jaffacakes118_Trojan-GameThief[.]Win32[.]Magania[.]esol[.]fa942e1a836236ca02c69cc5f531f0df

resource
jaffacakes118_Trojan-GameThief.Win32.Magania.esol.fa942e1a836236ca02c69cc5f531f0df
unpack001/CERTIFICATE
unpack002/CERTIFICATE
unpack003/CERTIFICATE
unpack004/CERTIFICATE
unpack005/CERTIFICATE
unpack006/CERTIFICATE
unpack007/CERTIFICATE
unpack008/CERTIFICATE
unpack009/CERTIFICATE

jaffacakes118_Trojan-GameThief.Win32.Magania.esol.fa942e1a836236ca02c69cc5f531f0df

IMPHASH 23e1ca1fea5af7dcd98430db24a4ac2f
SHA256 b5ec15c40d87f69eaf1a538d332967f21144699ed41b503318fde16f23a1acaa
MD5 fa942e1a836236ca02c69cc5f531f0df
SHA1 2936207477a8a8cef1736b694bd81e359154fcc9
SHA512 0f3cad9eb2114aa852af7f4b0e8ac5155ed96574dc6c5b25ebbaabb4dafbc9d69bd003478a0c2625af6296283156f518852ebdbf16da06ffdb91364f5b0792a2
SSDEEP 3072:jN4+teBllrVtH99C3048PVnx8mMr4/tiSEdHRkmKywX6l3PeqovF:jN4diAdnxqytBGRkEwXIeqo9
TLSH
T19AE37D11FA8449F9E5A4213C14AB3B379A7FBC74CE495A87F760F59A08722D0BB12347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

.data

SHA256 6daa3ff8ab2d6d60587517da515028452e2f27e5e938c7a3f4a36e4482826a68
MD5 f183958663484310e0fbc70ffb8079b1
SHA1 9946397689216f525c77dc705b9276cb80f42593
SHA512 7ca757cb429cb976befbc02ad7b34cbcbae1c02fd21e7604480f6543473b5005bf725cb3c7f1a5f2d67c01122a2dfc0c9837335e64ff9a2d9a5a4446fb314ead
SSDEEP 192:VD9lXUt7GJikwMqQYHlmvh4lj+fzARyUeDA2fLIg:JXZa+fztUmT0g
TLSH
T10812621D6F642BBDD536203308A90F3BC87AB08835DE0D15BCAE929504566CD9F6731C
MD5 SHA1 SHA512 SSDEEP TLSH

.rdata

SHA256 1edca14c1d90975259a1edf8180f262c7dcee0f2a574fa776e02e4d3397dbdd4
MD5 0477154884f2ae3867601fb346157af5
SHA1 f3a0b9de1de1081e2772a94ebf10dae3c69f51de
SHA512 555a27cdb92ed91fc792d47e040aef3e5c230e71ca9b1814fcd2a4b9906889494e3a26b842d58e816f8e3ad8185e595cd581dd80ca9a96ea53f5af79c226f31e
SSDEEP 192:5flq/6gEFOQNftmzhwkKAW5fOU6ouWQ9ZjM1hL9CiwYYIt/WQprn:5fki/5NftmmkEfOU6hn2LL99wO
TLSH
T1AC425042B998C9A3C18E0338DDD787758FB2B444CEFA096B2C84D39E1D9A2585F147E1
MD5 SHA1 SHA512 SSDEEP TLSH

.reloc

SHA256 10c2f129fc974d16f4c0dfc26249d89f3d07132ac7068e4cf357f09b18eefcdb
MD5 503fdf00a50b1772a92da3c37860b425
SHA1 444d05e787b2ec302ead3c15294529102342f87d
SHA512 03e1dee1c88f16a997864152cc084d511efa170bddc5f18ab040dd5531c12efc8afd831b9be3228cec76e3fc1026b1563ed4d951e18b953d584aa8b3e1fbe65e
SSDEEP 96:oPfIlAWom9TSbZ0HUfnyVZJWUPD8AhSSTwxG+pxqFHFv+lAnIsT84yA:oolA1ZLyVZMEhSe+dE7GlgIs
TLSH
T1D8C13B397A08D115E7B452BD372EBB44ACEEC231E6995727E12097C19C078A0ACED717
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
TLSH
T17FC001137168C994D20400318887CFBC0D387C839846020B27F1DF5FBCB4B646446155
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 31db5abf48b626f6840811c9b71dffaa6e2eace7f9d33334d7849df41b9db8f8
MD5 f92d10d718732d41dd0ce9ad35371598
SHA1 4be063b4d7e51dcdb13fb57362f7e767be212ee2
SHA512 d9a60f7c4f8707ec867507c6dbf97425c2a2d48c07eafc340e27358422d309cbea41b77b331a20a0e6f264a7bf39a8f840ca73d9cb6fe8b79f5d45077a5edeae
TLSH
T1BD31910AA6FA3268B1A7A6489FE6CC3143537D11443ED25E98CC3E8D0FE38045951BF7
MD5 SHA1 SHA512 TLSH

.text

SHA256 fb1e8b67d0a299ec7ab9adc929c8f54211e88bb3904a89d0dd8f370277da03b1
MD5 4be6e96ac73f7845801e774abba861e1
SHA1 2aa3648d4cf764f8a5b5109bb72584ffb95bf232
SHA512 e8ee709ee3137f3c9a8d53319d3ce029bac0ecd1288a441928e72a1ba699b73810af40f5c2da64a8b990b62760935140e7f864538b567f600b54dcefcf62d5a2
SSDEEP 1536:1eBpvEwlxVtHRPiR69C300t8iQtVnxkFNP3y79MrcTdkK1fiSEpIe:1eBllrVtH99C3048PVnx8mMr4/tiSE
TLSH
T1F5834B41D98A48F8FA84343C587F3B7BE63F59788A09AAC7F720EDA54472561F823507
MD5 SHA1 SHA512 SSDEEP TLSH

CERTIFICATE

IMPHASH 95eb8766537ad3d32942f587bbdc8ed4
SHA256 cd7e9dc67b5f4b440edb71031ccc1ee5858c45ed911bd885401b17be618137de
MD5 148b56e23b9fbbdf87392a1385950db3
SHA1 720917fb724303ca0476d558351a335a40358c77
SHA512 419aefe05225360eca405ba3a73119711f037c4b2fb7391cd53b5f92996be84a635802a2ae5374591bd6907adfe0e1e23f86c283ee341d422362aa624b65e78a
SSDEEP 3072:JeBllrVtH99C3048PVnx8mMr4/tiSEdHRkmKywX6l:giAdnxqytBGRkEwX
TLSH
T185B36D01FE8549FDF9A4213C58BF3B37DA3FB8648A495A87FB24D9950472190BB22347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryA WaitForSingleObject SetEvent FreeLibrary CloseHandle TerminateThread Sleep ResumeThread CreateThread DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc GetLastError ResetEvent InterlockedExchange CancelIo GetTickCount GetLocalTime GetCurrentProcessId HeapAlloc GetProcessHeap DeleteFileA CreateDirectoryA GetFileAttributesA lstrcpyA lstrlenA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode GetCurrentProcess GetWindowsDirectoryA SetFileAttributesA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA CreateFileA RaiseException

msvcrt

strncpy free malloc _except_handler3 strrchr _beginthreadex atoi wcstombs sprintf srand calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv rand _CxxThrowException strstr _ftol ceil putchar memmove __CxxFrameHandler puts _access ??3@YAXPAX@Z ??2@YAPAXI@Z _strrev _stricmp

