatusStorm is a ransomware written in C#.
- Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
- Family: Shinolocker
Shinolocker is a ransomware simulator written in Visual Basic.
- Family: Vohuk
Vohuk is a Windows Ransomware.
- Family: Xorist Ransomware
Xorist is a ransomware first seen in 2020.
- Family: eCh0raix, QNAPCrypt
Ransomware targeting network-attached storage devices.
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe family_asyncrat - Chaos Ransomware 2 IoCs
resource yara_rule static1/unpack001/148c2d55d317029444578d478aeedcc834cffa4db695702adc8add568b517557.exe family_chaos static1/unpack001/318bf82fc655bfe553770702b1ba9c9a7cb69bb61f50832bd006718263428784.exe family_chaos - Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/297dbbb1daca4b23893b034ab20b8afd0de7664705f064dbbc7fd1d217b5fae0.exe disable_win_def - Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule static1/unpack001/416d2f821b7cb984859cfce43be981c5c9bc1489446ba41951c041d5801b65cb.exe family_mafiaware666 - Detected LegionLocker ransomware 1 IoCs
Sample contains strings associated with the LegionLocker family.
resource yara_rule static1/unpack001/188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe family_legionlocker - Detected Xorist Ransomware 2 IoCs
resource yara_rule static1/unpack001/280a75ca5ca5dc8e106f6f6e2005fe3e23b6c35e296d5639b00b5b6daba8c38e.exe family_xorist static1/unpack001/319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe family_xorist - Detects ChupaCabra ransomware 1 IoCs
resource yara_rule static1/unpack001/213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.exe family_chupacabra - Detects NoCry ransomware 1 IoCs
resource yara_rule static1/unpack001/421af5adde9ca3fd3312067c0a113faaef07a88241df3ed1538d96145aab4303.exe family_nocry - Detects NominatusCrypto C# variant 2 IoCs
resource yara_rule static1/unpack001/227aff885f792fe1bcc142a13b7148482ad8c576fd75e0d92abedb0c7cdc520c.exe family_nominatuscrypto_dotnet static1/unpack001/499e1eddf39a47eb3392be7e0cbd906f15e22bf9cb10c55dbd34f433772c0f8d.exe family_nominatuscrypto_dotnet - Detects NominatusCrypto DOS executable variant 2 IoCs
resource yara_rule static1/unpack001/227aff885f792fe1bcc142a13b7148482ad8c576fd75e0d92abedb0c7cdc520c.exe family_nominatuscrypto_dos static1/unpack001/499e1eddf39a47eb3392be7e0cbd906f15e22bf9cb10c55dbd34f433772c0f8d.exe family_nominatuscrypto_dos - Detects Seven ransomware 2 IoCs
resource yara_rule static1/unpack001/372e52a5af110f0e11e678829db332d6e831dfa0e13efa967bfec324822459de.exe family_seven static1/unpack001/432c917a2ef72aaa140ae8a79112fb80806d2740a465201e1298c1ed40040eb9.exe family_seven - Detects Vohuk Ransomware 1 IoCs
resource yara_rule static1/unpack001/339a6e6e891d5bb8f19a01f948c352216e44656e46f3ee462319371fd98b3369.exe family_vohuk - GandCrab payload 1 IoCs
resource yara_rule static1/unpack001/195cdde8bc2a98f3583f9647171a5b47d9f577f4ffd5805bb3367b012f3428d3.exe family_gandcrab - MAKOP ransomware payload 1 IoCs
resource yara_rule static1/unpack001/267f4251888e56ee84029a34e56fcceb63940f75fa563b20e1a7267806049a97.exe family_makop - Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule static1/unpack001/391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5.exe family_lockbit - eCh0raix ransomware 1 IoCs
resource yara_rule static1/unpack001/244ed096d26ae952b472dfbfbd27c6eed8db08e02ba6b5239236ef4d5a977e6d.elf family_ech0raix - Codesign digest Mismatch 2 IoCs
File was altered after it was signed.
resource unpack001/00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd.exe unpack001/350ba7fca67721c74385faff083914ecdd66ef107a765dfb7ac08b38d5c9c0bd.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/358a95605a125c9df231ad94e95e455709785b5f22e36b1324a128e205dfb699.exe ConfuserEx -
resource yara_rule static1/unpack001/280a75ca5ca5dc8e106f6f6e2005fe3e23b6c35e296d5639b00b5b6daba8c38e.exe upx static1/unpack001/372e52a5af110f0e11e678829db332d6e831dfa0e13efa967bfec324822459de.exe upx static1/unpack001/432c917a2ef72aaa140ae8a79112fb80806d2740a465201e1298c1ed40040eb9.exe upx - Unsigned PE 32 IoCs
Checks for missing Authenticode signature.
resource unpack001/0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.exe unpack001/125f75320c80d5b4d73c000058f26e92207d28a3d7d88551041f7a62f2a59e3c.exe unpack001/148c2d55d317029444578d478aeedcc834cffa4db695702adc8add568b517557.exe unpack001/158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe unpack001/160dd5158fa00a537fee81df13e8bc4eb14a464806aa3bb3e252a7c435dfcff6.exe unpack001/166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3.exe unpack001/188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe unpack001/195cdde8bc2a98f3583f9647171a5b47d9f577f4ffd5805bb3367b012f3428d3.exe unpack001/213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.exe unpack001/227aff885f792fe1bcc142a13b7148482ad8c576fd75e0d92abedb0c7cdc520c.exe unpack001/231bba5652f6fbdbab3016362fb7925fc4e4489fff5e6a4a98c37fba5bd0cfe9.exe unpack001/259f9ec10642442667a40bf78f03af2fc6d653443cce7062636eb750331657c4.exe unpack001/267f4251888e56ee84029a34e56fcceb63940f75fa563b20e1a7267806049a97.exe unpack001/280a75ca5ca5dc8e106f6f6e2005fe3e23b6c35e296d5639b00b5b6daba8c38e.exe unpack001/288e97d97b9708e5c4d7a57b04ce9fc5b852e75c1945ad5378562d810a2f52af.exe unpack001/297dbbb1daca4b23893b034ab20b8afd0de7664705f064dbbc7fd1d217b5fae0.exe unpack001/318bf82fc655bfe553770702b1ba9c9a7cb69bb61f50832bd006718263428784.exe unpack001/319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe unpack001/338c43850b513f6c4bfda76790ae4cf21ee42bd254bbac18dffcb50cec4acc31.exe unpack001/339a6e6e891d5bb8f19a01f948c352216e44656e46f3ee462319371fd98b3369.exe unpack001/358a95605a125c9df231ad94e95e455709785b5f22e36b1324a128e205dfb699.exe unpack001/372e52a5af110f0e11e678829db332d6e831dfa0e13efa967bfec324822459de.exe unpack001/387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe unpack001/391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5.exe unpack001/393a7a313548a4edc025fb47c6c8e614ecc2b41db880ecb59f20cf238e9a864c.exe unpack001/406a89dab9ccaf9c5ddc064d3f19875259de9564f93a240c7123e53aadfd6006.exe unpack001/416d2f821b7cb984859cfce43be981c5c9bc1489446ba41951c041d5801b65cb.exe unpack001/421af5adde9ca3fd3312067c0a113faaef07a88241df3ed1538d96145aab4303.exe unpack001/428d162ec89c51946ac87fb0b87a614470f56ff61eca07a9391fcab9e103188a.exe unpack001/432c917a2ef72aaa140ae8a79112fb80806d2740a465201e1298c1ed40040eb9.exe unpack001/495d9eca1e009ecdd97618f096da1d8407b1910523fbdf2cf8b869bf7e6c1c18.exe unpack001/499e1eddf39a47eb3392be7e0cbd906f15e22bf9cb10c55dbd34f433772c0f8d.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/134de049f7ef48728b0a126b5f440494817d577c3fbdb92792afa15ae08f1393.msi unpack001/151e21dde7bb3ce31c04e25638e7513f83e19cbd0a7549a574d97339c9486f80.msi
File Explorer
-
jaffacakes118_samples.part016.rar.rar 15.0MB
-
00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd.exe.dll 69KB
-
0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.exe.exe 1.5MB
-
125f75320c80d5b4d73c000058f26e92207d28a3d7d88551041f7a62f2a59e3c.exe.exe 214KB
-
133e003cc510e3d2d0c7df70a603448605641256c88ce64a3bcabb762295d622.elf.elf 1.8MB
-
134de049f7ef48728b0a126b5f440494817d577c3fbdb92792afa15ae08f1393.msi.msi 1.1MB
-
148c2d55d317029444578d478aeedcc834cffa4db695702adc8add568b517557.exe.exe 23KB
-
151e21dde7bb3ce31c04e25638e7513f83e19cbd0a7549a574d97339c9486f80.msi.msi 1.1MB
-
158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe.exe 63KB
-
160dd5158fa00a537fee81df13e8bc4eb14a464806aa3bb3e252a7c435dfcff6.exe.exe 265KB
-
166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3.exe.exe 61KB
-
