loader.zip
- SHA256 265d73e614e111034332d03d60a5285d6e21e15c599756d8ae6b2a79e6418626
Overview
overview
8Static
static
5auth\O4bL6Cpwn4kO.exe
windows10-2004-x64
8auth\O4bL6Cpwn4kO.exe
windows11-ltsc_2024-x64
8loader.exe
windows10-2004-x64
8loader.exe
windows11-ltsc_2024-x64
8vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1version.dll
windows10-2004-x64
8version.dll
windows11-ltsc_2024-x64
8Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
auth\O4bL6Cpwn4kO.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
auth\O4bL6Cpwn4kO.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
vcruntime140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
version.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral8
Sample
version.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target loader.zip
- Size 3.8MB
- Sample261027-w97kqaec56
- SHA256 265d73e614e111034332d03d60a5285d6e21e15c599756d8ae6b2a79e6418626
- MD5 96d9b0b8d96c5e0a8a6646738371e720
- SHA1 3b6e5390c19bd910655c408eac2db294f015318d
- SHA512 92d59394ae758d126888cdf52b21ec354ac01daaf4113ec1f77753c20101862de0105e5ef51b88e9a6b820a350f681f742fc02feb6bf15a0662d12d241096cee
- SSDEEP 98304:H86tQy+5jDwHHC8uNONfqSLQmj0p1HW9XdyH56hD:2V2uNOsSLnjkMQZ6hD
- TLSH T11206336BD4ECC78AFA0DE63E557CCAF7C6AC489AC9068CF964751513E09B0C85B140FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/version.dll - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/auth\O4bL6Cpwn4kO unpack001/version.dll
File Explorer
-
loader.zip.zip 3.8MB
-
auth\O4bL6Cpwn4kO.exe 131.8MB
-
loader.exe.exe 4.5MB
-
vcruntime140.dll.dll 116KB
-
version.dll.dll 124KB
auth\O4bL6Cpwn4kO
- IMPHASH 96c988111beae19d6f75f54b89a75585
- SHA256 f200923165a6510508964000f305df45a00bc079f3eb97dcd14ca94ae0cd0dd5
- MD5 98264f9aba5271ca6e2c971ca8a8ad8f
- SHA1 fd1a1c8c61d343f89921a1685e72326ff5fba067
- SHA512 7d2b999c43d708d22ebfee722b87cbbf286bd404220e68d1f2343856eed0ba25d37cc9a019f41bc2ee8c8d62d1ffc24f7eb0750d1b4179914cd2a2250f73fc1b
- SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
- TLSH T131688E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2118036
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader
RtlInitUnicodeString
RtlUnwindEx
RtlCaptureContext
RtlUnwind
kernel32
GetFullPathNameA
WriteConsoleW
GetLastError
ExitProcess
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
GetFileAttributesA
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
DeleteFileW
GetDriveTypeW
GetLogicalDriveStringsW
GetTempFileNameW
SetFileAttributesW
WriteFile
GetTempPathW
WaitForSingleObject
FindResourceExW
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
QueryFullProcessImageNameW
EnumResourceLanguagesW
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
GetVolumeInformationW
GlobalMemoryStatusEx
LocalFree
GetComputerNameW
LoadLibraryW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesExW
GetCurrentThreadId
GetSystemTime
SetUnhandledExceptionFilter
ResetEvent
CreateEventA
ExitThread
GetTickCount64
GetSystemInfo
GetTimeZoneInformation
GetLocalTime
GetEnvironmentVariableW
CreateDirectoryW
GetFileAttributesW
GetFileSizeEx
GetLongPathNameW
QueryDosDeviceW
ReadFile
RemoveDirectoryW
CloseHandle
SetEvent
CreateMutexA
OpenEventA
GetCurrentProcess
GetCurrentProcessId
CreateThread
TerminateThread
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MoveFileExW
MultiByteToWideChar
SetDllDirectoryW
ExpandEnvironmentStringsW
CreateFileA
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDrives
SetFilePointerEx
GetTempPathA
SetErrorMode
CreatePipe
TerminateProcess
CreateProcessA
CreateProcessW
OpenProcess
MoveFileW
FileTimeToSystemTime
K32GetProcessMemoryInfo
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
FormatMessageA
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetProcessHeap
GetFileSize
LockFileEx
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
HeapReAlloc
DeleteFileA
GetVersionExA
WaitForSingleObjectEx
LoadLibraryA
FlushViewOfFile
OutputDebugStringW
GetDiskFreeSpaceA
FormatMessageW
Sleep
HeapSize
HeapValidate
GetVersionExW
CreateMutexW
UnlockFileEx
SetEndOfFile
SetEnvironmentVariableW
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
ConnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetExitCodeThread
InitOnceBeginInitialize
InitOnceComplete
QueryPerformanceFrequency
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
GetLocaleInfoEx
FindFirstFileExW
GetFinalPathNameByHandleW