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

.data

SHA256 6daa3ff8ab2d6d60587517da515028452e2f27e5e938c7a3f4a36e4482826a68
MD5 f183958663484310e0fbc70ffb8079b1
SHA1 9946397689216f525c77dc705b9276cb80f42593
SHA512 7ca757cb429cb976befbc02ad7b34cbcbae1c02fd21e7604480f6543473b5005bf725cb3c7f1a5f2d67c01122a2dfc0c9837335e64ff9a2d9a5a4446fb314ead
SSDEEP 192:VD9lXUt7GJikwMqQYHlmvh4lj+fzARyUeDA2fLIg:JXZa+fztUmT0g
TLSH
T10812621D6F642BBDD536203308A90F3BC87AB08835DE0D15BCAE929504566CD9F6731C
MD5 SHA1 SHA512 SSDEEP TLSH

.rdata

SHA256 1edca14c1d90975259a1edf8180f262c7dcee0f2a574fa776e02e4d3397dbdd4
MD5 0477154884f2ae3867601fb346157af5
SHA1 f3a0b9de1de1081e2772a94ebf10dae3c69f51de
SHA512 555a27cdb92ed91fc792d47e040aef3e5c230e71ca9b1814fcd2a4b9906889494e3a26b842d58e816f8e3ad8185e595cd581dd80ca9a96ea53f5af79c226f31e
SSDEEP 192:5flq/6gEFOQNftmzhwkKAW5fOU6ouWQ9ZjM1hL9CiwYYIt/WQprn:5fki/5NftmmkEfOU6hn2LL99wO
TLSH
T1AC425042B998C9A3C18E0338DDD787758FB2B444CEFA096B2C84D39E1D9A2585F147E1
MD5 SHA1 SHA512 SSDEEP TLSH

.reloc

SHA256 10c2f129fc974d16f4c0dfc26249d89f3d07132ac7068e4cf357f09b18eefcdb
MD5 503fdf00a50b1772a92da3c37860b425
SHA1 444d05e787b2ec302ead3c15294529102342f87d
SHA512 03e1dee1c88f16a997864152cc084d511efa170bddc5f18ab040dd5531c12efc8afd831b9be3228cec76e3fc1026b1563ed4d951e18b953d584aa8b3e1fbe65e
SSDEEP 96:oPfIlAWom9TSbZ0HUfnyVZJWUPD8AhSSTwxG+pxqFHFv+lAnIsT84yA:oolA1ZLyVZMEhSe+dE7GlgIs
TLSH
T1D8C13B397A08D115E7B452BD372EBB44ACEEC231E6995727E12097C19C078A0ACED717
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
TLSH
T17FC001137168C994D20400318887CFBC0D387C839846020B27F1DF5FBCB4B646446155
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 31db5abf48b626f6840811c9b71dffaa6e2eace7f9d33334d7849df41b9db8f8
MD5 f92d10d718732d41dd0ce9ad35371598
SHA1 4be063b4d7e51dcdb13fb57362f7e767be212ee2
SHA512 d9a60f7c4f8707ec867507c6dbf97425c2a2d48c07eafc340e27358422d309cbea41b77b331a20a0e6f264a7bf39a8f840ca73d9cb6fe8b79f5d45077a5edeae
TLSH
T1BD31910AA6FA3268B1A7A6489FE6CC3143537D11443ED25E98CC3E8D0FE38045951BF7
MD5 SHA1 SHA512 TLSH

.text

SHA256 fb1e8b67d0a299ec7ab9adc929c8f54211e88bb3904a89d0dd8f370277da03b1
MD5 4be6e96ac73f7845801e774abba861e1
SHA1 2aa3648d4cf764f8a5b5109bb72584ffb95bf232
SHA512 e8ee709ee3137f3c9a8d53319d3ce029bac0ecd1288a441928e72a1ba699b73810af40f5c2da64a8b990b62760935140e7f864538b567f600b54dcefcf62d5a2
SSDEEP 1536:1eBpvEwlxVtHRPiR69C300t8iQtVnxkFNP3y79MrcTdkK1fiSEpIe:1eBllrVtH99C3048PVnx8mMr4/tiSE
TLSH
T1F5834B41D98A48F8FA84343C587F3B7BE63F59788A09AAC7F720EDA54472561F823507
MD5 SHA1 SHA512 SSDEEP TLSH

CERTIFICATE

IMPHASH 95eb8766537ad3d32942f587bbdc8ed4
SHA256 cd7e9dc67b5f4b440edb71031ccc1ee5858c45ed911bd885401b17be618137de
MD5 148b56e23b9fbbdf87392a1385950db3
SHA1 720917fb724303ca0476d558351a335a40358c77
SHA512 419aefe05225360eca405ba3a73119711f037c4b2fb7391cd53b5f92996be84a635802a2ae5374591bd6907adfe0e1e23f86c283ee341d422362aa624b65e78a
SSDEEP 3072:JeBllrVtH99C3048PVnx8mMr4/tiSEdHRkmKywX6l:giAdnxqytBGRkEwX
TLSH
T185B36D01FE8549FDF9A4213C58BF3B37DA3FB8648A495A87FB24D9950472190BB22347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryA WaitForSingleObject SetEvent FreeLibrary CloseHandle TerminateThread Sleep ResumeThread CreateThread DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc GetLastError ResetEvent InterlockedExchange CancelIo GetTickCount GetLocalTime GetCurrentProcessId HeapAlloc GetProcessHeap DeleteFileA CreateDirectoryA GetFileAttributesA lstrcpyA lstrlenA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode GetCurrentProcess GetWindowsDirectoryA SetFileAttributesA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA CreateFileA RaiseException

msvcrt

strncpy free malloc _except_handler3 strrchr _beginthreadex atoi wcstombs sprintf srand calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv rand _CxxThrowException strstr _ftol ceil putchar memmove __CxxFrameHandler puts _access ??3@YAXPAX@Z ??2@YAPAXI@Z _strrev _stricmp

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

.data

SHA256 6daa3ff8ab2d6d60587517da515028452e2f27e5e938c7a3f4a36e4482826a68
MD5 f183958663484310e0fbc70ffb8079b1
SHA1 9946397689216f525c77dc705b9276cb80f42593
SHA512 7ca757cb429cb976befbc02ad7b34cbcbae1c02fd21e7604480f6543473b5005bf725cb3c7f1a5f2d67c01122a2dfc0c9837335e64ff9a2d9a5a4446fb314ead
SSDEEP 192:VD9lXUt7GJikwMqQYHlmvh4lj+fzARyUeDA2fLIg:JXZa+fztUmT0g
TLSH
T10812621D6F642BBDD536203308A90F3BC87AB08835DE0D15BCAE929504566CD9F6731C
MD5 SHA1 SHA512 SSDEEP TLSH

