zararli.zip
- SHA256 74d7735c55216f1ebc3e9d68d3e6c8e9f945d3d6cd10deba55520be119bd5fdc
Overview
overview
8Static
static
3Oxymorphaz...4).exe
windows10-2004-x64
1Oxymorphaz...6).exe
windows10-2004-x64
Oxymorphaz...4).exe
windows10-2004-x64
1Oxymorphaz...6).exe
windows10-2004-x64
3zararlı/h...86.exe
windows10-2004-x64
salinewin1...ty.exe
windows10-2004-x64
3salinewin1.5.exe
windows10-2004-x64
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Oxymorphazone (x64).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Oxymorphazone (x86).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
Oxymorphazone-safety (x64).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
Oxymorphazone-safety (x86).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral5
Sample
zararlı/hydrogenx86.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral6
Sample
salinewin1.5-safety.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral7
Sample
salinewin1.5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
900 seconds
General
- Target zararli.zip
- Size 525KB
- Sample261018-rlrgdabc89
- SHA256 74d7735c55216f1ebc3e9d68d3e6c8e9f945d3d6cd10deba55520be119bd5fdc
- MD5 3111059488e0a24ab7c3c3712530ed71
- SHA1 951fb817e776a69a4f5c7ea55d6991318fb5d48f
- SHA512 8bbf6c337d5b3b73424064a3b8133f56069dc5314cf328d2c24e3d236b3efa43aee3d4919c590d1306ef5d9926dd62bbc7448db75e85ddca2212fb8302aa2288
- SSDEEP 12288:DBNOf2BkDLs9plh1tgvd8wycSYAXJ+MEEbuxNMcpNWY2HEyF4/rC:DBQf2BkDLs9plh4FyciSenHE24/2
- TLSH T177B423DAB88F13F6E4EF179C15CBC8240C38C65FD1715D5AD9B8E75A30C6228B83A529
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack002/Oxymorphazone (x64).exe unpack002/Oxymorphazone (x86).exe unpack002/Oxymorphazone-safety (x64).exe unpack002/Oxymorphazone-safety (x86).exe unpack001/zararlı/hydrogenx86.exe unpack003/salinewin1.5-safety.exe unpack003/salinewin1.5.exe
File Explorer
-
zararli.zip.zip 525KB
-
zararlı/Oxymorphazone.exe.zip.zip 265KB
-
Oxymorphazone (x64).exe.exe 173KB
-
Oxymorphazone (x86).exe.exe 155KB
-
Oxymorphazone-safety (x64).exe.exe 140KB
-
Oxymorphazone-safety (x86).exe.exe 122KB
-
readme.txt1016B
-
zararlı/hydrogenx86.exe.exe 108KB
-
zararlı/salinewin1.5.zip.zip 202KB
-
readme.txt760B
-
salinewin1.5-safety.exe.exe 245KB
-
salinewin1.5.exe.exe 279KB
zararlı/Oxymorphazone.exe.zip
- SHA256 d4368c4193773ba09469a9ff682d862e7c63dfd9670e700bc5a308b86193c0e0
- MD5 776fb5f0883b39ec096489431e883ee9
- SHA1 6af533012bb3a5c2e99f2038cb85233e24bf4f76
- SHA512 3794c5601b6c39b31604fc0103afcd71a09a0c1ddb79d368ebd5f5d5137851f5bba3f51b16278be9114b75137c682422aece414c084af92f816c879ee9ccd9fc
- SSDEEP 6144:pPEBkYkLsrJBTlh1f1gwk+Aqan8bxat3EcSoZ1ASafeU+MGh/SRLPyGH:yBkDLs9plh1tgvd8wycSYAXJ+MEEbX
- TLSH T1504423CB73AD8BF6A49F0D9CAD43EC9458A4D66FC0B4298AFDB5C655208706CB03B015
- MD5 SHA1 SHA512 SSDEEP TLSH
Oxymorphazone (x64).exe
- IMPHASH bcc485503b3c0465d7b7d556265d49db
- SHA256 7045b85e1b7dca29eab66baf73739a17889d644fd1a16a2c52c06c3e5cde20ae
- MD5 3d0322c1fab03efd169be5f58aabe610
- SHA1 e696b151f865b7441cce50b33ff8b68772138fb5
- SHA512 50413c833ca84b94e3226fb83dd61f3c60d0aefae66f17d9e8569693698f5e1700c4ca046c0c664ac43422804fee796c00a63f56b5431b5f2eb3a8e655959813
- SSDEEP 3072:duLC1xXAhmuy2elv5Ta1HVDzmONoDv7k/q37hK:dnXPupeZI1HdXFK9
- TLSH T14E045B0772A235E5E5728674C4619A36F77338710760CFAF02E086773F26291BE6BB25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
30176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\MSI\source\repos\Oxymorphazone\x64\Release\Oxymorphazone.pdb
kernel32
SetStdHandle
GetFileType
LCMapStringW
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetTickCount
FreeLibrary
ExitProcess
