jaffacakes118_samples.part031.rar
- SHA256 7a83be8b6b13c566efcc0ea63ef88f3e87bea375627f5b71b1bdc5575f33a6f5
Overview
overview
10Static
static
10c181904383...69.exe
windows10-2004-x64
8c181904383...69.exe
windows11-ltsc_2024-x64
8c1941061ad...77.exe
windows10-2004-x64
10c1941061ad...77.exe
windows11-ltsc_2024-x64
10c21841807f...68.exe
windows10-2004-x64
10c21841807f...68.exe
windows11-ltsc_2024-x64
10c230758a0b...fd.exe
windows10-2004-x64
10c230758a0b...fd.exe
windows11-ltsc_2024-x64
10c484870884...3a.exe
windows10-2004-x64
10c484870884...3a.exe
windows11-ltsc_2024-x64
1c631446f0a...43.exe
windows10-2004-x64
10c631446f0a...43.exe
windows11-ltsc_2024-x64
10c690148b6b...b2.exe
windows10-2004-x64
10c690148b6b...b2.exe
windows11-ltsc_2024-x64
10c75748dc54...df.exe
windows10-2004-x64
6c75748dc54...df.exe
windows11-ltsc_2024-x64
6ca3e078052...82.exe
windows10-2004-x64
10ca3e078052...82.exe
windows11-ltsc_2024-x64
10ca9853f654...e2.exe
windows10-2004-x64
10ca9853f654...e2.exe
windows11-ltsc_2024-x64
1caa904d7e0...b0.exe
windows10-2004-x64
10caa904d7e0...b0.exe
windows11-ltsc_2024-x64
10caf7124501...04.exe
windows10-2004-x64
5caf7124501...04.exe
windows11-ltsc_2024-x64
5cc2b06d508...94c.js
windows10-2004-x64
3cc2b06d508...94c.js
windows11-ltsc_2024-x64
3cc3b570fa8...64.exe
windows10-2004-x64
10cc3b570fa8...64.exe
windows11-ltsc_2024-x64
10cce5a75388...e7.exe
windows10-2004-x64
9cce5a75388...e7.exe
windows11-ltsc_2024-x64
9cd41ed86dd...40.exe
windows10-2004-x64
1cd41ed86dd...40.exe
windows11-ltsc_2024-x64
1Static task
static1
18 signatures
Behavioral task
behavioral1
Sample
c1819043839dddcca0b5de3d438cffb67c79dc26e811e97e65f13d89845cc969.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
c1819043839dddcca0b5de3d438cffb67c79dc26e811e97e65f13d89845cc969.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
c1941061adad1b747b3ea1585ea0859f0bfd295189809221a633e35e57dd8077.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
c1941061adad1b747b3ea1585ea0859f0bfd295189809221a633e35e57dd8077.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
c21841807f7625eda4a388a0aed508f6b315345b9d85ff7407e5b4c71060ef68.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral6
Sample
c21841807f7625eda4a388a0aed508f6b315345b9d85ff7407e5b4c71060ef68.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral8
Sample
c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral9
Sample
c4848708844b01858c9fe048ad71b539c1e1847b8aa4198af84d407626880e3a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
c4848708844b01858c9fe048ad71b539c1e1847b8aa4198af84d407626880e3a.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
c631446f0af048680de353abf2c26bcaadd2fb01a015f3663174610341274a43.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral12
Sample
c631446f0af048680de353abf2c26bcaadd2fb01a015f3663174610341274a43.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral13
Sample
c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral14
Sample
c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
Behavioral task
behavioral15
Sample
c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral16
Sample
c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral17
Sample
ca3e078052da372b3238b78d311eca0dee9e82bb75d62773be05bc033ab0ea82.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral18
Sample
ca3e078052da372b3238b78d311eca0dee9e82bb75d62773be05bc033ab0ea82.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral19
Sample
ca9853f6543bf749e602a8880ce803d911b7783ec9d035a4f668c3f624adf6e2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral20
Sample
ca9853f6543bf749e602a8880ce803d911b7783ec9d035a4f668c3f624adf6e2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
caa904d7e0d470975318568eec0840cbf46b58e122c64e6d41c903399569a7b0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral22
Sample
caa904d7e0d470975318568eec0840cbf46b58e122c64e6d41c903399569a7b0.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral23
Sample
caf712450117958adda7660ba3ba984195ea1cc61ac40d6fe9fbb087af8acc04.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
caf712450117958adda7660ba3ba984195ea1cc61ac40d6fe9fbb087af8acc04.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
cc2b06d5086f6a8c9b43441020365300f04ab0b4dde16f0e3677cae2cf1a394c.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
cc2b06d5086f6a8c9b43441020365300f04ab0b4dde16f0e3677cae2cf1a394c.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral28
Sample
cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral29
Sample
cce5a753888cb5b044c767fe8e95e410ebdf1e1c79cabc95db1c9e1a8e81c5e7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral30
Sample
cce5a753888cb5b044c767fe8e95e410ebdf1e1c79cabc95db1c9e1a8e81c5e7.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
Behavioral task
behavioral31
Sample
cd41ed86dd2b59459c6e241c5ab3d210f8bd6f12129c1ff838c7d1557797bd40.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
cd41ed86dd2b59459c6e241c5ab3d210f8bd6f12129c1ff838c7d1557797bd40.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target jaffacakes118_samples.part031.rar
- Size 15.0MB
- Sample261011-wbas4avtbs
- SHA256 7a83be8b6b13c566efcc0ea63ef88f3e87bea375627f5b71b1bdc5575f33a6f5
- MD5 fa78cb791e449c31ac868e3711f632c1
- SHA1 a2b9d4bbb2cb3ebab59e7d6e612f3ddf2d34f7f0
- SHA512 61816c880f144a0289e48c0b6909ba96552e4d0b0d34defe156f950ccebd861d1ba5e5795c168acb5ac62556ccbf4973987dea273e78c660a7572b9c647f68be
- SSDEEP 393216:qKe5QSjNrQJVUeemfgVeHU0aQHrMMOfDVDmy6:P4LNkIS3HU0jHOfBqy
- TLSH T16EF633C9DAC517C2C236CC757DA8D81F062775A109D271B7B396722F3CA19C8898A2FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
purecrypter
C2
-
http://80.66.75.34/Utirkyu.png
Extracted
Family
-
asyncrat
Version
-
1.0.7
Botnet
-
Default
Mutex
-
DcRatMutex_corrupts
Attributes
-
c2_url_file
https://corrupts.xyz/dc
-
delay
1
-
install
true
-
install_file
Runtime Broker.exe
-
install_folder
%AppData%
aes.plain
Signatures
- Family: Chaos
Ransomware family first seen in June 2021.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Family: Makop
Ransomware family discovered by @VK_Intel in early 2020.
- Family: NominatusCrypto,NominatusStorm
NominatusCrypto aka NominatusStorm is a ransomware written in C#.
