RenderEdge_v0.3.0.rar
- SHA256 9b741f3afb50096ae4690c2031297885e36638b0285346577638b3c4c2deef0e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RenderEdge/AntTweakBar.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
RenderEdge/RenderEdge.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
RenderEdge/RenderEdge.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
RenderEdge/RenderEdge_loader.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target RenderEdge_v0.3.0.rar
- Size 8.0MB
- Sample261014-n6r2vsvsaz
- SHA256 9b741f3afb50096ae4690c2031297885e36638b0285346577638b3c4c2deef0e
- MD5 6fe2a3e2b0cd679a2a8f17fdbb758e99
- SHA1 5b2060e91f249cccba01908f187bd8c198caaab7
- SHA512 deffaa5209162572928aa89541ddd0677881b47b2b5b09ba6a3eb7e5ff1e756455daa759bfefe854e6a2717dffb26ad684f6309d9909ec8ef7aef452e2229b96
- SSDEEP 196608:mY1v8MiTXPMe6kVac2gG4FM8fKbfB+t9aZqVMS8pL:mHTXPLLVac/rM+ifB+eZqVV+L
- TLSH T1B3863380F5D656BD13882FAA05C2F1F9A910AF4D745B7E5ED9EC3813E2B6A0D41C8C2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/RenderEdge/AntTweakBar.dll unpack001/RenderEdge/RenderEdge.dll unpack001/RenderEdge/RenderEdge.exe unpack001/RenderEdge/RenderEdge_loader.dll
File Explorer
-
RenderEdge_v0.3.0.rar.rar 8.0MB
-
RenderEdge/AntTweakBar.dll.dll 628KB
-
RenderEdge/Maps/RenderEdge/[RenderEdge]_Experimental_Map.w3x33KB
-
RenderEdge/Maps/RenderEdge/[RenderEdge]_Sample_Map.w3x54KB
-
RenderEdge/RenderEdge.dll.dll 961KB
-
RenderEdge/RenderEdge.exe.exe 47KB
-
RenderEdge/RenderEdge.ini8KB
-
RenderEdge/RenderEdge.mpq7.3MB
-
RenderEdge/RenderEdge_loader.dll.dll 16KB
RenderEdge/AntTweakBar.dll
- IMPHASH 00d88fdfc8347ef3b83b370737c4308d
- SHA256 8a34a705489a9a9457e6232cb27d518c7ed51c86740df91bc61888f52bf91845
- MD5 04ec8f97dffcba20d4fe00bfabe4ff46
- SHA1 117da2ed2ff6f23d8ff7a040fc4dfdb1066de051
- SHA512 7d2e6ee8bb54a31b714ae9dce86b032b75ba19a70d0d6fef1eeb3300f67a56634b4b5a20739d7e0c452e379182abd605eec039104e0be34655bdb80e931e70c3
- SSDEEP 12288:83JIaTow8gDHCtpRYOe9r9MopQWpHuw0n:kToSKyaopQWdD0
- TLSH T102D48B50BA8AB071D54915BCE552E33AB729FE148F248EC37BD41F6FAE305E09E34186
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
304658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
GetProcAddress
FreeLibrary
QueryPerformanceFrequency
QueryPerformanceCounter
GlobalLock
GlobalUnlock
GlobalAlloc
Sleep
OutputDebugStringA
GetModuleHandleA
CreateFileA
ReadFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CloseHandle
SetFilePointer
GetLocaleInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
IsValidLocale
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetModuleHandleW
ExitProcess
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
HeapCreate
HeapDestroy
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
IsValidCodePage
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
user32
SetCursor
GetCursorInfo
DestroyCursor
CreateCursor
LoadCursorA
SetCapture
GetAsyncKeyState
MapVirtualKeyA
InvalidateRect
ReleaseCapture
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
MessageBoxA
TwEventCharGLFWcdecl
TwEventKeyGLFWcdecl
TwEventKeyboardGLUT
TwEventMouseButtonGLFWcdecl
TwEventMouseButtonGLUT
TwEventMouseMotionGLUT
TwEventMousePosGLFWcdecl
TwEventMouseWheelGLFWcdecl
TwEventSpecialGLUT
_TwAddButton@20
_TwAddSeparator@12
_TwAddVarCB@28
_TwAddVarRO@20
_TwAddVarRW@20
_TwCopyCDStringToClientFunc@4
_TwCopyCDStringToLibrary@8
_TwCopyStdStringToClientFunc@4
_TwCopyStdStringToLibrary@8
_TwDefine@4
_TwDefineEnum@12
_TwDefineEnumFromString@8
_TwDefineStruct@24
_TwDeleteAllBars@0
_TwDeleteBar@4
_TwDraw@0
_TwEventCharGLFW@8
_TwEventKeyGLFW@8
_TwEventMouseButtonGLFW@8
_TwEventSDL@12
_TwEventSFML@12
_TwEventWin32@16
_TwEventWin@16
_TwGLUTModifiersFunc@4
_TwGetBarByIndex@4
_TwGetBarByName@4
