CheckERB_download.7z
- SHA256 a6f20e138af5fd4a578ec3400709a39d58032096ec104f62fa9db1244ed00357
Password
vSpsM9hfP5kmK1srH6wlA3jq
Overview
overview
7Static
static
3CheckERB_download.7z
windows10-2004-x64
1CheckERB_download.7z
windows11-ltsc_2024-x64
1Custodian.txt
windows10-2004-x64
1Custodian.txt
windows11-ltsc_2024-x64
1checkERB_d...le.exe
windows10-2004-x64
7checkERB_d...le.exe
windows11-ltsc_2024-x64
7checkERB_w...le.pyc
windows10-2004-x64
3checkERB_w...le.pyc
windows11-ltsc_2024-x64
3chromedriver.exe
windows10-2004-x64
1readMe.docx
windows10-2004-x64
1readMe.docx
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
CheckERB_download.7z
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
CheckERB_download.7z
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Custodian.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Custodian.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
checkERB_downloadfile.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
checkERB_downloadfile.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
checkERB_withReport_downloadfile.pyc
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
checkERB_withReport_downloadfile.pyc
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
chromedriver.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
readMe.docx
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
readMe.docx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target CheckERB_download.7z
- Size 37.7MB
- Sample261027-qq67ysdf69
- SHA256 a6f20e138af5fd4a578ec3400709a39d58032096ec104f62fa9db1244ed00357
- MD5 d0ab6d76910a247c161f9617b7ff58a6
- SHA1 9c7d6768f26dab389f7f43b6ed97f9c24d800edc
- SHA512 d19e44faf7b28b9bdf29ac4bb8950eb9c98fa743ebe778fdd1b493e7171608b970a163793556ad377c1354b9aa5ec78dc17dc5cfbef641c38e48d713ec2dfee2
- SSDEEP 786432:bu4d+Rls835Cq8RXuobiaVXrdduNtdULyYcJOeiFuH9LirH8hbytg/L0h:ATpKpbiaVXsriwHI+agAh
- TLSH T1A68733BA123E7AA148FDAEB05F831E6BD20DC5DDF0BEB1F60694773014867976134688
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/checkERB_downloadfile.exe pyinstaller - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/checkERB_downloadfile.exe unpack001/chromedriver.exe
File Explorer
-
CheckERB_download.7z.7z 37.7MB
-
Custodian.txt14B
-
checkERB_downloadfile.exe.exe 31.3MB
-
checkERB_withReport_downloadfile.pyc21KB
-
chromedriver.exe.exe 23.2MB
-
readMe.docx.docx 19KB
Custodian.txt
- SHA256 63a6c8c4d0102f0cfbd914c279a0cb8bb626fffe1fa8c85e488f9de563c10441
- MD5 b3fc657f6d2a914989711269792d298c
- SHA1 c144ab5913b9b95772d7b68c2376cc0257fc3d72
- SHA512 2d80f561730563c2cab26b93d327b8cfaacc9b3b5349fcd079ab43f8bf01fd85b74aa424846522abc56b0dd5bd606c83d5c6bcbdc20f451064fbf5f31d894ad7
- MD5 SHA1 SHA512
checkERB_downloadfile.exe
- IMPHASH f0d05c1dd5ba1ed096c85a04a8275fec
- SHA256 a3b2ab11ee973b4f2e75c50edabe3715fbc86edfd9d76d9b34f3bb4fa5eb8236
- MD5 73457add0d069ee48670a75a596af3d5
- SHA1 e4832434318b4fb46976c35c649a2dfec6285a29
- SHA512 5008d02c12a4bc0b4c63f27c79492777d910f11c7e2bfd6b4d58ce482f0332c81f11e89df384b9b8b342a8e67e99338a8ed192ac785b4e58b4b70ade2bbdb196
- SSDEEP 786432:g6BlcT8yk8pFdCrG2qnucT3qmM+HZBS336YnczZwt7k2+ZOhpA:hYwyk8rdCrGF/zqyHD8369lwNuip
- TLSH T1117733D8E2A502C9F0AA423D69E195B7D3F0F5110363C48F47E56B263D6F1E0AF796A0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
vSpsM9hfP5kmK1srH6wlA3jq
Minor OS version
0
Major OS version
6
Entry point
56560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
HeapSize
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
Process32NextW
SetUnhandledExceptionFilter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleHandleW
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
205KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=188, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=145, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
checkERB_withReport_downloadfile.pyc
- SHA256 523010d6b1e7f3e0fdda379b7881fa9ec394cfc4e8b44e33563e0e7802ff68f2
- MD5 3aaf47621983c1d3cfab771c171737da
- SHA1 9eca099eddbc5286068dda5610651f3d7c9b6d6b
- SHA512 504d1b39a9c512e51e2103570f24d7ad08b3968e5128a19c812de697366215f3ee2f003a6bc1a3b0029749d9567864dd05c3944c7a8b4e8bafe1dacb046435d8
- SSDEEP 384:1x1OesifUNxuQdRIWeTdi3sU10N53Kj+NViZx1:1x1lTfcP6FU1i3Jqz1
- TLSH T17BA2E871869424DFE9CCF07AB4899D443F3283BEB7629307F1245D7DAEE4329925821E
- MD5 SHA1 SHA512 SSDEEP TLSH
chromedriver.exe
- IMPHASH 266496c1123b7229c70d03eac53415b2
- SHA256 ffce245136a0c6b444ecb91976e95ccdcf90843ecba7d94546c1c70d9b118157
- MD5 425fe180d59e8fcf44cd751054892ff1
- SHA1 296d13400d3fa419013474d9164dc96564feb03b
- SHA512 965e78afeb1456c80bcb6a72f3413f53cb66d17c331eb4e844488b3c62b1c19c9bb629c2d9166ba161efefc6f0eac9ae1f585702cf5f192d02111d5e3609423f
- SSDEEP 196608:jMkrSqyoDD9zMGACy4O0zGMZ/8kJXNSr4dTkQA2vEv3Z:jMXqyyDeU4SZEoMUj+3Z
- TLSH T13C378E13F29611E8C01EC5788B5A9233AA70BC594B35B2EF1A5067911F7AFE47B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
vSpsM9hfP5kmK1srH6wlA3jq
Minor OS version
0
Major OS version
10
Entry point
10410944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
chromedriver.exe.pdb
advapi32
BuildTrusteeWithSidW
CheckTokenMembership
ConvertStringSidToSidW
CreateProcessAsUserW
DuplicateTokenEx
EqualSid
GetLengthSid
GetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
IsValidAcl
IsValidSecurityDescriptor
IsValidSid
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
SetEntriesInAclW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
SetSecurityInfo
dbghelp
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetModuleInfo64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW
user32
AllowSetForegroundWindow
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
GetActiveWindow
GetQueueStatus
KillTimer
LoadKeyboardLayoutW
MapVirtualKeyW
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassExW
SetTimer
ToUnicode
TranslateMessage
UnregisterClassW
VkKeyScanW
ws2_32
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEnumProtocolsW
WSAEventSelect
WSAGetLastError
WSAGetOverlappedResult
WSAIoctl
WSARecv
WSARecvFrom
WSAResetEvent
WSASend
WSASendTo
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
inet_ntop
ioctlsocket
listen
ntohs
recv
recvfrom
sendto
setsockopt
shutdown
socket
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
AreFileApisANSI
AssignProcessToJobObject
CancelIo
CancelIoEx
CloseHandle
CompareStringW
ConnectNamedPipe
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateNamedPipeW
CreatePipe
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeleteProcThreadAttributeList
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrencyFormatEx
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCurrentThreadStackLimits
GetDateFormatEx
GetDateFormatW
GetDiskFreeSpaceA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeW
GetDynamicTimeZoneInformation
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameA
GetFullPathNameW
GetGeoInfoW
GetHandleInformation
GetLastError
GetLocalTime
GetLocaleInfoEx
GetLocaleInfoW
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNamedPipeClientProcessId
GetNamedPipeServerProcessId
GetNativeSystemInfo
GetNumberFormatEx
GetOEMCP
GetOverlappedResult
GetPriorityClass
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessTimes
GetProductInfo
