f8467c35fd48927368b1b5adae3ff6ced993a0d897cf283b3c515593675652e8
- SHA256 f8467c35fd48927368b1b5adae3ff6ced993a0d897cf283b3c515593675652e8
Overview
overview
7Static
static
5OUninstall.exe
windows10-2004-x64
7OUninstall.exe
windows11-ltsc_2024-x64
7OUninstall_x64.exe
windows10-2004-x64
7OUninstall_x64.exe
windows11-ltsc_2024-x64
7윈도우 ...IO.cmd
windows10-2004-x64
4윈도우 ...IO.cmd
windows11-ltsc_2024-x64
4윈도우�...5p.exe
windows10-2004-x64
5윈도우�...5p.exe
windows11-ltsc_2024-x64
5Behavioral task
behavioral1
Sample
OUninstall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
OUninstall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
OUninstall_x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
OUninstall_x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target f8467c35fd48927368b1b5adae3ff6ced993a0d897cf283b3c515593675652e8
- Size 4.0MB
- Sample261024-qqwffsh191
- SHA256 f8467c35fd48927368b1b5adae3ff6ced993a0d897cf283b3c515593675652e8
- MD5 365e46b03aaba56846b85c702039c5d3
- SHA1 d16e763130096c0ec50dc81f58eede7819431308
- SHA512 8556622f74b2e02a75fca3cda2d0cf0f5c85669d99e888424b9e8add2e619e904e92995b5fec04284c7ada4beec250ebaa0bfae481bb3b7402d0b5175c312a71
- SSDEEP 98304:1/3KkNnqLmWtM0gWuQh6x5v8RBawI9CsX1Mt:d37pAwWuQhLIIsX1Y
- TLSH T12D1602466D0251A6C1B3F3B99E57808EFB26C2638335526835AEC444BF36309A1FEF5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/윈도우설치 루퍼스 4.15/rufus-4.15p.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/OUninstall.exe unpack002/OUninstall_x64.exe
File Explorer
-
f8467c35fd48927368b1b5adae3ff6ced993a0d897cf283b3c515593675652e8.zip 4.0MB
-
오피스 삭제툴/Office Uninstall_v2.0.2.7z.7z 1.4MB
-
OUninstall.exe.exe 2.9MB
-
OUninstall_x64.exe.exe 3.1MB
-
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/.gitattributes105B
-
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/LICENSE34KB
-
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd.cmd .bat 744KB
-
윈도우설치 루퍼스 4.15/rufus-4.15p.exe.exe 1.9MB
오피스 삭제툴/Office Uninstall_v2.0.2.7z
- SHA256 7404b1b38b1b9e12157cd6654daaa37092732762740c6d4908baeb440409333e
- MD5 00b895d28978279678df4bf77722c0e5
- SHA1 fe5dc0cfa490485a52987aef04b1a6dc32cae5e6
- SHA512 6c72f5e550cc4a5b3aa70dc145ae84b09ee61367eae161b97aacb56f9a8e687ac63d7dee26598a132372536080a3a28c84ef5967afcb46a2a8ee4cfcaa733eb2
- SSDEEP 24576:p9Xwr2eHKh88EsVs6Jliz5qViXuxAaQqv4EtvVS/en9ulEuYcZyGU24NWt71K0qb:fyHO/s6KkIuxNbwEfqen9xqZmWtM0A
- TLSH T1B36533AF05459F5F6C8347AD019FB0EEAB01787AF086F8847BAA8895412D467BC0D973
- MD5 SHA1 SHA512 SSDEEP TLSH
OUninstall.exe
- IMPHASH 00d3891b305ccb5e6ada1da8003b123c
- SHA256 ca9522744e96899df991c073c66a65a86b753c12bba71a83a28cd73f4f330b1c
- MD5 dcd30da513a3348c4a34c70121dab8ab
- SHA1 6ecd365e1a65e3f04a14264cf9acf96d8e0eec60
- SHA512 16588aa24e47cf22f123f755955daa410e68417330cebd4d9cae2c61b956846ba8f1a98283dc7e370680e09293a2e3dd3ca76a43a177a35ec883e08582c631f6
- SSDEEP 24576:TO+rnnOxyCZisUZw85zkI3nugEGcarV7CqViXtxAadq/WEtO8O/en9uRuu:TOkOxJAzzNccMkItxNs+Ebuen9c
- TLSH T138E5B8106FFA0114F1B2EA74D9B64025CB27B9565A36C94E718C09CE1FB7580C9FBB3A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
setlocale
wcscmp
memmove
wcslen
wcscpy
wcscat
memcmp
strlen
strcpy
strcat
_stricmp
sprintf
malloc
free
_wstat
_wcsdup
strcmp
memcpy
strncpy
_CIfmod
_wfopen
longjmp
_setjmp3
fclose
_wcsicmp
wcsncmp
wcsncpy
_snwprintf
tolower
floor
gmtime
localtime
mktime
_wcsnicmp