_TwGetBarCount@0
_TwGetBarName@4
_TwGetBottomBar@0
_TwGetCurrentWindow@0
_TwGetLastError@0
_TwGetParam@24
_TwGetTopBar@0
_TwHandleErrors@4
_TwInit@8
_TwKeyPressed@8
_TwKeyTest@8
_TwMouseButton@8
_TwMouseMotion@8
_TwMouseWheel@4
_TwNewBar@4
_TwRefreshBar@4
_TwRemoveAllVars@4
_TwRemoveVar@8
_TwSetBottomBar@4
_TwSetCurrentWindow@4
_TwSetParam@24
_TwSetTopBar@4
_TwTerminate@0
_TwWindowExists@4
_TwWindowSize@8
Name
.text
Size
395KB
Virtual Size
395KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
37KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=149, productName=VS2008 build 21022, version=21022,
count=54, id=132, productName=VS2008 build 21022, version=21022,
count=133, id=131, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=110, id=1, productName=Unmarked objects,
count=19, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
RenderEdge/Maps/RenderEdge/[RenderEdge]_Experimental_Map.w3x
- SHA256 66866b4222f4ae55312e7bc634c7368f452e32fe4460ba5610595bfe6d3d4d91
- MD5 142de2c28df9060f51cd778b9a9f11d7
- SHA1 45fe1438d6abaf03bf0ada7a2d457bd2a9a275bc
- SHA512 788bb9003be3fe75fda7d5cc5b031de682cc2dfe560012e0b4adc84814ebb254a240409b58c6437c61d7cf202c5b8742ce88d54fd5c97321348d087ef1ff9310
- SSDEEP 768:tdmS8tc43wQaGbKdIp9tjNCOrmz6A0313XkHyhnXWcYP1q:tdm/tnnXrmz6AK13XkHy5
- TLSH T171F2E11F8ABCB525D73066729C0AD71EF9CBB6C947B791450894C2A1F3BB12C068F989
- MD5 SHA1 SHA512 SSDEEP TLSH
RenderEdge/Maps/RenderEdge/[RenderEdge]_Sample_Map.w3x
- SHA256 a5839b97efcb896b1be6884d81e034db5d9b3f42c46f8210ce51840bf295331d
- MD5 6208b3bffdf09477aa798040442edef5
- SHA1 beb6c8b06061122bb29a6fa961992278b7ee64a9
- SHA512 9a8543533b08a11c4147d9e069d1c95e21e3ed42e1a6b169cb006e36b0bac36a255cbcbc38e3ad2ed945cd5402750a308b3c083e19a79c5cb4aebc151ac623ef
- SSDEEP 1536:74LvQalaYZ64WsISt67P7oEnCPAHXwqbF/CpXqbuBC:8L5s4/qjo8CPAHXwJpaaBC
- TLSH T1DD430271833F5D30DDB05E3E1E88052390B07A3BC19E8B2477DA8F9926D957191AB74D
- MD5 SHA1 SHA512 SSDEEP TLSH
RenderEdge/RenderEdge.dll
- IMPHASH 44d7135cc3f1e664665a872440b97179
- SHA256 33d1e11d143175b7622b13469b22336f47928931f0f317477a1d655b2e40ddd4
- MD5 c99751fdc23dd951bb86a807ce822bea
- SHA1 9309ac8daaaeb0514272b32ba81c38595294c158
- SHA512 c2c578a0d326e57740e76f293c1bb4aa9e3775bf372ceae3dc2cbf367e308a9b4009cbab678b8414c4112f8e6ee189c1d31b2aa788d7e1cb2772cbc5c7b8d865
- SSDEEP 12288:UQ2hR+Byz4eJus4pyXp1xp7ZRtdyfK5UKvrrs+3E1PkAZTlZvEfEWm/ZOFa:tByEeJur6tdyfKyuEhlXtZ/ZOFa
- TLSH T12725AE80BB4A01F6EA8E12B4917EBB3B4E3427150324C1D3D2D43C65ED617E37B7A65A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
193961
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetThreadContext
SetThreadContext
SuspendThread
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualQuery
ResumeThread
WideCharToMultiByte
GetFileAttributesA
GetLastError
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
TerminateProcess
GetCurrentThread
GetModuleFileNameA
SetLastError
GetLocalTime
MultiByteToWideChar
GetSystemTime
CreateDirectoryA
K32GetProcessMemoryInfo
GetCurrentProcess
GetModuleHandleW
GetProcAddress
LoadLibraryW
VirtualProtect
user32
GetKeyState
ScreenToClient
GetCursorPos
GetWindowLongW
MessageBoxA
SetWindowPos
SetWindowLongW
GetDC
ReleaseDC
SetCursorPos
GetWindowRect
gdi32
SelectObject
GetFontData
DeleteObject
AddFontMemResourceEx
GetDeviceCaps
CreateFontA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?_Xinvalid_argument@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
_Xtime_get_ticks
_Query_perf_counter
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
_Query_perf_frequency
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Xout_of_range@std@@YAXPBD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
anttweakbar
_TwTerminate@0
_TwInit@8
_TwDefineStruct@24