.rdata

SHA256 1edca14c1d90975259a1edf8180f262c7dcee0f2a574fa776e02e4d3397dbdd4
MD5 0477154884f2ae3867601fb346157af5
SHA1 f3a0b9de1de1081e2772a94ebf10dae3c69f51de
SHA512 555a27cdb92ed91fc792d47e040aef3e5c230e71ca9b1814fcd2a4b9906889494e3a26b842d58e816f8e3ad8185e595cd581dd80ca9a96ea53f5af79c226f31e
SSDEEP 192:5flq/6gEFOQNftmzhwkKAW5fOU6ouWQ9ZjM1hL9CiwYYIt/WQprn:5fki/5NftmmkEfOU6hn2LL99wO
TLSH
T1AC425042B998C9A3C18E0338DDD787758FB2B444CEFA096B2C84D39E1D9A2585F147E1
MD5 SHA1 SHA512 SSDEEP TLSH

.reloc

SHA256 10c2f129fc974d16f4c0dfc26249d89f3d07132ac7068e4cf357f09b18eefcdb
MD5 503fdf00a50b1772a92da3c37860b425
SHA1 444d05e787b2ec302ead3c15294529102342f87d
SHA512 03e1dee1c88f16a997864152cc084d511efa170bddc5f18ab040dd5531c12efc8afd831b9be3228cec76e3fc1026b1563ed4d951e18b953d584aa8b3e1fbe65e
SSDEEP 96:oPfIlAWom9TSbZ0HUfnyVZJWUPD8AhSSTwxG+pxqFHFv+lAnIsT84yA:oolA1ZLyVZMEhSe+dE7GlgIs
TLSH
T1D8C13B397A08D115E7B452BD372EBB44ACEEC231E6995727E12097C19C078A0ACED717
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
TLSH
T17FC001137168C994D20400318887CFBC0D387C839846020B27F1DF5FBCB4B646446155
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 31db5abf48b626f6840811c9b71dffaa6e2eace7f9d33334d7849df41b9db8f8
MD5 f92d10d718732d41dd0ce9ad35371598
SHA1 4be063b4d7e51dcdb13fb57362f7e767be212ee2
SHA512 d9a60f7c4f8707ec867507c6dbf97425c2a2d48c07eafc340e27358422d309cbea41b77b331a20a0e6f264a7bf39a8f840ca73d9cb6fe8b79f5d45077a5edeae
TLSH
T1BD31910AA6FA3268B1A7A6489FE6CC3143537D11443ED25E98CC3E8D0FE38045951BF7
MD5 SHA1 SHA512 TLSH

.text

SHA256 fb1e8b67d0a299ec7ab9adc929c8f54211e88bb3904a89d0dd8f370277da03b1
MD5 4be6e96ac73f7845801e774abba861e1
SHA1 2aa3648d4cf764f8a5b5109bb72584ffb95bf232
SHA512 e8ee709ee3137f3c9a8d53319d3ce029bac0ecd1288a441928e72a1ba699b73810af40f5c2da64a8b990b62760935140e7f864538b567f600b54dcefcf62d5a2
SSDEEP 1536:1eBpvEwlxVtHRPiR69C300t8iQtVnxkFNP3y79MrcTdkK1fiSEpIe:1eBllrVtH99C3048PVnx8mMr4/tiSE
TLSH
T1F5834B41D98A48F8FA84343C587F3B7BE63F59788A09AAC7F720EDA54472561F823507
MD5 SHA1 SHA512 SSDEEP TLSH

CERTIFICATE

IMPHASH 95eb8766537ad3d32942f587bbdc8ed4
SHA256 cd7e9dc67b5f4b440edb71031ccc1ee5858c45ed911bd885401b17be618137de
MD5 148b56e23b9fbbdf87392a1385950db3
SHA1 720917fb724303ca0476d558351a335a40358c77
SHA512 419aefe05225360eca405ba3a73119711f037c4b2fb7391cd53b5f92996be84a635802a2ae5374591bd6907adfe0e1e23f86c283ee341d422362aa624b65e78a
SSDEEP 3072:JeBllrVtH99C3048PVnx8mMr4/tiSEdHRkmKywX6l:giAdnxqytBGRkEwX
TLSH
T185B36D01FE8549FDF9A4213C58BF3B37DA3FB8648A495A87FB24D9950472190BB22347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryA WaitForSingleObject SetEvent FreeLibrary CloseHandle TerminateThread Sleep ResumeThread CreateThread DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc GetLastError ResetEvent InterlockedExchange CancelIo GetTickCount GetLocalTime GetCurrentProcessId HeapAlloc GetProcessHeap DeleteFileA CreateDirectoryA GetFileAttributesA lstrcpyA lstrlenA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode GetCurrentProcess GetWindowsDirectoryA SetFileAttributesA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA CreateFileA RaiseException

msvcrt

strncpy free malloc _except_handler3 strrchr _beginthreadex atoi wcstombs sprintf srand calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv rand _CxxThrowException strstr _ftol ceil putchar memmove __CxxFrameHandler puts _access ??3@YAXPAX@Z ??2@YAPAXI@Z _strrev _stricmp

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

.data

SHA256 6daa3ff8ab2d6d60587517da515028452e2f27e5e938c7a3f4a36e4482826a68
MD5 f183958663484310e0fbc70ffb8079b1
SHA1 9946397689216f525c77dc705b9276cb80f42593
SHA512 7ca757cb429cb976befbc02ad7b34cbcbae1c02fd21e7604480f6543473b5005bf725cb3c7f1a5f2d67c01122a2dfc0c9837335e64ff9a2d9a5a4446fb314ead
SSDEEP 192:VD9lXUt7GJikwMqQYHlmvh4lj+fzARyUeDA2fLIg:JXZa+fztUmT0g
TLSH
T10812621D6F642BBDD536203308A90F3BC87AB08835DE0D15BCAE929504566CD9F6731C
MD5 SHA1 SHA512 SSDEEP TLSH

.rdata

SHA256 1edca14c1d90975259a1edf8180f262c7dcee0f2a574fa776e02e4d3397dbdd4
MD5 0477154884f2ae3867601fb346157af5
SHA1 f3a0b9de1de1081e2772a94ebf10dae3c69f51de
SHA512 555a27cdb92ed91fc792d47e040aef3e5c230e71ca9b1814fcd2a4b9906889494e3a26b842d58e816f8e3ad8185e595cd581dd80ca9a96ea53f5af79c226f31e
SSDEEP 192:5flq/6gEFOQNftmzhwkKAW5fOU6ouWQ9ZjM1hL9CiwYYIt/WQprn:5fki/5NftmmkEfOU6hn2LL99wO
TLSH
T1AC425042B998C9A3C18E0338DDD787758FB2B444CEFA096B2C84D39E1D9A2585F147E1
MD5 SHA1 SHA512 SSDEEP TLSH