_itow
abs
sqrt
fseek
ftell
fread
pow
??3@YAXPAX@Z
wcsstr
_close
calloc
_lseeki64
_errno
realloc
_snprintf
abort
_wopen
_setmode
exit
wcschr
_open_osfhandle
_strdup
strrchr
strncmp
wctomb
_get_osfhandle
_open
toupper
mbstowcs
strchr
frexp
modf
_CIpow
fflush
fwrite
atof
fopen
strerror
__p__iob
fprintf
ferror
getenv
sscanf
_vsnwprintf
cos
fmod
sin
ceil
kernel32
GetModuleHandleW
HeapCreate
GetEnvironmentVariableW
GetUserDefaultLangID
HeapDestroy
ExitProcess
SystemTimeToFileTime
LocalFileTimeToFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
CreateToolhelp32Snapshot
CloseHandle
GetLogicalDriveStringsW
QueryDosDeviceW
FileTimeToLocalFileTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
GetCurrentProcess
GetSystemDefaultLangID
MultiByteToWideChar
GetProcAddress
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
GetCurrentProcessId
OpenProcess
TerminateProcess
GetLastError
FormatMessageW
GetVolumeInformationW
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
CreateProcessW
Beep
CreateFileW
CreateSemaphoreW
DeviceIoControl
GetCommandLineW
GetComputerNameW
GetDateFormatW
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileTime
GetPrivateProfileStringW
GetShortPathNameW
GetSystemDirectoryW
GetSystemPowerStatus
GetTimeZoneInformation
GetUserDefaultLCID
GetWindowsDirectoryW
GlobalMemoryStatus
LocalFree
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
SetComputerNameW
SetFileTime
SetSystemTime
SetVolumeLabelW
Sleep
WritePrivateProfileStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
TerminateThread
CreateThread
GetCurrentThreadId
GetModuleFileNameW
DuplicateHandle
CreatePipe
GetStdHandle
HeapAlloc
HeapFree
PeekNamedPipe
SetEnvironmentVariableW
HeapReAlloc
ReadFile
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
DeleteFileW
FreeLibrary
LoadLibraryExW
TlsAlloc
TlsSetValue
GetTickCount
TlsGetValue
LoadLibraryW
GetVersionExW
SetLastError
GetDriveTypeW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
GetTempPathW
GetLongPathNameW
CopyFileW
MoveFileW
MulDiv
GetLocalTime
HeapSize
TlsFree
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetFileType
GetFileInformationByHandle
GetFileAttributesA
CreateFileA
GetFullPathNameW
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject
user32
SendMessageW
OemToCharW
GetSysColor
GetDlgCtrlID
CallWindowProcW
SetWindowLongW
GetWindowLongW
GetClientRect
FillRect
GetClassNameW
GetWindow
SetWindowPos
InvalidateRect
BeginPaint
EndPaint
IsWindowEnabled
RedrawWindow
SetClassLongW
GetClassLongW
GetWindowRect
OffsetRect
IsRectEmpty
MapWindowPoints
SubtractRect
IsWindow
GetParent
GetDC
ReleaseDC
DefWindowProcW
GetAsyncKeyState
KillTimer
GetCursorPos
ScreenToClient
SetTimer
DrawTextW
FrameRect
InflateRect
FindWindowW
FindWindowExW
DrawFrameControl
EnumWindows
GetWindowThreadProcessId
GetForegroundWindow
SetCursorPos
AnimateWindow
AttachThreadInput
BlockInput
ChangeDisplaySettingsW
CharToOemW
CreateWindowExW
DrawMenuBar
EnableMenuItem
EnableWindow
EnumDisplaySettingsW
ExitWindowsEx
FlashWindow
GetDesktopWindow
GetFocus
GetKeyState
GetLastInputInfo
GetSystemMenu
GetSystemMetrics
GetWindowTextW
LoadCursorW
LockWorkStation
MessageBeep
PostMessageW
RegisterHotKey
RemoveMenu
SetFocus
SetForegroundWindow
ShowWindow
UnregisterHotKey
UpdateWindow
WaitForInputIdle
keybd_event
mouse_event
MessageBoxW
IsWindowVisible
DestroyWindow
SystemParametersInfoW