- Family: PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
- Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/caa904d7e0d470975318568eec0840cbf46b58e122c64e6d41c903399569a7b0.exe family_asyncrat - Chaos Ransomware 2 IoCs
resource yara_rule static1/unpack001/c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd.exe family_chaos static1/unpack001/ca3e078052da372b3238b78d311eca0dee9e82bb75d62773be05bc033ab0ea82.exe family_chaos - Detects NominatusCrypto C# variant 1 IoCs
resource yara_rule static1/unpack001/ceba56d82e97ea9d50f38842046f24eb4b46784b2ad3acee026eca940a386b41.exe family_nominatuscrypto_dotnet - Detects NominatusCrypto DOS executable variant 1 IoCs
resource yara_rule static1/unpack001/ceba56d82e97ea9d50f38842046f24eb4b46784b2ad3acee026eca940a386b41.exe family_nominatuscrypto_dos - Detects Seven ransomware 1 IoCs
resource yara_rule static1/unpack002/out.upx family_seven - MAKOP ransomware payload 1 IoCs
resource yara_rule static1/unpack001/cfed5d55391704116b3bf68840ebcdd99277054cb1924ecff31876478ed9a927.exe family_makop - Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule static1/unpack001/c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe family_lockbit - ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/c21841807f7625eda4a388a0aed508f6b315345b9d85ff7407e5b4c71060ef68.exe ConfuserEx static1/unpack001/cdaf128fa48fa20bd32393a998958bf579b1c2159286253045a2c7e0790be49d.exe ConfuserEx - SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
resource yara_rule static1/unpack001/cce5a753888cb5b044c767fe8e95e410ebdf1e1c79cabc95db1c9e1a8e81c5e7.exe SmartAssembly -
resource yara_rule static1/unpack001/c631446f0af048680de353abf2c26bcaadd2fb01a015f3663174610341274a43.exe upx static1/unpack001/cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe upx - Unsigned PE 26 IoCs
Checks for missing Authenticode signature.
resource unpack001/c1819043839dddcca0b5de3d438cffb67c79dc26e811e97e65f13d89845cc969.exe unpack001/c1941061adad1b747b3ea1585ea0859f0bfd295189809221a633e35e57dd8077.exe unpack001/c21841807f7625eda4a388a0aed508f6b315345b9d85ff7407e5b4c71060ef68.exe unpack001/c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd.exe unpack001/c4848708844b01858c9fe048ad71b539c1e1847b8aa4198af84d407626880e3a.exe unpack001/c631446f0af048680de353abf2c26bcaadd2fb01a015f3663174610341274a43.exe unpack002/out.upx unpack001/c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe unpack001/c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df.exe unpack001/ca3e078052da372b3238b78d311eca0dee9e82bb75d62773be05bc033ab0ea82.exe unpack001/ca9853f6543bf749e602a8880ce803d911b7783ec9d035a4f668c3f624adf6e2.exe unpack001/caa904d7e0d470975318568eec0840cbf46b58e122c64e6d41c903399569a7b0.exe unpack001/caf712450117958adda7660ba3ba984195ea1cc61ac40d6fe9fbb087af8acc04.exe unpack001/cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe unpack001/cce5a753888cb5b044c767fe8e95e410ebdf1e1c79cabc95db1c9e1a8e81c5e7.exe unpack001/cd41ed86dd2b59459c6e241c5ab3d210f8bd6f12129c1ff838c7d1557797bd40.exe unpack001/cd548a83dce50ef1647700ea7f45d57baa2decf0cb0d3f7692715bf7388eecda.exe unpack001/cd73245dde46bfc46ca4e89c64a46c30cfe45e572a137f60d242aefacdd00bed.dll unpack001/cda99e504a122208862739087cf16b4838e9f051acfcbeb9ec794923b414c018.exe unpack001/cdaf128fa48fa20bd32393a998958bf579b1c2159286253045a2c7e0790be49d.exe unpack001/ce58d9e1741ca1f58f0880465ff4e322c9036293d2dba8947cd65e2153f070e4.exe unpack001/ce7a28d3f7cbcb06f484a17dcd244ac1cd126f8c557b702e011f57448045f4cf.exe unpack001/ceba56d82e97ea9d50f38842046f24eb4b46784b2ad3acee026eca940a386b41.exe unpack001/cf25380af0493268f45a46aea425d30f6af0d8144ec6eeed7c2f5496293daf53.exe unpack001/cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe unpack001/cfed5d55391704116b3bf68840ebcdd99277054cb1924ecff31876478ed9a927.exe
File Explorer
-
jaffacakes118_samples.part031.rar.rar 15.0MB
-
c1819043839dddcca0b5de3d438cffb67c79dc26e811e97e65f13d89845cc969.exe.exe 4.0MB
-
c1941061adad1b747b3ea1585ea0859f0bfd295189809221a633e35e57dd8077.exe.exe 9KB
-
c21841807f7625eda4a388a0aed508f6b315345b9d85ff7407e5b4c71060ef68.exe.exe 90KB
-
c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd.exe.exe 49KB
-
c4848708844b01858c9fe048ad71b539c1e1847b8aa4198af84d407626880e3a.exe.exe 2.7MB
-
c631446f0af048680de353abf2c26bcaadd2fb01a015f3663174610341274a43.exe.exe 131KB
-
out.upx.exe 367KB
-
c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe.exe 159KB
-
c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df.exe.exe 71KB
-
ca3e078052da372b3238b78d311eca0dee9e82bb75d62773be05bc033ab0ea82.exe.exe 23KB
-
ca9853f6543bf749e602a8880ce803d911b7783ec9d035a4f668c3f624adf6e2.exe.exe 2.8MB
-
caa904d7e0d470975318568eec0840cbf46b58e122c64e6d41c903399569a7b0.exe.exe 47KB
-
caf712450117958adda7660ba3ba984195ea1cc61ac40d6fe9fbb087af8acc04.exe.exe 470KB
-
cc2b06d5086f6a8c9b43441020365300f04ab0b4dde16f0e3677cae2cf1a394c.unknown.js 5KB
-
cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe.exe 1.9MB
-
cce5a753888cb5b044c767fe8e95e410ebdf1e1c79cabc95db1c9e1a8e81c5e7.exe.exe 94KB
-
cd41ed86dd2b59459c6e241c5ab3d210f8bd6f12129c1ff838c7d1557797bd40.exe.exe 539KB
-
cd548a83dce50ef1647700ea7f45d57baa2decf0cb0d3f7692715bf7388eecda.exe.exe 1.0MB
-
cd73245dde46bfc46ca4e89c64a46c30cfe45e572a137f60d242aefacdd00bed.dll.dll 96KB
-
cda99e504a122208862739087cf16b4838e9f051acfcbeb9ec794923b414c018.exe.exe 2.1MB
-
cdaf128fa48fa20bd32393a998958bf579b1c2159286253045a2c7e0790be49d.exe.exe 94KB
-
ce58d9e1741ca1f58f0880465ff4e322c9036293d2dba8947cd65e2153f070e4.exe.exe 131KB
-
ce7a28d3f7cbcb06f484a17dcd244ac1cd126f8c557b702e011f57448045f4cf.exe.exe 1.0MB
-
ceba56d82e97ea9d50f38842046f24eb4b46784b2ad3acee026eca940a386b41.exe.exe 4.4MB
-
cf1256ae391410f7ebc785d180eb03ff36135cf8f9051b6d8c803386abdafb78.exe541KB
-
cf25380af0493268f45a46aea425d30f6af0d8144ec6eeed7c2f5496293daf53.exe.exe 811KB
-
cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe.exe 110KB
-
cfed5d55391704116b3bf68840ebcdd99277054cb1924ecff31876478ed9a927.exe.exe 49KB
c1819043839dddcca0b5de3d438cffb67c79dc26e811e97e65f13d89845cc969.exe
- IMPHASH fada6cba5bb68b74e893b0c75c1220be
- SHA256 c1819043839dddcca0b5de3d438cffb67c79dc26e811e97e65f13d89845cc969
- MD5 cc0c4dd633d14d2999c7c0af25b779d4
- SHA1 eef8dac70851b4124d2aea817e30da82882df885
