jaffacakes118_samples.part019.rar
- SHA256 1a7bbd596d6076a0f9364f41dc6235031f249d52403bb6e9f5582068de3e286c
Overview
overview
10Static
static
1003309c90e6...69.exe
windows10-2004-x64
1003309c90e6...69.exe
windows11-ltsc_2024-x64
1005072a7ec4...7f.exe
windows10-2004-x64
1005072a7ec4...7f.exe
windows11-ltsc_2024-x64
1007117c02a0...99.dll
windows10-2004-x64
307117c02a0...99.dll
windows11-ltsc_2024-x64
32624a0becf...b5.exe
windows10-2004-x64
102624a0becf...b5.exe
windows11-ltsc_2024-x64
102756b78e9d...21.exe
windows10-2004-x64
102756b78e9d...21.exe
windows11-ltsc_2024-x64
102790fbc25d...cb.exe
windows10-2004-x64
12790fbc25d...cb.exe
windows11-ltsc_2024-x64
13107e64c2b...d8.exe
windows10-2004-x64
103107e64c2b...d8.exe
windows11-ltsc_2024-x64
103123adc3a2...0a.exe
windows10-2004-x64
103123adc3a2...0a.exe
windows11-ltsc_2024-x64
13424a8c9c9...0e.exe
windows10-2004-x64
103424a8c9c9...0e.exe
windows11-ltsc_2024-x64
10Antivirus_...f2.dll
windows10-2004-x64
10Antivirus_...f2.dll
windows11-ltsc_2024-x64
104481b936a2...c4.exe
windows10-2004-x64
104481b936a2...c4.exe
windows11-ltsc_2024-x64
105165cd6115...bc.exe
windows10-2004-x64
105165cd6115...bc.exe
windows11-ltsc_2024-x64
105211ad8427...aa.dll
windows10-2004-x64
105211ad8427...aa.dll
windows11-ltsc_2024-x64
105221cbfcd9...97.exe
windows10-2004-x64
105221cbfcd9...97.exe
windows11-ltsc_2024-x64
75339c1fc00...e2.exe
windows10-2004-x64
105339c1fc00...e2.exe
windows11-ltsc_2024-x64
15458f18e36...fc.exe
windows10-2004-x64
105458f18e36...fc.exe
windows11-ltsc_2024-x64
10Static task
static1
27 signatures
Behavioral task
behavioral1
Sample
03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
Behavioral task
behavioral5
Sample
07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral8
Sample
2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral9
Sample
2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral10
Sample
2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
2790fbc25dae73ea4526ea5e39baf5bc9e44947258b05f43a01ec71f118e9bcb.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
2790fbc25dae73ea4526ea5e39baf5bc9e44947258b05f43a01ec71f118e9bcb.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral14
Sample
3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral15
Sample
3123adc3a214dc483cbc17c9fa4342a549f7dc7d7dd700bd87f48d2831efc50a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral16
Sample
3123adc3a214dc483cbc17c9fa4342a549f7dc7d7dd700bd87f48d2831efc50a.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
3424a8c9c995896f9d6fe3bb4a164d0d8675a781f9f9c32286a5472ce8e9e50e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral18
Sample
3424a8c9c995896f9d6fe3bb4a164d0d8675a781f9f9c32286a5472ce8e9e50e.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral19
Sample
Antivirus_Upgrade_Cloud.1d094d24ac37f2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral20
Sample
Antivirus_Upgrade_Cloud.1d094d24ac37f2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral22
Sample
4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral23
Sample
5165cd61158a14ba2f90c275d29d8271b1f0c5669ebcdc620edd86ee90474dbc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
5165cd61158a14ba2f90c275d29d8271b1f0c5669ebcdc620edd86ee90474dbc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
5221cbfcd9be738e23a42dd9cda8aa1a9b085c05bf3e0f43b593e2f1e6909597.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral28
Sample
5221cbfcd9be738e23a42dd9cda8aa1a9b085c05bf3e0f43b593e2f1e6909597.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral29
Sample
5339c1fc009133bdcb1f004710538a3ed3885c7474108d3e0fa6fe2624d6f2e2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral30
Sample
5339c1fc009133bdcb1f004710538a3ed3885c7474108d3e0fa6fe2624d6f2e2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral32
Sample
5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target jaffacakes118_samples.part019.rar
- Size 15.0MB
- Sample261011-v4fdlsbv7x
- SHA256 1a7bbd596d6076a0f9364f41dc6235031f249d52403bb6e9f5582068de3e286c
- MD5 63b9624b063ffc665ab6d07e6c75fe70
- SHA1 a9796e7856935bb68907b8d4427cf0bdd30bd6b0
- SHA512 c7c9eef6262f5092fe7dd8f48009b9a459cc9f731d08271495b5bf9e954d1719bd9cc01700592b2bfdbe470887f760feafa5af863a0bb01cf90e5f7cfc7613c9
- SSDEEP 393216:N8iUN/jwdIcAccosGE/i/Av1I4aQ372PhkgZmcTEE4q:tUqyLJGsi/MS4V2pZmG4q
- TLSH T197F6330755F881E76CF2C9F699F1DE0783730400B5AA426D8E758BFAE6C1A1B6EB1314
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
HacKed
C2
-
192.168.0.161:2478
Mutex
-
0a477f3e02d48d76a648160656e258c9
Attributes
-
reg_key
0a477f3e02d48d76a648160656e258c9
-
splitter
|'|'|
Signatures
- Family: Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
- Family: BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
- Family: Chaos
Ransomware family first seen in June 2021.
- Family: MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
- Family: MedusaLocker
Ransomware with several variants first seen in September 2019.
- Family: NominatusCrypto,NominatusStorm
NominatusCrypto aka NominatusStorm is a ransomware written in C#.
- Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
- Family: Venus
Venus is a ransomware first seen in 2022.
- Family: Xorist Ransomware
Xorist is a ransomware first seen in 2020.
- Family: Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
- Chaos Ransomware 1 IoCs
resource yara_rule static1/unpack001/6480fc12292296a76979f4340ec0432a69ff466792f8eb3281558617df45aa48.exe family_chaos - Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule static1/unpack001/8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe family_mafiaware666 - Detected Xorist Ransomware 1 IoCs
resource yara_rule static1/unpack004/out.upx family_xorist - Detects BlackBasta Ransomware 2 IoCs
resource yara_rule static1/unpack001/07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799.dll family_blackbasta_2 static1/unpack001/5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa.dll family_blackbasta_2 - Detects NominatusCrypto C# variant 3 IoCs
resource yara_rule static1/unpack001/2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5.exe family_nominatuscrypto_dotnet static1/unpack001/4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4.exe family_nominatuscrypto_dotnet static1/unpack001/7112a45ea2f6672b908d3e74967448d37ac3a2a3a21e6945d0723280e952f5da.exe family_nominatuscrypto_dotnet - Detects NominatusCrypto DOS executable variant 3 IoCs
resource yara_rule static1/unpack001/2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5.exe family_nominatuscrypto_dos static1/unpack001/4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4.exe family_nominatuscrypto_dos static1/unpack001/7112a45ea2f6672b908d3e74967448d37ac3a2a3a21e6945d0723280e952f5da.exe family_nominatuscrypto_dos - Detects Seven ransomware 2 IoCs
resource yara_rule static1/unpack002/out.upx family_seven static1/unpack001/7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe family_seven - Detects Zeppelin payload 1 IoCs
resource yara_rule static1/unpack001/7757c11c449860e2dd54ae97e05835fb39f89a9c93f32dfc23b258ad49c3622e.exe family_zeppelin - MedusaLocker payload 1 IoCs
resource yara_rule static1/unpack001/6066e91a9b651a9061d3f0941e6686ff476e5e84e11a51ec3bcae049d84b366b.exe family_medusalocker - Venus Ransomware 1 IoCs
resource yara_rule static1/unpack001/8045ad5cda6c42e5669cf52e492c004d842c7ae6f8a09522134834d0f57347eb.exe family_venus - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack003/Antivirus_Upgrade_Cloud.1d094d24ac37f2.cpl - ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe ConfuserEx static1/unpack001/8236c2d4fa44ce877dec977d323065c8c9a7f46635366bd27b9acf46c1d12d24.exe ConfuserEx - SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
resource yara_rule static1/unpack001/5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe SmartAssembly -
resource yara_rule static1/unpack001/3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8.exe upx static1/unpack001/6269c641b9c51dc32fec94cc0dc0f7116b1686eec750bd1297133844419cfea1.exe upx static1/unpack001/6471a7f99df7a48e01bb7a7ebca3d638c5f6bf8f7feffd84f177cf969609819d.exe upx - Unsigned PE 41 IoCs
Checks for missing Authenticode signature.