.reloc

SHA256 10c2f129fc974d16f4c0dfc26249d89f3d07132ac7068e4cf357f09b18eefcdb
MD5 503fdf00a50b1772a92da3c37860b425
SHA1 444d05e787b2ec302ead3c15294529102342f87d
SHA512 03e1dee1c88f16a997864152cc084d511efa170bddc5f18ab040dd5531c12efc8afd831b9be3228cec76e3fc1026b1563ed4d951e18b953d584aa8b3e1fbe65e
SSDEEP 96:oPfIlAWom9TSbZ0HUfnyVZJWUPD8AhSSTwxG+pxqFHFv+lAnIsT84yA:oolA1ZLyVZMEhSe+dE7GlgIs
TLSH
T1D8C13B397A08D115E7B452BD372EBB44ACEEC231E6995727E12097C19C078A0ACED717
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
TLSH
T17FC001137168C994D20400318887CFBC0D387C839846020B27F1DF5FBCB4B646446155
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 31db5abf48b626f6840811c9b71dffaa6e2eace7f9d33334d7849df41b9db8f8
MD5 f92d10d718732d41dd0ce9ad35371598
SHA1 4be063b4d7e51dcdb13fb57362f7e767be212ee2
SHA512 d9a60f7c4f8707ec867507c6dbf97425c2a2d48c07eafc340e27358422d309cbea41b77b331a20a0e6f264a7bf39a8f840ca73d9cb6fe8b79f5d45077a5edeae
TLSH
T1BD31910AA6FA3268B1A7A6489FE6CC3143537D11443ED25E98CC3E8D0FE38045951BF7
MD5 SHA1 SHA512 TLSH

.text

SHA256 fb1e8b67d0a299ec7ab9adc929c8f54211e88bb3904a89d0dd8f370277da03b1
MD5 4be6e96ac73f7845801e774abba861e1
SHA1 2aa3648d4cf764f8a5b5109bb72584ffb95bf232
SHA512 e8ee709ee3137f3c9a8d53319d3ce029bac0ecd1288a441928e72a1ba699b73810af40f5c2da64a8b990b62760935140e7f864538b567f600b54dcefcf62d5a2
SSDEEP 1536:1eBpvEwlxVtHRPiR69C300t8iQtVnxkFNP3y79MrcTdkK1fiSEpIe:1eBllrVtH99C3048PVnx8mMr4/tiSE
TLSH
T1F5834B41D98A48F8FA84343C587F3B7BE63F59788A09AAC7F720EDA54472561F823507
MD5 SHA1 SHA512 SSDEEP TLSH

CERTIFICATE

IMPHASH 95eb8766537ad3d32942f587bbdc8ed4
SHA256 cd7e9dc67b5f4b440edb71031ccc1ee5858c45ed911bd885401b17be618137de
MD5 148b56e23b9fbbdf87392a1385950db3
SHA1 720917fb724303ca0476d558351a335a40358c77
SHA512 419aefe05225360eca405ba3a73119711f037c4b2fb7391cd53b5f92996be84a635802a2ae5374591bd6907adfe0e1e23f86c283ee341d422362aa624b65e78a
SSDEEP 3072:JeBllrVtH99C3048PVnx8mMr4/tiSEdHRkmKywX6l:giAdnxqytBGRkEwX
TLSH
T185B36D01FE8549FDF9A4213C58BF3B37DA3FB8648A495A87FB24D9950472190BB22347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryA WaitForSingleObject SetEvent FreeLibrary CloseHandle TerminateThread Sleep ResumeThread CreateThread DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc GetLastError ResetEvent InterlockedExchange CancelIo GetTickCount GetLocalTime GetCurrentProcessId HeapAlloc GetProcessHeap DeleteFileA CreateDirectoryA GetFileAttributesA lstrcpyA lstrlenA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode GetCurrentProcess GetWindowsDirectoryA SetFileAttributesA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA CreateFileA RaiseException

msvcrt

strncpy free malloc _except_handler3 strrchr _beginthreadex atoi wcstombs sprintf srand calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv rand _CxxThrowException strstr _ftol ceil putchar memmove __CxxFrameHandler puts _access ??3@YAXPAX@Z ??2@YAPAXI@Z _strrev _stricmp

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

.data

SHA256 6daa3ff8ab2d6d60587517da515028452e2f27e5e938c7a3f4a36e4482826a68
MD5 f183958663484310e0fbc70ffb8079b1
SHA1 9946397689216f525c77dc705b9276cb80f42593
SHA512 7ca757cb429cb976befbc02ad7b34cbcbae1c02fd21e7604480f6543473b5005bf725cb3c7f1a5f2d67c01122a2dfc0c9837335e64ff9a2d9a5a4446fb314ead
SSDEEP 192:VD9lXUt7GJikwMqQYHlmvh4lj+fzARyUeDA2fLIg:JXZa+fztUmT0g
TLSH
T10812621D6F642BBDD536203308A90F3BC87AB08835DE0D15BCAE929504566CD9F6731C
MD5 SHA1 SHA512 SSDEEP TLSH

.rdata

SHA256 1edca14c1d90975259a1edf8180f262c7dcee0f2a574fa776e02e4d3397dbdd4
MD5 0477154884f2ae3867601fb346157af5
SHA1 f3a0b9de1de1081e2772a94ebf10dae3c69f51de
SHA512 555a27cdb92ed91fc792d47e040aef3e5c230e71ca9b1814fcd2a4b9906889494e3a26b842d58e816f8e3ad8185e595cd581dd80ca9a96ea53f5af79c226f31e
SSDEEP 192:5flq/6gEFOQNftmzhwkKAW5fOU6ouWQ9ZjM1hL9CiwYYIt/WQprn:5fki/5NftmmkEfOU6hn2LL99wO
TLSH
T1AC425042B998C9A3C18E0338DDD787758FB2B444CEFA096B2C84D39E1D9A2585F147E1
MD5 SHA1 SHA512 SSDEEP TLSH

.reloc

SHA256 10c2f129fc974d16f4c0dfc26249d89f3d07132ac7068e4cf357f09b18eefcdb
MD5 503fdf00a50b1772a92da3c37860b425
SHA1 444d05e787b2ec302ead3c15294529102342f87d
SHA512 03e1dee1c88f16a997864152cc084d511efa170bddc5f18ab040dd5531c12efc8afd831b9be3228cec76e3fc1026b1563ed4d951e18b953d584aa8b3e1fbe65e
SSDEEP 96:oPfIlAWom9TSbZ0HUfnyVZJWUPD8AhSSTwxG+pxqFHFv+lAnIsT84yA:oolA1ZLyVZMEhSe+dE7GlgIs
TLSH
T1D8C13B397A08D115E7B452BD372EBB44ACEEC231E6995727E12097C19C078A0ACED717
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
TLSH
T17FC001137168C994D20400318887CFBC0D387C839846020B27F1DF5FBCB4B646446155
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 31db5abf48b626f6840811c9b71dffaa6e2eace7f9d33334d7849df41b9db8f8
MD5 f92d10d718732d41dd0ce9ad35371598
SHA1 4be063b4d7e51dcdb13fb57362f7e767be212ee2
SHA512 d9a60f7c4f8707ec867507c6dbf97425c2a2d48c07eafc340e27358422d309cbea41b77b331a20a0e6f264a7bf39a8f840ca73d9cb6fe8b79f5d45077a5edeae
TLSH
T1BD31910AA6FA3268B1A7A6489FE6CC3143537D11443ED25E98CC3E8D0FE38045951BF7
MD5 SHA1 SHA512 TLSH