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
LoadLibraryA
TerminateThread
Sleep
CreateFileW
GetCurrentThreadId
VirtualAlloc
WriteFile
GetCurrentProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
WriteConsoleW
user32
UnhookWindowsHookEx
EnableWindow
GetCursorPos
ReleaseDC
SetCursorPos
GetWindowRect
GetDC
MessageBoxW
GetIconInfo
InvalidateRect
GetSystemMetrics
CallNextHookEx
LoadIconW
SetWindowsHookExW
GetDlgItem
DrawIconEx
GetDesktopWindow
gdi32
CreateCompatibleBitmap
CreateFontA
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchBlt
PlgBlt
GetBitmapBits
DeleteDC
SetTextColor
TextOutA
SetBitmapBits
SetBkMode
GetObjectW
Polygon
DeleteObject
InvertRgn
CreateSolidBrush
CreateEllipticRgn
CreateBitmap
BitBlt
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
winmm
waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
msimg32
AlphaBlend
GradientFill
Name
.text
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=241, version=40116,
count=122, id=243, version=40116,
count=22, id=242, version=40116,
count=10, id=259, version=24237,
count=36, id=261, version=24237,
count=18, id=260, version=24237,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=141, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=151,
count=1, id=258, version=24245,
Oxymorphazone (x86).exe
- IMPHASH 3894baa1a54d6eac014400fb5be3afd9
- SHA256 61d4f06ca3f1a9957557474cfeaa05e3b0b50287dd7436f7c6051e565e51906a
- MD5 a4e01f885e4c77a240a4e6eb857e3402
- SHA1 646b1bbebe9dfc02a0bd6c82af2aeadb7ae089ff
- SHA512 afe0d53fc296b0d4fe2e101fee7e504f36c163fd4460ffe0f156700ba186a12a307952d44bbf7569d491220aa15ca47aa798424d256d8bff34579d070b22de79
- SSDEEP 3072:Y1LBN3otshrrEhvO5TEwLiYk0/ZmIS3dct:6oGWvO58KZu3it
- TLSH T14CF37E05B4C5D972E57319700475EAB59E2EFDB00B699EBB23C42A2F2E290D34C36D63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
26950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\MSI\source\repos\Oxymorphazone\Release\Oxymorphazone.pdb
kernel32
GetFileType
SetStdHandle
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
GetTickCount
FreeLibrary
ExitProcess
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
LoadLibraryA
TerminateThread
Sleep
CreateFileW
GetCurrentThreadId
VirtualAlloc
WriteFile
GetCurrentProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
GetLastError
SetLastError
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
DecodePointer
user32
UnhookWindowsHookEx
EnableWindow
GetCursorPos
ReleaseDC
SetCursorPos
GetWindowRect
GetDC
MessageBoxW
GetIconInfo
InvalidateRect
GetSystemMetrics
CallNextHookEx
LoadIconW
SetWindowsHookExW
GetDlgItem
DrawIconEx
GetDesktopWindow
gdi32
CreateCompatibleBitmap
CreateFontA
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchBlt
PlgBlt
GetBitmapBits
DeleteDC
SetTextColor
TextOutA
SetBitmapBits
SetBkMode
GetObjectW
Polygon
DeleteObject
InvertRgn
CreateSolidBrush
CreateEllipticRgn
CreateBitmap
BitBlt
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
winmm
waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
msimg32
AlphaBlend
GradientFill
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=241, version=40116,
count=122, id=243, version=40116,
count=31, id=242, version=40116,
count=21, id=259, version=24237,
count=37, id=261, version=24237,
count=18, id=260, version=24237,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=138, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=151,
count=1, id=258, version=24245,
Oxymorphazone-safety (x64).exe
- IMPHASH 0fc40614b5e0d8bb1690226869860cec
- SHA256 cbaefb8dbfc6523fbd4467ae9f8d64210d1691548f1d47582cfed64533d3fb96
- MD5 b18393d161f4ee018f9d636605da76a9
- SHA1 578d05c11ba5571f962b3cb05b671cef83880638