resource unpack001/03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe unpack001/05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe unpack001/07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799.dll unpack001/2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5.exe unpack001/2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe unpack001/2790fbc25dae73ea4526ea5e39baf5bc9e44947258b05f43a01ec71f118e9bcb.exe unpack001/3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8.exe unpack002/out.upx unpack001/3123adc3a214dc483cbc17c9fa4342a549f7dc7d7dd700bd87f48d2831efc50a.exe unpack001/3424a8c9c995896f9d6fe3bb4a164d0d8675a781f9f9c32286a5472ce8e9e50e.exe unpack001/4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4.exe unpack001/5165cd61158a14ba2f90c275d29d8271b1f0c5669ebcdc620edd86ee90474dbc.exe unpack001/5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa.dll unpack001/5221cbfcd9be738e23a42dd9cda8aa1a9b085c05bf3e0f43b593e2f1e6909597.exe unpack001/5339c1fc009133bdcb1f004710538a3ed3885c7474108d3e0fa6fe2624d6f2e2.exe unpack001/5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe unpack001/6066e91a9b651a9061d3f0941e6686ff476e5e84e11a51ec3bcae049d84b366b.exe unpack001/6269c641b9c51dc32fec94cc0dc0f7116b1686eec750bd1297133844419cfea1.exe unpack004/out.upx unpack001/6471a7f99df7a48e01bb7a7ebca3d638c5f6bf8f7feffd84f177cf969609819d.exe unpack001/6480fc12292296a76979f4340ec0432a69ff466792f8eb3281558617df45aa48.exe unpack001/6485af5032466d4171f7b8dc6e819a9638b3845ace73309681f4763ae3430a3a.exe unpack001/7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6.exe unpack001/7112a45ea2f6672b908d3e74967448d37ac3a2a3a21e6945d0723280e952f5da.exe unpack001/7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe unpack001/7247f33113710e5d9bd036f4c7ac2d847b0bf2ac2769cd8246a10f09d0a41bab.exe unpack001/7757c11c449860e2dd54ae97e05835fb39f89a9c93f32dfc23b258ad49c3622e.exe unpack001/7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe unpack001/7934f58d59c52bd585febb83bbdc8726c4a02313609d8d0380cd1167f0f91671.exe unpack001/8045ad5cda6c42e5669cf52e492c004d842c7ae6f8a09522134834d0f57347eb.exe unpack001/8209b64a1d6982efbe3ff4924e17a9b07db3d8f0d71f4c8eee2bc68f231dca23.exe unpack001/8236c2d4fa44ce877dec977d323065c8c9a7f46635366bd27b9acf46c1d12d24.exe unpack001/8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe unpack001/8808e4e220fcda37bdb05b703e86053f88a6ebd68037d37ef89754c459d7ad2b.exe unpack006/$PLUGINSDIR/System.dll unpack006/$PLUGINSDIR/nsDialogs.dll unpack006/uninstall.exe unpack007/$PLUGINSDIR/LangDLL.dll unpack007/$PLUGINSDIR/System.dll unpack007/$PLUGINSDIR/nsDialogs.dll unpack001/8955db80bf0b9e71069ef8085f116c56e9525a8ffc64b665e0f7ecd9edcfac5f.exe - NSIS installer 4 IoCs
resource yara_rule static1/unpack001/8808e4e220fcda37bdb05b703e86053f88a6ebd68037d37ef89754c459d7ad2b.exe nsis_installer_1 static1/unpack001/8808e4e220fcda37bdb05b703e86053f88a6ebd68037d37ef89754c459d7ad2b.exe nsis_installer_2 static1/unpack006/uninstall.exe nsis_installer_1 static1/unpack006/uninstall.exe nsis_installer_2
File Explorer
-
jaffacakes118_samples.part019.rar.rar 15.0MB
-
03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe.exe 716KB
-
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe.exe 1.4MB
-
07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799.dll.dll 838KB
-
2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5.exe.exe 2.6MB
-
2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe.exe 780KB
-
2790fbc25dae73ea4526ea5e39baf5bc9e44947258b05f43a01ec71f118e9bcb.exe.exe 435KB
-
3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8.exe.exe 131KB
-
out.upx.exe 367KB
-
3123adc3a214dc483cbc17c9fa4342a549f7dc7d7dd700bd87f48d2831efc50a.exe.exe 182KB
-
3424a8c9c995896f9d6fe3bb4a164d0d8675a781f9f9c32286a5472ce8e9e50e.exe.exe 37KB
-
4104fa712aa8c34f0761edd14cf57b883eba861c0a6c1f9d6e0b3bf685d897b9.zip.zip 72KB
-
Antivirus_Upgrade_Cloud.1d094d24ac37f2.cpl.dll 271KB
-
4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4.exe.exe 5.4MB
-
5165cd61158a14ba2f90c275d29d8271b1f0c5669ebcdc620edd86ee90474dbc.exe.exe 3.0MB
-
5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa.dll.dll 850KB
-
5221cbfcd9be738e23a42dd9cda8aa1a9b085c05bf3e0f43b593e2f1e6909597.exe.exe 115KB
-
5339c1fc009133bdcb1f004710538a3ed3885c7474108d3e0fa6fe2624d6f2e2.exe.exe 265KB
-
5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe.exe 100KB
-
5634e4e97a71930c574b80e50ee479ab782b6888f5af31c7e7529fa651377f50.exe683KB
-
6066e91a9b651a9061d3f0941e6686ff476e5e84e11a51ec3bcae049d84b366b.exe.exe 666KB
-
6269c641b9c51dc32fec94cc0dc0f7116b1686eec750bd1297133844419cfea1.exe.exe 7KB
-
out.upx.exe 12KB
-
6417c606fc6220ff91727a6c210e9707b95bf79bf6f56bb1987923fb66416cb6.macho.macho 3.2MB
-
6471a7f99df7a48e01bb7a7ebca3d638c5f6bf8f7feffd84f177cf969609819d.exe.exe 646KB
-
6480fc12292296a76979f4340ec0432a69ff466792f8eb3281558617df45aa48.exe.exe 552KB
-
6485af5032466d4171f7b8dc6e819a9638b3845ace73309681f4763ae3430a3a.exe.exe 173KB
-
7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6.exe.exe 458KB
-
7112a45ea2f6672b908d3e74967448d37ac3a2a3a21e6945d0723280e952f5da.exe.exe 4.4MB
-
7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe.exe 368KB
-
7247f33113710e5d9bd036f4c7ac2d847b0bf2ac2769cd8246a10f09d0a41bab.exe.exe 153KB
-
7757c11c449860e2dd54ae97e05835fb39f89a9c93f32dfc23b258ad49c3622e.exe.exe 211KB
-
7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe.exe 90KB
-
7934f58d59c52bd585febb83bbdc8726c4a02313609d8d0380cd1167f0f91671.exe.exe 701KB
-
8045ad5cda6c42e5669cf52e492c004d842c7ae6f8a09522134834d0f57347eb.exe.exe 225KB
-
8209b64a1d6982efbe3ff4924e17a9b07db3d8f0d71f4c8eee2bc68f231dca23.exe.exe 500KB
-
8236c2d4fa44ce877dec977d323065c8c9a7f46635366bd27b9acf46c1d12d24.exe.exe 95KB
-
8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe.exe 267KB
-
8808e4e220fcda37bdb05b703e86053f88a6ebd68037d37ef89754c459d7ad2b.exe.exe 169KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/modern-header.bmp9KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
OT670KB
-
uninstall.exe.exe 71KB
-
$PLUGINSDIR/LangDLL.dll.dll 5KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/modern-header.bmp9KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
8955db80bf0b9e71069ef8085f116c56e9525a8ffc64b665e0f7ecd9edcfac5f.exe.exe 152KB
-
9095bbb4b123a353a856634166f193124bdc4591cb3a38922b2283acc1d966d6.jse.jse 186KB
03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969.exe
- IMPHASH 23f9df8e3fa0bbe313771c0a01ac6eae
- SHA256 03309c90e6c60a2e3cd44374efa3003ae10cd9e05ba6a39c77aa5289b32cb969
- MD5 ac625552601c190656dcb8cf4c21cd1d
- SHA1 acad7a91c2812a0652d62f252774454c217666e9
- SHA512 9e04dbbc624e808a678e64648dbc12deb286341876ea4590d50f996732dde2b91c6b7defbffcbdd3883c74a98488a0ad26540b364942d3117625770bc4e5e6d3
- SSDEEP 12288:nB6xrkyoUKbidQN0M2TNK36YPiCuL1+jZ5tXdAD6x/NJxaZUzrd9gW6PdrO5SAou:nwrkyoUGJJgWQrOUAua
- TLSH T100F47C2A779C01F8E177D2798C954646F7F17C0613615BCF83A04AAA2F2F6B41E7A390
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
313928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wldap32
ord88
ord13
ord191
ord135
ord206
ord224
ord140
ord27
ord26
ord41
ord72
ord215
ord14
ord145
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
GetCurrentDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
GetVolumeInformationW
GetTempPathW
GetVolumePathNamesForVolumeNameW
CloseHandle
GetLastError
DeviceIoControl
ReleaseMutex
CreateMutexW
OpenMutexW
SetEnvironmentVariableW
GetCurrentProcessId
GetTickCount
GetModuleFileNameW
LocalAlloc
LocalFree
FormatMessageW
CopyFileW
MoveFileW
FreeConsole
GetComputerNameExW
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
Sleep
GetSystemTimeAsFileTime
FormatMessageA
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
QueryPerformanceCounter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
RtlUnwind
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
SetFileAttributesW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
user32
SystemParametersInfoW
shell32
SHChangeNotify
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
VariantInit
SysFreeString
SysAllocStringLen
SysAllocString
advapi32
RegSetValueExW
RegCreateKeyExW
SetSecurityDescriptorDacl
SetFileSecurityW
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetEntriesInAclW
Name
.text
Size
516KB
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=28900,
count=187, id=261, version=28900,
count=17, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=10, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=21, id=260, version=28900,
count=94, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=15, id=257, version=28900,
count=203, id=1, productName=Unmarked objects,
count=1, id=260, version=31329,
count=6, id=261, version=31329,
count=1, id=255, version=31329,
count=1, id=258, version=31329,
05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f
- MD5 0ada88218b67a313a4f5ab0062fbc4e6
- SHA1 15dfcef932d666fdc7501bcee357ec2aabfcfdee
- SHA512 0b217e5aa8b17d347dbb05507cb5cf179328aad593fb65a8083ca8c300de4901eb55e6c8e971ce3280f50ceefd327332cfafde0280e09044d8da1dc8e20a49ed
- SSDEEP 24576:J6w15zVAFj5WEx9+22sHFXVYmLmYy+vz236ZSV8BGxon3sgGhzl1KsIVy:QsV85WU9+ElYmyZMz23sSyBGdgelIsj
- TLSH T17F65138581910B9BDC0143339D271B86BBB108355174EB16FBE3B39D7DE9310BE46AEA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1451230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\User\source\repos\A.E.S.R.T\A.E.S.R.T\obj\Debug\A.E.S.R.T.pdb
mscoree
_CorExeMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799.dll
- IMPHASH 49336329916f610627e1dfca1c33c427
- SHA256 07117c02a09410f47a326b52c7f17407e63ba5e6ff97277446efc75b862d2799
- MD5 afa27795c0c86b6afeb138d0fb09506b
- SHA1 d32e44f7e04a8c84e7159ed020dcf26b6e51416e
- SHA512 85e92d60000981d836c8fe102a191e21c94f6add14fef0dd33816060699dfa5a05e1db38bd8b7194ad9e1ff30240bfdf807f91d0abe535733e2a2fc1d7264fc0
- SSDEEP 24576:pyAo7FAIP03acBtXWKe25ep59MxQU08wHG3MJAQof1hB:Lo7ARBtmKe28MSU08wHaM6Qo1hB
- TLSH T13D05AF11B6AAE0B0D69D00F508386F1665BDFC6407B08EEB67C87E2FBE352C14636E55
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BlackBasta Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
424722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetTempPathW
GetLastError
CreateMutexW
OpenMutexW
CreateProcessA
GetTickCount
lstrcmpW
MultiByteToWideChar
CreateFileW
WriteFile
CloseHandle
FindNextFileW
ReadFile
WaitForSingleObject
CreateThread
MoveFileW
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
SetEndOfFile
WriteConsoleW
SetStdHandle
FindFirstFileW
GetFileSizeEx
FindClose
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
VirtualQuery
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetModuleFileNameW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
HeapReAlloc
HeapSize
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
shell32
SHChangeNotify
advapi32
RegCreateKeyExW
RegSetValueExW
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom
VisibleEntry
Name
.text
Size
625KB
Virtual Size
625KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
142KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=259, version=28900,
count=190, id=261, version=28900,
count=23, id=260, version=28900,
count=18, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=25, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=85, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=9, id=257, version=28900,
count=155, id=1, productName=Unmarked objects,
count=41, id=261, version=31329,
count=1, id=256, version=31329,
count=1, id=255, version=31329,
count=1, id=258, version=31329,
2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2624a0becfcbe1ab95c8ecefb37b74c67eef218502c11b5e6446937c7ba31fb5
- MD5 8df1a9b8f79a0b13a3c1591ad38042f9
- SHA1 edab7f4055d17d2bade0ede1435c7254e09ec627
- SHA512 bfc807d2fd2304cb9682845b745da49f5211f1b2748e8f5dda497c6776bcf287898f9a81d17509a601abd7e7dd166ab5501981c35db5acd59d05e81408aec0a2
- SSDEEP 24576:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK+:KjLuSh3i+FtvkMzT+A
- TLSH T15DC55A4977D4C126C0BF0736487392852372F8979E1346AB34E5B32E7E757C04EA2AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects NominatusCrypto C# variant
-
Detects NominatusCrypto DOS executable variant
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\sd\Documents\SharpDevelop Projects\VirusMSILNominatusStorm\VirusMSILNominatusStorm\obj\Debug\VirusMSILNominatusStorm.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921
- MD5 712e164996f8a491ca08dd3eb4b5b16a
- SHA1 07fbb42d5168e3ce7f0aedb437e0a1cbca59ea5d
- SHA512 5ba44f6528907c94c0fb650dbdc0bfe7923e096961f05865f7a4ffab523d2c3e7d1bed095b69ce02cad5e830b7a5f4dccfd2e7a00ff291556259dd884023f078
- SSDEEP 12288:N8St0dbGh7Qzq95i05ymO63rcBaIiICzVcZLMAdGFRaTdlIG3pct1v1Ru9IZRtI:N8S6wNQm9hdoYVIChchnGahutXRjhI
- TLSH T1BE05127742B195F5C9581374F8A10F4F36ACC3245988B298F05BE2AADC1D64E9EF83B4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
827402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
~3y".