.text

SHA256 fb1e8b67d0a299ec7ab9adc929c8f54211e88bb3904a89d0dd8f370277da03b1
MD5 4be6e96ac73f7845801e774abba861e1
SHA1 2aa3648d4cf764f8a5b5109bb72584ffb95bf232
SHA512 e8ee709ee3137f3c9a8d53319d3ce029bac0ecd1288a441928e72a1ba699b73810af40f5c2da64a8b990b62760935140e7f864538b567f600b54dcefcf62d5a2
SSDEEP 1536:1eBpvEwlxVtHRPiR69C300t8iQtVnxkFNP3y79MrcTdkK1fiSEpIe:1eBllrVtH99C3048PVnx8mMr4/tiSE
TLSH
T1F5834B41D98A48F8FA84343C587F3B7BE63F59788A09AAC7F720EDA54472561F823507
MD5 SHA1 SHA512 SSDEEP TLSH

CERTIFICATE

IMPHASH 95eb8766537ad3d32942f587bbdc8ed4
SHA256 cd7e9dc67b5f4b440edb71031ccc1ee5858c45ed911bd885401b17be618137de
MD5 148b56e23b9fbbdf87392a1385950db3
SHA1 720917fb724303ca0476d558351a335a40358c77
SHA512 419aefe05225360eca405ba3a73119711f037c4b2fb7391cd53b5f92996be84a635802a2ae5374591bd6907adfe0e1e23f86c283ee341d422362aa624b65e78a
SSDEEP 3072:JeBllrVtH99C3048PVnx8mMr4/tiSEdHRkmKywX6l:giAdnxqytBGRkEwX
TLSH
T185B36D01FE8549FDF9A4213C58BF3B37DA3FB8648A495A87FB24D9950472190BB22347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryA WaitForSingleObject SetEvent FreeLibrary CloseHandle TerminateThread Sleep ResumeThread CreateThread DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc GetLastError ResetEvent InterlockedExchange CancelIo GetTickCount GetLocalTime GetCurrentProcessId HeapAlloc GetProcessHeap DeleteFileA CreateDirectoryA GetFileAttributesA lstrcpyA lstrlenA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode GetCurrentProcess GetWindowsDirectoryA SetFileAttributesA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA CreateFileA RaiseException

msvcrt

strncpy free malloc _except_handler3 strrchr _beginthreadex atoi wcstombs sprintf srand calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv rand _CxxThrowException strstr _ftol ceil putchar memmove __CxxFrameHandler puts _access ??3@YAXPAX@Z ??2@YAPAXI@Z _strrev _stricmp

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

.data

SHA256 6daa3ff8ab2d6d60587517da515028452e2f27e5e938c7a3f4a36e4482826a68
MD5 f183958663484310e0fbc70ffb8079b1
SHA1 9946397689216f525c77dc705b9276cb80f42593
SHA512 7ca757cb429cb976befbc02ad7b34cbcbae1c02fd21e7604480f6543473b5005bf725cb3c7f1a5f2d67c01122a2dfc0c9837335e64ff9a2d9a5a4446fb314ead
SSDEEP 192:VD9lXUt7GJikwMqQYHlmvh4lj+fzARyUeDA2fLIg:JXZa+fztUmT0g
TLSH
T10812621D6F642BBDD536203308A90F3BC87AB08835DE0D15BCAE929504566CD9F6731C
MD5 SHA1 SHA512 SSDEEP TLSH

.rdata

SHA256 1edca14c1d90975259a1edf8180f262c7dcee0f2a574fa776e02e4d3397dbdd4
MD5 0477154884f2ae3867601fb346157af5
SHA1 f3a0b9de1de1081e2772a94ebf10dae3c69f51de
SHA512 555a27cdb92ed91fc792d47e040aef3e5c230e71ca9b1814fcd2a4b9906889494e3a26b842d58e816f8e3ad8185e595cd581dd80ca9a96ea53f5af79c226f31e
SSDEEP 192:5flq/6gEFOQNftmzhwkKAW5fOU6ouWQ9ZjM1hL9CiwYYIt/WQprn:5fki/5NftmmkEfOU6hn2LL99wO
TLSH
T1AC425042B998C9A3C18E0338DDD787758FB2B444CEFA096B2C84D39E1D9A2585F147E1
MD5 SHA1 SHA512 SSDEEP TLSH

.reloc

SHA256 10c2f129fc974d16f4c0dfc26249d89f3d07132ac7068e4cf357f09b18eefcdb
MD5 503fdf00a50b1772a92da3c37860b425
SHA1 444d05e787b2ec302ead3c15294529102342f87d
SHA512 03e1dee1c88f16a997864152cc084d511efa170bddc5f18ab040dd5531c12efc8afd831b9be3228cec76e3fc1026b1563ed4d951e18b953d584aa8b3e1fbe65e
SSDEEP 96:oPfIlAWom9TSbZ0HUfnyVZJWUPD8AhSSTwxG+pxqFHFv+lAnIsT84yA:oolA1ZLyVZMEhSe+dE7GlgIs
TLSH
T1D8C13B397A08D115E7B452BD372EBB44ACEEC231E6995727E12097C19C078A0ACED717
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
TLSH
T17FC001137168C994D20400318887CFBC0D387C839846020B27F1DF5FBCB4B646446155
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 31db5abf48b626f6840811c9b71dffaa6e2eace7f9d33334d7849df41b9db8f8
MD5 f92d10d718732d41dd0ce9ad35371598
SHA1 4be063b4d7e51dcdb13fb57362f7e767be212ee2
SHA512 d9a60f7c4f8707ec867507c6dbf97425c2a2d48c07eafc340e27358422d309cbea41b77b331a20a0e6f264a7bf39a8f840ca73d9cb6fe8b79f5d45077a5edeae
TLSH
T1BD31910AA6FA3268B1A7A6489FE6CC3143537D11443ED25E98CC3E8D0FE38045951BF7
MD5 SHA1 SHA512 TLSH

.text

SHA256 fb1e8b67d0a299ec7ab9adc929c8f54211e88bb3904a89d0dd8f370277da03b1
MD5 4be6e96ac73f7845801e774abba861e1
SHA1 2aa3648d4cf764f8a5b5109bb72584ffb95bf232
SHA512 e8ee709ee3137f3c9a8d53319d3ce029bac0ecd1288a441928e72a1ba699b73810af40f5c2da64a8b990b62760935140e7f864538b567f600b54dcefcf62d5a2
SSDEEP 1536:1eBpvEwlxVtHRPiR69C300t8iQtVnxkFNP3y79MrcTdkK1fiSEpIe:1eBllrVtH99C3048PVnx8mMr4/tiSE
TLSH
T1F5834B41D98A48F8FA84343C587F3B7BE63F59788A09AAC7F720EDA54472561F823507
MD5 SHA1 SHA512 SSDEEP TLSH