188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe.exe 3.4MB
-
195cdde8bc2a98f3583f9647171a5b47d9f577f4ffd5805bb3367b012f3428d3.exe.exe 143KB
-
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.exe.exe 235KB
-
227aff885f792fe1bcc142a13b7148482ad8c576fd75e0d92abedb0c7cdc520c.exe.exe 4.7MB
-
231bba5652f6fbdbab3016362fb7925fc4e4489fff5e6a4a98c37fba5bd0cfe9.exe.exe 55KB
-
244ed096d26ae952b472dfbfbd27c6eed8db08e02ba6b5239236ef4d5a977e6d.elf.elf 4.5MB
-
259f9ec10642442667a40bf78f03af2fc6d653443cce7062636eb750331657c4.exe.exe 444KB
-
266f930572d3006c36ba7e97b4ffed107827decd7738a58c218e1ae5450fbe95.jse.jse 176KB
-
267f4251888e56ee84029a34e56fcceb63940f75fa563b20e1a7267806049a97.exe.exe 34KB
-
280a75ca5ca5dc8e106f6f6e2005fe3e23b6c35e296d5639b00b5b6daba8c38e.exe.exe 40KB
-
288e97d97b9708e5c4d7a57b04ce9fc5b852e75c1945ad5378562d810a2f52af.exe.exe 658KB
-
297dbbb1daca4b23893b034ab20b8afd0de7664705f064dbbc7fd1d217b5fae0.exe.exe 164KB
-
318bf82fc655bfe553770702b1ba9c9a7cb69bb61f50832bd006718263428784.exe.exe 22KB
-
319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe.exe 12KB
-
338c43850b513f6c4bfda76790ae4cf21ee42bd254bbac18dffcb50cec4acc31.exe.exe 778KB
-
339a6e6e891d5bb8f19a01f948c352216e44656e46f3ee462319371fd98b3369.exe.exe 88KB
-
350ba7fca67721c74385faff083914ecdd66ef107a765dfb7ac08b38d5c9c0bd.exe.exe 737KB
-
358a95605a125c9df231ad94e95e455709785b5f22e36b1324a128e205dfb699.exe.exe 67KB
-
372e52a5af110f0e11e678829db332d6e831dfa0e13efa967bfec324822459de.exe.exe 424KB
-
387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe.exe 58KB
-
391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5.exe.exe 162KB
-
393a7a313548a4edc025fb47c6c8e614ecc2b41db880ecb59f20cf238e9a864c.exe.exe 92KB
-
406a89dab9ccaf9c5ddc064d3f19875259de9564f93a240c7123e53aadfd6006.exe.exe 576KB
-
411a98777829cd43945f5390efbb9ff7835dbe0fc07e6bf07f2713f037c5b477.unknown6KB
-
416d2f821b7cb984859cfce43be981c5c9bc1489446ba41951c041d5801b65cb.exe.exe 322KB
-
421af5adde9ca3fd3312067c0a113faaef07a88241df3ed1538d96145aab4303.exe.exe 210KB
-
428d162ec89c51946ac87fb0b87a614470f56ff61eca07a9391fcab9e103188a.exe.exe 1.0MB
-
432c917a2ef72aaa140ae8a79112fb80806d2740a465201e1298c1ed40040eb9.exe.exe 424KB
-
495d9eca1e009ecdd97618f096da1d8407b1910523fbdf2cf8b869bf7e6c1c18.exe.exe 190KB
-
499e1eddf39a47eb3392be7e0cbd906f15e22bf9cb10c55dbd34f433772c0f8d.exe.exe 4.4MB
00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd.exe
- SHA256 00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd
- MD5 28f71f85417e8897ea1f27d8d9c16248
- SHA1 c3f0881b1e543ac8a9172e0528ac1400820622dd
- SHA512 7bebacbcfd25325cc9af2be0727e926f57564c437e0a03c63e188bee900c1d3370206e62cdb86d7634f79d8b2678235d36796c000c4e879a70f173b68f4ce988
- SSDEEP 1536:OtBd0whwlxq3REfnynG2JrkDUgjsqyzMIN8jcahCc4ySyI:O2wJevwuyzF3ZyXI
- TLSH T1F963C274C389C019EAD7BA3552C9FE7B4745B922E787175B0824B2983E3B6F2CC81352
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
ba:2e:62:13:5d:81:cc:ef:56:98:7b:ee:93:82:5c:e6:b8:cf:83:13:77:df:e5:68:57:5d:51:65:d4:69:46:b8:5e:7b:95:3a:de:49:f9:e7:42:d0:4d:f3:d3:ff:76:bc:25:ad:8b:28:3e:22:e4:4e:bb:af:02:4b:f2:3b:24:62
Digest Algorithm
sha512
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
1
Major OS version
6
Entry point
68489
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.wdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=205, productName=VS2012 build 50727, version=50727,
count=1, id=204, productName=VS2012 build 50727, version=50727,
0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224
- MD5 07563c3b4988c221314fdab4b0500d2f
- SHA1 a5f53c9b0f7956790248607e4122db18ba2b8bd9
- SHA512 e0264bf772ba43377d1dcdc95dccdacc16ccafee28e8d91a9d532cf2383b0d1ad43625cd0b09555018583db796a59603ad12d568e2aea154594b5d02248d0ecb
- SSDEEP 12288:+OFevZPYI+MbO7NkfWcIV8wZ9CeqFrOdS2KCwILo2bx9I5Nweb/yCdwO4Pzjzbf4:jFaoccQ7XUCdw1X32ekwVXeU+
- TLSH T1FF6572DCBA4CABA496ED5730C3F3655862E6C9F21014C22FC748E4D18E9690B8FDD9D2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1549326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
125f75320c80d5b4d73c000058f26e92207d28a3d7d88551041f7a62f2a59e3c.exe
- IMPHASH bcb64e67818079866efdc97c2da83d74
- SHA256 125f75320c80d5b4d73c000058f26e92207d28a3d7d88551041f7a62f2a59e3c
- MD5 85fab8174bc91d7c0538fb67336e852c
- SHA1 0c7fcf278d72608caf7443e8830f2365c67f9916
- SHA512 9e077abb0228d9b057ba0bfe83f3a2a9fdb1ea31df6aebee5fdda7e527ba5ed5b4cbea5e6f15f4816e136b1d775e84f2aae0d85455886c686d23536cbb98b697
- SSDEEP 3072:0iEm4ok3S63xBNPNO4CgasIBbCFO5JpOALujzkhQeMuYSrC4BA3vHCxX:JEm4oiS6HzO4Cgip5JAmwkhFpYUC4I8
- TLSH T17324E11272D0D972D0B24A724C68E594763DF7914BB8178B671E2ABB1FB03D08EB6347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8887
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryW
GetSystemTimeAdjustment
TerminateProcess
GetMailslotInfo
FillConsoleOutputCharacterW
SetLastError
GetProcAddress
VirtualAlloc
FindAtomA
GetTickCount
IsValidCodePage
GetOEMCP
GetACP
HeapSize
SetProcessShutdownParameters
GetNativeSystemInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
HeapReAlloc
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW
user32
GetRawInputBuffer
GetAltTabInfoW
RegisterRawInputDevices
GetRawInputDeviceList
ValidateRect
GetNextDlgGroupItem
EndPaint
gdi32
SetViewportOrgEx
shell32
ShellAboutW
FindExecutableA
DragQueryFileA
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=158, productName=VS2010 build 30319, version=30319,
count=39, id=171, productName=VS2010 build 30319, version=30319,
count=97, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=1, id=7868, version=8344,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=18389, version=54693,
133e003cc510e3d2d0c7df70a603448605641256c88ce64a3bcabb762295d622.elf
- SHA256 133e003cc510e3d2d0c7df70a603448605641256c88ce64a3bcabb762295d622
- MD5 89f48e5e7a5532eb34c4d22dba7c16bc
- SHA1 58964b055faf9b7f72d1725786f8112f56c187bd
- SHA512 f3e982d8b534ad0f9a921166d8842683f7bd5d2f7307d572f16dcce0c00129709249c2de2fecd20e538c194085c2db5fdde1ab82818eb2373f2af124f2f9077c
- SSDEEP 49152:cqew+96PoBjYs5ngToDEZwTFgN+1TtI1:cqezRob
- TLSH T175954B47F5A250BDD5BAC934832E6137F6317C0D41212A6B67D4EA203F59F209F1EBA2
- MD5 SHA1 SHA512 SSDEEP TLSH
134de049f7ef48728b0a126b5f440494817d577c3fbdb92792afa15ae08f1393.msi
- SHA256 134de049f7ef48728b0a126b5f440494817d577c3fbdb92792afa15ae08f1393
- MD5 0275f9bed85537e199da466e885b5548
- SHA1 67a0cdb1ebd5682cff0582a516ffd611a827296e
- SHA512 e586c3339ddfdc95609b81002262cd1ba64a99a09832698b39330e4241d29301f46bd33080b6415162f4385ca7dfc509d69c429265455223574cffc2baf25a90
- SSDEEP 1536:8hMhkJn+cDx79Z3vH4OGpzZZL0Ds0DI7H:S/xD99vGpzZZ1
- TLSH T10045197F7FC89030EA3536379951D67A4BE0AC084252C6AA1C8DB34D5932CBD397A32D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
25a9e13e3711bb2f95d1f172885f0546926cfc0cb8e2f70e7f0271b883b91000
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Prehash
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
148c2d55d317029444578d478aeedcc834cffa4db695702adc8add568b517557.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 148c2d55d317029444578d478aeedcc834cffa4db695702adc8add568b517557
- MD5 f739d9e0a8ba8b82f65ef09f6d7d4dc6
- SHA1 ab94d1c1ec147ea6bfd159cc740a9f7fce54e840
- SHA512 c98a68f8232c73e8be9e001f4a7049f29d5f884ee429aea81f36f0534ced913f0dcae54e09a9b1272b69955c9121b831378255ec872f59ec6d698ec94899eead
- SSDEEP 384:z3Mg/bqo2LgyOg/Uzv3pzDKF+98cJAr91CkkzLb5Me1:Fqo2514pzDKN0Ar9RqLb2e1
- TLSH T15FB2D51867FA4A38FAFF2E782DB250515775BD57EC3DD74D188A004D0822B9C8D60B67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
151e21dde7bb3ce31c04e25638e7513f83e19cbd0a7549a574d97339c9486f80.msi