Size
728KB
Virtual Size
728KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
2790fbc25dae73ea4526ea5e39baf5bc9e44947258b05f43a01ec71f118e9bcb.exe
- IMPHASH ba2cdd8a9cd97d1e6bdd45cc80b9530d
- SHA256 2790fbc25dae73ea4526ea5e39baf5bc9e44947258b05f43a01ec71f118e9bcb
- MD5 4e70adee51ccfbdacacaeeecb7a377aa
- SHA1 fbb0a73c9e9841636be71bfea104b8aa43cb8d8b
- SHA512 e76513003f5cec1b4d9c0752a3c95d7bae0b4cb831a7b7bb35187f5e4648a3f8f4a98953a191f980dfb52988662cb0dd731f40f3270e7aca558d011bc82a00be
- SSDEEP 12288:/hvwwek908JYMyakTV1fZifGOUWRJ2mQ:Jw0uMyakJ1l+YmQ
- TLSH T12A944A47E3A250FCC06EC17847576533FA717C4C4525BB6B6BE0BA312E21B909B2EB16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
CloseHandle
CreateFileMappingA
CreateFileW
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DeleteFileW
DeviceIoControl
DuplicateHandle
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentThread
GetDriveTypeW
GetEnvironmentVariableW
GetFileInformationByHandle
GetFullPathNameW
GetLastError
GetLogicalDriveStringsW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemInfo
HeapAlloc
HeapFree
HeapReAlloc
LoadLibraryA
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RtlCaptureContext
RtlLookupFunctionEntry
SetFilePointerEx
SetLastError
SetThreadStackGuarantee
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnmapViewOfFile
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WriteConsoleW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwindEx
RtlVirtualUnwind
VirtualProtect
VirtualQuery
__C_specific_handler
netapi32
NetApiBufferFree
NetServerEnum
NetShareEnum
NetUseEnum
msvcrt
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_fmode
_fpreset
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf
Name
.text
Size
372KB
Virtual Size
371KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8.exe
- SHA256 3107e64c2b546d829cfb6be5abda66534fc08553669126ac31f2ded1c4cd97d8
- MD5 b7d1ed4093d0ef39c512cb517bce8916
- SHA1 2fcfceb83adfa7210bb71118710630acb566c698
- SHA512 f9a26d9b9d7e83c30a35fc78412f11aa774e881661288f8fd43e0495861d5484b765240f5e34d04ef8eb3ba23e792cdffcaac76a2eb5a377596a134b8fb3b2a5
- SSDEEP 3072:Mc7q9xwhoUhRPkkWfZf5wX/gowJOLEnlywUaBbeWWiUNU:Mz9xwhlkkS+Xoow0mlywJ4w
- TLSH T1E4D3028268BDDB1EF201453693077F79539862540FD39EEF0CFBE2246045F6AAB2B614
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
417984
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
129KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=12, id=241, version=40116,
count=162, id=243, version=40116,
count=27, id=242, version=40116,
count=22, id=259, version=23013,
count=61, id=261, version=23013,
count=66, id=260, version=23013,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=169, id=1, productName=Unmarked objects,
count=2, id=265, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
out.upx
- SHA256 c0aa10c796d534aa897505341b72d1279b094c785ddaa170bdb1213eefbcad78
- MD5 d393a535a675116e59999c99936d9df7
- SHA1 3ec4a67020ca8f6bd4b00d1467656877020e2ce9
- SHA512 84e19e20759d27b6fb26a87002d8f36f6788cd5563ce201ba8c801f633979d392893ff5e11da0e4b0fd0100432aa1ff51aa6c8ba3b0064060f7e11e0d8fc461c
- SSDEEP 6144:fHEmrnWIHf5Kt4m6bkyotM4dxtsXgrNfl0EU+0sr:fHEmjH/5KtEbkRtM0jflnUb
- TLSH T1F384092570829AEAEEB554751A64BBFDA92DF4304B640EF7B3C649B404E03C25B74F23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Xorist Ransomware
-
Detects Seven ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
162098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
273KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=162, id=243, version=40116,
count=27, id=242, version=40116,
count=22, id=259, version=23013,
count=61, id=261, version=23013,
count=66, id=260, version=23013,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=169, id=1, productName=Unmarked objects,
count=2, id=265, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
3123adc3a214dc483cbc17c9fa4342a549f7dc7d7dd700bd87f48d2831efc50a.exe
- IMPHASH 72567d001c30c3c46b19a98842491779
- SHA256 3123adc3a214dc483cbc17c9fa4342a549f7dc7d7dd700bd87f48d2831efc50a
- MD5 5a701b573cbe8b83a904c887af60104e
- SHA1 eb616c2de8d04ad836208a9ea347e66fecb6dcbe
- SHA512 970f3507df7dd4ac52c5648283069f6bbc6ce5016cbec49665f62b69ce338962e3bc9256d91c1271d3ecc99ddaf89f590cf601530a7be8aa70d6d97d8b020434
- SSDEEP 3072:tuTO4rRZiOWvXjmGh1XscjYU39Mq+ZDPUEMTlqjraE7Ehit2WpFGCOP:tkZVWvTmGhxas9gZDPFMTkGEA4sWpEJP
- TLSH T18B04AE47B3F400A9E176D27AC8F687169BB1BC110B7153DF26998A9A6F33BE04D35312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
95292
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msiexec.pdb
advapi32
CreateServiceW
RegisterEventSourceW
CloseServiceHandle
OpenProcessToken
DeleteService
OpenThreadToken
OpenSCManagerW
StartServiceCtrlDispatcherW
SetThreadToken
SetSecurityDescriptorGroup
OpenServiceW
GetTokenInformation
RegEnumKeyW
RegCreateKeyExW
EqualSid
RegQueryValueExW
DeregisterEventSource
InitializeSecurityDescriptor
RegDeleteKeyW
SetSecurityDescriptorDacl
LookupPrivilegeValueW
GetAce
GetSecurityDescriptorLength
RegGetKeySecurity
QueryServiceStatus
RegDeleteValueW
MakeAbsoluteSD
InitializeAcl
AllocateAndInitializeSid
SetServiceStatus
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
AddAccessAllowedAce
RevertToSelf
FreeSid
RegOpenKeyExW
MakeSelfRelativeSD
RegisterServiceCtrlHandlerW
ReportEventW
GetLengthSid
ControlService
RegEnumKeyExW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
kernel32
GetSystemDefaultLangID
ExitProcess
GetCommandLineW
GetEnvironmentVariableW
FreeLibrary
CreateProcessW
LoadLibraryExW
GetCurrentProcess
WaitForSingleObject
SetEvent
OutputDebugStringW
GetModuleHandleW
GetCurrentThread
WriteFile
InitializeCriticalSection
OpenProcess
GlobalAlloc
WideCharToMultiByte
LoadLibraryW
GetLocaleInfoW
Sleep
FormatMessageW
GetVersionExW
LeaveCriticalSection
GetModuleFileNameW
CompareStringW
GetACP
lstrcmpW
MultiByteToWideChar
lstrlenW
GetStdHandle
GetLastError
SetLastError
GetProcAddress
EnterCriticalSection
GlobalFree
UnhandledExceptionFilter
GetFileType
SetConsoleCtrlHandler
CreateEventW
SetCurrentDirectoryW
lstrcmpiW
OpenEventW
DeleteCriticalSection
CloseHandle
GetVersion
CreateThread
GetUserDefaultLangID
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
user32
DispatchMessageW
PeekMessageW
IsCharAlphaNumericW
TranslateMessage
MsgWaitForMultipleObjects
PostQuitMessage
GetMessageW
PostThreadMessageW
msvcrt
__dllonexit
_lock
_onexit
memcpy
memset
?terminate@@YAXXZ
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__C_specific_handler
__getmainargs
_vsnprintf
_vsnwprintf
wcsrchr
_wcsicmp
ntdll
RtlNtStatusToDosError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ole32
CoInitialize
StgOpenStorage
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
msi
ord222
ord141
ord228
ord78
ord280
ord240
ord136
ord8
ord196
ord88
ord131
ord190
ord70
ord148
ord169
ord199
ord175
ord197
ord184
Name
.text
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=215, id=1, productName=Unmarked objects,
count=65, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
3424a8c9c995896f9d6fe3bb4a164d0d8675a781f9f9c32286a5472ce8e9e50e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3424a8c9c995896f9d6fe3bb4a164d0d8675a781f9f9c32286a5472ce8e9e50e
- MD5 5c0e12b00990af8e6a82dee0c0e09d95
- SHA1 cf2be3ad4715d73a3d55c26f8eb972de163b255d
- SHA512 2cc6d4a725e1b21d1c0e7108c7103b17d6150add109bf4d3ce964e00210c3d7880b660c6a57e9c5695316fb60490328acc252232b63196cf76598c76b70c2ed2
- SSDEEP 384:BcOmK3hUidksXR21cGMy8PIU5fHkFlacPZrAF+rMRTyN/0L+EcoinblneHQM3epY:6OmK3bLGv8PIU58KcBrM+rMRa8NubGt
- TLSH T1F9033A4D7FE18168D5FD067B06B2D413077AE04B6E23D91E8EE164AA37636C18B50EF2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4104fa712aa8c34f0761edd14cf57b883eba861c0a6c1f9d6e0b3bf685d897b9.zip
- SHA256 4104fa712aa8c34f0761edd14cf57b883eba861c0a6c1f9d6e0b3bf685d897b9
- MD5 c248eab055964d5f6af9a9bc821813f1
- SHA1 f731cae47060c3095208b9704edd9099f123d80b
- SHA512 237d6a46cce7603e2eb88f9ad5c409b7d3c2e849eb0815d7fb4e111f31a44fed53357723f55b0ad4eb62b28a8103fdce0d943cc7c0690c2dcca715e0c3dc686b
- SSDEEP 1536:72i5PGKc6ToL74bKCyQDCeRvgLd1QkzKGAnZAShqDEOFX0c0mCw:K6GOoL71QbRvgR1QJnZWEO+c0e
- TLSH T11373024EF69D00D860C285316D96287E17968B64FE5AEAB70CE195173E7233FCD32B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Antivirus_Upgrade_Cloud.1d094d24ac37f2.cpl
- SHA256 f7cf9b53f0124b9fbc1cac8991b51a24a03f8feceb711677aae39b916a686c55
- MD5 1e19d57d74f09c03521d89cb75695281
- SHA1 28b57dc71d0c36aa5cfb65343711affb930d5adc
- SHA512 bc6fb08826f5cff9d606f42a3bd61eeb366f8b5a8545a1fb91db1ccb79d1719086e4815500753966e701b9f0503ec83ad3094125314b7bd42209f826c0840fa9
- SSDEEP 3072:rer5jmhgECqcvk23AvWli13fu3s4CaCyhvt2l7Fl50MSy9Vb:r9Cqcvk23AvWr3s/SW7WSvb