CERTIFICATE

IMPHASH 95eb8766537ad3d32942f587bbdc8ed4
SHA256 cd7e9dc67b5f4b440edb71031ccc1ee5858c45ed911bd885401b17be618137de
MD5 148b56e23b9fbbdf87392a1385950db3
SHA1 720917fb724303ca0476d558351a335a40358c77
SHA512 419aefe05225360eca405ba3a73119711f037c4b2fb7391cd53b5f92996be84a635802a2ae5374591bd6907adfe0e1e23f86c283ee341d422362aa624b65e78a
SSDEEP 3072:JeBllrVtH99C3048PVnx8mMr4/tiSEdHRkmKywX6l:giAdnxqytBGRkEwX
TLSH
T185B36D01FE8549FDF9A4213C58BF3B37DA3FB8648A495A87FB24D9950472190BB22347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryA WaitForSingleObject SetEvent FreeLibrary CloseHandle TerminateThread Sleep ResumeThread CreateThread DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc GetLastError ResetEvent InterlockedExchange CancelIo GetTickCount GetLocalTime GetCurrentProcessId HeapAlloc GetProcessHeap DeleteFileA CreateDirectoryA GetFileAttributesA lstrcpyA lstrlenA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode GetCurrentProcess GetWindowsDirectoryA SetFileAttributesA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA CreateFileA RaiseException

msvcrt

strncpy free malloc _except_handler3 strrchr _beginthreadex atoi wcstombs sprintf srand calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv rand _CxxThrowException strstr _ftol ceil putchar memmove __CxxFrameHandler puts _access ??3@YAXPAX@Z ??2@YAPAXI@Z _strrev _stricmp

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

.data

SHA256 6daa3ff8ab2d6d60587517da515028452e2f27e5e938c7a3f4a36e4482826a68
MD5 f183958663484310e0fbc70ffb8079b1
SHA1 9946397689216f525c77dc705b9276cb80f42593
SHA512 7ca757cb429cb976befbc02ad7b34cbcbae1c02fd21e7604480f6543473b5005bf725cb3c7f1a5f2d67c01122a2dfc0c9837335e64ff9a2d9a5a4446fb314ead
SSDEEP 192:VD9lXUt7GJikwMqQYHlmvh4lj+fzARyUeDA2fLIg:JXZa+fztUmT0g
TLSH
T10812621D6F642BBDD536203308A90F3BC87AB08835DE0D15BCAE929504566CD9F6731C
MD5 SHA1 SHA512 SSDEEP TLSH

.rdata

SHA256 1edca14c1d90975259a1edf8180f262c7dcee0f2a574fa776e02e4d3397dbdd4
MD5 0477154884f2ae3867601fb346157af5
SHA1 f3a0b9de1de1081e2772a94ebf10dae3c69f51de
SHA512 555a27cdb92ed91fc792d47e040aef3e5c230e71ca9b1814fcd2a4b9906889494e3a26b842d58e816f8e3ad8185e595cd581dd80ca9a96ea53f5af79c226f31e
SSDEEP 192:5flq/6gEFOQNftmzhwkKAW5fOU6ouWQ9ZjM1hL9CiwYYIt/WQprn:5fki/5NftmmkEfOU6hn2LL99wO
TLSH
T1AC425042B998C9A3C18E0338DDD787758FB2B444CEFA096B2C84D39E1D9A2585F147E1
MD5 SHA1 SHA512 SSDEEP TLSH

.reloc

SHA256 10c2f129fc974d16f4c0dfc26249d89f3d07132ac7068e4cf357f09b18eefcdb
MD5 503fdf00a50b1772a92da3c37860b425
SHA1 444d05e787b2ec302ead3c15294529102342f87d
SHA512 03e1dee1c88f16a997864152cc084d511efa170bddc5f18ab040dd5531c12efc8afd831b9be3228cec76e3fc1026b1563ed4d951e18b953d584aa8b3e1fbe65e
SSDEEP 96:oPfIlAWom9TSbZ0HUfnyVZJWUPD8AhSSTwxG+pxqFHFv+lAnIsT84yA:oolA1ZLyVZMEhSe+dE7GlgIs
TLSH
T1D8C13B397A08D115E7B452BD372EBB44ACEEC231E6995727E12097C19C078A0ACED717
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
TLSH
T17FC001137168C994D20400318887CFBC0D387C839846020B27F1DF5FBCB4B646446155
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 31db5abf48b626f6840811c9b71dffaa6e2eace7f9d33334d7849df41b9db8f8
MD5 f92d10d718732d41dd0ce9ad35371598
SHA1 4be063b4d7e51dcdb13fb57362f7e767be212ee2
SHA512 d9a60f7c4f8707ec867507c6dbf97425c2a2d48c07eafc340e27358422d309cbea41b77b331a20a0e6f264a7bf39a8f840ca73d9cb6fe8b79f5d45077a5edeae
TLSH
T1BD31910AA6FA3268B1A7A6489FE6CC3143537D11443ED25E98CC3E8D0FE38045951BF7
MD5 SHA1 SHA512 TLSH

.text

SHA256 fb1e8b67d0a299ec7ab9adc929c8f54211e88bb3904a89d0dd8f370277da03b1
MD5 4be6e96ac73f7845801e774abba861e1
SHA1 2aa3648d4cf764f8a5b5109bb72584ffb95bf232
SHA512 e8ee709ee3137f3c9a8d53319d3ce029bac0ecd1288a441928e72a1ba699b73810af40f5c2da64a8b990b62760935140e7f864538b567f600b54dcefcf62d5a2
SSDEEP 1536:1eBpvEwlxVtHRPiR69C300t8iQtVnxkFNP3y79MrcTdkK1fiSEpIe:1eBllrVtH99C3048PVnx8mMr4/tiSE
TLSH
T1F5834B41D98A48F8FA84343C587F3B7BE63F59788A09AAC7F720EDA54472561F823507
MD5 SHA1 SHA512 SSDEEP TLSH

CERTIFICATE

IMPHASH 95eb8766537ad3d32942f587bbdc8ed4
SHA256 cd7e9dc67b5f4b440edb71031ccc1ee5858c45ed911bd885401b17be618137de
MD5 148b56e23b9fbbdf87392a1385950db3
SHA1 720917fb724303ca0476d558351a335a40358c77
SHA512 419aefe05225360eca405ba3a73119711f037c4b2fb7391cd53b5f92996be84a635802a2ae5374591bd6907adfe0e1e23f86c283ee341d422362aa624b65e78a
SSDEEP 3072:JeBllrVtH99C3048PVnx8mMr4/tiSEdHRkmKywX6l:giAdnxqytBGRkEwX
TLSH
T185B36D01FE8549FDF9A4213C58BF3B37DA3FB8648A495A87FB24D9950472190BB22347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryA WaitForSingleObject SetEvent FreeLibrary CloseHandle TerminateThread Sleep ResumeThread CreateThread DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc GetLastError ResetEvent InterlockedExchange CancelIo GetTickCount GetLocalTime GetCurrentProcessId HeapAlloc GetProcessHeap DeleteFileA CreateDirectoryA GetFileAttributesA lstrcpyA lstrlenA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode GetCurrentProcess GetWindowsDirectoryA SetFileAttributesA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA CreateFileA RaiseException

msvcrt

strncpy free malloc _except_handler3 strrchr _beginthreadex atoi wcstombs sprintf srand calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv rand _CxxThrowException strstr _ftol ceil putchar memmove __CxxFrameHandler puts _access ??3@YAXPAX@Z ??2@YAPAXI@Z _strrev _stricmp