- SHA256 151e21dde7bb3ce31c04e25638e7513f83e19cbd0a7549a574d97339c9486f80
- MD5 dcdef9b1dc316aa6dbbf575e67b58be2
- SHA1 23e0701cdcba071ac74e6caac125a4c987020083
- SHA512 56097d60da3c9d284957450658d68ee3e3e50026f71aa62e829de8236ad888f19913360fe45af5593a0f9cd71716d254b32f4547500f29ae8346ea0a21a8b8af
- SSDEEP 768:qVqfv+7ARGxnyXU/xsTIi2vXMUAoQktnv1jS03SQOSyWMDCjyWMDCTYiyx:J3+ZXOTIi2vX+ofnl/f0Ds0DW7yx
- TLSH T1CA35B3022F4E0229D263197AAB2D272777395D021F8134D3512DB5DC09BB4B39F67BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
fcfa69d198083567931a324f18ac49e70f68e7fd2c64ec56fdc96bc6ceee8a8b
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Prehash
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 158ca8d131402f77b2efadfbfe70e1ee44764ce4551ed15f43de064d98eb16c7
- MD5 5ac0232ae6cd6380c135ebcb607de9e3
- SHA1 44e7ee71128c2f1948490016d50175ffb45acb35
- SHA512 9b7002830d70c74176afe292673fff18856843c79ea1eb5278f19a16301c8e2e542f6b772730a7db0a0405910c351baeb85fc157fc737fba48f96bebcc7aaa5b
- SSDEEP 768:cMm3L4o3g/vXNbINb0ZX+pKIzLDwUzc80gmq3oP/oDI:cMm0Ec/NRur/0O8/oM
- TLSH T1005396295173C92DC42C82B815EB2FBC27B0AF166450C76E4A79E6AC3F273B78D10756
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\borod\Desktop\NitroRansomware-master\NitroRansomware\obj\Debug\IntelRansom.pdb
mscoree
_CorExeMain
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
160dd5158fa00a537fee81df13e8bc4eb14a464806aa3bb3e252a7c435dfcff6.exe
- IMPHASH 14cf8f87d7eefee36338756e049a016b
- SHA256 160dd5158fa00a537fee81df13e8bc4eb14a464806aa3bb3e252a7c435dfcff6
- MD5 e966f2760b0d0f5ae5860a5790be4a35
- SHA1 16d0cbf30be1b864615b6d523402b2a59d3f3d44
- SHA512 0de342e22915803fa0a8c8dfa93755d9e92a699d00ead83d316cdbcc846f777d1fbb16df6cea0ee048d003f8b800b19a153e2d40d8ed94a45bb28ca4113f4e65
- SSDEEP 6144:WNXQxVs9xAQ+Vuy4elu8GiXzMlTB5xAuFQfadQHHkC+:WVQxVs9xEu6LzUTfx9QfCekH
- TLSH T1EA44AF1AB3A00DF5DC67827ACD838B55EA727C054730D34B165A93A75F33361AA3E34A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
58120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
o:\src\python-3-trunk\lib\distutils\command\wininst-9.0-amd64.pdb
comctl32
CreatePropertySheetPageA
PropertySheetA
kernel32
FreeLibrary
SetStdHandle
GetStdHandle
LocalFree
FormatMessageA
GetTempFileNameA
GetTempPathA
GetModuleHandleA
GetVersionExA
ResumeThread
SetPriorityClass
GetCurrentProcess
GetCurrentThread
SetThreadPriority
CreateProcessA
GetModuleFileNameA
RemoveDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetModuleFileNameW
SetEndOfFile
CompareStringA
GetFileSize
GetLocaleInfoW
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetConsoleMode
SetFilePointer
ReadFile
DeleteFileA
LoadLibraryA
GetProcAddress
MultiByteToWideChar
lstrlenA
CompareStringW
UnmapViewOfFile
CreateFileA
GetLastError
DosDateTimeToFileTime
SetFileTime
CloseHandle
CreateFileMappingA
MapViewOfFile
GetFileAttributesA
CreateDirectoryA
SetLastError
GetConsoleCP
SetHandleCount
FatalAppExitA
DeleteCriticalSection
GetProcessHeap
RtlUnwindEx
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
EnterCriticalSection
LeaveCriticalSection
GetDateFormatA
GetTimeFormatA
HeapReAlloc
GetModuleHandleW
Sleep
ExitProcess
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
TlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
WriteFile
SetEnvironmentVariableA
SetEnvironmentVariableW
user32
wsprintfA
GetFocus
ShowWindow
SetCursor
GetDlgItem
SendDlgItemMessageA
GetParent
PostMessageA
GetWindowRect
MoveWindow
LoadCursorA
RegisterClassA
CreateWindowExA
MessageBoxA
UpdateWindow
DefWindowProcA
BeginPaint
GetSystemMetrics
EndPaint
TranslateMessage
DispatchMessageA
PeekMessageA
GetDC
ReleaseDC
SendMessageA
SetDlgItemTextA
gdi32
CreateFontA
SelectObject
SetBkMode
TextOutA
SetTextColor
DeleteObject
CreateDIBitmap
CreateSolidBrush
advapi32
RegDeleteKeyA
RegEnumKeyExA
RegCloseKey
RegDeleteValueA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueA
shell32
ShellExecuteA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Name
.text
Size
150KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=150, version=20413,
count=38, id=132, productName=VS2008 build 21022, version=21022,
count=11, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=128, version=50727,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=166, id=1, productName=Unmarked objects,
count=138, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3
- MD5 e06246e30ae66a2dd4de85270947dbb7
- SHA1 02e99b245f2734020334f80504710db43a141fea
- SHA512 03b426b28eb2f3f6c800d70ae19fbd0e897d4f1c4537659a2eb9f31ffc5789062b3576f18059f3f2e51f064edce1865c39572aacdd133b9486b71837efab8790
- SSDEEP 768:oKsMqCXfVcWGpuuM9ZkiANIUI2YLDwUzc80gmq3oP/oDE:oKseG1M9ZkiAPQr/0O8/oQ
- TLSH T1D753542852738A2DC47C82B815FB2F7C27B0AF565460C75D4A78D2AC3F277B68D10B56
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Caleb\Downloads\Nitro-Ransomware-master\Nitro-Ransomware-master\NitroRansomware\obj\Debug\NitroRansomware.pdb
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99
- MD5 35acbf4b0e8cfe8b9c3c2d5da5eb0131
- SHA1 bc2d3b96b8f5d227b41611f64216753a898e804c
- SHA512 381f3a0867207e9824a1382620c17d1b445e307512982279a285e7cb4ce2f79a7f48b549d5c78e0f1ef707ff10ec249784a1d6e88788eba1e861f492f19fe2ca
- SSDEEP 98304:NUqA6Sp+ZIogCxfwijqisUzS5Q1J6KtqxxwwpJKILMW:JAOC/MINxxVpEp
- TLSH T122F533638D241271EBBAA23F9A5DD101A3607E1541D5B893F15EF4E06E73EF20FA2C94
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected LegionLocker ransomware
Sample contains strings associated with the LegionLocker family.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3488554
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\xxx\source\repos\LegionLauncher\LegionLauncher\obj\Debug\LegionLocker.pdb
mscoree
_CorExeMain
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
195cdde8bc2a98f3583f9647171a5b47d9f577f4ffd5805bb3367b012f3428d3.exe
- IMPHASH 4b0a5cb1aa0992ea9901768198fd3e7e
- SHA256 195cdde8bc2a98f3583f9647171a5b47d9f577f4ffd5805bb3367b012f3428d3
- MD5 a82e420c74def2792316dfe5e330ff28
- SHA1 6bb9f6c014d036ad8172d275612551dc0e9e5fa3
- SHA512 08a4a6123543ef53c7ecde1ea1783d4a36cf2810ec6add83de4f34443c895680a23c5492ed3f5b4fafce116b8794a9241279f6f0cf537b46572c42c5fe30edd3
- SSDEEP 3072:o+HcL2ICfSTntqSQRruiMZMqqDL2/AwvdK7Vjp9:haDtORruiMyqqDL6tvdQp9
- TLSH T1A8E38B1B72D190B2F0F30675E9B4AD21092F3D202F949EEB26E655ED1D210F1AD3AB53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
GandCrab payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualProtect
ExitProcess
OpenProcess
Sleep
GetFileAttributesW
GetModuleFileNameW
CreateFileW
ExitThread
lstrlenW
GetLastError
GetProcAddress
CloseHandle
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCommandLineA
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
WriteConsoleW
user32
MessageBoxW
ntdll
RtlUnwind
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
78KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=225, version=20806,
count=17, id=223, version=20806,
count=101, id=224, version=20806,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=103, id=1, productName=Unmarked objects,
count=2, id=228, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259
- MD5 07f482fdc70a699d02495c8b4dc1ee63
- SHA1 8c536b4c8a9a810635daa506c67f70180b048c83
- SHA512 5a8ec11ed23b6e17e894965cf3fab92ae55e7408ee1f6bd00a59ba43c61648cd9d9fd7894288427a14446d3d9bc59c66b0416d57f7de9cd626d64e575ca14d91
- SSDEEP 384:LTxamiSIM6mcfE7gdEVruKJPB5wVKnJZQB59Wrc1:LTYSv6mcfEzruKdB5w0JZQBL
- TLSH T15F341904667386D6C49E05BA1EF9D6801C30A951292FBF9AF5F1BFCBB835D41A18D2CC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects ChupaCabra ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\Videos\AnubisNew(1)\obj\Debug\svhost.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
225KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
227aff885f792fe1bcc142a13b7148482ad8c576fd75e0d92abedb0c7cdc520c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 227aff885f792fe1bcc142a13b7148482ad8c576fd75e0d92abedb0c7cdc520c
- MD5 087045c4a829688c481b46bfc1097c54
- SHA1 b76544c11fc23dd0cdabbb0211896fd88fcc50b7
- SHA512 ad73da94d6203aa331c5e693df6c1a45d9e2b71477262e40102f0d5264283365117fed990889aa336316869d7727600ee2d7d79268a91a96c62b1d7c388d271b
- SSDEEP 24576:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKN7ChBWMQ+uSJJd3Dkdd:ajLuSh3i+FtvkMzT+TIR
- TLSH T1D9367D567BC5C16AC06F03361862C3893272F8A69F1383A73495B32E7D7A7C44DB29B5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects NominatusCrypto C# variant
-
Detects NominatusCrypto DOS executable variant
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\sd\Documents\SharpDevelop Projects\VirusMSILNominatusStorm\VirusMSILNominatusStorm\obj\Debug\VirusMSILNominatusStorm.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
231bba5652f6fbdbab3016362fb7925fc4e4489fff5e6a4a98c37fba5bd0cfe9.exe
- IMPHASH 851a0ba8fbb71710075bdfe6dcef92eb
- SHA256 231bba5652f6fbdbab3016362fb7925fc4e4489fff5e6a4a98c37fba5bd0cfe9
- MD5 b2f083ee365141030c49ddffc325f6be
- SHA1 f1091be7e566d068403a87b0e7ed4b959c952c8e
- SHA512 09ce81f0bbbcc42444b177857de062ba09213a30d0d1171dd8902cab2592b1773b3a6090e017d4b68f6d9782f25f69d524f7fb84798a7e5e4f576aaa05c71430
- SSDEEP 768:xvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1ERnqfD19l3C6J:LNeRBl5PT/rx1mzwRMSTdLpJRyvx
- TLSH T11A43C007746990B2CDA14B70293A6F5F8FBA641580B488974F390D8B3FD5472DB393BA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpr
WNetEnumResourceW
WNetUseConnectionW
WNetOpenEnumW
WNetCloseEnum
ws2_32
ioctlsocket
getpeername
ntohl
select
WSAGetLastError
htons
recv
socket
closesocket
getsockopt
WSAAddressToStringW
htonl
connect
iphlpapi
GetIpAddrTable
winhttp
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSendRequest
kernel32
FindClose
FindNextFileW
SystemTimeToFileTime
OpenProcess
FindFirstFileW
MoveFileW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
GetCurrentThreadId
GetLocalTime
ExitProcess
SetFilePointer
WaitForSingleObject
GetComputerNameW
SetEvent
GetLogicalDrives
GetTickCount
Sleep
CopyFileW
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
CreateEventW
WaitForMultipleObjects
CloseHandle
SetFileAttributesW
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResetEvent
DeleteCriticalSection
AllocConsole
WriteFile
WideCharToMultiByte
WriteConsoleW
GetStdHandle
CreateMutexW
CreateProcessW
GetCurrentProcess
SetHandleInformation
HeapFree
GetLocaleInfoW
ReadProcessMemory
TerminateProcess
GetModuleFileNameW
FlushFileBuffers
OpenMutexW
GetLastError
GetProcAddress
Process32FirstW
GetExitCodeThread
CreatePipe
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
ReleaseMutex
GetVersion
DeleteFileW
GetCurrentProcessId
GetVolumeInformationW
ExpandEnvironmentStringsW
HeapAlloc
GetProcessHeap
HeapReAlloc
QueryPerformanceCounter
user32
GetWindowThreadProcessId
GetShellWindow
advapi32
FreeSid
LookupPrivilegeValueW
OpenProcessToken
GetTokenInformation
EqualSid
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
LookupAccountSidW
AllocateAndInitializeSid
DuplicateTokenEx
RegQueryValueExW
shell32
ShellExecuteExW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=18, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
244ed096d26ae952b472dfbfbd27c6eed8db08e02ba6b5239236ef4d5a977e6d.elf
- SHA256 244ed096d26ae952b472dfbfbd27c6eed8db08e02ba6b5239236ef4d5a977e6d
- MD5 ff107185650f7780b74f584f2ce275dc
- SHA1 5486f4183f173686fa444c218c6b2dd62149c15b
- SHA512 dda5a9c8d5eedbeaf4842c6360e9b9a12d5d19e409fdfb8758152a735bb767ef67fb8d681663bdecadec1664509eabb43a803f51b1064f33440f460cdfaab80f
- SSDEEP 49152:vIPweIRiyshXorLNEwVzZbW9teAJTwu7dXLcK/tCZ2kZLKYDsf8GulVkdkotl7qq:4TONEYb0TwAXYKFCNLjDoM/i
- TLSH T15B265B50FECB54FAD6071A7180BFA33F673155098336DBC7DA406E53E82B6E15A32229
- MD5 SHA1 SHA512 SSDEEP TLSH
-
eCh0raix ransomware
259f9ec10642442667a40bf78f03af2fc6d653443cce7062636eb750331657c4.exe
- IMPHASH fd93c615e10c26bda651551a69e41a8d
- SHA256 259f9ec10642442667a40bf78f03af2fc6d653443cce7062636eb750331657c4
- MD5 2dab3c06cafa0877ed841eb72beae0ae
- SHA1 eda84fdb6fab3592df696fe57d52045d8f664bf7
- SHA512 d3cd2b9f660a2fb57d71ae67a84b2bd9a997234122d5e0b905eff25644d949104708278fa123ba31dfb5acc8eb5d8301dc7e44c631a752d24b27888b525e0291
- SSDEEP 6144:+zEXUXIsN2vGdSw0ld6Avhrjpjryd6O9mrmcFS8AKDbAw:+zEXv2xSwa62hvUf9mCccSAw
- TLSH T154A45C16B79559FDD06AC07482464521BA327C9A0B35FEFF1698B2352E36AF02F3CB14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
220724
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\user\Desktop\new\noko\target\release\deps\noko.pdb
advapi32
SystemFunction036
kernel32
GetConsoleOutputCP
CloseHandle
GetSystemInfo
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
ReleaseMutex
FindClose
ReleaseSRWLockShared
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SetLastError
Sleep
GetCurrentProcess
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
SetFilePointerEx
FlushFileBuffers
GetStdHandle
GetCurrentProcessId
WaitForSingleObject
TerminateProcess
QueryPerformanceCounter
TryAcquireSRWLockExclusive
GetSystemTimeAsFileTime
HeapAlloc
GetProcessHeap
HeapFree
TlsAlloc
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
FindNextFileW
CreateFileW
GetFileInformationByHandle
DeviceIoControl
FindFirstFileW
MoveFileExW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateThread
TlsGetValue
TlsSetValue
GetModuleHandleA
GetConsoleMode
WriteConsoleW
HeapSize
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
SetStdHandle
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
LoadLibraryExW
FreeLibrary
TlsFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
Name
.text
Size
273KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=6, id=259, version=27412,
count=137, id=261, version=27412,
count=38, id=261, version=30625,
count=16, id=260, version=30625,
count=9, id=259, version=30625,
count=11, id=257, version=27412,
count=171, id=1, productName=Unmarked objects,
count=92, productName=Unmarked objects (old),
count=1, id=258, version=30709,
266f930572d3006c36ba7e97b4ffed107827decd7738a58c218e1ae5450fbe95.jse
- SHA256 266f930572d3006c36ba7e97b4ffed107827decd7738a58c218e1ae5450fbe95
- MD5 ad184cf93d38d51111a7ef305992eb5f
- SHA1 37b05248dbd96c8a94082471069f24a7b1036313
- SHA512 a37d0984d65b0eaef4169a22e5802ac8f24b9508b717f46b2911ad583f5a4b2e4f59bd31c317976f14995ba69a7855318ef7d5e0ba866d3b8fc1db352a14c56e
- SSDEEP 3072:x4xkakIeI6QKzm+bga+V9cw+yOTE4o5V0eD11TbXx1113B1WR9KflL11H6IFNC4v:GfelQKzbMYJQ4o5VxhakLDNyjt8
- TLSH T1ED04E85B72ECD18662B0E6D61AC1CE75CADBA5F44FE1C0CE749EA2004D31C5A2B0B95F
- MD5 SHA1 SHA512 SSDEEP TLSH
267f4251888e56ee84029a34e56fcceb63940f75fa563b20e1a7267806049a97.exe
- IMPHASH 8e2593408c2a9aab2b5ce501907a2a3e
- SHA256 267f4251888e56ee84029a34e56fcceb63940f75fa563b20e1a7267806049a97
- MD5 fc5456389ec7e0142df678aadde7fdb5
- SHA1 833f4e36b4adbe00d06a846d1035585ec269a078
- SHA512 40cd72a52fae2b5db6bb7814cf910adbf4497b7a0ec36c313eae6d5406633ab5d3907d0e24560a759f947450a487747c6d7d9f3607c2234135cad770ed8e1407
- SSDEEP 768:sNOkmJUpM2VA1dvLALUt2UBQNHXWYNZQluDRkOwT3OKFANi:sBmJ0VA1JA9ouZNZJRUOKFB
- TLSH T1B8F28D96F181CAF3EDE504B46ADA271BB9AFD429137447E3CF54AC6029121D1A4FE4C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
MAKOP ransomware payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21488