SetWindowTextW
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
SetScrollPos
GetWindowDC
ClientToScreen
GetIconInfo
ReleaseCapture
DrawStateW
SetCapture
GetSysColorBrush
MoveWindow
EnumPropsExW
SetActiveWindow
DestroyIcon
LoadIconW
RegisterClassW
AdjustWindowRectEx
UnregisterClassW
CreateAcceleratorTableW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DefFrameProcW
DestroyAcceleratorTable
SetRect
EnumChildWindows
IsChild
RegisterWindowMessageW
CopyImage
CharUpperW
CharLowerW
DrawIconEx
gdi32
CreatePen
CreateSolidBrush
SelectObject
DeleteDC
DeleteObject
CreatePatternBrush
CreateRoundRectRgn
GetPixel
CreateCompatibleDC
SelectClipRgn
BitBlt
GetStockObject
RoundRect
SetBkMode
SetTextColor
SetDCBrushColor
SetBrushOrgEx
CreateDCW
CreateCompatibleBitmap
CreateFontIndirectW
ExcludeClipRect
GetTextExtentPoint32W
GetObjectType
GetObjectW
SetBkColor
CreateRectRgnIndirect
GetClipRgn
ExtSelectClipRgn
GetDeviceCaps
GdiGetBatchLimit
GdiSetBatchLimit
CreateDIBSection
CreateBitmap
SetPixel
GetDIBits
CreateFontW
SetTextAlign
TextOutW
SetStretchBltMode
StretchBlt
GetTextMetricsW
advapi32
RegOpenKeyExW
RegOpenKeyW
RegConnectRegistryW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
IsValidSid
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyW
AdjustTokenPrivileges
ChangeServiceConfigW
CloseServiceHandle
ControlService
CryptAcquireContextW
CryptCreateHash
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptHashData
CryptReleaseContext
GetUserNameW
ImpersonateLoggedOnUser
LogonUserW
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceStatus
RegEnumValueW
RevertToSelf
StartServiceW
CryptGenRandom
oleaut32
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetElement
ole32
CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
RevokeDragDrop
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ExtractIconExW
ExtractIconW
ord66
ord524
SHAddToRecentDocs
SHFileOperationW
SHFormatDrive
SHGetFileInfoW
ShellAboutW
Shell_NotifyIconW
ShellExecuteExW
ws2_32
WSAStartup
gethostbyname
WSACleanup
gethostbyaddr
inet_addr
closesocket
gethostname
htons
select
__WSAFDIsSet
ioctlsocket
recvfrom
socket
connect
recv
bind
winmm
timeBeginPeriod
msimg32
AlphaBlend
gdiplus
GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY
icmp
IcmpCloseHandle
IcmpCreateFile
IcmpSendEcho
imagehlp
MapFileAndCheckSumW
MakeSureDirectoryPathExists
iphlpapi
GetAdaptersInfo
GetNetworkParams
msi
ord45
ord70
netapi32
NetApiBufferFree
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupEnum
NetUserDel
NetUserGetInfo
NetUserSetInfo
setupapi
SetupIterateCabinetW
urlmon
URLDownloadToFileW
UrlMkSetSessionOption
userenv
GetDefaultUserProfileDirectoryW
uxtheme
SetWindowTheme
wininet
DeleteUrlCacheEntryW
InternetCloseHandle
InternetGetConnectedState
InternetOpenUrlW
InternetOpenW
InternetReadFile
UnlockUrlCacheEntryFileW
winspool.drv
ClosePrinter
DeletePrinter
OpenPrinterW
SetPrinterW
comctl32
InitCommonControlsEx
Name
.code
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
555KB
Virtual Size
555KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
OUninstall_x64.exe
- IMPHASH 2798d555e773aa050c988c48e0aa6988
- SHA256 17aa3a2e186c1a625a9e337defea3b65c820dc1dfeb0eb289702e0cc95bb3578
- MD5 e896a7c8d331c1e2e317f9a3cd0bb227
- SHA1 aee3ae0b7acffc57694009a0ff1880ac3015dad3
- SHA512 b48a9ab553b5a3ced79908ca2cb02163275694c14ab3530ebe53d00b2b20491ef9b89ad8a29d7ede7fefccb91b5f5c36cf7b7ad8ed2e8de4e7a7e65fb604aed6