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

.data

SHA256 6daa3ff8ab2d6d60587517da515028452e2f27e5e938c7a3f4a36e4482826a68
MD5 f183958663484310e0fbc70ffb8079b1
SHA1 9946397689216f525c77dc705b9276cb80f42593
SHA512 7ca757cb429cb976befbc02ad7b34cbcbae1c02fd21e7604480f6543473b5005bf725cb3c7f1a5f2d67c01122a2dfc0c9837335e64ff9a2d9a5a4446fb314ead
SSDEEP 192:VD9lXUt7GJikwMqQYHlmvh4lj+fzARyUeDA2fLIg:JXZa+fztUmT0g
TLSH
T10812621D6F642BBDD536203308A90F3BC87AB08835DE0D15BCAE929504566CD9F6731C
MD5 SHA1 SHA512 SSDEEP TLSH

.rdata

SHA256 1edca14c1d90975259a1edf8180f262c7dcee0f2a574fa776e02e4d3397dbdd4
MD5 0477154884f2ae3867601fb346157af5
SHA1 f3a0b9de1de1081e2772a94ebf10dae3c69f51de
SHA512 555a27cdb92ed91fc792d47e040aef3e5c230e71ca9b1814fcd2a4b9906889494e3a26b842d58e816f8e3ad8185e595cd581dd80ca9a96ea53f5af79c226f31e
SSDEEP 192:5flq/6gEFOQNftmzhwkKAW5fOU6ouWQ9ZjM1hL9CiwYYIt/WQprn:5fki/5NftmmkEfOU6hn2LL99wO
TLSH
T1AC425042B998C9A3C18E0338DDD787758FB2B444CEFA096B2C84D39E1D9A2585F147E1
MD5 SHA1 SHA512 SSDEEP TLSH

.reloc

SHA256 10c2f129fc974d16f4c0dfc26249d89f3d07132ac7068e4cf357f09b18eefcdb
MD5 503fdf00a50b1772a92da3c37860b425
SHA1 444d05e787b2ec302ead3c15294529102342f87d
SHA512 03e1dee1c88f16a997864152cc084d511efa170bddc5f18ab040dd5531c12efc8afd831b9be3228cec76e3fc1026b1563ed4d951e18b953d584aa8b3e1fbe65e
SSDEEP 96:oPfIlAWom9TSbZ0HUfnyVZJWUPD8AhSSTwxG+pxqFHFv+lAnIsT84yA:oolA1ZLyVZMEhSe+dE7GlgIs
TLSH
T1D8C13B397A08D115E7B452BD372EBB44ACEEC231E6995727E12097C19C078A0ACED717
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
TLSH
T17FC001137168C994D20400318887CFBC0D387C839846020B27F1DF5FBCB4B646446155
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 31db5abf48b626f6840811c9b71dffaa6e2eace7f9d33334d7849df41b9db8f8
MD5 f92d10d718732d41dd0ce9ad35371598
SHA1 4be063b4d7e51dcdb13fb57362f7e767be212ee2
SHA512 d9a60f7c4f8707ec867507c6dbf97425c2a2d48c07eafc340e27358422d309cbea41b77b331a20a0e6f264a7bf39a8f840ca73d9cb6fe8b79f5d45077a5edeae
TLSH
T1BD31910AA6FA3268B1A7A6489FE6CC3143537D11443ED25E98CC3E8D0FE38045951BF7
MD5 SHA1 SHA512 TLSH

.text

SHA256 fb1e8b67d0a299ec7ab9adc929c8f54211e88bb3904a89d0dd8f370277da03b1
MD5 4be6e96ac73f7845801e774abba861e1
SHA1 2aa3648d4cf764f8a5b5109bb72584ffb95bf232
SHA512 e8ee709ee3137f3c9a8d53319d3ce029bac0ecd1288a441928e72a1ba699b73810af40f5c2da64a8b990b62760935140e7f864538b567f600b54dcefcf62d5a2
SSDEEP 1536:1eBpvEwlxVtHRPiR69C300t8iQtVnxkFNP3y79MrcTdkK1fiSEpIe:1eBllrVtH99C3048PVnx8mMr4/tiSE
TLSH
T1F5834B41D98A48F8FA84343C587F3B7BE63F59788A09AAC7F720EDA54472561F823507
MD5 SHA1 SHA512 SSDEEP TLSH

CERTIFICATE

IMPHASH 95eb8766537ad3d32942f587bbdc8ed4
SHA256 cd7e9dc67b5f4b440edb71031ccc1ee5858c45ed911bd885401b17be618137de
MD5 148b56e23b9fbbdf87392a1385950db3
SHA1 720917fb724303ca0476d558351a335a40358c77
SHA512 419aefe05225360eca405ba3a73119711f037c4b2fb7391cd53b5f92996be84a635802a2ae5374591bd6907adfe0e1e23f86c283ee341d422362aa624b65e78a
SSDEEP 3072:JeBllrVtH99C3048PVnx8mMr4/tiSEdHRkmKywX6l:giAdnxqytBGRkEwX
TLSH
T185B36D01FE8549FDF9A4213C58BF3B37DA3FB8648A495A87FB24D9950472190BB22347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryA WaitForSingleObject SetEvent FreeLibrary CloseHandle TerminateThread Sleep ResumeThread CreateThread DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc GetLastError ResetEvent InterlockedExchange CancelIo GetTickCount GetLocalTime GetCurrentProcessId HeapAlloc GetProcessHeap DeleteFileA CreateDirectoryA GetFileAttributesA lstrcpyA lstrlenA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode GetCurrentProcess GetWindowsDirectoryA SetFileAttributesA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA CreateFileA RaiseException

msvcrt

strncpy free malloc _except_handler3 strrchr _beginthreadex atoi wcstombs sprintf srand calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv rand _CxxThrowException strstr _ftol ceil putchar memmove __CxxFrameHandler puts _access ??3@YAXPAX@Z ??2@YAPAXI@Z _strrev _stricmp