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
kernel32
FindClose
DeviceIoControl
WaitForMultipleObjects
FindNextFileW
GetVolumeInformationW
CreateThread
Sleep
WriteFile
SetEndOfFile
SetFilePointerEx
ReadFile
FlushFileBuffers
GetFileSizeEx
MoveFileW
SetFileAttributesW
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
GetLastError
GetVersion
GetProcAddress
LoadLibraryA
OpenProcess
GetFileType
GetModuleHandleA
DuplicateHandle
GetCurrentProcessId
ExitProcess
CreateFileW
CreatePipe
GetEnvironmentVariableW
PeekNamedPipe
CreateProcessW
GetSystemWindowsDirectoryW
SetHandleInformation
GetLocaleInfoW
GetModuleFileNameW
Process32FirstW
Process32NextW
CreateMutexA
CreateToolhelp32Snapshot
CreateDirectoryW
GetFileAttributesW
GetLogicalDrives
WaitForSingleObject
SetErrorMode
GetDriveTypeW
FindFirstFileW
CloseHandle
DeleteCriticalSection
EnterCriticalSection
TerminateProcess
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
GetCommandLineW
user32
wsprintfW
wsprintfA
GetShellWindow
GetWindowThreadProcessId
advapi32
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptAcquireContextW
CryptDecrypt
OpenProcessToken
GetTokenInformation
SetTokenInformation
RegCloseKey
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
CryptReleaseContext
CryptSetKeyParam
shell32
ord680
CommandLineToArgvW
SHGetSpecialFolderPathW
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=125, productName=VS2005 build 50727, version=50727,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=97, id=1, productName=Unmarked objects,
count=16, id=114, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
280a75ca5ca5dc8e106f6f6e2005fe3e23b6c35e296d5639b00b5b6daba8c38e.exe
- SHA256 280a75ca5ca5dc8e106f6f6e2005fe3e23b6c35e296d5639b00b5b6daba8c38e
- MD5 deb90cbd18c233c18803a38db5799a52
- SHA1 bdecb3a9b1e7048fddf645bc5c17f0f8342468b8
- SHA512 bf0d637d15dde553654b7384bd3458ce12e7a4a9e8fa37c68808538655cdc7d57ef490474adcc2fbc910946710841b4e8a013d254b15ce96c8b73ddbce291211
- SSDEEP 384:febFNw4Pk1itKkpAjj/3nrI9oRg1qYvjSfkDCgScjUZhGXq8VMBAciu:f0FmBkpKjPMXcY73DCsjSG2Ni
- TLSH T15E035B5F98D406DBC211D6F223532613C6BD705052A18A116FAC7D1F297E9E39F78A0F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Xorist Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8657
Magic Number
267
Subsystem
MAGE_SUBSYSTEM_UNKNOWN
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
30KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.imports
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
288e97d97b9708e5c4d7a57b04ce9fc5b852e75c1945ad5378562d810a2f52af.exe
- IMPHASH e5b4359a3773764a372173074ae9b6bd
- SHA256 288e97d97b9708e5c4d7a57b04ce9fc5b852e75c1945ad5378562d810a2f52af
- MD5 4600c747000f1f9d1c6f6fe19a31e918
- SHA1 261ae05be2b422f240475ea8da64221f90291f72
- SHA512 83ef9b26a7ab555a3417fdcfc941c39c3725b4b50f0729ab8b205b55048102b65c469acca848c6c56003303f567c254a17b1076f84f4045f0c6c4b017819d4a6
- SSDEEP 12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hR:eZ1xuVVjfFoynPaVBUR8f+kN10EB3
- TLSH T199E48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
587912
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
GetErrorInfo
GetActiveObject
SysFreeString
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyA
RegFlushKey
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueA
LookupPrivilegeNameA
LookupPrivilegeDisplayNameA
LookupAccountSidA
IsValidSid
GetUserNameA
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetCurrentHwProfileA
AdjustTokenPrivileges
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
EnumServicesStatusA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
user32
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
mouse_event
keybd_event
WindowFromPoint
WaitMessage
VkKeyScanA
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
ToAscii
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetClassLongA
SetCapture
SetActiveWindow
SendMessageW
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageW
PeekMessageA
OpenClipboard
OffsetRect
OemToCharA
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxA
MapWindowPoints
MapVirtualKeyA
LockWorkStation
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageW
IsDialogMessageA
IsClipboardFormatAvailable
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextLengthA
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessagePos
GetMessageA
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastInputInfo
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameA
GetClassLongA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowExA
FindWindowA
FillRect
ExitWindowsEx
EqualRect
EnumWindows
EnumThreadWindows
EnumDisplayDevicesA
EnumClipboardFormats
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoA
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringA
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcpyA
WriteProcessMemory
WriteFile
WinExec
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQuery
VirtualProtectEx
VirtualProtect
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
VerLanguageNameA
UnmapViewOfFile
TerminateProcess
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetThreadContext
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesA
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadProcessMemory
ReadFile
PeekNamedPipe
OpenProcess
MultiByteToWideChar
MulDiv
MoveFileA
MapViewOfFile
LockResource
LocalFileTimeToFileTime
LocalAlloc
LoadResource
LoadLibraryA
LeaveCriticalSection
IsBadReadPtr
InitializeCriticalSection
HeapFree
HeapAlloc
GlobalUnlock
GlobalMemoryStatus
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetVersion
GetUserDefaultLangID
GetTickCount
GetThreadLocale
GetThreadContext
GetTempPathA
GetSystemPowerStatus
GetSystemDirectoryA
GetStdHandle
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileTime
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetExitCodeProcess
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetCPInfo
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitThread
ExitProcess
EnumResourceNamesA
EnumCalendarInfoA
EnterCriticalSection
DosDateTimeToFileTime
DeleteFileA
DeleteCriticalSection
CreateThread
CreateRemoteThread
CreateProcessA
CreatePipe
CreateMutexA
CreateFileMappingA
CreateFileA
CreateEventA
CreateDirectoryA
CopyFileA
CompareStringA
CloseHandle
Beep
Sleep
gdi32
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RectVisible
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
ExtTextOutA
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
wsock32
__WSAFDIsSet
WSACleanup
WSAStartup
WSAGetLastError
gethostname
getservbyname
gethostbyname
gethostbyaddr
socket
shutdown
sendto
send
select
recv
ntohs
listen
ioctlsocket
inet_ntoa
inet_addr
htons
getsockname
connect
closesocket
bind
accept
ole32
CoTaskMemFree
StringFromCLSID
CoTaskMemFree
CLSIDFromProgID
ProgIDFromCLSID
StringFromCLSID
CoCreateInstance
CoUninitialize
CoInitialize
IsEqualGUID
shell32
ShellExecuteExA
ShellExecuteA
SHGetFileInfoA
SHFileOperationA
DragQueryFileA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHEmptyRecycleBinA
urlmon
URLDownloadToFileA
comctl32
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpQueryInfoA
FtpPutFileA
winmm
waveInUnprepareHeader
waveInStart
waveInReset
waveInPrepareHeader
waveInOpen
waveInClose
waveInAddBuffer
PlaySoundA
mciSendStringA
netapi32
Netbios
NetApiBufferFree
NetShareGetInfo
NetShareEnum
gdiplus
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipDisposeImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
msacm32
acmStreamUnprepareHeader
acmStreamPrepareHeader
acmStreamConvert
acmStreamReset
acmStreamSize
acmStreamClose
acmStreamOpen
ntdll
NtQuerySystemInformation