- SSDEEP 24576:ZOFzXVDZq6FJ3/rWganJ/sJpORXy0BoJ0CpYo0NBbeGaD+wcvDpYbgEGcarV7CqJ:ur4Uxe456cRQiaccMkItxNs+Ebuen9c
- TLSH T17AE5B7106BF90118F2B3EA74D9764125CA3779565A35CA4E218C0ACE1F77980C9FFB3A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
memset
setlocale
wcscmp
memmove
wcslen
wcscpy
wcscat
memcmp
strlen
strcpy
strcat
_stricmp
sprintf
malloc
free
_wstat
_wcsdup
strcmp
memcpy
strncpy
fmod
_wfopen
longjmp
setjmp
fclose
_wcsicmp
wcsncmp
wcsncpy
_snwprintf
tolower
floor
_gmtime64
_localtime64
_mktime64
_wcsnicmp
_itow
sqrtf
abs
fseek
ftell
fread
pow
??3@YAXPEAX@Z
wcsstr
_close
calloc
_errno
_lseeki64
realloc
_snprintf
abort
_wopen
_setmode
exit
wcschr
_open_osfhandle
_strdup
strrchr
strncmp
wctomb
_get_osfhandle
_open
toupper
mbstowcs
strchr
frexp
modf
fflush
fwrite
atof
fopen
strerror
__iob_func
fprintf
ferror
getenv
sscanf
_vsnwprintf
sinf
cosf
fmodf
ceil
kernel32
GetModuleHandleW
HeapCreate
GetEnvironmentVariableW
GetUserDefaultLangID
HeapDestroy
ExitProcess
SystemTimeToFileTime
LocalFileTimeToFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
CreateToolhelp32Snapshot
CloseHandle
GetLogicalDriveStringsW
QueryDosDeviceW
FileTimeToLocalFileTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
GetCurrentProcess
GetSystemDefaultLangID
MultiByteToWideChar
GetProcAddress
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
GetCurrentProcessId
OpenProcess
TerminateProcess
GetLastError
FormatMessageW
GetVolumeInformationW
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
CreateProcessW
Beep
CreateFileW
CreateSemaphoreW
DeviceIoControl
GetCommandLineW
GetComputerNameW
GetDateFormatW
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileTime
GetPrivateProfileStringW
GetShortPathNameW
GetSystemDirectoryW
GetSystemPowerStatus
GetTimeZoneInformation
GetUserDefaultLCID
GetWindowsDirectoryW
GlobalMemoryStatus
LocalFree
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
SetComputerNameW
SetFileTime
SetSystemTime
SetVolumeLabelW
Sleep
WritePrivateProfileStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
TerminateThread
CreateThread
GetCurrentThreadId
GetModuleFileNameW
DuplicateHandle
CreatePipe
GetStdHandle
HeapAlloc
HeapFree
PeekNamedPipe
SetEnvironmentVariableW
ReadFile
HeapReAlloc
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
DeleteFileW
FreeLibrary
LoadLibraryExW
TlsAlloc
TlsSetValue
GetTickCount
TlsGetValue
LoadLibraryW
GetVersionExW
SetLastError
GetDriveTypeW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
GetTempPathW
GetLongPathNameW
CopyFileW
MoveFileW
MulDiv
GetLocalTime
HeapSize
TlsFree
DeleteCriticalSection
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetFileType
GetFileInformationByHandle
GetFileAttributesA
CreateFileA
GetFullPathNameW
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject
user32
SendMessageW
OemToCharW
GetSysColor
GetDlgCtrlID
CallWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
FillRect
GetClassNameW
GetWindow
SetWindowPos
InvalidateRect
BeginPaint
EndPaint
IsWindowEnabled
RedrawWindow
SetClassLongPtrW
GetClassLongPtrW
GetWindowRect
OffsetRect
IsRectEmpty
MapWindowPoints
SubtractRect
IsWindow
GetParent
GetDC
ReleaseDC
DefWindowProcW
GetAsyncKeyState
KillTimer
GetCursorPos
ScreenToClient
SetTimer
DrawTextW
FrameRect
InflateRect
FindWindowW
FindWindowExW
DrawFrameControl
EnumWindows