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

.data

SHA256 6daa3ff8ab2d6d60587517da515028452e2f27e5e938c7a3f4a36e4482826a68
MD5 f183958663484310e0fbc70ffb8079b1
SHA1 9946397689216f525c77dc705b9276cb80f42593
SHA512 7ca757cb429cb976befbc02ad7b34cbcbae1c02fd21e7604480f6543473b5005bf725cb3c7f1a5f2d67c01122a2dfc0c9837335e64ff9a2d9a5a4446fb314ead
SSDEEP 192:VD9lXUt7GJikwMqQYHlmvh4lj+fzARyUeDA2fLIg:JXZa+fztUmT0g
TLSH
T10812621D6F642BBDD536203308A90F3BC87AB08835DE0D15BCAE929504566CD9F6731C
MD5 SHA1 SHA512 SSDEEP TLSH

.rdata

SHA256 1edca14c1d90975259a1edf8180f262c7dcee0f2a574fa776e02e4d3397dbdd4
MD5 0477154884f2ae3867601fb346157af5
SHA1 f3a0b9de1de1081e2772a94ebf10dae3c69f51de
SHA512 555a27cdb92ed91fc792d47e040aef3e5c230e71ca9b1814fcd2a4b9906889494e3a26b842d58e816f8e3ad8185e595cd581dd80ca9a96ea53f5af79c226f31e
SSDEEP 192:5flq/6gEFOQNftmzhwkKAW5fOU6ouWQ9ZjM1hL9CiwYYIt/WQprn:5fki/5NftmmkEfOU6hn2LL99wO
TLSH
T1AC425042B998C9A3C18E0338DDD787758FB2B444CEFA096B2C84D39E1D9A2585F147E1
MD5 SHA1 SHA512 SSDEEP TLSH

.reloc

SHA256 10c2f129fc974d16f4c0dfc26249d89f3d07132ac7068e4cf357f09b18eefcdb
MD5 503fdf00a50b1772a92da3c37860b425
SHA1 444d05e787b2ec302ead3c15294529102342f87d
SHA512 03e1dee1c88f16a997864152cc084d511efa170bddc5f18ab040dd5531c12efc8afd831b9be3228cec76e3fc1026b1563ed4d951e18b953d584aa8b3e1fbe65e
SSDEEP 96:oPfIlAWom9TSbZ0HUfnyVZJWUPD8AhSSTwxG+pxqFHFv+lAnIsT84yA:oolA1ZLyVZMEhSe+dE7GlgIs
TLSH
T1D8C13B397A08D115E7B452BD372EBB44ACEEC231E6995727E12097C19C078A0ACED717
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
TLSH
T17FC001137168C994D20400318887CFBC0D387C839846020B27F1DF5FBCB4B646446155
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 31db5abf48b626f6840811c9b71dffaa6e2eace7f9d33334d7849df41b9db8f8
MD5 f92d10d718732d41dd0ce9ad35371598
SHA1 4be063b4d7e51dcdb13fb57362f7e767be212ee2
SHA512 d9a60f7c4f8707ec867507c6dbf97425c2a2d48c07eafc340e27358422d309cbea41b77b331a20a0e6f264a7bf39a8f840ca73d9cb6fe8b79f5d45077a5edeae
TLSH
T1BD31910AA6FA3268B1A7A6489FE6CC3143537D11443ED25E98CC3E8D0FE38045951BF7
MD5 SHA1 SHA512 TLSH

.text

SHA256 fb1e8b67d0a299ec7ab9adc929c8f54211e88bb3904a89d0dd8f370277da03b1
MD5 4be6e96ac73f7845801e774abba861e1
SHA1 2aa3648d4cf764f8a5b5109bb72584ffb95bf232
SHA512 e8ee709ee3137f3c9a8d53319d3ce029bac0ecd1288a441928e72a1ba699b73810af40f5c2da64a8b990b62760935140e7f864538b567f600b54dcefcf62d5a2
SSDEEP 1536:1eBpvEwlxVtHRPiR69C300t8iQtVnxkFNP3y79MrcTdkK1fiSEpIe:1eBllrVtH99C3048PVnx8mMr4/tiSE
TLSH
T1F5834B41D98A48F8FA84343C587F3B7BE63F59788A09AAC7F720EDA54472561F823507
MD5 SHA1 SHA512 SSDEEP TLSH

CERTIFICATE

IMPHASH 95eb8766537ad3d32942f587bbdc8ed4
SHA256 cd7e9dc67b5f4b440edb71031ccc1ee5858c45ed911bd885401b17be618137de
MD5 148b56e23b9fbbdf87392a1385950db3
SHA1 720917fb724303ca0476d558351a335a40358c77
SHA512 419aefe05225360eca405ba3a73119711f037c4b2fb7391cd53b5f92996be84a635802a2ae5374591bd6907adfe0e1e23f86c283ee341d422362aa624b65e78a
SSDEEP 3072:JeBllrVtH99C3048PVnx8mMr4/tiSEdHRkmKywX6l:giAdnxqytBGRkEwX
TLSH
T185B36D01FE8549FDF9A4213C58BF3B37DA3FB8648A495A87FB24D9950472190BB22347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryA WaitForSingleObject SetEvent FreeLibrary CloseHandle TerminateThread Sleep ResumeThread CreateThread DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc GetLastError ResetEvent InterlockedExchange CancelIo GetTickCount GetLocalTime GetCurrentProcessId HeapAlloc GetProcessHeap DeleteFileA CreateDirectoryA GetFileAttributesA lstrcpyA lstrlenA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode GetCurrentProcess GetWindowsDirectoryA SetFileAttributesA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA CreateFileA RaiseException

msvcrt

strncpy free malloc _except_handler3 strrchr _beginthreadex atoi wcstombs sprintf srand calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv rand _CxxThrowException strstr _ftol ceil putchar memmove __CxxFrameHandler puts _access ??3@YAXPAX@Z ??2@YAPAXI@Z _strrev _stricmp

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Magania.esol.fa942e1a836236ca02c69cc5f531f0df

kernel32

msvcrt

generic

.data

.rdata

.reloc

.rsrc/BITMAP/103.bmp

.rsrc/MANIFEST/1

.rsrc/MENU/102

.rsrc/version.txt

.text

CERTIFICATE

kernel32

msvcrt

msvcp60

generic

.data

.rdata

.reloc

.rsrc/BITMAP/103.bmp

.rsrc/MANIFEST/1

.rsrc/MENU/102

.rsrc/version.txt

.text

CERTIFICATE

kernel32

msvcrt

msvcp60

generic

.data

.rdata

.reloc

.rsrc/BITMAP/103.bmp

.rsrc/MANIFEST/1

.rsrc/MENU/102

.rsrc/version.txt

.text

CERTIFICATE

kernel32

msvcrt

msvcp60

generic

.data

.rdata

.reloc

.rsrc/BITMAP/103.bmp

.rsrc/MANIFEST/1

.rsrc/MENU/102

.rsrc/version.txt

.text

CERTIFICATE

kernel32

msvcrt

msvcp60

generic

.data

.rdata

.reloc

.rsrc/BITMAP/103.bmp

.rsrc/MANIFEST/1

.rsrc/MENU/102

.rsrc/version.txt

.text

CERTIFICATE

kernel32

msvcrt

msvcp60

generic

.data

.rdata

.reloc

.rsrc/BITMAP/103.bmp

.rsrc/MANIFEST/1

.rsrc/MENU/102