_TwGetLastError@0
_TwDefineEnum@12
_TwAddSeparator@12
_TwWindowSize@8
_TwNewBar@4
_TwAddVarCB@28
_TwAddVarRW@20
_TwDefine@4
_TwEventWin@16
_TwAddButton@20
_TwDraw@0
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateSprite
D3DXMatrixTransformation2D
D3DXCreateFontW
D3DXCreateCubeTextureFromFileExA
D3DXSaveSurfaceToFileA
D3DXCreateEffectFromFileA
D3DXCreateTextureFromFileExA
D3DXMatrixOrthoOffCenterLH
D3DXVec4Transform
D3DXVec3Normalize
D3DXCreateTexture
D3DXFilterTexture
D3DXMatrixInverse
D3DXCreateEffect
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXGetImageInfoFromFileA
D3DXCreateTextureFromFileInMemoryEx
D3DXMatrixMultiply
D3DXGetImageInfoFromFileInMemory
D3DXMatrixTranslation
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
wsock32
htons
ioctlsocket
getsockopt
ntohs
setsockopt
vcruntime140
__CxxFrameHandler3
__std_terminate
__std_exception_destroy
__std_exception_copy
strstr
strchr
_CxxThrowException
memset
_except_handler4_common
__std_type_info_destroy_list
memcpy
memmove
strrchr
longjmp
memchr
_setjmp3
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
realloc
calloc
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_cexit
terminate
_initterm
_initterm_e
exit
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_initialize_onexit_table
_errno
_execute_onexit_table
api-ms-win-crt-convert-l1-1-0
strtoul
strtof
strtol
api-ms-win-crt-stdio-l1-1-0
ftell
__stdio_common_vsprintf
fflush
__stdio_common_vfprintf
fseek
__stdio_common_vsscanf
__acrt_iob_func
fclose
fgetc
fwrite
fputc
fgetpos
setvbuf
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
fopen
api-ms-win-crt-string-l1-1-0
isxdigit
strncmp
strncpy
tolower
isspace
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
_libm_sse2_sin_precise
_libm_sse2_pow_precise
_libm_sse2_cos_precise
_CIfmod
exp2f
_libm_sse2_sqrt_precise
lround
_except1
_libm_sse2_tan_precise
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-environment-l1-1-0
getenv
Name
.text
Size
754KB
Virtual Size
753KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=260, version=25019,
count=3, id=261, productName=VS2017 v15.3 build 25506, version=25506,
count=42, id=260, productName=VS2017 v15.3 build 25506, version=25506,
count=2, id=156, version=21202,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=10, id=260, version=26706,
count=7, id=259, version=26706,
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=261, version=26706,
count=4, id=257, version=26706,
count=13, id=257, version=23917,
count=300, id=1, productName=Unmarked objects,
count=49, id=265, version=27026,
count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,
RenderEdge/RenderEdge.exe
- IMPHASH 58c57beda9c8e27ea8c21aae4f3bb02d
- SHA256 c4f5fe0508e616de62ad5c70b12f362f18988b97dbd52492f2cee6c1185bd092
- MD5 5d6278ba9898cb0b91ef90f54dd221c3
- SHA1 e0415fd2443d0a25bea905b783a6a05298e1c387
- SHA512 9fe0856c8b6a05f87d6ebb00c92e9f57fa89354970496a8e53b64993af84310863f512d389a79d26cf7fe6c52d6ae900aac0347a8b3c88f4559f77558c7308d5
- SSDEEP 768:T0bLL53bTrn4Awf0iXdmvCAfdkEa3m3KAcyF3VleE7LPJq:oT5/rn4sQdmLiT3msyFtPJq
- TLSH T13D23161EEA0E88C6EDE01074DF6682ACCFADA33C56E40E23535925DE1B60C6F7D0D068
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10179
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateProcessA
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetProcAddress
SetThreadContext
FlushInstructionCache
GetThreadContext
VirtualProtectEx
GetModuleHandleA
ResumeThread
GetFileAttributesA
WriteProcessMemory
IsProcessorFeaturePresent
QueryPerformanceCounter
UnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
user32
MessageBoxA
comdlg32
GetOpenFileNameA
advapi32
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
msvcp140