NtUnmapViewOfSection
ws2_32
WSAIoctl
shfolder
SHGetFolderPathA
avicap32
capGetDriverDescriptionA
Name
.text
Size
566KB
Virtual Size
566KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
29KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
56B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
297dbbb1daca4b23893b034ab20b8afd0de7664705f064dbbc7fd1d217b5fae0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 297dbbb1daca4b23893b034ab20b8afd0de7664705f064dbbc7fd1d217b5fae0
- MD5 df0b023471306ceb44a253d7cfd86abc
- SHA1 36b498e04a1777bbea6582f9d1a0820f96cabe97
- SHA512 2334f5dad874d44b7180241247f959d36b5d58fe8625c2b5013dd6bd751998a5ad9055b3c5255b95cb8a05eda2a06f566ab77bd45a54bd6923588c05b76e956c
- SSDEEP 3072:/I/0W2G4b/gFbGbj2koc34mwAEoznq1vK7rbKO5oqoO0MhwNz:/RjG40RGb3X34Hknq1cm20NN
- TLSH T1DAF3B32432E50500F5BF5DB5C6A8748287FEB8136919EA5E08C243A64D727C09EA7FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
171486
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
159KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
318bf82fc655bfe553770702b1ba9c9a7cb69bb61f50832bd006718263428784.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 318bf82fc655bfe553770702b1ba9c9a7cb69bb61f50832bd006718263428784
- MD5 bc5567aac7801de5efb8536ae4ff6378
- SHA1 4f1fd63e0fe4ca52187c1ddf7f966bdd0a2257fb
- SHA512 8a493a243d421f4998dc58e0bd676dfd93196b019108d10ee4eed8f3d927159e5f35a8615667789f7cbb97cc0f010ada8d902f51c8fdfbe951db7012195119aa
- SSDEEP 384:I3MLWHn3kI3vhqoIQp5SOBBJGr91CrLb5beO:Qn3kIgLQp5XvGr9SLbteO
- TLSH T13FA2D61867FA5A39F7FF6F786C7251505B71B893ED3ED74D188E004D0822B8C8AA0766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe
- SHA256 319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5
- MD5 0a5e38ff165e9e78e58fd5b47b19b86a
- SHA1 d0cccb38776b7390bf8b0fc5ebe14a75b1dfa3ef
- SHA512 330c946e02bab30f4f33a6b246c0ad3d83438dddd1572d499aca2af5a1789714b81ba08729c2917ad8b6090ccb2b476d3a88f6bfd537ebd5a2f0e8ff9048ab67
- SSDEEP 192:K/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMTrE4l2W:KebFNw4Pk1itKkpAjjI2YpdmToQ2W
- TLSH T15742080FFDD044D6D316C7F2235B260ACB7D71A2A6A066156FAC2C18147A5E3EFA450F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Xorist Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8657
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
338c43850b513f6c4bfda76790ae4cf21ee42bd254bbac18dffcb50cec4acc31.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 338c43850b513f6c4bfda76790ae4cf21ee42bd254bbac18dffcb50cec4acc31
- MD5 be0154b3df434968c695a57bf0a2ce27
- SHA1 efd8d98148e46d28c999ae9d17d20ec9de8f0af5
- SHA512 9b17f5dfc8d028cb8fe015368cca3b9439adc22233f61c3fd4397537620519efa2bd0bab38aa0e3b30df330cc4d24c5318e361ba0e5942c8e5fe1d0bf46da0b9
- SSDEEP 24576:DYJRAQ/ljVTpFRU+44J/CWwRIOb2TkGg:ETAyFvUHBzboHg
- TLSH T1290502BB4275A1B6C1582374F5750F0B35BCE6320641B698A04BA3FEEC4E29C9EF4764
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
819210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
*$(=}
Size
727KB
Virtual Size
726KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
339a6e6e891d5bb8f19a01f948c352216e44656e46f3ee462319371fd98b3369.exe
- IMPHASH 37f01a80e028f92aeb4f7284acd12f45
- SHA256 339a6e6e891d5bb8f19a01f948c352216e44656e46f3ee462319371fd98b3369
- MD5 fbb796cc4209793257bc08943e9bfa29
- SHA1 5200d89104d66cab7ee6418e1dc5eccc13bc5193
- SHA512 9b41837bf7d20b26343b9fcde1c5b47e56568517ab5cc225a9ceb6415eb0b4987414aa15634ab25b7909aa61062654a1c2284b06039b1bf558221a9cb95b9e4d
- SSDEEP 1536:bs6+rOTW/tkze6Z4PWZ8Z0pzs0an0orPQc8:bs6+KgOzeX7Z0YL8
- TLSH T109934A0175E6A21DF6B68AF078F6D975392AF9364B718BEB594027440CCCAD18A70F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Vohuk Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetProcessShutdownParameters
CreateMutexW
WaitForSingleObject
Wow64RevertWow64FsRedirection
DeleteFileW
GetNativeSystemInfo
VerSetConditionMask
GetComputerNameW
CreateProcessW
CopyFileW
VerifyVersionInfoW
GetSystemInfo
GlobalMemoryStatusEx
IsWow64Process
OpenProcess
GetTickCount
ReadFile
SetThreadPriority
GetQueuedCompletionStatus
GetCurrentThread
TerminateThread
SetFilePointer
GetLocalTime
HeapCreate
HeapFree
HeapAlloc
GetProcessHeap
CancelIo
CreateTimerQueueTimer
DeleteTimerQueueEx
ExitThread
CreateTimerQueue
GetModuleFileNameW
lstrlenW
GetCurrentProcess
SetPriorityClass
CreateDirectoryW
GetDriveTypeW
CreateIoCompletionPort
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
GetCurrentProcessId
FindVolumeClose
ExitProcess
MoveFileExW
LocalFree
GetProcAddress
SetVolumeMountPointW
CreateThread
GetCommandLineW
LoadLibraryW
CloseHandle
Wow64DisableWow64FsRedirection
lstrcatW
GetLastError
SetFileAttributesW
PostQueuedCompletionStatus
ResumeThread
GetFileAttributesW
CreateFileW
FindClose
lstrlenA
WaitForMultipleObjects
WriteFile
FindNextFileW
FindFirstVolumeW
FindFirstFileExW
GetFileSizeEx
GetLogicalDrives
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcmpiW
lstrcpyW
Sleep
user32
ReleaseDC
SystemParametersInfoW
DrawTextW
GetDC
wsprintfA
wsprintfW
gdi32
GetTextExtentPoint32W
SetTextColor
SetBkMode
SetBkColor
DeleteObject
GetDeviceCaps
GetDIBits
CreateFontW
SelectObject
CreateCompatibleBitmap
DeleteDC
CreateCompatibleDC
advapi32
OpenSCManagerW
DeleteService
ControlService
EnumDependentServicesW
OpenServiceW
QueryServiceStatusEx
RegCloseKey
GetWindowsAccountDomainSid
CreateWellKnownSid
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
CheckTokenMembership
RegOpenKeyExW
RegDeleteValueW
GetUserNameW
GetTokenInformation
RevertToSelf
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
SetThreadToken
LookupPrivilegeValueW
AdjustTokenPrivileges
EqualSid
DuplicateToken
CloseServiceHandle
shell32
SHEmptyRecycleBinW
SHGetFolderPathW
SHChangeNotify
CommandLineToArgvW
ole32
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
rstrtmgr
RmStartSession
RmEndSession
RmRegisterResources
RmGetList
wtsapi32
WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsW
mpr
WNetAddConnection2W
WNetGetConnectionW
netapi32
NetShareEnum
NetGetDCName
NetApiBufferFree
NetGetJoinInformation
ws2_32
WSACleanup
WSAGetLastError
setsockopt
htons
htonl
getsockopt
WSAAddressToStringW
socket
inet_addr
WSAStartup
WSASocketW
shutdown
ntohl
closesocket
bind
WSAIoctl
iphlpapi
GetAdaptersInfo
shlwapi
StrStrIW
wnsprintfA
PathFindExtensionW
wvnsprintfW
ntdll
NtQuerySystemInformation
RtlGetVersion
NtTerminateProcess
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=30034,
count=1, id=262, version=27412,
count=33, id=257, version=27412,
count=176, id=1, productName=Unmarked objects,
count=22, id=265, version=30145,
count=1, id=255, version=30145,
count=1, id=258, version=30145,
350ba7fca67721c74385faff083914ecdd66ef107a765dfb7ac08b38d5c9c0bd.exe
- IMPHASH bdcfc79ca571a25df2a5d87fa136abef
- SHA256 350ba7fca67721c74385faff083914ecdd66ef107a765dfb7ac08b38d5c9c0bd
- MD5 0bf7bc20496143a9f028e77ab47b4698
- SHA1 aa54013aeb502b4a936331deb76a6411f1f1ade7
- SHA512 5e94cd77c4ad6dfa1064915ca0f4d117a2e3a4e924d05a16df0b223a5a0cbcb6124627e41d184aa0584f3ff3bbd5f9f913964887c7eb140e105317d4f5709981
- SSDEEP 12288:bO+sm75a7DI9Mv53VI/XfaUs442JbV24chSS1i2wZbDFMMWzVFq:rh75a7M9S3VYa4npY4cFM2MWhY
- TLSH T119F40266BFD5006AF46B2430586CABF2B93CDB31694218776B445D189A34FC38E39B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
6b:3f:29:89:e8:83:56:da:77:cb:89:28:4e:44:4c:58:89:f4:e0:bf:d3:08:f3:bc:88:a6:96:ce:56:34:fd:13
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 1, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6b:3f:29:89:e8:83:56:da:77:cb:89:28:4e:44:4c:58:89:f4:e0:bf:d3:08:f3:bc:88:a6:96:ce:56:34:fd:13