- SHA512 37f27a81671c2893e0023bd9ce524913f290b8a8a68bb710ffc049e192a6080367ffc43898cd615345309b6042150664f17bf4753f668c875bcdc23de2a738c1
- SSDEEP 98304:qjEtOdVEfrmNNTC2zM9yklTIh5DBWM2UPXU:IdRNUj9rlgeMS
- TLSH T18B1602617A43C1B2D59100F04DBDAB7B4A3DAE291B3086D7E3C81E3E99305D15E37A9B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
721474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Legion\source\repos\last project\Release\curl.pdb
ws2_32
inet_addr
recv
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
closesocket
normaliz
IdnToAscii
wldap32
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegCreateKeyExA
RegSetValueExA
kernel32
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
GetCommandLineW
GetCommandLineA
WriteFile
GetModuleFileNameA
ExitProcess
HeapAlloc
GetModuleHandleExW
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
RaiseException
RtlUnwind
WaitForSingleObject
LoadLibraryW
HeapFree
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetExitCodeProcess
CreateProcessA
SetStdHandle
HeapReAlloc
HeapSize
FindFirstFileExA
GetTimeZoneInformation
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
SetEndOfFile
SetFilePointerEx
GetLogicalDrives
FindFirstFileW
Process32First
FindNextFileW
TerminateProcess
GetDriveTypeA
FindClose
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CloseHandle
FreeConsole
lstrcmpW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetLastError
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SetLastError
FormatMessageA
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
GetCurrentThread
GetThreadTimes
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindFirstFileExW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetModuleHandleW
CreateDirectoryExW
CopyFileW
MoveFileExW
FormatMessageW
GetStringTypeW
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
user32
BlockInput
Name
.text
Size
1005KB
Virtual Size
1004KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
220KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=241, version=40116,
count=185, id=243, version=40116,
count=31, id=242, version=40116,
count=6, id=199, version=41118,
count=26, id=259, version=26706,
count=134, id=261, version=26706,
count=37, id=260, version=26706,
count=51, id=261, productName=VS2019 v16.0.0 build 27508, version=27508,
count=260, id=1, productName=Unmarked objects,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=260, productName=VS2019 v16.0.0 build 27508, version=27508,
count=1, id=265, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
c1941061adad1b747b3ea1585ea0859f0bfd295189809221a633e35e57dd8077.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c1941061adad1b747b3ea1585ea0859f0bfd295189809221a633e35e57dd8077
- MD5 029b5d34e91b7ee1e4084d4f6a76710d
- SHA1 eba9b85d8d6800fa7ccfc2bc78f9ca8029a0d0d5
- SHA512 a14fd0eb0330a5d3b982436f27dd4c9175ebdf59e53988ad547bd85252314d2817fc5d2787e80b337402a1ebe5ae0c0bdb0e2fc90741bdc59d016da1968d2821
- SSDEEP 192:yFfhphrBv9BrLy6LLlqf9t9wvJrefwmvWF1AWg9:Sh7rB1hLy6LZqf9nwFefBWfAW
- TLSH T19E12D920FBDC8132EAB74B764873A240477DEB525C17DF6E9994044BBD216418BF2762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
c21841807f7625eda4a388a0aed508f6b315345b9d85ff7407e5b4c71060ef68.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c21841807f7625eda4a388a0aed508f6b315345b9d85ff7407e5b4c71060ef68
- MD5 533e39425d8eceb8604e926069c6bd2c
- SHA1 911b65a953ab08f5c0447b333b127b8064fac9de
- SHA512 9f921dc0339d39b62f6b01dbe5fffd980492b009893bb8f5bc8426a2220ba2461849a79bbdfa43035bddbde48be932ab50fa5103a5646f093cbf942c2977dd75
- SSDEEP 1536:REPTQvmf+VSTYUWuPbJMXDvIm6N6ZRZVeCbCFptVcl:O7bTYUvbJMXDA6ZRZVeCbep/Y
- TLSH T102930D99F21C71DEC857F4769AAB1C6CEA50646AC31B42C3B32715AD9A4CFC7CF140A2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
114698
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
_7 b.$R
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c230758a0b4389848b032ca8ef0fec581763c0ba51f49ff267d39ade19366ffd
- MD5 81f5893f673b81ed4a271634c899aed2
- SHA1 7ccd3b7434b908f060a56f90594fc3d46252113b
- SHA512 3a5350743d757e805d46a7d965032e24793cbe0a82e0c4b83ccc3de3ab9aab509faa8a66c3d44ccb53b76cba36d40f1c9eb8f7ad1325a2f244ec11e661cd636d
- SSDEEP 768:Ln3kIsp+L5hSIr9ix4mZryx7L2ksQ1QC/KeX:z3kI3hSIr9ixsx32XK/HX
- TLSH T19233DE743AE9003CF3B79FB84BF5359E95AAFA7377168D5D1096028E0A21A41DAC133D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
55310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
c4848708844b01858c9fe048ad71b539c1e1847b8aa4198af84d407626880e3a.exe
- IMPHASH ccf7c01a714215ec70f14cd24d2ea534
- SHA256 c4848708844b01858c9fe048ad71b539c1e1847b8aa4198af84d407626880e3a
- MD5 2dd2da6788422bc0a1b61b002cb18a01
- SHA1 ec7d2a30671a4f85bb3d1f5c5e52629927044221
- SHA512 d41e58da5d49e3b13fb4bd7486fbf65604690095a8d72ba87df4bec2c5c2f4bf6217eade2a5a228c8e8a7da8b65cafe96ff0dadfb5e373a6237551a44f6d1390
- SSDEEP 49152:HarJjhK89t3TPb+jVTCISg30AinLtivJGHfAuOp6mSlFr6PTaaxhot7l:H+3mBvZinLtebma767l
- TLSH T169D56C13B3F941DCF0AAE2B8D7715632DE72BC528B34A5DF125012191EB6EE05B39722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
1057824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
setup.exe.pdb
advapi32
AddAce
AdjustTokenPrivileges
BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
ChangeServiceConfigW
CloseServiceHandle
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
CopySid
CreateProcessAsUserW
CreateServiceW
DeleteService
EqualSid
EventRegister
EventUnregister
EventWrite
GetAce
GetAclInformation
GetLengthSid
GetNamedSecurityInfoW
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
GetUserNameW
ImpersonateNamedPipeClient
InitializeAcl
InitializeSid
IsValidSid
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegLoadKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegUnLoadKeyW
RegisterTraceGuidsW
RevertToSelf
SetNamedSecurityInfoW
SystemFunction036
TraceEvent
UnregisterTraceGuids
dbghelp
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW
shell32
CommandLineToArgvW
ord680
SHChangeNotify
SHGetFolderPathW
SHGetKnownFolderPath
SHOpenWithDialog
SHQueryUserNotificationState
ShellExecuteExW
ShellExecuteW
user32
AllowSetForegroundWindow
CallNextHookEx
CharUpperW
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EqualRect
GetForegroundWindow
GetMessageW
GetMonitorInfoW