- SHA512 997e57c7219492a13ab4b10080f0ce75e111a26b1275a9e7befa3ef8cf2ba796cb48f6badd76402685c3e5135f84b6fb5f678b7a5c605bb07ce75b6f791f4e42
- SSDEEP 3072:TGSeUVytGMlZUh8oUy1QPKnvvimq77p+g:TLVMDU5Uy16R/p
- TLSH T121E35C07736231E5D57286748461EA66E7737C7107608FAF02E18A673F271D0BE6BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
29632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\MSI\source\repos\Oxymorphazone-safety\x64\Release\Oxymorphazone-safety.pdb
kernel32
SetStdHandle
GetFileType
LCMapStringW
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
GetTickCount
FreeLibrary
ExitProcess
CreateThread
LoadLibraryW
CloseHandle
TerminateThread
Sleep
GetCurrentThreadId
VirtualAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
CreateFileW
user32
UnhookWindowsHookEx
EnableWindow
GetCursorPos
ReleaseDC
SetCursorPos
GetWindowRect
GetDC
MessageBoxW
GetIconInfo
InvalidateRect
GetSystemMetrics
CallNextHookEx
LoadIconW
SetWindowsHookExW
GetDlgItem
DrawIconEx
GetDesktopWindow
gdi32
CreateCompatibleBitmap
CreateFontA
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchBlt
PlgBlt
GetBitmapBits
DeleteDC
SetTextColor
TextOutA
SetBitmapBits
SetBkMode
GetObjectW
Polygon
DeleteObject
InvertRgn
CreateSolidBrush
CreateEllipticRgn
CreateBitmap
BitBlt
winmm
waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
msimg32
AlphaBlend
GradientFill
Name
.text
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=241, version=40116,
count=122, id=243, version=40116,
count=22, id=242, version=40116,
count=10, id=259, version=24237,
count=36, id=261, version=24237,
count=18, id=260, version=24237,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=137, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=151,
count=1, id=258, version=24245,
Oxymorphazone-safety (x86).exe
- IMPHASH 167b2fbf2bc8e5db22df40bed7635644
- SHA256 429463bf6f19019407793d8c823c59f189ad0a807c6fa47f9c4a6580ba3cdd3d
- MD5 df3d60c77cfda021f90ceecc0f14d88e
- SHA1 955b78b1009bf3b910853ea500fa6cc7e23c8ddc
- SHA512 b175d4a863527ee4b36cdcbd1f4ac0f9fbc7aac74c1de4a3ec31c8396761a009e802bec11a9dd9b133b3e719ca76b94df75ccb87075e4168de194dcc45c30ea1
- SSDEEP 1536:ESBHiNoHYEfsFek32GDyFvW8ZjJ3QIvKtTC2YprWgpnszWg7QJAsWxcdrwHA6yFO:7iWnZJA4KTC2Yrs7w5rwAFxKh5LJ
- TLSH T1A4C35C01B4D599B2E5B2097114A5DBB65D3EFDB00B594BBB23D4262F6E280C31C37E63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
26548
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\MSI\source\repos\Oxymorphazone-safety\Release\Oxymorphazone-safety.pdb
kernel32
GetFileType
SetStdHandle
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
GetTickCount
FreeLibrary
ExitProcess
CreateThread
LoadLibraryW
CloseHandle
TerminateThread
Sleep
GetCurrentThreadId
VirtualAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
GetLastError
SetLastError
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
CreateFileW
user32
UnhookWindowsHookEx
EnableWindow
GetCursorPos
ReleaseDC
SetCursorPos
GetWindowRect
GetDC
MessageBoxW
GetIconInfo
InvalidateRect
GetSystemMetrics
CallNextHookEx
LoadIconW
SetWindowsHookExW
GetDlgItem
DrawIconEx
GetDesktopWindow
gdi32
CreateCompatibleBitmap
CreateFontA
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchBlt
PlgBlt
GetBitmapBits
DeleteDC
SetTextColor
TextOutA
SetBitmapBits
SetBkMode
GetObjectW
Polygon
DeleteObject
InvertRgn
CreateSolidBrush
CreateEllipticRgn
CreateBitmap
BitBlt
winmm
waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
msimg32
AlphaBlend
GradientFill
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=241, version=40116,
count=122, id=243, version=40116,
count=31, id=242, version=40116,
count=21, id=259, version=24237,
count=37, id=261, version=24237,