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
__std_exception_destroy
memset
memcpy
memmove
__CxxFrameHandler3
__std_exception_copy
_CxxThrowException
_except_handler4_common
api-ms-win-crt-string-l1-1-0
strcpy_s
strcat_s
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_invalid_parameter_noinfo_noreturn
_controlfp_s
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_seh_filter_exe
_cexit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_configure_narrow_argv
_set_app_type
_initialize_narrow_environment
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
malloc
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=261, version=26706,
count=12, id=260, version=26706,
count=1, id=259, version=26706,
count=4, id=257, version=26706,
count=9, id=257, version=23917,
count=74, id=1, productName=Unmarked objects,
count=2, id=265, version=27025,
count=1, id=255, productName=VS2017 v15.9.4 build 27025, version=27025,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.4 build 27025, version=27025,
RenderEdge/RenderEdge.ini
- SHA256 08cb4f7127304fdaf9b2a8bf465416fb64890171dccb254b7ee4eb31c6f32743
- MD5 7cfcf64afa48aebfbb3a5f5ac3b91e6c
- SHA1 32d7661e94a20f59c2fcbcb06c238bd5f641e638
- SHA512 ab3d0c9e77fc22009984cc49833b6bb60ef615688d6e2004ae2e788fdc45a1e317d73e35cadeab024663b0a1f2d269f45558584210ca838d3467ef359bbd634c
- SSDEEP 192:PMyKqJZkn6H9H7acfxbvksUfUS87U0yuP:PMLMkn6H9H79fxbKfUlyuP
- TLSH T107125523769A37ACEAA3DC1ACCC798111FF176245F3B30A470695A0C2707A18CDE5A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
RenderEdge/RenderEdge.mpq
- SHA256 c81932ab5087e857b40e86a0cd7ba99ed63e8789ac9b2a4332ffdc205431b052
- MD5 97653d0e971acb296312f41e7cae2527
- SHA1 242eb6d6bfea69675bd06c57c4b39b80bb8d91ab
- SHA512 8acca151efda0b6fbbed5c3ef4885a20aeb7dfc44407d68d8eb611f403e70186bb8177e0e592c9252382058dac48a073f3533658af4b5c509b9e880bbe61fef2
- SSDEEP 196608:wWQ5rzDqCj+WKqf7ggJF5nLh7ZCl6k5nj5UwBxrxy5:K5sqfcgJDVUlR5nNji5
- TLSH T1B57633C3A604149FE8E6C6B5D4E72379DE665AC20D6C5ECFF47FA9B143593A80800E39
- MD5 SHA1 SHA512 SSDEEP TLSH
RenderEdge/RenderEdge_loader.dll
- IMPHASH 6a2014b6b64c9d3ce13c732d50e1648d
- SHA256 e0e6ad2776fc0236198239993c9c6ccac0c9fb12f544fb46b9559862833eb71f
- MD5 49f0e88b99a9811d832949294bb4e4a3
- SHA1 4c6a2ab9da53977cba206a11c20890eb26cb689a
- SHA512 f3cc6fa48afa94408b568f32295b32239a28e7abc3c0de296a18faeef9dd9af2ba908fc6428542f184be1ffc8b382091594728bf4d6db87aa6d40dc62f563a58
- SSDEEP 384:fdq0q3LIRt22urHAetFAJewG1jb+US4dAq13:FyHAesAwGd+UTSq1
- TLSH T139722B02FF6142B3D57803705CB6AAAF85B9B8184FF15ACB6B525A4B0D303D2BD3251B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9965
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleFileNameW
GetFileAttributesW
DisableThreadLibraryCalls
LoadLibraryW
GetModuleHandleW
VirtualProtect
WriteProcessMemory
GetCurrentProcess
ReadProcessMemory
FlushInstructionCache
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
UnhandledExceptionFilter
GetSystemTimeAsFileTime
InitializeSListHead
user32
MessageBoxW
msvcp140
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
_CxxThrowException
memmove
memcpy
__std_type_info_destroy_list
_except_handler4_common
__std_exception_destroy
__CxxFrameHandler3
memset
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
_invalid_parameter_noinfo_noreturn
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=261, version=26706,
count=10, id=260, version=26706,
count=1, id=259, version=26706,
count=4, id=257, version=26706,
count=5, id=257, version=23917,
count=52, id=1, productName=Unmarked objects,
count=6, id=265, version=27025,
count=1, id=255, productName=VS2017 v15.9.4 build 27025, version=27025,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.4 build 27025, version=27025,