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 1, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:90:0e:61:14:98:12:78:23:70:00:00:00:00:04:90
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:462F-E319-3F20,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a4:07:cf:e3:8f:a3:ba:6f:d6:00:01:00:00:01:a4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cf:a0:25:90:e3:13:04:ef:15:00:00:00:00:02:cf
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
58912
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
HeapCreate
CloseHandle
WriteConsoleW
GetStringTypeW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
DecodePointer
user32
LookupIconIdFromDirectoryEx
EqualRect
IntersectRect
InflateRect
GetClipCursor
EnumPropsExW
ExcludeUpdateRgn
GetWindowRgn
WindowFromDC
GetTitleBarInfo
ToUnicode
IsCharAlphaW
CharPrevExA
CharUpperW
GetNextDlgGroupItem
IsDlgButtonChecked
CheckDlgButton
MoveWindow
AnimateWindow
DrawAnimatedRects
GetSubMenu
gdi32
Polygon
GetDCOrgEx
GetTextFaceA
DPtoLP
ExtTextOutA
GetMiterLimit
SetArcDirection
FlattenPath
ArcTo
AbortPath
GetColorAdjustment
GetDIBColorTable
GetWorldTransform
AngleArc
GdiComment
GetWinMetaFileBits
GetEnhMetaFilePaletteEntries
GetEnhMetaFileW
CopyEnhMetaFileW
PlayMetaFileRecord
SetTextJustification
SetTextCharacterExtra
SetSystemPaletteUse
SetLayout
EnumFontFamiliesExA
EnumFontFamiliesW
EqualRgn
FillRgn
FloodFill
GetROP2
GetCharWidthA
GetClipBox
GetMetaRgn
GetCurrentObject
GetCurrentPositionEx
GetGraphicsMode
GetMapMode
GetPaletteEntries
GetRasterizerCaps
GetStretchBltMode
GetTextAlign
GetTextColor
GetFontLanguageInfo
GetCharacterPlacementA
GetViewportExtEx
GetWindowExtEx
InvertRgn
MaskBlt
OffsetClipRgn
PaintRgn
PolyPolygon
PtInRegion
RectInRegion
RestoreDC
RemoveFontResourceA
RemoveFontResourceW
RoundRect
ResizePalette
SetMetaRgn
SetBkColor
SetDIBits
SetDIBitsToDevice
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
589KB
Virtual Size
588KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=141, id=261, version=27412,
count=18, id=260, version=27412,
count=37, id=261, version=31616,
count=17, id=260, version=31616,
count=20, id=259, version=31616,
count=7, id=257, version=27412,
count=164, id=1, productName=Unmarked objects,
count=1, id=261, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,
358a95605a125c9df231ad94e95e455709785b5f22e36b1324a128e205dfb699.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 358a95605a125c9df231ad94e95e455709785b5f22e36b1324a128e205dfb699
- MD5 8945fc31fc491156099b38d6e956be24
- SHA1 e343a2f9ed6c74831f415f15d841c85d5072935e
- SHA512 9a7ef1b82e999bd344161d31f093ff6f429246702e5e90a7b52125f92f6efa63218c08639aaf3a4e4ae38653f2443bbd2e22632ce682397a51dad0e38093551d
- SSDEEP 1536:ucBizwYi/uOzcvGs7skSrU7CJhqz3IKNpwVcl:5mi/uOQv37hSJhqz3IKNpqY
- TLSH T1F663409D726072EFC86BD4729EA82C78FB61747B531B4213A02715ADAE4C897CF144F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
98314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
sp7)
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
372e52a5af110f0e11e678829db332d6e831dfa0e13efa967bfec324822459de.exe
- SHA256 372e52a5af110f0e11e678829db332d6e831dfa0e13efa967bfec324822459de
- MD5 ef35df5351e657db6f4c9b237f5df7ec
- SHA1 e3822f7d01a70e4a29580e0d6623cf5bb1c65d29
- SHA512 05454d2e89cf38c1eea7b1515ee29aa3fa8041116fb0fba81fb71f93c0e4f566180184a75e7d2b1411e7e5b3d8890aac4f40f10ce970ba5b37702ff893e8973a
- SSDEEP 6144:JHEmrnWIHf5Kt4m6bkyotM4dxtsXgrNfl0EUl0srjnLoe:JHEmjH/5KtEbkRtM0jflnUWILoe
- TLSH T167942A2570829AEAEDB554751A64FBFDA92CB4B00BA40EF7B7C649B404E03C26774F13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Seven ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
162098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
273KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
129KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.imports
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=12, id=241, version=40116,
count=162, id=243, version=40116,
count=27, id=242, version=40116,
count=22, id=259, version=23013,
count=61, id=261, version=23013,
count=66, id=260, version=23013,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=169, id=1, productName=Unmarked objects,
count=2, id=265, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640
- MD5 278a0cd8cf2ad02e2f2b139e78406ac9
- SHA1 e824197381e55771bf91fe67f3652dd0e75bd4fa
- SHA512 31bd692fe817af9de4c4aaf26d4f37011827014cf86f8a08e51e9ec77114f0130dd17dcfb9360bb141e0432f0bd9d6ecf59c609e1bb63bdc496fa0309044fbb4
- SSDEEP 1536:EuyRNTAGo2s7LI5ymUbZFyn62MHKdVal7:Euy/TAGo2s3I5ymUbZ462Mqval7
- TLSH T13A435D0037E9C167F1BE4F7499F321058676F2772613C64D1CC402AB9613BC69A53AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5.exe
- IMPHASH a50a0d82b9120fc73965c28fea79e1f9
- SHA256 391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5
- MD5 bd440d2c348b4cc4b6ad75f92d9e1c13
- SHA1 faafd96ac68278360353c35d0bf3d5a353292f11
- SHA512 8da82f0496b1a7bcb6cf0523858efd7110f1da5320399bc9be7d23cdd9a53716685af5619559265edb858d50e7c9abb1ebb63fa67aca6f06c9869528046d5ea1
- SSDEEP 3072:Iy1IbCkfer2IsGpQf8oFTO3PfvXdG4pcT+fwfNZi5kSpRIFf34icFQ+d5S:IcxkOTpQ8olO/fvc5T+iNEkJ34igQ+/S
- TLSH T17DF31265F34C0FBEE8A26EB6586C578054CB4BEA40942FCBE56C6B9C03CD31429FC956
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
111727
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
TextOutW
SetTextColor
SetPixel
SelectObject
GetTextMetricsW
user32
EndDialog
GetDlgItem
GetDlgItemTextW
GetKeyNameTextW
GetMessageW
LoadMenuW
DialogBoxParamW
CreateWindowExW
CreateDialogParamW
GetClassNameW
kernel32
GetDateFormatW
LoadLibraryExA
GetTickCount
GetProcAddress
GetModuleHandleW
GetLocaleInfoW
GetCommandLineA
FormatMessageW
GetLastError
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
393a7a313548a4edc025fb47c6c8e614ecc2b41db880ecb59f20cf238e9a864c.exe
- IMPHASH 202fa14f574c71c2f95878e40a79322d
- SHA256 393a7a313548a4edc025fb47c6c8e614ecc2b41db880ecb59f20cf238e9a864c
- MD5 7cdc8057b3fe13b069b8db93fdde1764
- SHA1 8ddd3c69fe3935e4903a2b397bc6f0de772a1bcb
- SHA512 7a7778b03a681bad08722019d27c2ca56609cbe6ec6e976b2d08e402b7ec5f2c7ad7d935632c0958b15b42d3dd066b1bd03707a778d77592a29b92adae684801
- SSDEEP 1536:y8JknEUnj2zfGN2/PEiTsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2XsfzK7g:ynlnj2S+hTsrQLOJgY8Zp8LHD4XWaNHY
- TLSH T1C4933C10D884E2F3D9E629355697F19EC43923310335A687A7C0276DF7902EAF629F27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
44016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
OpenProcess
GetTickCount
GetModuleHandleA
GetProcAddress
LoadLibraryA
lstrcmpW
lstrlenW
SetVolumeMountPointW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
lstrlenA
GetCommandLineW
FindClose
FindFirstFileW
FindNextFileW
GetFileSizeEx
GetCurrentProcess
ReadFile
SetFileAttributesW
SetFilePointerEx
WaitForSingleObject
CreateMutexA
WaitForMultipleObjects
GetCurrentProcessId
ExitProcess
CreateThread
ExitThread
SetProcessShutdownParameters
GetSystemInfo
lstrcmpiW
lstrcpyW
lstrcatW
OpenMutexA
MoveFileExW
WideCharToMultiByte
HeapAlloc
HeapFree
GetProcessHeap
ReleaseSemaphore
CreateSemaphoreA
TerminateProcess
Sleep
GetLastError
CloseHandle
GetVolumePathNamesForVolumeNameW
GetDriveTypeW
FindVolumeClose
FindNextVolumeW
GetLogicalDrives
FindFirstVolumeW
user32
wsprintfA
advapi32
QueryServiceStatusEx
OpenSCManagerA
EnumDependentServicesA
ControlService
CloseServiceHandle
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
OpenServiceA
shell32
SHEmptyRecycleBinA
CommandLineToArgvW
ShellExecuteW
netapi32
NetShareEnum
NetApiBufferFree
rstrtmgr
RmGetList
RmStartSession
RmEndSession
RmRegisterResources
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