- TLSH T1F744494F2BA431D4C161C3B99B458391E1F138702B9232EF15E6FA7D8B539DE5A34B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
43:48:26:9b:81:d7:a5:1f:54:1f:74:ca:79:52:65:88:45:79:76:c6:8b:22:fc:58:49:4d:bb:50:72:a4:4b:91:47:89:ef:51:fe:c3:9f:8c:07:c0:8d:86:d9:52:e0:b8:f2:aa:d2:62:47:77:ec:83:a7:bf:fb:a7:64:53:49:a3
Digest Algorithm
sha512
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
1
Major OS version
6
Entry point
237048
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.odata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tdata
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.jdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=27412,
count=3, id=259, version=27412,
count=196, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=1, id=256, version=27412,
count=20, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4481b936a2246a640be36f9a37a15b4f89b3493f705c7fdb8af7df5445e8bcc4
- MD5 c74eef88110f2fe87a1af8e5745684de
- SHA1 c9db2870dd23947c41d3678267bebcb889a45821
- SHA512 cb58fec67e7279411991e66104d290802e0c09ef49d0eb63ca2a1bd7636cb611fe6dce53d636e907310f593239da4ec2c925882e97b9623134a6ca0836693bc4
- SSDEEP 49152:ljLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:VLu1TIRtUOV5Zv
- TLSH T10F464A05B7D88526D4BF473A593393841371FC939C23876F31A0A26E7E717908D92BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects NominatusCrypto C# variant
-
Detects NominatusCrypto DOS executable variant
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\sd\Documents\SharpDevelop Projects\VirusMSILNominatusStorm\VirusMSILNominatusStorm\obj\Debug\VirusMSILNominatusStorm.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
5165cd61158a14ba2f90c275d29d8271b1f0c5669ebcdc620edd86ee90474dbc.exe
- IMPHASH b9247c9e8d968989696a85c3451cc615
- SHA256 5165cd61158a14ba2f90c275d29d8271b1f0c5669ebcdc620edd86ee90474dbc
- MD5 591a72097e280ad1fd07cc5d0b81b180
- SHA1 ac838556c813413afbb58880754baca9d11d1807
- SHA512 2041f1c40a675199a01c7c3ae3a8ce2b6c5b38ed311a558bef70ed9100687af956459c8680ac24c34b0ef8c7bb705b7010671b5111043606a62a098f04b8e6d1
- SSDEEP 49152:+kKSYoAZCTE3TUzwkATt0uFZmcg9Bsle+iE7YCANGCm8A5FUj7+zsqmq7c+:+k5YoAZCgDG8T9pYBsVMTcIKs
- TLSH T177E5AE16FAA356EECDA71570385EB33AD7304A28001D8EA3D7D49E6CBD7E7201D8861D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
SetConsoleCursorPosition
AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AttachConsole
CancelIo
CloseHandle
CompareStringOrdinal
CopyFileExW
CreateEventW
CreateFileMappingA
CreateFileW
CreateMutexA
CreateNamedPipeW
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FormatMessageW
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
GetCommandLineW
GetComputerNameExW
GetComputerNameW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetLogicalDrives
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetTimeZoneInformation
GetVolumePathNamesForVolumeNameW
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
IsWow64Process
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
OpenProcess
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleW
ReadFile
ReadProcessMemory
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RemoveDirectoryW
SetConsoleCursorInfo
SetConsoleMode
SetConsoleTextAttribute
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetHandleInformation
SetLastError
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SetVolumeMountPointW
Sleep
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
TzSpecificLocalTimeToSystemTime
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
Wow64DisableWow64FsRedirection
WriteConsoleW
WriteFile
lstrlenW
DeleteCriticalSection
VirtualProtect
VirtualQuery
ntdll
NtOpenProcessToken
NtQueryInformationToken
RtlCaptureContext
advapi32
AddAccessAllowedAceEx
AddAce
AdjustTokenPrivileges
CloseServiceHandle
ControlService
CopySid
CreateProcessWithLogonW
CreateProcessWithTokenW
CreateServiceW
EnumDependentServicesW
EnumServicesStatusExW
GetAce
GetAclInformation
GetLengthSid
GetSecurityDescriptorDacl
GetTokenInformation
GetUserNameW
InitializeAcl
InitializeSecurityDescriptor
LogonUserW
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegisterServiceCtrlHandlerExW
SetSecurityDescriptorDacl
StartServiceCtrlDispatcherW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
ws2_32
WSACleanup
WSAGetLastError
WSASocketW
WSAStartup
bind
closesocket
connect
freeaddrinfo
getaddrinfo
ioctlsocket
recv
recvfrom
send
sendto
setsockopt
userenv
GetUserProfileDirectoryW
bcrypt
BCryptGenRandom
user32
ExitWindowsEx
GetProcessWindowStation
GetUserObjectSecurity
OpenDesktopW
SetUserObjectSecurity
SystemParametersInfoW
rstrtmgr
RmEndSession
RmGetList
RmRegisterResources
RmStartSession
shell32
SHTestTokenMembership
netapi32
NetApiBufferFree
NetServerEnum
NetShareEnum
msvcrt
__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_fpreset
_initterm
_iob
_onexit
_wcsicmp
abort
calloc
ceil
exit
fprintf
free
fwrite
malloc
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf
wcscat
wcscat_s
wcscpy
wcscpy_s
wcslen
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
871KB
Virtual Size
871KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa.dll
- IMPHASH e6d7144b5be0aafc78ec7bcd50d0a643
- SHA256 5211ad84270862e68026ce8e6c15c1f8499551e19d2967c349b46d3f8cfcdcaa
- MD5 4c54bec464ba0c2b9d522643e1b3ebe7
- SHA1 db497b95c79e41212577db0ba06777b62db209ff
- SHA512 ca9487b37a4163fba13442b6ffa728730cbb67f6b4dc8d6cf8ea8f3ae8099a3aab811cbcadc5e0c24511cf9670664bebd3b9da2fc98566f3a0279c50577ec763
- SSDEEP 24576:0Y/KwH785Qjo2tkYvEEGuzTWu523YxcAf:7/785Qjo2ZGuzTWI23IcAf
- TLSH T13A059E11B69AD0B0E79D04F50838BF2A65BDAC6007B08EE7A7D47D2FBE352C14636E45
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BlackBasta Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
432425
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
CreateMutexW
OpenMutexW
CreateProcessA
GetTickCount
GetModuleFileNameW
lstrcmpW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetVolumeInformationW
GetVolumePathNamesForVolumeNameW
CreateFileW
GetTempPathW
CloseHandle
GetFileSizeEx
ReadFile
WaitForSingleObject
CreateThread
MoveFileW
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
SetEndOfFile
WriteConsoleW
SetStdHandle
GetFileAttributesW
FindNextFileW
FindFirstFileW
WriteFile
FindClose
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
VirtualQuery
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
HeapReAlloc
HeapSize
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
shell32
SHChangeNotify
advapi32
RegSetValueExW
RegCreateKeyExW
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom
VisibleEntry
Name
.text
Size
635KB
Virtual Size
635KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=259, version=28900,
count=190, id=261, version=28900,
count=23, id=260, version=28900,
count=18, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=25, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=85, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=9, id=257, version=28900,
count=163, id=1, productName=Unmarked objects,
count=41, id=261, version=31329,
count=1, id=256, version=31329,
count=1, id=255, version=31329,
count=1, id=258, version=31329,
5221cbfcd9be738e23a42dd9cda8aa1a9b085c05bf3e0f43b593e2f1e6909597.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5221cbfcd9be738e23a42dd9cda8aa1a9b085c05bf3e0f43b593e2f1e6909597
- MD5 5ed0c11008735405eb7da211006c0ce4
- SHA1 60f9d5879c5fbb25f3a646de35476ad10e065963
- SHA512 9094b7ec634fbb7cd659d54f065feb9b1ccf0c25de808ff068550d639ec3f58dc66f16cfcaf4fba829fd074c17a02b1af5c11db811229f59cb1deca9e8c0fc84
- SSDEEP 1536:VKseKSZFwjA2er/0O8/oPKBJAgHFYpExXLE+wEGwqoiClW71r:XXSZ6LeN8/oPKBBHFYWxXo4q0o7V
- TLSH T1ABC3D7954173892CD86C86B811EB2F7817B5AF6A6450C71D4A74F2AD3E333B78C20B57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\33782\Desktop\Nitro-Ransomware\NitroRansomware\obj\Debug\CCleaner.pdb
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
5339c1fc009133bdcb1f004710538a3ed3885c7474108d3e0fa6fe2624d6f2e2.exe
- IMPHASH 14cf8f87d7eefee36338756e049a016b
- SHA256 5339c1fc009133bdcb1f004710538a3ed3885c7474108d3e0fa6fe2624d6f2e2
- MD5 1f0d38fc9ddcb17fdadd60ad4edf8dab
- SHA1 b05d811007c28819c81302ce85f4522ec4be3e9b
- SHA512 0b4c50aad016c3d330a95119a9d8002795661956a79afb7bdbd2c5a46465719442dc06a4a18df3e01b58c3bfa81553d251c2b2232801f22de027876235e1113a
- SSDEEP 6144:l9jyxFs9ob4OVFVOIwW9PE/z83yTB5xAuFQfaIIoo:ltyxFs9o3EcAzKyTfx9Qf3Ioo
- TLSH T19144AF0AB3A00DF5EC67C27ACD838755EA727C194770D34B125A87A65F233219E3E35A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
58120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