GetSystemMetrics
GetWindowLongPtrW
GetWindowLongW
GetWindowRect
GetWindowThreadProcessId
IntersectRect
LoadIconW
MessageBoxW
MonitorFromRect
MonitorFromWindow
MoveWindow
PostMessageW
RegisterClassW
SendMessageW
SetForegroundWindow
SetWindowLongPtrW
SetWindowsHookExW
TranslateMessage
UnhookWindowsHookEx
UnregisterClassW
ws2_32
ntohl
kernel32
AcquireSRWLockExclusive
AssignProcessToJobObject
AttachConsole
CloseHandle
CompareStringW
ConnectNamedPipe
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DisconnectNamedPipe
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FindResourceW
FlsAlloc
FlsSetValue
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleDisplayMode
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetPriorityClass
GetProcAddress
GetProcessHandleCount
GetProcessHeap
GetProcessId
GetProcessIoCounters
GetProcessTimes
GetProductInfo
GetQueuedCompletionStatus
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDefaultLCID
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadId
GetThreadLocale
GetThreadPreferredUILanguages
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetVersion
GetVersionExW
GetWindowsDirectoryW
HeapAlloc
HeapDestroy
HeapFree
HeapReAlloc
HeapSetInformation
HeapSize
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetPerformanceInfo
K32GetProcessMemoryInfo
K32QueryWorkingSetEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalFree
LockFileEx
LockResource
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
Process32FirstW
Process32NextW
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
QueueUserAPC
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSemaphore
RemoveDirectoryW
ReplaceFileW
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetNamedPipeHandleState
SetPriorityClass
SetProcessShutdownParameters
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepConditionVariableSRW
SleepEx
SuspendThread
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
UnregisterWaitEx
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualProtect
VirtualQuery
VirtualQueryEx
WTSGetActiveConsoleSessionId
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
Wow64GetThreadContext
WriteConsoleW
WriteFile
WriteProcessMemory
lstrcmpiW
ole32
CoAllowSetForegroundWindow
CoCreateInstance
CoInitializeEx
CoRegisterInitializeSpy
CoRevokeInitializeSpy
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
PropVariantClear
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
WTSQueryUserToken
netapi32
NetApiBufferFree
NetGetJoinInformation
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
propsys
InitPropVariantFromCLSID
shlwapi
ord437
PathMatchSpecW
UrlCanonicalizeW
urlmon
CreateURLMonikerEx
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
VariantInit
winmm
timeGetTime
winhttp
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpWriteData
GetHandleVerifier
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
281KB
Virtual Size
281KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
24B
Characteristics
Name
.tls
Size
512B
Virtual Size
305B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CPADinfo
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
427KB
Virtual Size
427KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
c631446f0af048680de353abf2c26bcaadd2fb01a015f3663174610341274a43.exe
- SHA256 c631446f0af048680de353abf2c26bcaadd2fb01a015f3663174610341274a43
- MD5 c6925c9e1c8afc7dc6b0fdcce9e2d525
- SHA1 eec111ed02645456f2a4acb1eb4e74fa5ad5e614
- SHA512 37b57cf25e0c9f06ee63e87ed4736787c79219648324e1413f151884a0cc19f46e7593a0d9f6437ff587b5c3cc0f3fc353cca2774523f7fd273bf9702de38bda
- SSDEEP 3072:Mc7q9xwhoUhRPkkWfZf5wX/gowJOLEnlywUaBbeWWiUNE:Mz9xwhlkkS+Xoow0mlywJ4g
- TLSH T196D3028268BDDB1EF201453693077F79539862540FD39EEF0CFBE2246045F6AAB2B614
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
417984
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
129KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=12, id=241, version=40116,
count=162, id=243, version=40116,
count=27, id=242, version=40116,
count=22, id=259, version=23013,
count=61, id=261, version=23013,
count=66, id=260, version=23013,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=169, id=1, productName=Unmarked objects,
count=2, id=265, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
out.upx
- SHA256 c0aa10c796d534aa897505341b72d1279b094c785ddaa170bdb1213eefbcad78
- MD5 d393a535a675116e59999c99936d9df7
- SHA1 3ec4a67020ca8f6bd4b00d1467656877020e2ce9
- SHA512 84e19e20759d27b6fb26a87002d8f36f6788cd5563ce201ba8c801f633979d392893ff5e11da0e4b0fd0100432aa1ff51aa6c8ba3b0064060f7e11e0d8fc461c
- SSDEEP 6144:fHEmrnWIHf5Kt4m6bkyotM4dxtsXgrNfl0EU+0sr:fHEmjH/5KtEbkRtM0jflnUb
- TLSH T1F384092570829AEAEEB554751A64BBFDA92DF4304B640EF7B3C649B404E03C25B74F23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Seven ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
162098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
273KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=162, id=243, version=40116,
count=27, id=242, version=40116,
count=22, id=259, version=23013,
count=61, id=261, version=23013,
count=66, id=260, version=23013,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=169, id=1, productName=Unmarked objects,
count=2, id=265, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe
- IMPHASH 8365ac85490d89776a96737b801cde2b
- SHA256 c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2
- MD5 a8e0d56f8c67f1f7b6e592c12d87acab
- SHA1 ed555f0162ea6ec5b8b8bada743cfc628d376274
- SHA512 41aac8e5a4604134b1014cc08824a1820c138e2762324fd05521d55824aa56d118a8c2ab105285c914f6f839dff9a71a2ecb2e0b8c7bf0e2202edce288577a67
- SSDEEP 3072:wrQnZg2Bvu2K8/PzRanIzrQSsKQj+zXzCGRG2:wrf2Bm3cLRanKr5zRG
- TLSH T1A3F38E22A111D077F4271DF12B3672B1B3EB8E2C15A7A417EAE40F58ACA7D632F14517
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
103535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
TextOutW
SetTextColor
SelectObject
GetPixel
GetDeviceCaps
user32
LoadMenuW
IsDlgButtonChecked
GetDlgItem
DialogBoxParamW
CreateDialogParamW
GetMessageW
kernel32
GetModuleHandleW
SetLastError
LoadLibraryW
LoadLibraryExA
GetTickCount
GetProcAddress
GetModuleHandleA
GetLastError
GetFileAttributesW
GetCommandLineW
GetAtomNameW
Name
.text
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df.exe