WNetGetConnectionW
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.CRT
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=15, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=10, id=261, version=31329,
count=1, id=258, version=31329,
406a89dab9ccaf9c5ddc064d3f19875259de9564f93a240c7123e53aadfd6006.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 406a89dab9ccaf9c5ddc064d3f19875259de9564f93a240c7123e53aadfd6006
- MD5 d70ae22b29979d72b01a50b4ca960dd9
- SHA1 8df37a8d07ccd56fe161288de626eeab8329a176
- SHA512 3be78b05986795db228a5cb70ae440d545131a3589ac54f72712f964d4a15e6fcadaa3f76e451065d4a563e8c4b46f51c8341582b64d0de532a1228d57360767
- SSDEEP 12288:+SheDWOxIJHXJkQ28AFiE+nMwoCzPiaSdA3uSheDWOxIJHXJkQ28AFiE+nMwoCzZ:NkInAFcjkInAFc
- TLSH T1D6C4383439FA501AB173EFA69BE478DADA6FB3733B07645D1091038A4723981DDC253A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
595198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
573KB
Virtual Size
573KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
411a98777829cd43945f5390efbb9ff7835dbe0fc07e6bf07f2713f037c5b477.unknown
- SHA256 411a98777829cd43945f5390efbb9ff7835dbe0fc07e6bf07f2713f037c5b477
- MD5 76a926bab38d30882b45a4b12879f754
- SHA1 50359d69e63929642e08f95a55e1a46191497f4b
- SHA512 a8ef9184368810b8e9a8694809724a82020da4d759e9bcb8f97d23edec15fc3163a14d0ea6daad651b399b3abf75d795280dea9db96810ad3a815d03b00a0036
- SSDEEP 96:1soCXLXXCKyHmOZTePkEHWHcY5hxlLhTAPkDKHTHustB3B4rcf9QGfMXoPq5K8qI:1soOCGozKwhF3nQbTAM9S
- TLSH T1D2D1750A15AE87318471B624F90E6557F75F71CBF0A36E8433881394DFA450ECA9ADEC
- MD5 SHA1 SHA512 SSDEEP TLSH
416d2f821b7cb984859cfce43be981c5c9bc1489446ba41951c041d5801b65cb.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 416d2f821b7cb984859cfce43be981c5c9bc1489446ba41951c041d5801b65cb
- MD5 39f33d6842fa6495ccd7a41e8ddcb9b8
- SHA1 61cd2b3e22e2e6e514d611d3154e001f7e9fd195
- SHA512 97e8b15b82b70efebbf5cbfbbd4ac4925a7300049f5866bf01b59396de43c633342b5bc2ed657aae573c9f77e2dd20fe67234110aef048c49a2af9c8bd45dc29
- SSDEEP 3072:iMMFnguNpdYSkMXV2KMMEuWgY792XaY6UTuuAk2usbA+klAGPqhdp4efHxub8ehY:ideMXVeuWgY79OWpmq/yQxuAeS9Jb/
- TLSH T12964D003AF068E53DB180B755F2A3814972A9E48C4F366897C513C99B9F7282CFED179
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect MafiaWare666 ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
235010
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\cudden\Downloads\EncrypterPOC-main\EncrypterPOC-main\WindowsFormsApp1\obj\Debug\NitroSniper 2021.pdb
mscoree
_CorExeMain
Name
.text
Size
222KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
421af5adde9ca3fd3312067c0a113faaef07a88241df3ed1538d96145aab4303.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 421af5adde9ca3fd3312067c0a113faaef07a88241df3ed1538d96145aab4303
- MD5 feb85358ad7eaa596eece81f3aa68bac
- SHA1 7074c266e387f90bc85b329d46cecaf6101d9852
- SHA512 0a62453784fad941949bc651444b515abaad0380468545c3eef9eb6a0fc395bd7de9650ad24d5a2eef1b4e9ce1a16343b5c3240eabd739f8ec8615918b991b7b
- SSDEEP 3072:lk8bx9YtlSHPOpRZkbISJhDgRo2o41q8lh8Fuz+WSMzbrsfyb50E3QBSfUqK1K3z:jK+8RJq8wFu1Cyd0E3QMfhqK3cq
- TLSH T1DE24D1B2A2F0FF02F66A4E7D23304D4012A429738B9A9905B9EFE3D555D3D60612F6D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects NoCry ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
221582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
208KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
428d162ec89c51946ac87fb0b87a614470f56ff61eca07a9391fcab9e103188a.exe
- SHA256 428d162ec89c51946ac87fb0b87a614470f56ff61eca07a9391fcab9e103188a
- MD5 60362644be2cc2012ce94e27e44275bc
- SHA1 3f6e7e56a0637b520b3ccd5f03dd657eeff28406
- SHA512 1502d22915705638c7845065cb66182599a7dc8efecf54a26cdc2274a455d97ed419f11f1cfdabdc4bcf8311a6fffe8db6782f29767cef739485d6494da3a290
- SSDEEP 24576:mLCLPcjjGhi9ZyQlnK4ORRhMTstIwYJDaNjReEK:KjM8EQd7OeTKlY1aPrK
- TLSH T122358D1A66AC00E9E0BBD1788D624506E7B17C5A17719FDF12E2274B1F736E09E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
389476
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
702KB
Virtual Size
701KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
31KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=260, version=26715,
count=13, id=259, version=26715,
count=189, id=261, version=26715,
count=17, id=260, version=28920,
count=10, id=259, version=28920,
count=155, id=261, version=28920,
count=9, id=257, version=26715,
count=171, id=1, productName=Unmarked objects,
count=43, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=259, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=265, version=29111,
count=1, id=255, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=258, productName=VS2019 v16.7.1 build 29111, version=29111,
432c917a2ef72aaa140ae8a79112fb80806d2740a465201e1298c1ed40040eb9.exe
- SHA256 432c917a2ef72aaa140ae8a79112fb80806d2740a465201e1298c1ed40040eb9
- MD5 dbb9d0482cb2a3b96f547b8e08c0dd5c
- SHA1 49eca1673deb5f1da084f4ece717c3af24b0e2a6
- SHA512 f7267c19b23faa8883902a3f0c3b5ee0db6d6d3aa0437b779d9f200c5b6551ee1a28c8e578ebd9518d2d82cf2be76050ce3c87d9f5c9d30c3b0d09867ee7bc09
- SSDEEP 6144:JHEmrnWIHf5Kt4m6bkyotM4dxtsXgrNfl0EUl0srjnLop:JHEmjH/5KtEbkRtM0jflnUWILop
- TLSH T122942A2570829AEAEDB554751A64FBFDA92CB4B00BA40EF7B7C649B404E03C26774F13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Seven ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
162098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
273KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
129KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.imports
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=12, id=241, version=40116,
count=162, id=243, version=40116,
count=27, id=242, version=40116,
count=22, id=259, version=23013,
count=61, id=261, version=23013,
count=66, id=260, version=23013,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=169, id=1, productName=Unmarked objects,
count=2, id=265, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
495d9eca1e009ecdd97618f096da1d8407b1910523fbdf2cf8b869bf7e6c1c18.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 495d9eca1e009ecdd97618f096da1d8407b1910523fbdf2cf8b869bf7e6c1c18
- MD5 5bb81fa8ae72697f375dc658d61b7b8d
- SHA1 7fd812be4f56bc59b2083d5ca8e3fdad75a0362f
- SHA512 a18b0aa3936d671d98936be6bacdda24806ae12a084a4a73f8c231994e7c695893908d9282ad5dbe96cec913ec999d0973b3e9ac7e21428dd2addb66b0230332
- SSDEEP 3072:/6w9+FrD19ZQb5J5QOgdPrY7zE551QGWiE55k:Uubf
- TLSH T11214211163ED9695F6F75EB06CB0E03219B5BD66A931E02D29C03D9F35F1FC48A60B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
146270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
135KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
499e1eddf39a47eb3392be7e0cbd906f15e22bf9cb10c55dbd34f433772c0f8d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 499e1eddf39a47eb3392be7e0cbd906f15e22bf9cb10c55dbd34f433772c0f8d
- MD5 dba2ecd56c04d2d289d3294feedaf9dd
- SHA1 ba5cba6a029a63a1c81cb821cc91c0f54bcf7a54
- SHA512 4693ec19c1b729ade2bced8bea0b03b16695562d9aa6b5e0e2abe9f83e03e33585fb86013d6f29b141cc95a8feda68b2ca26960b0b6ff8a49b32c6c81cc6111d
- SSDEEP 49152:GjLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:6Lu1TIRtUOV5Zv
- TLSH T125265B1577D48126E0BF4739587393842372F8939D23876F31A0A76E7D727808DA2B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects NominatusCrypto C# variant
-
Detects NominatusCrypto DOS executable variant
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\sd\Documents\SharpDevelop Projects\VirusMSILNominatusStorm\VirusMSILNominatusStorm\obj\Debug\VirusMSILNominatusStorm.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