o:\src\python-3-trunk\lib\distutils\command\wininst-9.0-amd64.pdb
comctl32
CreatePropertySheetPageA
PropertySheetA
kernel32
FreeLibrary
SetStdHandle
GetStdHandle
LocalFree
FormatMessageA
GetTempFileNameA
GetTempPathA
GetModuleHandleA
GetVersionExA
ResumeThread
SetPriorityClass
GetCurrentProcess
GetCurrentThread
SetThreadPriority
CreateProcessA
GetModuleFileNameA
RemoveDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetModuleFileNameW
SetEndOfFile
CompareStringA
GetFileSize
GetLocaleInfoW
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetConsoleMode
SetFilePointer
ReadFile
DeleteFileA
LoadLibraryA
GetProcAddress
MultiByteToWideChar
lstrlenA
CompareStringW
UnmapViewOfFile
CreateFileA
GetLastError
DosDateTimeToFileTime
SetFileTime
CloseHandle
CreateFileMappingA
MapViewOfFile
GetFileAttributesA
CreateDirectoryA
SetLastError
GetConsoleCP
SetHandleCount
FatalAppExitA
DeleteCriticalSection
GetProcessHeap
RtlUnwindEx
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
EnterCriticalSection
LeaveCriticalSection
GetDateFormatA
GetTimeFormatA
HeapReAlloc
GetModuleHandleW
Sleep
ExitProcess
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
TlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
WriteFile
SetEnvironmentVariableA
SetEnvironmentVariableW
user32
wsprintfA
GetFocus
ShowWindow
SetCursor
GetDlgItem
SendDlgItemMessageA
GetParent
PostMessageA
GetWindowRect
MoveWindow
LoadCursorA
RegisterClassA
CreateWindowExA
MessageBoxA
UpdateWindow
DefWindowProcA
BeginPaint
GetSystemMetrics
EndPaint
TranslateMessage
DispatchMessageA
PeekMessageA
GetDC
ReleaseDC
SendMessageA
SetDlgItemTextA
gdi32
CreateFontA
SelectObject
SetBkMode
TextOutA
SetTextColor
DeleteObject
CreateDIBitmap
CreateSolidBrush
advapi32
RegDeleteKeyA
RegEnumKeyExA
RegCloseKey
RegDeleteValueA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueA
shell32
ShellExecuteA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Name
.text
Size
150KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=150, version=20413,
count=38, id=132, productName=VS2008 build 21022, version=21022,
count=11, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=128, version=50727,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=166, id=1, productName=Unmarked objects,
count=138, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc
- MD5 7fdd3bf8886199e8336f95c88bcaa49a
- SHA1 77e2019093379de4d5de07dbcf5893831c9bb7ec
- SHA512 9d774eca21fb33f26991cf20f0f6a2f0bce56aa4cc3d17fd769e0bb767ca400cd5c8dd64bb62db23bf5bc112b91b1a26db7bf2f9d85993cb990be5113e527a40
- SSDEEP 1536:1zmSA404oATJVPHEMXMxa6CO3/k/hdXVyczH+95DfFFjfuEnm:1zxEYsZaLhdlo95DfFFjfuCm
- TLSH T1D9A3F440D786C12EEBDE32FA956761C04E70B4DB6935C72AACE0A8E519527C17F0D2CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
107886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
5634e4e97a71930c574b80e50ee479ab782b6888f5af31c7e7529fa651377f50.exe
- SHA256 5634e4e97a71930c574b80e50ee479ab782b6888f5af31c7e7529fa651377f50
- MD5 09aaf431d8db13c6ebca277d918665d6
- SHA1 229441dc8bce6c357cfba5b791aad1adee232743
- SHA512 923b47223133a2729349741d1fed46d3850fe364f7bde8ba6c7a6a5a275eb62576baf79360555ac533ac3736e6f09e5e6e606d76987666870cfe307f7f7cd346
- SSDEEP 12288:ffATk/j8LKZkiw86pClAV6t75NJy4VyySsMZBT+/jl64e4fVitTjxaz3pa2dG:3Wk/j82uiw8dkEnSsMPJ4e4fVipjxazy
- TLSH T1D2E4707EC51BCF98F82CF4391041B6953748F6A0B27AD77E92AE347A8F0EA644950371
- MD5 SHA1 SHA512 SSDEEP TLSH
6066e91a9b651a9061d3f0941e6686ff476e5e84e11a51ec3bcae049d84b366b.exe
- IMPHASH 1a395bd10b20c116b11c2db5ee44c225
- SHA256 6066e91a9b651a9061d3f0941e6686ff476e5e84e11a51ec3bcae049d84b366b
- MD5 48fab78d6f4e0f8a499d6a27d38f7f8b
- SHA1 b6c11eed15ac5c0c28e094715310f9c51ae15093
- SHA512 03f13959df51eac1f167303e3978c66d8a5f093541bbb9ba7c8c717bcfccffc6a1d2429a4c53ddb9ddd0588ae53ad310ab3553b6e06ba7959984acb0b4739e80
- SSDEEP 12288:ZYW1LNT35lDbK/LIVaN8+T7vwqyqhYMhWt918vulA2C9+m:dd35lDbKDIwWUDyqS5om3C9+
- TLSH T132E4AF1035C28033EAB301718EBD966D916DF9220B266DD7A3D8465E5FB99F27E31233
- MD5 SHA1 SHA512 SSDEEP TLSH
-
MedusaLocker payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
235613
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Process32NextW
Process32FirstW
CreateProcessW
GetTickCount
CopyFileW
GetCurrentProcess
WriteConsoleW
CreateToolhelp32Snapshot
OpenProcess
WaitForSingleObject
TerminateProcess
FindClose
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
SetVolumeMountPointW
FindFirstVolumeW
QueryDosDeviceW
GetEnvironmentVariableW
GetLogicalDrives
GetProcessHeap
MoveFileExW
SetFilePointerEx
HeapAlloc
CloseHandle
GetLastError
SetFileAttributesW
GetFileAttributesW
CreateFileW
WriteFile
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
GetFileType
GetTimeZoneInformation
EnumSystemLocalesW
HeapFree
GetFileSizeEx
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
ReadFile
OpenMutexW
Sleep
CreateMutexW
GetModuleFileNameW
SetEnvironmentVariableW
EncodePointer
DecodePointer
RaiseException
GetCurrentThreadId
IsProcessorFeaturePresent
QueueUserWorkItem
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
WaitForSingleObjectEx
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
LocalFree
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwind
ExitProcess
advapi32
CryptExportKey
RegCreateKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
CryptReleaseContext
CryptGenKey
CryptImportKey
OpenProcessToken
GetTokenInformation
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
EnumDependentServicesW
OpenServiceW
QueryServiceStatusEx
CryptDestroyKey
CryptAcquireContextW
CryptEncrypt
CryptDuplicateKey
RegDeleteValueW
shell32
SHEmptyRecycleBinW
ole32
CLSIDFromString
IIDFromString
CoInitializeEx
CoGetObject
CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeSecurity
oleaut32
SysAllocStringByteLen
VariantClear
SysAllocString
SysStringByteLen
VariantInit
SysFreeString
crypt32
CryptStringToBinaryA
mpr
WNetGetConnectionW
netapi32
NetApiBufferFree
NetShareEnum
iphlpapi
IcmpSendEcho
IcmpCloseHandle
GetAdaptersInfo
IcmpCreateFile
ws2_32
inet_addr
rstrtmgr
RmShutdown
RmRegisterResources
RmStartSession
RmGetList
RmEndSession
Name
.text
Size
455KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=259, version=26715,
count=169, id=261, version=26715,
count=23, id=260, version=26715,
count=1, id=262, version=26715,
count=17, id=260, version=26504,
count=24, id=259, version=26504,
count=150, id=261, version=26504,
count=23, id=257, version=26715,
count=219, id=1, productName=Unmarked objects,
count=13, id=265, version=27905,
count=1, id=255, productName=VS2019 v16.2.3 build 27905, version=27905,
count=1, id=258, productName=VS2019 v16.2.3 build 27905, version=27905,
6269c641b9c51dc32fec94cc0dc0f7116b1686eec750bd1297133844419cfea1.exe
- SHA256 6269c641b9c51dc32fec94cc0dc0f7116b1686eec750bd1297133844419cfea1
- MD5 d60334141a0014e162feb53aac1567e2
- SHA1 a7cf0a8cba03881e29230a07b9da8e210b66931f
- SHA512 7a08c2f459cf22916502efa65bf5731b929749b88cec164af4e83ba7fa88685da3ab78ea37c6fe0792b1726a5956089e0561b024f5f0c3d53143d9b878b739fa
- SSDEEP 96:Y+Zhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExnC3XScQmP1XiVatNLZ0:lzdrr1FG1WDCgmjPZYXj1X0WNLZMUA
- TLSH T126E18E67252B71B7C0937632230FD123236FB45056E98AD4EA5CEE6E38B78609535607
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41920
Magic Number
267
Subsystem
MAGE_SUBSYSTEM_UNKNOWN
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 c0c4f79539143d5a65ba6a853099c36209d31da4ae1df2a01ab460f22f8f04e6
- MD5 4a3308fc0c62c2a73fa95e7c898a570f
- SHA1 d068846cbf7cd72c0e75ef0f76253f0353e16952
- SHA512 8e7d80a277291391aeb882e9198f25758296f417ee786dc42fc5cc977b41d2b90d9dde7ee85109f8f92817903174a5fa278d0b597400db288ad9dd80de9ef7c6
- SSDEEP 192:Z/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjnfPtRMlMUA:ZebFNw4Pk1itKkpAjjglMB
- TLSH T1EA42E70EFCD004E6D716DAF223172605D7BE75A196A057222FAC6D2020776A7EF6150F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Xorist Ransomware
-
Detects Seven ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8657
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
6417c606fc6220ff91727a6c210e9707b95bf79bf6f56bb1987923fb66416cb6.macho
- SHA256 6417c606fc6220ff91727a6c210e9707b95bf79bf6f56bb1987923fb66416cb6
- MD5 c1497a93fb597cbc8afeb7469304ccab
- SHA1 1579d270994f493d460555eb03ff8339112bca2e
- SHA512 af4868465d2998b501dfa5511de2d3103235d7b230509fc33a91b6c5dad158666cd588ade6085d430f2b1b5ad0797ae66e03088bbb129ea2590a6ba8e9a7a9c9
- SSDEEP 98304:v/OauaiHbXvJ9cQ3OzSdL+K1DYC1ErUTWOeBppA:vIHjJ9c5SdLZZeUCOeBp
- TLSH T177F5331AFF98A192F44B2A7A72C23E7DA4B75045060DC36E50D3D76397A2456F0EF08B
- MD5 SHA1 SHA512 SSDEEP TLSH
6471a7f99df7a48e01bb7a7ebca3d638c5f6bf8f7feffd84f177cf969609819d.exe