- SHA256 c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df
- MD5 efec04688a493077cea9786243c25656
- SHA1 429237548351288fac00e0909616b1518d5487b9
- SHA512 2f12adc31336aa10c889e1b7bd7219111e677580f53fc3c6b340c7276411a8bbd0fcf706adf74ee3a45f1089c51e0cdf8321aa3920d02427f802a0c8e887a1d0
- SSDEEP 1536:G+5geBR2Q+a8M124Zl2i5SADBDg8trv4t9MBY5yqv:GDeBgQ+a8M12Y2i59hrvWMB2v
- TLSH T15F63D64AB749EA30F59694B996FC2A17688E8938835F85C3EBD0C05A7651CC6B834F13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
59520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ca3e078052da372b3238b78d311eca0dee9e82bb75d62773be05bc033ab0ea82.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ca3e078052da372b3238b78d311eca0dee9e82bb75d62773be05bc033ab0ea82
- MD5 4fcd7a7a8e5ac3afd21d849e8f6cde86
- SHA1 53cd28e9e2487f32e660f421c1bcd2f6591622bd
- SHA512 977fc099f29922eea0b8a1463be7777f0525e7ec80bb40c962b9346e5b17b2d4d611bbaa8d95187ebd7b3e2f9997b75ff5ce24be60176f1c598c0f7d3818c4cc
- SSDEEP 384:W3Mg/bqo2N3xk+pVpkUM3LTAzkMJfr91Cb/9eg:kqo29xkupkvbTzEfr9UFeg
- TLSH T1A9B2D41867FA4A39F6FF2F786DB250415B75B853EE3DD74C188A004D0922B9C8DA0B67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Chaos Ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ca9853f6543bf749e602a8880ce803d911b7783ec9d035a4f668c3f624adf6e2.exe
- IMPHASH acd34b280c2d8b2a020a1867e9237c73
- SHA256 ca9853f6543bf749e602a8880ce803d911b7783ec9d035a4f668c3f624adf6e2
- MD5 e9c3b266896539bbc6d26bc4019fb126
- SHA1 cce4b0867b5ccc7a9ed7ea88ab08f3408851b542
- SHA512 0ab4a451621eedc5c0cf07fd18170d1167348379be90815df92cb616b9397096779570bb4a773c0500714078febb1b0e19a5c373205b218a68bfc5dfd40ab345
- SSDEEP 49152:mwQA9p2Kd/0a507NUUWn043oHS3fbYwVq1/xT3DDbw0TUqyZ7w:rB0hSTYw8yB0
- TLSH T1A9D55C13B3F941DCF0AAE2B8D7314632DAB2BC538B34A5DF125416191E76EE05B39722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
1124528
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
setup.exe.pdb
advapi32
AdjustTokenPrivileges
BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
BuildTrusteeWithSidW
ChangeServiceConfigW
CloseServiceHandle
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
CreateProcessAsUserW
CreateServiceW
CreateWellKnownSid
DeleteService
EventRegister
EventUnregister
EventWrite
GetLengthSid
GetNamedSecurityInfoW
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
GetUserNameW
ImpersonateNamedPipeClient
InitializeSid
IsValidSid
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegLoadKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegUnLoadKeyW
RegisterTraceGuidsW
RevertToSelf
SetEntriesInAclW
SetNamedSecurityInfoW
SystemFunction036
TraceEvent
UnregisterTraceGuids
dbghelp
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW
shell32
CommandLineToArgvW
ord680
SHChangeNotify
SHGetFolderPathW
SHGetKnownFolderPath
SHOpenWithDialog
SHQueryUserNotificationState
ShellExecuteExW
ShellExecuteW
user32
AllowSetForegroundWindow
CallNextHookEx
CharUpperW
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EqualRect
GetForegroundWindow
GetMessageW
GetMonitorInfoW
GetSystemMetrics
GetWindowLongPtrW
GetWindowLongW
GetWindowRect
GetWindowThreadProcessId
IntersectRect
LoadIconW
MessageBoxW
MonitorFromRect
MonitorFromWindow
MoveWindow
PostMessageW
RegisterClassW
SendMessageW
SetForegroundWindow
SetWindowLongPtrW
SetWindowsHookExW
TranslateMessage
UnhookWindowsHookEx
UnregisterClassW
ws2_32
ntohl
kernel32
AcquireSRWLockExclusive
AssignProcessToJobObject
AttachConsole
CloseHandle
CompareStringW
ConnectNamedPipe
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DisconnectNamedPipe
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FindResourceW
FlsAlloc
FlsSetValue
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleDisplayMode
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetPriorityClass
GetProcAddress
GetProcessHandleCount
GetProcessHeap
GetProcessId
GetProcessIoCounters
GetProcessTimes
GetProductInfo
GetQueuedCompletionStatus
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDefaultLCID
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadId
GetThreadLocale
GetThreadPreferredUILanguages
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetVersion
GetVersionExW
GetWindowsDirectoryW
HeapSetInformation
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetPerformanceInfo
K32GetProcessMemoryInfo
K32QueryWorkingSetEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalFree
LockFileEx
LockResource
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
Process32FirstW
Process32NextW
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
QueueUserAPC
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSemaphore
RemoveDirectoryW
ReplaceFileW
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetNamedPipeHandleState
SetPriorityClass
SetProcessShutdownParameters
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepConditionVariableSRW
SleepEx
SuspendThread
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
UnregisterWaitEx
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualProtect
VirtualQuery
VirtualQueryEx
WTSGetActiveConsoleSessionId
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
Wow64GetThreadContext
WriteConsoleW
WriteFile
WriteProcessMemory
lstrcmpiW
ole32
CoAllowSetForegroundWindow
CoCreateInstance
CoInitializeEx
CoRegisterInitializeSpy
CoRevokeInitializeSpy
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
PropVariantClear
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
WTSQueryUserToken
netapi32
NetApiBufferFree
NetGetJoinInformation
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
propsys
InitPropVariantFromCLSID
shlwapi
ord437
PathMatchSpecW
UrlCanonicalizeW
urlmon
CreateURLMonikerEx
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
VariantInit
winmm
timeGetTime
winhttp
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpWriteData
GetHandleVerifier
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
276KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
24B
Characteristics
Name
.tls
Size
512B
Virtual Size
305B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CPADinfo
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
427KB
Virtual Size
427KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