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetSystemTimePreciseAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadId
GetThreadPriority
GetThreadPriorityBoost
GetTickCount
GetTimeFormatEx
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserGeoID
GetVersionExW
GetWindowsDirectoryW
GlobalFree
GlobalMemoryStatusEx
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
InitializeSRWLock
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetModuleInformation
K32QueryWorkingSetEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadDirectoryChangesW
ReadFile
RegisterWaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RemoveDirectoryW
ReplaceFileW
ResetEvent
ResolveLocaleName
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleMode
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFileCompletionNotificationModes
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetInformationJobObject
SetLastError
SetStdHandle
SetThreadInformation
SetThreadPriority
SetThreadPriorityBoost
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SuspendThread
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryEnterCriticalSection
TzSpecificLocalTimeToSystemTime
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
UnregisterWaitEx
UpdateProcThreadAttribute
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
ole32
CoInitializeEx
CoRegisterInitializeSpy
CoRevokeInitializeSpy
CoTaskMemFree
CoUninitialize
crypt32
CertAddStoreToCollection
CertCloseStore
CertControlStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertGetEnhancedKeyUsage
CertOpenStore
CryptProtectMemory
CryptUnprotectMemory
iphlpapi
GetAdaptersAddresses
if_indextoname
ntdll
NtQueryObject
RtlGetLastNtStatus
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
shell32
CommandLineToArgvW
SHGetFolderPathW
SHGetKnownFolderPath
ShellExecuteExW
shlwapi
PathMatchSpecW
secur32
AcquireCredentialsHandleW
DeleteSecurityContext
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextW
QueryContextAttributesW
QuerySecurityPackageInfoW
winhttp
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpSetTimeouts
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
urlmon
CoInternetCreateSecurityManager
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
dhcpcsvc
DhcpCApiInitialize
DhcpRequestParams
ncrypt
NCryptCreateClaim
NCryptCreatePersistedKey
NCryptExportKey
NCryptFinalizeKey
NCryptFreeObject
NCryptGetProperty
NCryptImportKey
NCryptIsAlgSupported
NCryptOpenKey
NCryptOpenStorageProvider
NCryptSetProperty
NCryptSignHash
GetHandleVerifier
sqlite3_dbdata_init
Name
.text
Size
18.3MB
Virtual Size
18.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.2MB
Virtual Size
4.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
112KB
Virtual Size
462KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
507KB
Virtual Size
507KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rodata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.tls
Size
1024B
Virtual Size
857B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CPADinfo
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
malloc_h
Size
512B
Virtual Size
265B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
readMe.docx
- SHA256 f84cee1c71a37478fcf6efcc761b53d566b1b72d6e8ad9e76d474c653323d742
- MD5 6bb909cd07e99d3ce5eb97c6d4ffd180
- SHA1 82daa3682c34a14e9b1613ac0563b84f1958b0a3
- SHA512 b3ce33f3deb1e0b29542ac5eb9fdd98f9234b0d3517229985b57638b7454ce4999be8acb225f7a8a3810f471b9e6f1cf2c8d65bcd9c1f97af3ea8ab4d951fb38
- SSDEEP 384:d3VEJuTmaJqisrV6QxeSTGikLRHgmnJK/2n+Itllo9E:peJuTmaYis4S0pn+O+ItXv
- TLSH T19892CFFACB08BA16C273ACFC002515B6DAD84196B3A13A1F5505CBCF42A499347FADF4
- MD5 SHA1 SHA512 SSDEEP TLSH