count=18, id=260, version=24237,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=134, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=151,
count=1, id=258, version=24245,
readme.txt
- SHA256 e2e6a25bb5a582ddb6f7df2617027b9428d9f5479ddbc52f84dd4a0ee0cabaa0
- MD5 a97e447e2f346f0249948a5011e9caa7
- SHA1 dad9742aa2ede128e5e018f8d5e286fa55347bac
- SHA512 6d2ab80e07ea58fc31371fa96e7a74e920ca72ca092ddea10e08454ec1bf10e3732072664feebb2409d36af227bb842a6dfe81c9ce6a0e69758b8febaabefdc5
- TLSH T19C11142F2247F3F66B93B2920196DC93F7E6500EE68B4F1C781993053BC195512279CD
- MD5 SHA1 SHA512 TLSH
zararlı/hydrogenx86.exe
- IMPHASH 6647ce1889f9ee2aa40cb0c1d5b6fad4
- SHA256 fdb3dbba544d167c7b21bff4ca7277a90cd98b75e64fa03513c7ce55be33d1dd
- MD5 775aa2d429165e5b4e74385f1d163c31
- SHA1 b8657078e1fdc5583bceb4bc0bd89278e9c3ac35
- SHA512 55ab88d7029fa0046257b3ac8c30305b86bd9b73077519082a38c1bfc546296e189a754867fc5bf039e837acf54f28004108780808f4a9d65df71ac741089396
- SSDEEP 3072:bmPwlRm8c/92DeUSUQ2ZWsVnkxmdBwqvN:iPwlRmUDxQIDwqvN
- TLSH T1E1B36C01B6D08472F9B3193615B0EAB58A7FF9711F509DEB23A40A6A0F381D09D73A77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20834
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\MrSuperBuddy\source\repos\hydrogenx86\Release\hydrogenx86.pdb
kernel32
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
WriteConsoleW
GetProcessHeap
HeapAlloc
HeapFree
GetSystemDirectoryW
lstrcmpW
lstrcpyW
FreeLibrary
GetModuleHandleW
ExitProcess
LocalFree
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
DeleteFileW
lstrcatW
Sleep
GetLastError
CreateFileW
LocalAlloc
FindClose
SetFilePointer
RemoveDirectoryW
WriteFile
GetCurrentProcess
FindNextFileW
HeapReAlloc
FindFirstFileW
DecodePointer
GetStringTypeW
GetFileType
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
user32
TranslateMessage
ExitWindowsEx
MessageBoxW
ReleaseDC
RedrawWindow
EnumDisplayMonitors
UnionRect
EnumChildWindows
SetTimer
PeekMessageW
DispatchMessageW
GetWindowRect
SendMessageTimeoutW
GetDC
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
PatBlt
SetGraphicsMode
StretchBlt
PlgBlt
CreatePatternBrush
DeleteDC
TextOutW
SetTextColor
SetBkColor
Ellipse
DeleteObject
CreateSolidBrush
SetWorldTransform
advapi32
CryptAcquireContextW
CryptGenRandom
LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
OpenProcessToken
FreeSid
shell32
ShellExecuteW
SHFileOperationW
winmm
waveOutUnprepareHeader
waveOutReset
waveOutPrepareHeader
waveOutOpen
waveOutWrite
msimg32
AlphaBlend
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=259, version=29395,
count=142, id=261, version=29395,
count=21, id=260, version=29395,
count=41, id=261, version=32420,
count=17, id=260, version=32420,
count=20, id=259, version=32420,
count=15, id=257, version=29395,
count=142, id=1, productName=Unmarked objects,
count=5, id=265, version=32532,
count=1, id=255, version=32532,
count=1, id=258, version=32532,
zararlı/salinewin1.5.zip
- SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
- MD5 065a26b3f9570081f54201dad1bdc0e2
- SHA1 e311decefee96fc9afc2e96ccdedbb7b6bf5a6ab
- SHA512 a5710b30641d22db9fc2174d1f4151c76d50274df064207f5817fb80f4d5fc3411621b54d5775da3973b607c228a7ad58b6a02b79a6fd56ac0ae7bb56aa0e706
- SSDEEP 6144:oxNMcpOY7qY2Hglyi6x5LSBDdmz0DpQL/5:oxNMcpNWY2HEyF4/rw
- TLSH T186142375488F32D2E0A633C622DD06240D79C95F7333DD35C6F8BA5A6CD50296E42E2E
- MD5 SHA1 SHA512 SSDEEP TLSH
readme.txt
- SHA256 bb30cd5675d75102d1a73d39d784a85814aefc46cf5657f76c1ba3d2f20e8f96
- MD5 26f906de5a9836fd2ebc87fe99761c2b
- SHA1 65b7efe2dae3067e11bbe8cda5ac89006ed4d3cb
- SHA512 65e834e8a53638bbc0d2a34b81247adb03e8d09ceabe9813bd23b33a049b3d4517155f14d3e4a3883e2633d20bd114f7e279e1422a16bec45ae41e62de03074f