caa904d7e0d470975318568eec0840cbf46b58e122c64e6d41c903399569a7b0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 caa904d7e0d470975318568eec0840cbf46b58e122c64e6d41c903399569a7b0
- MD5 4832cf49cba2b0fee6d7458de518ef92
- SHA1 9bf03f22a5c08a880ccadee06954c356c22fc856
- SHA512 a7a8249193641b4735c4bd8522ef41f2db8158ecd9ffc43e3adf33ef12141c22c5606bea131222746e7235c26ed094151990b3ab68ec24a3674414be8c7b0b15
- SSDEEP 768:j13PjILweUc+biMQnMcz91ir8Yb/geq+OyUPvEgK/JXZVc6KN:j139kqCczbIJfyUPnkJXZVclN
- TLSH T15E236D4037ACC13AE6BD47B5A9F3920486B5D6672903C65C6CC810EA2F13FC59A436FE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
caf712450117958adda7660ba3ba984195ea1cc61ac40d6fe9fbb087af8acc04.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 caf712450117958adda7660ba3ba984195ea1cc61ac40d6fe9fbb087af8acc04
- MD5 94cd3db90d5956fe52191c75c05adf2f
- SHA1 dce6e2e4bc0f1275c1e9e4f90cbd76884f0105fb
- SHA512 384f94ed44b3210d0f662c91c74511123470dc09530d9ac6c0c9c2aa9a6c88b4f0730b627f2b1f9b6e860f4b0336b4467798c17d336bf77acccdf16a0818ab40
- SSDEEP 6144:ZEb/+lDAAptYjRfWOUTx5GjVL0nrtlm4D/ODAxW:3dAAotfkM6nrt9AAxW
- TLSH T124A41CF1F782C664D757557D843EBEB76623628D9CD8050E2893BE0B7D22B2600138AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
383310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\brknc\source\repos\rs-jon\rs-jon\obj\Debug\rs-jon.pdb
mscoree
_CorExeMain
Name
.text
Size
366KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
cc2b06d5086f6a8c9b43441020365300f04ab0b4dde16f0e3677cae2cf1a394c.unknown
- SHA256 cc2b06d5086f6a8c9b43441020365300f04ab0b4dde16f0e3677cae2cf1a394c
- MD5 5795e231fcb88ee3ec57d8abd2a35953
- SHA1 0a78315b2286273f797fe3204dc6d1a078856067
- SHA512 de0a1535f8070dc7685b34ddaf9ba3590964b024e9b7d9f78ed9c8cff792f401d57176ba86583088dc60a2b2450ce47babb40f2720c9f19084c2289cc46353f7
- SSDEEP 96:8QayzSRgWHyQobWB5kl0LTeVkRHTHBTyyCNW98KqX8XG4fUXQQ02azVhGoGErhyb:8QnzSRgPQobWB6mNVbVc2vhZW
- TLSH T183B1821D156E872190B0A635A90EB927771FB0CFB0936B9032842195E88401FDDEFEED
- MD5 SHA1 SHA512 SSDEEP TLSH
cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe
- SHA256 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64
- MD5 f09a781eeb97acf68c8c1783e76c29e6
- SHA1 ec2b7eebfcbf263424ae194817060eac44c380c7
- SHA512 972fc4759d344c3eab157fe8bb345596592895ab9d27546961a93047142e8236dd876f3449a9f60dd5eb93a54035dcd3d7c8d70d468e3233341bfa4d674cfa64
- SSDEEP 49152:jL7kITp6hTJEfHdQ2+Sd3KmkZt1EOS09VE8zbRfc7id4oPg:YITpmafy2+S5KmkZt1EOSP8zdfc7i5P
- TLSH T17B958E31F790D476D32336309A49AFB9B3F6E6302979924715D01E3E2F305935A2C6AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1156156
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
811KB
Virtual Size
812KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.imports
Size
13KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=55, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=871, id=1, productName=Unmarked objects,
count=50, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=191, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=393, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
cce5a753888cb5b044c767fe8e95e410ebdf1e1c79cabc95db1c9e1a8e81c5e7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cce5a753888cb5b044c767fe8e95e410ebdf1e1c79cabc95db1c9e1a8e81c5e7
- MD5 26f65722f6307386f3aa23237f44c24a
- SHA1 d26becc64f43c7af17f2d39d3fc1b744ac3e8fbb
- SHA512 241c6ba3e95206827fe26ee6ef279e0bad2fbe6d4b55732fdacd078e2a977726a01bc16fd4b213b7483a1f1e74d1355dc416fb04ad8d86e3da2443cfa499bbb1
- SSDEEP 1536:fp3TsQ1+E1zBoqveoDPasKdCzHG95cf0HF3B7D5:fpDsQ1+E1iAzl2v95cf0HF95
- TLSH T12B93B344D78AC662EB8E02FF94675E644270B3E76D34C73AACCE29F50A067D175012DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
101634
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
91KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
cd41ed86dd2b59459c6e241c5ab3d210f8bd6f12129c1ff838c7d1557797bd40.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cd41ed86dd2b59459c6e241c5ab3d210f8bd6f12129c1ff838c7d1557797bd40
- MD5 421ed51ff27bb5c8dc7696d0c1479298
- SHA1 e865419cdd49791ab1c9e612e5840875dae37b5c
- SHA512 fbe15e075fc4570864274bbdd385db4f1ec54d237e0db0012355915ea37e4525e2f062457912f9de39ab21395a0a0e5ce564765006d25d1619019f739c17d41b
- SSDEEP 3072:D0nRlr9sCkllr9sCkpEj6IwnXzMMCDtDJniCG:Da99sCkl99sCkGj6IUmtDJni
- TLSH T1A2C4862A1FDBC19CC98935F981932FCC1641ED9EC5B709A97685B407C2B06B635A2CCF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
366950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
350KB
Virtual Size
350KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
188KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
cd548a83dce50ef1647700ea7f45d57baa2decf0cb0d3f7692715bf7388eecda.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cd548a83dce50ef1647700ea7f45d57baa2decf0cb0d3f7692715bf7388eecda
- MD5 daf91dd1bd0b319fdcef390e8838c13e
- SHA1 880b429f3ecdeeb1d8df5cd9c8e8d178c2336c30
- SHA512 de180a904eb97eacf3146554ff4afac34744af1025eec8bf3ae890be92de6efb50c1d498fe3265db723ac4d29c2604763831526877651ccfadb4150b9133d7a1
- SSDEEP 24576:1mEp+bl2LZ894kTja81N5Fjk4LfmVr2b2DamK0lFV:1jMbIZ894kBk0eG2+mKi
- TLSH T10735232692E6C9F7C2EC0271484667C07A10C63984AAE53FB57480BED1D358DE376F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1089546
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
JbksF+Z
Size
941KB
Virtual Size
941KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
cd73245dde46bfc46ca4e89c64a46c30cfe45e572a137f60d242aefacdd00bed.dll
- IMPHASH 2e5708ae5fed0403e8117c645fb23e5b
- SHA256 cd73245dde46bfc46ca4e89c64a46c30cfe45e572a137f60d242aefacdd00bed
- MD5 ba39062e38d9ee96e99e31d7ae8ba5af
- SHA1 33317799238fb18193149f7df9d0d88812817d43
- SHA512 9a3cd90c87c94d98cafd5e5ea8912bafda8029864b64e2d5fe1465d91e46dbe12783230fa5561e640e4616eefec905e57125e1be63e244393869adf5a17028c5
- SSDEEP 1536:Qq7kJOty1IYyvlVaThD9WhuG2uP7qlr3vRgYfl6LEVTCA3:xV+LydVaND9yFm3hILEVTCg
- TLSH T118A36D096E9CC4F0C84D66B19857527AE7F27C1D427CCA4F8F64EE520EA33A1B529E13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
WriteFile
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
CreateProcessA
msvcrt
free
_initterm
malloc
_adjust_fdiv
sprintf
PlayGame
Name
.text
Size
4KB
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=15, id=1, productName=Unmarked objects,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