- SHA256 6471a7f99df7a48e01bb7a7ebca3d638c5f6bf8f7feffd84f177cf969609819d
- MD5 8acaddf6aa6cc46bb75249d8b097365a
- SHA1 de08efb88618b6dc7dc082fc7b0ae1e67675cf8e
- SHA512 0afe164a9a8c13456e2d167213824089bc977ad03adbefd83f0a6c2b4838cce9e555e78ce03d7c2c9beddd9ee0444f8ae9b8e96b78eb7b6187b01c85c06fb772
- SSDEEP 12288:JZ87vcaPsiOigqyxph1yZ5SYnpNloMJDr1s2kmiMKPHsVxWklN8wOhqzr:X87ca0jigtph1m5XNloMJrG2t2klNW
- TLSH T111E423401A6830CADEA2E0766B866F95F3531D681B6A32BE4E376CCF64BCD710547237
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
2565856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
645KB
Virtual Size
648KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
6480fc12292296a76979f4340ec0432a69ff466792f8eb3281558617df45aa48.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6480fc12292296a76979f4340ec0432a69ff466792f8eb3281558617df45aa48
- MD5 55732b58542d96fd54bafbdee4b63713
- SHA1 ddf634cde67534177cc503888cb6690130a00ce2
- SHA512 6419022a662098052f3933b0897fba5780e73938a7377bd46fe47d0ac34e2e90a32c19a79a955e754bff230c62029dff0f4ec278438deebd7104ffb20d20287c
- SSDEEP 12288:IXdsgKhyeqS+8kFrQoYBQ+1d8jPm4+Pyd7iW7KsxKZLae+0YG1RJpdUjdV:IezaEHTjUP
- TLSH T1C0C42C2439FF9019B2B3EFA65FD8B9EBDE6FF7332A06245A204103464613D41DD9163A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
570510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
549KB
Virtual Size
549KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
6485af5032466d4171f7b8dc6e819a9638b3845ace73309681f4763ae3430a3a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6485af5032466d4171f7b8dc6e819a9638b3845ace73309681f4763ae3430a3a
- MD5 74b94b14668ea1070980d221c963c628
- SHA1 61a0fdc4418c0812c7c660d7e0abde02d6ea178b
- SHA512 7de3d821b8928d9ce56e27aff56df6c1d452f51bf64c8da9cd18f25912529a971792690271c375b67acaf19b2f2866f92f6b5085c5ad408257c79cf30f785407
- SSDEEP 1536:MougyGBWoV5vNX+sfrPrfDAN/f+x8mOqGL63X5aUV1nt0PcPW8ih+wVcl:NyGs0RFfjrfDE/Gx8mOYn5aUVE84+qY
- TLSH T10504381522EBC535C2E8F578EF52CEF29723AD454A15C63727E47E1B3A2EB4361422A0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
64142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Worm\source\repos\blue_skull\blue_skull\obj\Debug\blue_skull.pdb
mscoree
_CorExeMain
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6.exe
- IMPHASH a5438bd40d42b97abb8c7e584178178a
- SHA256 7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6
- MD5 40c9dc2897b6b348da88b23deb0d3952
- SHA1 0f5457b123e60636623f585cc2bf2729f13a95d6
- SHA512 7c18c8a2b5ed77c48f694bf8e2d2e3a8b3308999c5a8ec6622624b146daaa3758b560f7b2085adf9de3a33a767ba7904fca7264024facba34fe6c38b5ad6b5cb
- SSDEEP 6144:1j7lTFXsbBigZb3NvejJz0wWuzeFBW7VO9mrmcF6qUjD:1tTFXfu3NWJz9XYYE9mCcM3
- TLSH T1B9A45C15F79618F9D06BC07486464921AA327C8A0B31BFFF1698B2752E36AF15F3CB14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
230180
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Y:\noko\target\release\deps\noko.pdb
advapi32
SystemFunction036
kernel32
CloseHandle
GlobalAlloc
GlobalFree
CreateFileW
GetLastError
DeviceIoControl
GetProcessHeap
HeapAlloc
GetDriveTypeW
FindFirstVolumeW
GetVolumePathNamesForVolumeNameW
SetVolumeMountPointW
FindNextVolumeW
FindVolumeClose
HeapFree
GetSystemDefaultLCID
GetSystemInfo
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
ReleaseMutex
FindClose
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
Sleep
GetCurrentProcess
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
SetFilePointerEx
FlushFileBuffers
GetStdHandle
GetCurrentProcessId
WaitForSingleObject
TerminateProcess
QueryPerformanceCounter
TryAcquireSRWLockExclusive
TlsAlloc
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
FindNextFileW
GetFileInformationByHandle
FindFirstFileW
MoveFileExW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateThread
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP
HeapSize
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
SetStdHandle
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
LoadLibraryExW
FreeLibrary
TlsFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
mpr
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
Name
.text
Size
283KB
Virtual Size
282KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
153KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=6, id=259, version=27412,
count=137, id=261, version=27412,
count=39, id=261, version=31616,
count=16, id=260, version=31616,
count=9, id=259, version=31616,
count=13, id=257, version=27412,
count=184, id=1, productName=Unmarked objects,
count=92, productName=Unmarked objects (old),
count=1, id=258, version=31630,
7112a45ea2f6672b908d3e74967448d37ac3a2a3a21e6945d0723280e952f5da.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7112a45ea2f6672b908d3e74967448d37ac3a2a3a21e6945d0723280e952f5da
- MD5 be74f6ab8318674eecc155a279921e47
- SHA1 8e428e1b8fb2b2e6868e3d22f958715f4b706511
- SHA512 3196a3f96266981734db69c322e642ef322f04a86a97d63ae2e84f759a70a5d42c8e1ccdd2d3e4534567daa5ca9aec4e5762a65d8092d87dc5dd26584db79acb
- SSDEEP 49152:CjLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:eLu1TIRtUOV5Zv
- TLSH T10F265B1577D48526E0BF4739587393842372F8939D23876F31A0A36E7D727808DA2B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects NominatusCrypto C# variant
-
Detects NominatusCrypto DOS executable variant
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\sd\Documents\SharpDevelop Projects\VirusMSILNominatusStorm\VirusMSILNominatusStorm\obj\Debug\VirusMSILNominatusStorm.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe
- IMPHASH 266bed6766ee2a20cf7c2dd0d6245d96
- SHA256 7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600
- MD5 dc4ae2105938cb68c5b6988465e13da1
- SHA1 4bf9313e1b4f51df9b94cf73e36adb53f8c29ac0
- SHA512 02ad76fcda95f5fc06bc8c5f0fa7e103379f7001e05f1bb23bfe1e67262bda8b045ae1f317569aa30a44566bf26bcb487ec9319f1a51fff79d57c40612b1bdf7
- SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371o0:/uTs1gBpQL5kmh0671o0
- TLSH T10A840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Seven ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
158849
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\admin\Desktop\new version with NO UAC\Release\Win32Project9.pdb
kernel32
GetCurrentProcess
CreateProcessW
ExitThread
WaitForSingleObject
GetLastError
ExitProcess
IsDebuggerPresent
GetVersionExW
GetVolumeInformationW
SetEndOfFile
HeapSize
WriteConsoleW
ReadConsoleW
GetProcAddress
FindFirstFileExW
FindClose
GetCommandLineW
GetCommandLineA
GetProcessHeap
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetModuleHandleW
CreateProcessA
GetStartupInfoA
GetModuleFileNameW
SetFileAttributesA
CopyFileA
GetFileAttributesA
GetModuleFileNameA
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
SetFileAttributesW
GetLocalTime
CreateThread
WinExec
GetLogicalDrives
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
Sleep
GetFileAttributesExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
FreeLibrary
LoadLibraryExW
RaiseException
RtlUnwind
QueryPerformanceFrequency
MoveFileExW
GetModuleHandleExW
GetStdHandle
WriteFile
GetACP
HeapAlloc
HeapReAlloc
HeapFree
GetFileType
GetExitCodeProcess
user32
GetSystemMetrics
LoadCursorW
RegisterClassExW
CreateWindowExW
ShowWindow
ScreenToClient
GetCursorPos
DrawTextA
MessageBoxW
DefWindowProcW
PostQuitMessage
DestroyWindow
SetTimer
KillTimer
InvalidateRect
EndPaint
DrawTextW
FillRect
BeginPaint
DispatchMessageW
TranslateMessage
GetMessageW
GetWindowLongW
SetWindowLongW
gdi32
LineTo
MoveToEx
CreatePen
SetBkMode
DeleteObject
TextOutA
TextOutW
SetTextColor
SetBkColor
SelectObject
CreateFontW
CreateSolidBrush
advapi32
SystemFunction036
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetUserNameW
wininet
InternetOpenUrlW
InternetReadFile
InternetOpenW
netapi32
NetUserGetInfo
Name
.text
Size
269KB
Virtual Size
269KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=162, id=243, version=40116,
count=27, id=242, version=40116,
count=22, id=259, version=23013,
count=62, id=261, version=23013,
count=66, id=260, version=23013,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=171, id=1, productName=Unmarked objects,
count=2, id=265, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
7247f33113710e5d9bd036f4c7ac2d847b0bf2ac2769cd8246a10f09d0a41bab.exe
- SHA256 7247f33113710e5d9bd036f4c7ac2d847b0bf2ac2769cd8246a10f09d0a41bab
- MD5 b97fc627bd5cb4ba0952e6033a09a84e
- SHA1 4d65559a14bca55f6cca722d09d80ba3e262053d
- SHA512 80837755942a9da36bf2c70e347f76b3301690113167b173fad91e85d84b602fa89bcaf0b8a5f66a1c4849cbd16cf5c8c0718feb6d13d360de6ecaee88c1ffd5
- SSDEEP 3072:16A47bkOeuzTlzccSTFHn1fUQp7NaJLcnnysxZW/+s0frvMqk7MYKDFqHD:1ZgkjuNkTFVz70Anysxi0AP7ADFq