GetWindowThreadProcessId
GetForegroundWindow
SetCursorPos
AnimateWindow
AttachThreadInput
BlockInput
ChangeDisplaySettingsW
CharToOemW
CreateWindowExW
DrawMenuBar
EnableMenuItem
EnableWindow
EnumDisplaySettingsW
ExitWindowsEx
FlashWindow
GetDesktopWindow
GetFocus
GetKeyState
GetLastInputInfo
GetSystemMenu
GetSystemMetrics
GetWindowTextW
LoadCursorW
LockWorkStation
MessageBeep
PostMessageW
RegisterHotKey
RemoveMenu
SetFocus
SetForegroundWindow
ShowWindow
UnregisterHotKey
UpdateWindow
WaitForInputIdle
keybd_event
mouse_event
MessageBoxW
IsWindowVisible
DestroyWindow
SystemParametersInfoW
SetWindowTextW
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
SetScrollPos
GetWindowDC
ClientToScreen
GetIconInfo
ReleaseCapture
DrawStateW
SetCapture
GetSysColorBrush
MoveWindow
EnumPropsExW
SetActiveWindow
DestroyIcon
LoadIconW
RegisterClassW
AdjustWindowRectEx
UnregisterClassW
CreateAcceleratorTableW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DefFrameProcW
DestroyAcceleratorTable
SetRect
EnumChildWindows
IsChild
RegisterWindowMessageW
CopyImage
CharUpperW
CharLowerW
DrawIconEx
gdi32
CreatePen
CreateSolidBrush
SelectObject
DeleteDC
DeleteObject
CreatePatternBrush
CreateRoundRectRgn
GetPixel
CreateCompatibleDC
SelectClipRgn
BitBlt
GetStockObject
RoundRect
SetBkMode
SetTextColor
SetDCBrushColor
SetBrushOrgEx
CreateDCW
CreateCompatibleBitmap
CreateFontIndirectW
ExcludeClipRect
GetTextExtentPoint32W
GetObjectType
GetObjectW
SetBkColor
CreateRectRgnIndirect
GetClipRgn
ExtSelectClipRgn
GetDeviceCaps
GdiGetBatchLimit
GdiSetBatchLimit
CreateDIBSection
CreateBitmap
SetPixel
GetDIBits
CreateFontW
SetTextAlign
TextOutW
SetStretchBltMode
StretchBlt
GetTextMetricsW
advapi32
RegOpenKeyExW
RegOpenKeyW
RegConnectRegistryW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
IsValidSid
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyW
AdjustTokenPrivileges
ChangeServiceConfigW
CloseServiceHandle
ControlService
CryptAcquireContextW
CryptCreateHash
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptHashData
CryptReleaseContext
GetUserNameW
ImpersonateLoggedOnUser
LogonUserW
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceStatus
RegEnumValueW
RevertToSelf
StartServiceW
CryptGenRandom
oleaut32
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetElement
ole32
CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
RevokeDragDrop
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ExtractIconExW
ExtractIconW
ord66
ord524
SHAddToRecentDocs
SHFileOperationW
SHFormatDrive
SHGetFileInfoW
ShellAboutW
Shell_NotifyIconW
ShellExecuteExW
ws2_32
WSAStartup
gethostbyname
WSACleanup
gethostbyaddr
inet_addr
closesocket
gethostname
htons
select
__WSAFDIsSet
ioctlsocket
recvfrom
socket
connect
recv
bind
winmm
timeBeginPeriod
msimg32
AlphaBlend
gdiplus
GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY
icmp
IcmpCloseHandle
IcmpCreateFile
IcmpSendEcho
imagehlp
MapFileAndCheckSumW
MakeSureDirectoryPathExists
iphlpapi
GetAdaptersInfo
GetNetworkParams
msi
ord45
ord70
netapi32
NetApiBufferFree
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupEnum
NetUserDel
NetUserGetInfo
NetUserSetInfo
setupapi
SetupIterateCabinetW
urlmon
URLDownloadToFileW
UrlMkSetSessionOption
userenv
GetDefaultUserProfileDirectoryW
uxtheme
SetWindowTheme
wininet
DeleteUrlCacheEntryW
InternetCloseHandle
InternetGetConnectedState
InternetOpenUrlW
InternetOpenW
