New folder.zip
- SHA256 c6bbba3518feebd640cf4654f0ea513adbe07c3097bf31344748e0fa4b71c9a1
Overview
overview
3Static
static
3New folder...0).exe
windows10-2004-x64
1New folder...1).exe
windows10-2004-x64
1New folder...2).exe
windows10-2004-x64
1New folder...3).exe
windows10-2004-x64
1New folder...4).exe
windows10-2004-x64
1New folder...5).exe
windows10-2004-x64
1New folder...6).exe
windows10-2004-x64
1New folder...7).exe
windows10-2004-x64
1New folder...8).exe
windows10-2004-x64
1New folder...9).exe
windows10-2004-x64
1New folder...2).exe
windows10-2004-x64
1New folder...0).exe
windows10-2004-x64
1New folder...1).exe
windows10-2004-x64
1New folder...3).exe
windows10-2004-x64
1New folder...4).exe
windows10-2004-x64
1New folder...5).exe
windows10-2004-x64
1New folder...6).exe
windows10-2004-x64
1New folder...7).exe
windows10-2004-x64
1New folder...8).exe
windows10-2004-x64
1New folder...9).exe
windows10-2004-x64
1New folder...py.exe
windows10-2004-x64
1New folder/bot.exe
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
New folder/bot - Copy (10).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
New folder/bot - Copy (11).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
New folder/bot - Copy (12).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
New folder/bot - Copy (13).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
New folder/bot - Copy (14).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
New folder/bot - Copy (15).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
New folder/bot - Copy (16).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
New folder/bot - Copy (17).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
New folder/bot - Copy (18).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
New folder/bot - Copy (19).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
New folder/bot - Copy (2).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
New folder/bot - Copy (20).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
New folder/bot - Copy (21).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
New folder/bot - Copy (3).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
New folder/bot - Copy (4).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
New folder/bot - Copy (5).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
New folder/bot - Copy (6).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
New folder/bot - Copy (7).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
New folder/bot - Copy (8).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
New folder/bot - Copy (9).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
New folder/bot - Copy.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
New folder/bot.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target New folder.zip
- Size 4.4MB
- Sample261023-gwce4acc79
- SHA256 c6bbba3518feebd640cf4654f0ea513adbe07c3097bf31344748e0fa4b71c9a1
- MD5 674913a309ec69b891bd45184f5f2854
- SHA1 f9d632952ba46b07f85a0d95222635ef066c579a
- SHA512 f747b51d06223b8cd547914c92364aa68909d24750930322cebcc201d79bf7b39087a0fa80c56ffa1f8816bcebdf933e6acc22cf7004c028ea66e58ac4b3c9f0
- SSDEEP 49152:+0X9d0X980X9b0X9y0X9R0X9A0X9/0X9W0X9V0X9E0X9V0X9W0X9D0X9a0X9Z0Xg:FaJYX+987SB2vwv21UD6Y/9
- TLSH T1292623C5846BDA02C1421334DDC117F96107226A9BAF023EBFE4665DBC8762FEDE18D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 22 IoCs
Checks for missing Authenticode signature.
resource unpack001/New folder/bot - Copy (10).exe unpack001/New folder/bot - Copy (11).exe unpack001/New folder/bot - Copy (12).exe unpack001/New folder/bot - Copy (13).exe unpack001/New folder/bot - Copy (14).exe unpack001/New folder/bot - Copy (15).exe unpack001/New folder/bot - Copy (16).exe unpack001/New folder/bot - Copy (17).exe unpack001/New folder/bot - Copy (18).exe unpack001/New folder/bot - Copy (19).exe unpack001/New folder/bot - Copy (2).exe unpack001/New folder/bot - Copy (20).exe unpack001/New folder/bot - Copy (21).exe unpack001/New folder/bot - Copy (3).exe unpack001/New folder/bot - Copy (4).exe unpack001/New folder/bot - Copy (5).exe unpack001/New folder/bot - Copy (6).exe unpack001/New folder/bot - Copy (7).exe unpack001/New folder/bot - Copy (8).exe unpack001/New folder/bot - Copy (9).exe unpack001/New folder/bot - Copy.exe unpack001/New folder/bot.exe
File Explorer
-
New folder.zip.zip 4.4MB
-
New folder/bot - Copy (10).exe.exe 782KB
-
New folder/bot - Copy (11).exe.exe 782KB
-
New folder/bot - Copy (12).exe.exe 782KB
-
New folder/bot - Copy (13).exe.exe 782KB
-
New folder/bot - Copy (14).exe.exe 782KB
-
New folder/bot - Copy (15).exe.exe 782KB
-
New folder/bot - Copy (16).exe.exe 782KB
-
New folder/bot - Copy (17).exe.exe 782KB
-
New folder/bot - Copy (18).exe.exe 782KB
-
New folder/bot - Copy (19).exe.exe 782KB
-
New folder/bot - Copy (2).exe.exe 782KB
-
New folder/bot - Copy (20).exe.exe 782KB
-
New folder/bot - Copy (21).exe.exe 782KB
-
New folder/bot - Copy (3).exe.exe 782KB
-
New folder/bot - Copy (4).exe.exe 782KB
-
New folder/bot - Copy (5).exe.exe 782KB
-
New folder/bot - Copy (6).exe.exe 782KB
-
New folder/bot - Copy (7).exe.exe 782KB
-
New folder/bot - Copy (8).exe.exe 782KB
-
New folder/bot - Copy (9).exe.exe 782KB
-
New folder/bot - Copy.exe.exe 782KB
-
New folder/bot.exe.exe 782KB
New folder/bot - Copy (10).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (11).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (12).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (13).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (14).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (15).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (16).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (17).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (18).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (19).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (2).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (20).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (21).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (3).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (4).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (5).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (6).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (7).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (8).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy (9).exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot - Copy.exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
New folder/bot.exe
- IMPHASH b302d3834b0ce6a1773d49e05678b7e9
- SHA256 0f0e3ce3fc968a4603eae55b8325af81535bac3ca603d4e792e07698c1e77950
- MD5 f1a1afe20593d5f7d1e03a2aa18d3e23
- SHA1 09c7e93e61e4acb756f7151b349d7fa8d8d84070
- SHA512 5c038aa13bd3f298fb497735b6bd05c23a429bc2d0858f3d4b2565e70e430d3abaee0ed33f43391c469f2344ce56924991ecdb54be1039c3a3874181a2295d6e
- SSDEEP 12288:2VPFcJ4hPTS9ZqwBP5/6eDyUVSHiQF33eKXKxZoV2:FoT0qwBP5/6epk3eKXKxZoV2
- TLSH T19B051983A1970CE9EA525B7811DB3331AB32BE36CB6A4B67A504C5316D139C25D3BFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateEventW
CreateMutexW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FormatMessageA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_atoi64
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_lock
_read
_setjmp
_strdup
_strtoi64
_unlock
_vscprintf
_vsnprintf
atexit
_write
abort
atoi
calloc
exit
fflush
fprintf
fputc
fputs
free
fwrite
getenv
isspace
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setvbuf
strchr
strcmp
strerror
strlen
strncmp
strtoul
tolower
toupper
vfprintf
wcslen
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htons
ioctlsocket
recv
send
sendto
setsockopt
socket
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