cda99e504a122208862739087cf16b4838e9f051acfcbeb9ec794923b414c018.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cda99e504a122208862739087cf16b4838e9f051acfcbeb9ec794923b414c018
- MD5 7dbfe0186e52ef2da13079f6d5b800d7
- SHA1 0b7e0bc361ba5309e555820094433bddc8a73707
- SHA512 1fb4d2d37d54875a25a7071885870e1f79ca290d72b819cada3ea90476fb75f16dbe82bdc2dc01178d0899fe90d59798c01e2c68f6cb59c2aee689c286bd50d8
- SSDEEP 49152:twXFUKwWm8nM8SujyVuVtrvJq5vqLrIjQl5P:aUhDVu3YyLsj65
- TLSH T136A59EA886B73EC3CD9E17F8E523058D0DAD0FAE52275002299439BDE774F8B958B543
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2149518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
cdaf128fa48fa20bd32393a998958bf579b1c2159286253045a2c7e0790be49d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cdaf128fa48fa20bd32393a998958bf579b1c2159286253045a2c7e0790be49d
- MD5 88f519dd596411961b97aa58e80f550e
- SHA1 e8c0a705281df1a4882e0e6a2609230d0e684009
- SHA512 9e354c54f6f1af8ef2ed5ffdacde422f066c61427a32324dd495ed5e980a78be10ef4ba1e07da719186cc83ba911952df332709799b0ddc405362d6098fc0136
- SSDEEP 1536:1ankdainz0rEz0YqZUx48aWPmUGCJ43zH+pG8FptVcl:1anS1ngrE0DZUx48J/u3zH+pp/Y
- TLSH T1D7930C98F11C71DEC857F4729A9B1C6CAA5168AAC30B86C3B317159DAA1CFD7CF140B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
122890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
mkv{>Q
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
ce58d9e1741ca1f58f0880465ff4e322c9036293d2dba8947cd65e2153f070e4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ce58d9e1741ca1f58f0880465ff4e322c9036293d2dba8947cd65e2153f070e4
- MD5 1b1a9f4dc26e32684dd3bccb3dc563f1
- SHA1 fdc2219b15b42db3d1626a0855059549a43e5920
- SHA512 ac2f747321c005272e9b589caebbb6765c0521e720610739ff10b1aa2156f57545aeb1fd80c5a8cdfc83bb6e5b79a2cb7787c918f0e5e2faaee7cfa91f838cc3
- SSDEEP 3072:wSlEMjwfA4rrJaSlEMjwfA4ASgJcKnnyPJMmGMWLXtjgQ:hEqwfAwEqwfAdS6sw
- TLSH T10ED35CF52BE2AF9BE590D03A2D7355B87371827CE1C29719E905852D78E2B1D80EF4E0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
140206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
129KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ce7a28d3f7cbcb06f484a17dcd244ac1cd126f8c557b702e011f57448045f4cf.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ce7a28d3f7cbcb06f484a17dcd244ac1cd126f8c557b702e011f57448045f4cf
- MD5 74bfab32741f15b9fcfb32aacffab584
- SHA1 496063408cd61466614cc8370a6687d6f8d45663
- SHA512 ff9520592b64bab8b4da5d0e074163b258b6120ba2bb527afd649513476eb586cdc4a395b32f569c168a33124de14407311321ed2b8923da096e4d357b4620af
- SSDEEP 24576:1mEp+bl2LZ894kTja81N5Fjk4LfmVr2b2DamK0lFz:1jMbIZ894kBk0eG2+mK2
- TLSH T14535232692E6C9F7C2EC0271484667C07A10C63984AAE53FB57480BED1D358DE376F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1089546
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
JbksF+Z
Size
941KB
Virtual Size
941KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
ceba56d82e97ea9d50f38842046f24eb4b46784b2ad3acee026eca940a386b41.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ceba56d82e97ea9d50f38842046f24eb4b46784b2ad3acee026eca940a386b41
- MD5 d84f1056e453919798a89ecb202d698d
- SHA1 084727c888033d4e0ff367acd3861f6b3f0331eb
- SHA512 cd7d10c74736c0326779f8cd80a749af2f5ff77290085fa196e47321fb5fcf8e4786746f534cc8f2238379b7e66451d9219a61933f276bb28cba1d8492f91bef
- SSDEEP 49152:ZjLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:xLu1TIRtUOV5Zv
- TLSH T11D265B1577D48526E0BF4739587393842372F8939D23876F31A0A36E7D727808DA2B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects NominatusCrypto C# variant
-
Detects NominatusCrypto DOS executable variant
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\sd\Documents\SharpDevelop Projects\VirusMSILNominatusStorm\VirusMSILNominatusStorm\obj\Debug\VirusMSILNominatusStorm.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
cf1256ae391410f7ebc785d180eb03ff36135cf8f9051b6d8c803386abdafb78.exe
- SHA256 cf1256ae391410f7ebc785d180eb03ff36135cf8f9051b6d8c803386abdafb78
- MD5 371360e2bc9c26cd2b2ee0a62e87cee9
- SHA1 e855b62afcb6b1b235be39858223ead8271f1b1e
- SHA512 ddd07dac6afe0a9039530bbc947097bf7213eadb1ea6c7ef62b94d2b15d34086423165f32680a790d4c0233dada4f0919688343ddc1c07b29c0a80de0fbad0eb
- SSDEEP 12288:SdXJ7ER/7kToCMCnUYvqMUeDkTXMzq2sVXw+c/uC7qstdl5Iu8z:WXJ7ER/7k0rC0eDcXasVX29l6u8
- TLSH T176C4B6BEC137CC1CF4AC14B228581F592918E7B8B99BE6EC265D792E951DC48BB31331
- MD5 SHA1 SHA512 SSDEEP TLSH
cf25380af0493268f45a46aea425d30f6af0d8144ec6eeed7c2f5496293daf53.exe
- IMPHASH 3a9d5cc472b8b1dd203ad2aebbb5c53a
- SHA256 cf25380af0493268f45a46aea425d30f6af0d8144ec6eeed7c2f5496293daf53
- MD5 4c6064a2aa6cf6140459bd2c98fc2dae
- SHA1 b1bc0e0963d70265e890c900057a1c5a1caebb6c
- SHA512 5626cfb3f261ccd65b9016885959f641565017052af42cc677c71f20cec452bf4e6eec64bfa50f062d4d28232ab7f75282ccc7f2156ce3e1fbf821e13209f43f
- SSDEEP 24576:YylHerkBfGIhD71nUaoSmRvyoDKS3iDUxxaRHjdcqi:YUxBfJx5qvhDjWUx4HZc
- TLSH T1A2051225B692C821D0512E3048D2DFA4667FFC66D6305943B7A07B9E3EB3380566E35F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
30354
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\tihulewo\zojupo87\yeb.pdb
kernel32
FoldStringA
InterlockedCompareExchange
OpenWaitableTimerA
CreateEventW
ReadConsoleInputA
WaitNamedPipeA
CommConfigDialogA
SetSystemTimeAdjustment
SearchPathA
EnumResourceTypesW
GetModuleFileNameA
UpdateResourceW
LoadLibraryW
DeleteFileW
CopyFileW
FillConsoleOutputCharacterA
WriteConsoleOutputCharacterA
GetConsoleAliasesLengthW
PeekConsoleInputA
GlobalGetAtomNameW
GetShortPathNameA
GetPrivateProfileStringW
GetModuleHandleA
VirtualAlloc
ReleaseActCtx
GetConsoleAliasW
FindFirstChangeNotificationA
WritePrivateProfileStringW
EnumResourceNamesA
LockFile
lstrcpynA
AddAtomA
AllocConsole
GetLongPathNameA
GetLastError
GetSystemDefaultLCID
GetSystemDefaultLangID
GlobalAlloc
GetComputerNameW
FindNextFileW
OpenJobObjectA
InitializeCriticalSection
FindResourceExA
_hwrite
GlobalUnfix
GetComputerNameA
VerifyVersionInfoW
SetFileShortNameW
GetVolumeNameForVolumeMountPointA
GetFileAttributesExA
SetComputerNameW
GetFileAttributesW
GetVolumePathNameW
GetProcAddress
LoadLibraryA
CreateFileA
CloseHandle
RtlUnwind
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
SetFilePointer
Sleep
ExitProcess
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
ReadFile