InternetReadFile
UnlockUrlCacheEntryFileW
winspool.drv
ClosePrinter
DeletePrinter
OpenPrinterW
SetPrinterW
comctl32
InitCommonControlsEx
Name
.code
Size
116KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
660KB
Virtual Size
660KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
138KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/.gitattributes
- SHA256 029733aba3846ccd4b25842b09820477be0de4954c8d29cf74c6984ca2c0c049
- MD5 ab1055a3118e5e3a00e4846f20c8600c
- SHA1 0caeee39e512c8d262e94852ad3852dc7e60b97d
- SHA512 f9e7f91cc207f2464bf704d4cdf38dcbd18e1702d86056860d9c09e11be5d2c421a8a18c5da60240315ac3629193c2da5603893f08d973e446b24a59683cc8d1
- TLSH T106B001E3460E17A64E6E99E3D359D9C3F04644CA15D5B410137D87F2808BA025FA8E2E
- MD5 SHA1 SHA512 TLSH
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/LICENSE
- SHA256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986
- MD5 1ebbd3e34237af26da5dc08a4e440464
- SHA1 31a3d460bb3c7d98845187c716a30db81c44b615
- SHA512 d361e5e8201481c6346ee6a886592c51265112be550d5224f1a7a6e116255c2f1ab8788df579d9b8372ed7bfd19bac4b6e70e00b472642966ab5b319b99a2686
- SSDEEP 768:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7J:Fhcycsrfrnoum
- TLSH T15FF2835FB74413B2018206A26A9F68DEE319D03A73664095785DC15C27B3E3483BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
- SHA256 850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa
- MD5 8e0a0b48ad0289d647e55d802170d795
- SHA1 6adced8154ebaa02e06efcb85715d2663c731bd0
- SHA512 58edc773d275dec130cc5ede3c55edc5680f52e1b7ca4d78b349323f6d64b565ba052366b59ff4a94640fb49d14c2ec490dc69946bac9f921cb82bb62bffe563
- SSDEEP 6144:g3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Auj:g3IuuhcEvTGGOEmcAXz0ykw7x
- TLSH T192F41A466D0261A601B3F379DE53814EFB2AC2638375526879ADC044BF36309A2FEF5D
- MD5 SHA1 SHA512 SSDEEP TLSH
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
- SHA256 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
- MD5 9ec58202a786e33506e852dc9ddd03f7
- SHA1 f42ac0f91d72116e329d19cdb270187181e317db
- SHA512 6194cda6ade733ba097f45a1cff9d32392eabb9e44669abc18d81158d763e7a07bbda1c0392a7fd02fae412d74f3fd12dc6cbc36a19cc9c064787b9e3b3a14ef
- SSDEEP 49152:oWuJkGtsXh6x5hd8KDUBB8wI9CKjX1PUDfBd/:oWuQh6x5v8RBawI9CsX1MT
- TLSH T1029533B3CFE89525D9E714F2BF5C49539B91384FA5294B9B30E72E0CAC6434CA0A1E5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7b:ff:f7:df:22:71:8a:b2:ed:12:c3:a2:d7:e6:6e:43:86:6e:ed:6a:37:f6:bb:58:a0:c3:17:b7:1c:20:2a:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024945
Chains
Jun 30, 2026
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024945
Serial Number
37:c5:0a:3c:1d:a0:03:71:c7:0d:c7:c6:26:90:2f:e5
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 28, 2024 - Aug 28, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
5916400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
41KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=220, id=261, version=33145,
count=11, id=259, version=33145,
count=9, id=253, version=35721,
count=12, id=259, version=35721,
count=20, id=260, version=35721,
count=73, id=260, version=36248,
count=42, id=261, version=35721,
count=25, id=260, version=33145,
count=7, id=257, version=33145,
count=535, id=1, productName=Unmarked objects,
count=125, id=264, version=36248,
count=1, id=255, version=36248,
count=1, id=151,
count=1, id=258, version=36248,