- TLSH T1E7E302D5FA168122F2095EB0DBD2C88476B2FD21AF40121D6A1FF3BC1F70AF541A5E66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
372048
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
140KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
7757c11c449860e2dd54ae97e05835fb39f89a9c93f32dfc23b258ad49c3622e.exe
- IMPHASH 8acb34bed3caa60cae3f08f75d53f727
- SHA256 7757c11c449860e2dd54ae97e05835fb39f89a9c93f32dfc23b258ad49c3622e
- MD5 511e849a593b7787b1387b56f12d8c05
- SHA1 6c830eed04570ba8f8873cba3f61ca568f7b9535
- SHA512 3d803144229fd7e63e971d0bd617fb96eaf2a1e802ad36dc2eac3fe809b351f68d07f4b81ebd24b9367e72b9d5e91a655a07acfd430ee631e226def7ff987fe6
- SSDEEP 6144:Bia1gMHOPDWIhID8X/4DQFu/U3buRKlemZ9DnGAetTsB+Q+:BIMH06cID84DQFu/U3buRKlemZ9DnGAI
- TLSH T1B8248E36AA808837D1321D7CEE4E52AE917E7A302E1C58977DE41E8D9F7D392652C1C3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Zeppelin payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
198244
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
user32
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects
MessageBoxA
LoadStringA
GetSystemMetrics
DispatchMessageA
CharNextW
CharLowerBuffW
CharNextA
CharLowerBuffA
CharLowerA
CharUpperA
CharToOemA
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
WriteProcessMemory
WriteFile
WaitForSingleObject
VirtualQuery
VirtualAllocEx
TerminateThread
TerminateProcess
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesW
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
OpenProcess
MoveFileW
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetVersionExA
GetUserDefaultLangID
GetTickCount
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesW
GetFileAttributesA
GetExitCodeThread
GetEnvironmentVariableW
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitThread
ExitProcess
EnumCalendarInfoA
EnterCriticalSection
DuplicateHandle
DeleteFileW
DeleteCriticalSection
CreateThread
CreateRemoteThread
CreateProcessW
CreateProcessA
CreatePipe
CreateFileW
CreateFileA
CreateEventA
CreateDirectoryW
CopyFileW
CompareStringW
CompareStringA
CloseHandle
Sleep
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
shell32
ShellExecuteW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
Name
.text
Size
181KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2
- MD5 17b2b21151392880e30110ad5b429709
- SHA1 4575d5d6664a5ae4e009d699ecde14b30a85e145
- SHA512 6830b97404a958106e8c34f10c211c226cf7e1a8b4a13f3bd2121d855ebab8a1e00ed12f1367642d6e429d15f7fd354e47f5064a87d378923508df0df9ef82b4
- SSDEEP 1536:1k9izMrI+ZvCA+RH1F2G+MOcY5CGFptVcl:Aiw0+r+RHbH+MOcY5Fp/Y
- TLSH T13793FA98F11C71DEC857F4729AAB1C6CAA50686AC31B82C3B35715AD9A4CFD7CF140A2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
114698
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
XvSVem
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
7934f58d59c52bd585febb83bbdc8726c4a02313609d8d0380cd1167f0f91671.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7934f58d59c52bd585febb83bbdc8726c4a02313609d8d0380cd1167f0f91671
- MD5 46ba5da6b508a5ba6ffc4e302a6ddf83
- SHA1 9a71331ab40c3941b2674ec559555fa26c101543
- SHA512 f51a31168a86de1a12037a80d1a59cfcc5fd1fb8dd9be360421f492c0d150a9bcaf38d7e56805622a1f865340974aca14dc96f049dec44516e35e008bfe4de06
- SSDEEP 12288:Fq+q+q+qs2veLPuClONf/hmmdisnHPld3SSE2veLPuClONf/hmmdisnHPld3SSw:ieLvlaldisHpeLvlaldisHw
- TLSH T157E4016423837A7BC95E5C33C538D5F36A1A6CABA19180242CDD1D2B3BFB172095F729
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
719402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\79113\source\repos\TankRansom 3.0\TankRansom 3.0\obj\Debug\Tanki X Ransomware.pdb
mscoree
_CorExeMain
Name
.text
Size
695KB
Virtual Size
694KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8045ad5cda6c42e5669cf52e492c004d842c7ae6f8a09522134834d0f57347eb.exe
- IMPHASH bb2600e94092da119ee6acbbd047be43
- SHA256 8045ad5cda6c42e5669cf52e492c004d842c7ae6f8a09522134834d0f57347eb
- MD5 38d8f55b3a4b6871b5e62fdc73c504d6
- SHA1 102b8625e5662c89efe4547dc2cb173be8b08851
- SHA512 97c8f11f1bd28ecacddf3606b507dbeb0ab85a56c788e99160ef77c9757f92fd1e4920b24ad077de8763939da77d2bd71089512787dda0fd0e804d47c0cbbecb
- SSDEEP 6144:gUhJmXLQwAhgEkJ8kdV50DErPMxgTw7ozFD254W:gUneLQwAE8VDtGcopfW
- TLSH T17A34CF10E6C290F2EC9B4FB995FA59FE50356E208735E3F7DBCA8EA585326C2C134251
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Venus Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
22912
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
crypt32
CryptStringToBinaryA
comctl32
ord17
InitCommonControlsEx
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
kernel32
Process32FirstW
GetSystemInfo
GetVersionExW
GetModuleHandleA
lstrcpyA
GetProcAddress
ExitProcess
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetVolumeInformationW
GetVolumePathNameW
MulDiv
GetCommandLineW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetFileSize
QueryDosDeviceW
ReadFile
GetTempPathW
CreateMutexW
CreateProcessA
lstrcatA
IsWow64Process
GetModuleFileNameA
GetModuleFileNameW
SetVolumeMountPointW
Process32NextW
ResumeThread
WaitForMultipleObjects
GetComputerNameExW
lstrcmpiW
GetSystemTime
GetWindowsDirectoryW
lstrcatW
GetLastError
Sleep
GetCurrentThreadId
CreateFileW
lstrlenA
WriteFile
lstrlenW
lstrcpyW
CreateThread
GetLogicalDriveStringsW
GetDriveTypeW
GetDiskFreeSpaceW
lstrcmpW
GetProcessHeap
CloseHandle
HeapReAlloc
OpenProcess
Wow64DisableWow64FsRedirection
WaitForSingleObject
GetCurrentProcess
VirtualAlloc
user32
DefWindowProcW
GetWindowRect
GetDC
SetWindowPos
MessageBoxW
CreateWindowExW
SendMessageW
EndDialog
GetSystemMetrics
RegisterClassExW
wsprintfA
DispatchMessageW
SetTimer
RegisterHotKey
TranslateMessage
LoadCursorW
GetClientRect
GetDlgItem
PostQuitMessage
wsprintfW
DrawTextW
GetMessageW
ReleaseDC
SystemParametersInfoW
ShowWindow
LoadImageW
gdi32
CreateCompatibleBitmap
BitBlt
CreateFontW
DeleteDC
GetDeviceCaps
SetBkMode
SetTextColor
DeleteObject
GetTextExtentPoint32W
SelectObject
CreateCompatibleDC
CreateDIBSection
SetBkColor
advapi32
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
SystemFunction036
RegQueryValueExW
RegQueryValueExA
RegCloseKey
AllocateAndInitializeSid
shell32
SHGetPathFromIDListW
CommandLineToArgvW
ShellExecuteExW
SHBrowseForFolderW
SHEmptyRecycleBinW
ws2_32
ntohl
inet_ntoa
setsockopt
socket
gethostbyname
WSAStartup
inet_addr
htons
bind
WSACleanup
sendto
iphlpapi
SendARP
GetAdaptersAddresses
netapi32
NetApiBufferFree
NetShareEnum
Name
.flat
Size
512B
Virtual Size
333B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
83KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=27, id=257, version=26715,
count=169, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2019 v16.4.0 build 28314, version=28314,
count=124, id=265, version=28314,
count=1, productName=Unmarked objects (old),
count=1, id=255, productName=VS2019 v16.4.0 build 28314, version=28314,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.4.0 build 28314, version=28314,
8209b64a1d6982efbe3ff4924e17a9b07db3d8f0d71f4c8eee2bc68f231dca23.exe
- IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
- SHA256 8209b64a1d6982efbe3ff4924e17a9b07db3d8f0d71f4c8eee2bc68f231dca23
- MD5 84388b6714ae52a58941bf0e4599ed10
- SHA1 b33cba122e9ebe72a7d847cd499fb0f28166ea09
- SHA512 489413cb62a970da794d0034bcfe6ca422011281f3e07db6471d3e596e29ba51af0a88c354559106a1b7aca54580ed4f34c432bd47161e5e037643bf13349fd4
- SSDEEP 12288:kh1Lk70TnvjczzIqHXh92Wkl7ZTEChDF6ABT2MFRLEeClYqiqUgG:gk70TrcYq3WpXTEChxz2MRL1qir
- TLSH T16AB4012579D0C2B2C477053484EACB7A9A7D30230B7656D7B7E91BB76E202E1A7352CC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
52527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
ole32
OleInitialize
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
364KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
8236c2d4fa44ce877dec977d323065c8c9a7f46635366bd27b9acf46c1d12d24.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8236c2d4fa44ce877dec977d323065c8c9a7f46635366bd27b9acf46c1d12d24
- MD5 22122414da1b2be957af67b1d5357db3
- SHA1 33b35c5129d3582d4d3e7d9bcffbe20b49af0683
- SHA512 fb72d699195782611fca86ff28d2d7d501c93049060e15c2eee51e7339355d40e89169276a232137ad7a7f5fc2b9f876290bffbc1e8fb883c919c2c7d1800c9e
- SSDEEP 1536:2FirV/O98n+0LD/SiWKs5SQb5IuJkh/4MyFptVcl:2FiJG9itjWS1uJkh/4Mup/Y
- TLSH T15BA3FC98F11C72DEC857F4769A9B1C6CAA50646AC31B41C3B32725ADAA4CFD7CF140E2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
122890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
PbO2%a
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752
- MD5 ef2faf4191b9a3e622ec8496c653bc4c
- SHA1 adc4411fd1248f9846dc67c8978d5d553809b075