SetStdHandle
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
user32
ScreenToClient
gdi32
GetCharWidth32A
GetCharacterPlacementA
msimg32
AlphaBlend
Name
.text
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
590KB
Virtual Size
600KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
127KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=129, id=131, productName=VS2008 build 21022, version=21022,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=150, id=1, productName=Unmarked objects,
count=39, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
- IMPHASH e097c2eba2804cfabad295256c8b4a6f
- SHA256 cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d
- MD5 914bcab4e777c2b32b7563edf0b6a7aa
- SHA1 eee78956f52218bec8f46b2692722a00f84dafba
- SHA512 8a0e5534721bedae89c738fcc43b543accb33385319ece5b9c5fd08677790392d9f89e99110462ede0575672588a395a7309e5c792d13795908228095fc858ab
- SSDEEP 3072:3jrvCU39gkTx4rVKPwo1YHYi3Avf3LVHoX5P5bsl0n3wX2b5RG9ru:3jjCs9MJouHFA3JoXdmy3YcUu
- TLSH T1FEB3CE4183D814D8F275C3B9D937691A5AA4FC260B6663EF7294CA1F4F37EC89231362
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
36768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msiexec.pdb
advapi32
OpenProcessToken
OpenThreadToken
StartServiceCtrlDispatcherW
SetThreadToken
SetSecurityDescriptorGroup
GetTokenInformation
RegEnumKeyW
EqualSid
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupPrivilegeValueW
GetAce
GetSecurityDescriptorLength
MakeAbsoluteSD
InitializeAcl
AllocateAndInitializeSid
SetServiceStatus
SetSecurityDescriptorOwner
AddAccessAllowedAce
RevertToSelf
FreeSid
RegOpenKeyExW
MakeSelfRelativeSD
RegisterServiceCtrlHandlerW
GetLengthSid
AdjustTokenPrivileges
RegCloseKey
kernel32
GetSystemDefaultLangID
ExitProcess
GetCommandLineW
GetEnvironmentVariableW
FreeLibrary
LoadLibraryExW
GetCurrentProcess
GetModuleHandleExW
WaitForSingleObject
SetEvent
OutputDebugStringW
GetModuleHandleW
GetCurrentThread
WriteFile
InitializeCriticalSection
OpenProcess
GlobalAlloc
WideCharToMultiByte
LoadLibraryW
GetLocaleInfoW
Sleep
FormatMessageW
GetVersionExW
LeaveCriticalSection
GetModuleFileNameW
CompareStringW
GetACP
lstrcmpW
MultiByteToWideChar
lstrlenW
GetStdHandle
GetLastError
SetLastError
GetProcAddress
EnterCriticalSection
GlobalFree
UnhandledExceptionFilter
GetFileType
CreateEventW
SetCurrentDirectoryW
OpenEventW
DeleteCriticalSection
CloseHandle
GetVersion
CreateThread
GetSystemDirectoryW
LoadLibraryExA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
DelayLoadFailureHook
SetUnhandledExceptionFilter
GetStartupInfoW
user32
PostQuitMessage
MsgWaitForMultipleObjects
TranslateMessage
IsCharAlphaNumericW
PeekMessageW
PostThreadMessageW
DispatchMessageW
GetMessageW
msvcrt
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
__setusermatherr
_initterm
__C_specific_handler
_acmdln
_fmode
_commode
_lock
_unlock
__dllonexit
_onexit
memcpy
memset
?terminate@@YAXXZ
_vsnprintf
_wcsicmp
_vsnwprintf
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ole32
CoInitialize
StgOpenStorage
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=241, version=40116,
count=67, id=242, version=40116,
count=16, id=243, version=40116,
count=13, id=239, version=40116,
count=207, id=1, productName=Unmarked objects,
count=3, id=247, version=40116,
count=1, id=126, version=50727,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
cfed5d55391704116b3bf68840ebcdd99277054cb1924ecff31876478ed9a927.exe
- IMPHASH b7b88f9fba96375d4eebc5d049319af3
- SHA256 cfed5d55391704116b3bf68840ebcdd99277054cb1924ecff31876478ed9a927
- MD5 a5e9983614e16c12b9196225007af964
- SHA1 af41c7a89f5e0f62f32ab0dbc62417af6795d007
- SHA512 f3fc8d72ccdeb2d510271627dab4e647d540db9831b6311802cba8b1d17ba1530b59d4ea7e8e065dc836fb793eef872330799817d55a5b82f6bfdacb9c7484a4
- SSDEEP 768:VaQRffDB31aCytHLykiKPT3JATD2qBwV2ckjbnsb0Ah99De0YADoYOjvX5qe:VaC318HxZATvnsblYOoYO
- TLSH T1A4337C6AAFC16DF3FDB525B416DBF64AA9DE690C032057C3AF24AD40B5202D06CF96C1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
MAKOP ransomware payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpr
WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW
kernel32
ReadFile
CreateFileW
GetFileSizeEx
MoveFileW
SetFileAttributesW
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
GlobalAlloc
GlobalFree
GetVersion
PeekNamedPipe
GetProcAddress
LoadLibraryA
GetComputerNameW
SetEvent
CreateEventW
TerminateThread
SetFilePointerEx
GetFileType
GetModuleHandleA
DuplicateHandle
GetCurrentProcessId
ExitProcess
GetModuleHandleW
CreatePipe
LocalFree
GetCommandLineW
GetEnvironmentVariableW
CreateProcessW
GetLocaleInfoW
GetModuleFileNameW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetSystemWindowsDirectoryW
SetHandleInformation
GetTempPathW
GetTempFileNameW
CreateDirectoryW
GetStdHandle
WriteFile
Sleep
TryEnterCriticalSection
FindClose
GetLastError
GetFileAttributesW
GetLogicalDrives
WaitForSingleObject
CreateThread
GetVolumeInformationW
SetErrorMode
FindNextFileW
GetDriveTypeW
WaitForMultipleObjects
FindFirstFileW
TerminateProcess
DeleteCriticalSection
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CloseHandle
OpenProcess
user32
DialogBoxParamW
RegisterHotKey
PostMessageW
EndDialog
KillTimer
ShowWindow
wsprintfA
MessageBoxW
SetWindowTextA
SendMessageW
GetShellWindow
UnregisterHotKey
SetTimer
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CloseClipboard
GetWindowTextA
EmptyClipboard
GetDlgItem
OpenClipboard
GetWindowThreadProcessId
ReleaseDC
SystemParametersInfoW
GetDC
DrawTextA
EnableWindow
SetClipboardData
wsprintfW
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
DeleteObject
SelectObject
SetBkMode
advapi32
CryptGenRandom
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DuplicateTokenEx
OpenProcessToken
SetTokenInformation
GetTokenInformation
CryptDecrypt
CryptAcquireContextW
CryptSetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptDestroyKey
shell32
ord680
ShellExecuteExW
CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ole32
CoInitialize
CoTaskMemFree
CoUninitialize
msimg32
GradientFill
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=125, productName=VS2005 build 50727, version=50727,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=133, id=1, productName=Unmarked objects,
count=17, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,