- TLSH T1AA01B16F710992F597C800625B5A6196A3ACC0BF77663F27591560DD2342955812B980
- MD5 SHA1 SHA512 TLSH
salinewin1.5-safety.exe
- IMPHASH 106168d1bd6a4669e663eb5e822d6613
- SHA256 bafd3d712a32b884001dccd7f6f77fd9aa515b254352310e20f67026364c7884
- MD5 e69d64dfc3d809dc8dbdda9c367b0afc
- SHA1 dc61951ccd463291bb2e2758fc8afebaa8ffadcc
- SHA512 d5e644ab734168d5f42028a6196aba091a60b8536e0101e15254ecc154f564b495f4d66d948399cd4de42f19423cb500a8f8b90d59652fb31e68f1375e28def5
- SSDEEP 3072:3WiJUpGuEy1AXy4e5II5CoTbLYiBZP5pHQpYR95WPNp/H:GBpduiPRZPPHQpY35WPNpf
- TLSH T127347D21B5C1C4F1F97945356836C9910E6AFC36AF501EAF3298332F0E751E2453AEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12842
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\PC\source\repos\salinewin-safety\Release\salinewin-safety.pdb
kernel32
GetConsoleCP
HeapReAlloc
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
CreateThread
CloseHandle
TerminateThread
FlushFileBuffers
Sleep
HeapSize
GetProcessHeap
GetStringTypeW
GetFileType
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
RaiseException
user32
GetSystemMetrics
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
LoadIconW
GetDC
DrawIcon
gdi32
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
PolyBezier
DeleteDC
CreatePen
Ellipse
DeleteObject
CreateSolidBrush
BitBlt
winmm
waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
msimg32
AlphaBlend
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
159KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=120, id=243, version=40116,
count=25, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=1, productName=Unmarked objects,
count=1, id=265, version=24247,
count=1, id=255, version=24247,
count=1, id=151,
count=1, id=258, version=24247,
salinewin1.5.exe
- IMPHASH 3fc652bbb2869637a8ab45305e4dc626
- SHA256 fbdaec9e16cb120887975def752432ff798834d521cfc87b24923bf6d3acfe4a
- MD5 7c4230a18208485741aa283707ce3a96
- SHA1 30d637688d60697379405272d6665bd8965d175f
- SHA512 81eebfa2f3ccffd8fe4714b6685760727c6c397ba27ea50b298777b8321a899dd94b49b0456e32072392249924fa1949daf5296be49d2c7827db1d36d6d56808
- SSDEEP 3072:qJ+qjy1h6nzfIIv2mGYndBO5CRNArWcMZuxo9AF3CrBZP5pHQpYR95WPNpHjcH:cDrIwBIrnCZPPHQpY35WPNpw
- TLSH T1F4547C11B5C1C4F1F97506366825CA910F6AFC359F905EAF3298332F0E751E2853AEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\PC\source\repos\salinewin\Release\salinewin.pdb
kernel32
HeapReAlloc
HeapSize
FlushFileBuffers
GetStringTypeW
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
ExitProcess
GetProcAddress
CreateThread
CloseHandle
LoadLibraryW
TerminateThread
Sleep
CreateFileW
WriteFile
GetProcessHeap
GetCurrentProcess
LCMapStringW
CompareStringW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
RaiseException
user32
GetSystemMetrics
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
SendMessageTimeoutW
GetDC
GetDesktopWindow
EnumChildWindows
MessageBoxW
DrawIcon
ExitWindowsEx
LoadIconW
gdi32
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
PolyBezier
DeleteDC
CreatePen
Ellipse
DeleteObject
CreateSolidBrush
BitBlt
advapi32
AdjustTokenPrivileges
RegCloseKey
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
winmm
waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
msimg32
AlphaBlend
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
159KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=120, id=243, version=40116,
count=25, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=124, id=1, productName=Unmarked objects,
count=1, id=265, version=24247,
count=1, id=255, version=24247,
count=1, id=151,
count=1, id=258, version=24247,