- SHA512 fbc65375233b94bd5bfc69ddaf8a0367aaf5b3906b45f8d16ad56add1e97ef221993fc2dbced810017298ceef278b72e4f66d71601a0e7feb9f7a0e36f9f62ef
- SSDEEP 3072:eszNtrCvGJKHRMGM6y7CGtEKqljDjn+AaErIcIqaGqPIhkp/7oL0DDlUU8NH79BS:P7KHRMGM7/LqRh9kfGqPHhoL0/lUUaB
- TLSH T1C4445BF15D00BD87C4670ABA4332CAFD42BA9E746A33F45680D1B673FB37A819D11A16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect MafiaWare666 ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\ADMIN\Desktop\Encrypt\EncrypterPOC-main\WindowsFormsApp1\obj\Release\Ransomware.pdb
mscoree
_CorExeMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
205KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8808e4e220fcda37bdb05b703e86053f88a6ebd68037d37ef89754c459d7ad2b.exe
- IMPHASH 4f67aeda01a0484282e8c59006b0b352
- SHA256 8808e4e220fcda37bdb05b703e86053f88a6ebd68037d37ef89754c459d7ad2b
- MD5 c99e32fb49a2671a6136535c6537c4d7
- SHA1 ada9bcb3da63e7b989b279fb6c3bc9fe7ff7b41f
- SHA512 ad77caa95954281cdb11239e832953a5c256981b2bc12fe48029ae002bd49c2715108bdf80a45f6aad459a110fa952cbb87fcae09ff23c79e2845a4296067257
- SSDEEP 3072:Z1E/rS2paccKntcIaKZEKIOjWqGxaTga0rIJ2SEguMG6NTCJAEhRP7ym6VwM1E6x:Z1on2KvuxaUa0NtgdTgXDTOpRh
- TLSH T10104027376E2D46BEA6304700ABEE23EE2F5F678415F960BAB444F795C703409A152A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12991
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CopyFileA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetFileAttributesA
SetFileAttributesA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
GetCurrentProcess
GetFullPathNameA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
lstrcpynA
SetErrorMode
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
- TLSH T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9995
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-header.bmp
- SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
- MD5 940c56737bf9bb69ce7a31c623d4e87a
- SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
- SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
- SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
- TLSH T1D312A8869D83DC42EC4F7F71E3E6A05320E0690A052FBAD56F3634D6E65F88B672410B
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
- SHA256 f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
- MD5 b3070cf20db659fdfb3cb2ed38130e8d
- SHA1 aa234b0620bebddde1414ff6b0840d883890b413
- SHA512 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1
- SSDEEP 96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn
- TLSH T1DE121A635A4055F3D5D7223A21AA2F2FD73C9324A062BC0287779E462BF531A7D3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7429
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc
user32
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
DrawFocusRect
GetWindowLongA
DrawTextA
GetClientRect
GetDlgItem
GetSysColor
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
MapWindowPoints
RemovePropA
GetWindowTextA
gdi32
SetTextColor
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
OT6
- SHA256 01a6c97fc1a23001fefc3c1f8c3480bc0cc444541463b8e3411f79644aef5b58
- MD5 0fc138abd7c94c998dbf29db15481b16
- SHA1 f2969233175e2d0275fb87438493108fee199b2e
- SHA512 b55afc819d3099a9da7de96e5f1c80f87b40f1bc37dc0296be22adb6e555e8869f197de1b7d7d3e271044f397e9aa3b81bbc123be4b32f59e68c28e09a95facf
- SSDEEP 1536:6DWEj63UlRcB+hd7gbyrs2vgQIXWAgT6dDbfhKeL3zXWMK3ezVsvC:6vjcB+H1rs2IQIXHgT6d/fMeXrKuzevC
- TLSH T13E63F1D2D46EAAE02F6EE4AEE377523A2E30999C193DD6B1DD77B15044C03B1F28815C
- MD5 SHA1 SHA512 SSDEEP TLSH
uninstall.exe
- IMPHASH 4f67aeda01a0484282e8c59006b0b352
- SHA256 bc04a3590a6c55d15a87fa189811ad4272b1b035e3851ab44f16251f53dbab98
- MD5 09033cb04b6e2f9d0e29609555a0a706
- SHA1 0f0dd5a4b9bbd58f616ae1bee26ffec79dccb365
- SHA512 79b58a8f51e0d84709cf024952a3b9f2d5187fc844ec403634d7d396afdb1cec28566885f16d9b254ab6b299b2e96ac4dfbf2171c87bd83490ce71931291b9c2
- SSDEEP 1536:Z1E/rzW2pakRmB7BW3nKscWgdLeAyNHIHijWIaMj2juU24/:Z1E/rS2paccKntcWceAoICjJaVjuU24/
- TLSH T1B573CF1637D280B7D6A703B10EF7D7BAE7B5FAA04019862B6B105F7F2C742419E16293
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12991
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CopyFileA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetFileAttributesA
SetFileAttributesA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
GetCurrentProcess
GetFullPathNameA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
lstrcpynA
SetErrorMode
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/LangDLL.dll
- IMPHASH 154903d617e825e7d4f76664593675fd
- SHA256 70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
- MD5 b26b412d9f1050ad53f663c972fdcd9f
- SHA1 7bc4ed444f3f8fd14c2c36784d828175bace8c17
- SHA512 ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
- SSDEEP 48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2
- TLSH T164C17537B3C246F9D6858133151373C3A6139A306365C00F9B6712AE2521CB79D7EB93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetACP
lstrlenA
lstrcmpA
GetModuleHandleA
GlobalFree
MulDiv
lstrcpynA
GlobalAlloc
lstrcpyA
user32
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
SetWindowTextA
LoadIconA
GetDC
ShowWindow
SendMessageA
gdi32
DeleteObject
CreateFontIndirectA
GetDeviceCaps
LangDialog
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
697B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
364B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
- TLSH T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9995
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-header.bmp
- SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
- MD5 940c56737bf9bb69ce7a31c623d4e87a
- SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
- SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
- SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
- TLSH T1D312A8869D83DC42EC4F7F71E3E6A05320E0690A052FBAD56F3634D6E65F88B672410B
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
- SHA256 f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
- MD5 b3070cf20db659fdfb3cb2ed38130e8d
- SHA1 aa234b0620bebddde1414ff6b0840d883890b413
- SHA512 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1
- SSDEEP 96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn
- TLSH T1DE121A635A4055F3D5D7223A21AA2F2FD73C9324A062BC0287779E462BF531A7D3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7429
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc
user32
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
DrawFocusRect
GetWindowLongA
DrawTextA
GetClientRect
GetDlgItem
GetSysColor
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
MapWindowPoints
RemovePropA
GetWindowTextA
gdi32
SetTextColor
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
8955db80bf0b9e71069ef8085f116c56e9525a8ffc64b665e0f7ecd9edcfac5f.exe
- IMPHASH f0457f592cb6623fae51f7d4ebd0268f
- SHA256 8955db80bf0b9e71069ef8085f116c56e9525a8ffc64b665e0f7ecd9edcfac5f
- MD5 5afe90056cf894df82e3034773194698
- SHA1 e5ce9c31cf66075457f76200cf6fe06a947e1f8a
- SHA512 6e02be6d5241806afd7b95f77b5b8ef91cfa0176d3e21c333dd85dfa8d76ca1c3183a8924372b293cc73f307a994152928f2460304c48c65f6ec1daef1b1fbe9
- SSDEEP 3072:98XDZ3HL9q/bbBzBifo60K8CMxI09+N5/v:WXKb5BiYNZkN5/v
- TLSH T1A8E38D5CA1A415F6C266E1B7C8C1053ADAA0789492B0832F57529DE43F726B3F07EF87
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
21952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
RtlVirtualUnwind
ntdll
RtlGetNativeSystemInformation
msvcrt
_getch
_vsnwprintf
memset
_wfopen
fgetws
feof
fclose
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.c
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.r
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.d
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=2, id=185, version=30716,
count=3, id=257, version=27412,
count=13, id=1, productName=Unmarked objects,
count=1, id=199, version=41118,
count=1, id=261, version=29118,
count=1, id=259, version=29118,
count=1, productName=Unmarked objects (old),
count=32, id=260, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=258, productName=VS2019 v16.8.4 build 29336, version=29336,
9095bbb4b123a353a856634166f193124bdc4591cb3a38922b2283acc1d966d6.jse
- SHA256 9095bbb4b123a353a856634166f193124bdc4591cb3a38922b2283acc1d966d6
- MD5 871d0084a53bb7733346b167f7e67e36
- SHA1 2b75f4d60b357ea3cdd53a73e8dd00148fea0889
- SHA512 b77f916dfe0fa3ebcd7ca7fef2df57d9e3e647a37ee90e5bdf845cc715f2ad58f7c3053d55b43d108da004ea1097826ad7dca7fde5f6f45bcb6781acbe68ddaf
- SSDEEP 3072:S7e1lcDeY9tstU6UtjvN7MLFfOVMumRRCivI7lvLAe25gfV99p:S4uDBtstmtJouig7V99p
- TLSH T17E14D7BD7043F205927496603880AE76CCE713ECC6F7C04B16A9A6847E21D19FF9A95F
- MD5 SHA1 SHA512 SSDEEP TLSH