GetFileInformationByHandleEx
EncodePointer
DecodePointer
InitializeCriticalSectionEx
CompareStringEx
GetCPInfo
LCMapStringEx
GetStringTypeW
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
757KB
Virtual Size
756KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=180, id=261, version=33145,
count=19, id=260, version=33145,
count=8, id=259, version=33145,
count=17, id=260, version=35207,
count=12, id=259, version=35207,
count=95, id=261, version=35207,
count=7, id=257, version=33145,
count=248, id=1, productName=Unmarked objects,
count=1, id=260, version=35228,
count=43, id=261, version=35228,
count=2, id=259, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,
loader.exe
- IMPHASH 84da1a1e6e5b4e368d1238a8a636444b
- SHA256 66a1f6ccc9f869945bec8149f1af5ce5bb587d3d25c8008cfdc0bf3c0cebf9c2
- MD5 42fe4a56c232d4f65bfa7ad9eab99812
- SHA1 ff382fff460371f167ae09d2f2cf54d7d6264a0b
- SHA512 3694acd3980705493876209de679cd316f596f5255be2a0eb23971dbef18a8c54adb08f7dad42217ca855768910bba8d6f1d9d69f74429f2a64af9f9fc29c1c6
- SSDEEP 98304:+bwdaDFrhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1Y:+bUEFHGpELcoR1Y
- TLSH T131269DC6BF88F5E0C4A48834B916D5BDC6737C7A8A11468732D7FB1F2A37180552B92B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
85:28:2e:f8:01:e3:2e:56:88:71:6e:bd:ec:e0:16:8e:45:e5:12:aa:59:ad:1a:59:65:d5:a0:7b:2f:9e:52:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ba:2b:8e:e1:83:51:fe:29:1a:00:00:00:00:00:ba
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 29, 2025 - May 28, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
507856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
F:\dbs\sh\odct\0126_161408\client\onedrive\Product\UX\Exe\obj\amd64\OneDrive.pdb
kernel32
GetFileType
GetFinalPathNameByHandleW
GetVolumePathNameW
ReadFile
RemoveDirectoryW
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
GetCompressedFileSizeW
FindFirstFileNameW
IsDebuggerPresent
SetHandleInformation
CreatePipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeviceIoControl
OpenMutexW
IsWow64Process
LoadLibraryExW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
ReadDirectoryChangesW
CreateSymbolicLinkW
CompareStringOrdinal
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProcessIoCounters
GetPrivateProfileStringW
WritePrivateProfileStringW
CopyFileW
MoveFileExW
ReplaceFileW
GetComputerNameW
RegisterApplicationRestart
GetFileInformationByHandleEx
OpenFileById
GetModuleHandleW
GetDllDirectoryW
WriteConsoleW
ReadConsoleW
SetEndOfFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
SetStdHandle
SetEnvironmentVariableW
GetFileSizeEx
GetEnvironmentStringsW
GetCommandLineA
FindNextFileW
FindFirstFileExW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
CompareStringW
GetTimeFormatW
GetFileSize
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceExW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
CreateFileW
CreateDirectoryW
SetThreadInformation
GetSystemTimes
SetProcessShutdownParameters
GetExitCodeProcess
GetProcessTimes
WaitForMultipleObjects
CreateEventW
ReleaseMutex
GetLongPathNameW
SetLastError
VerifyVersionInfoW
GetProductInfo
VerSetConditionMask
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
K32GetModuleFileNameExW
GetUserDefaultLCID
GetUserGeoID
LCIDToLocaleName
SystemTimeToFileTime
MoveFileW
LocalAlloc
GetModuleFileNameW
GetVersionExW
GetSystemTimeAsFileTime
GetSystemTime
OpenProcess
TerminateProcess
GetCurrentProcess
CreateMutexW
WaitForSingleObject
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
FindFirstFileW
FindClose
DeleteFileW
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
CreateProcessW
InitializeCriticalSectionEx
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryW
SetDllDirectoryW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
WriteFile
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentThreadId
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
LocalFree
DeleteCriticalSection
DecodePointer
GetLastError
FreeEnvironmentStringsW
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCPInfo
CompareStringEx
LCMapStringEx
EncodePointer
GetLocaleInfoEx
QueryPerformanceCounter
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
RaiseException
OutputDebugStringW
user32
PostMessageW
EnumWindows
GetClassNameW
GetWindowThreadProcessId
SystemParametersInfoW
SendMessageTimeoutW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
RegisterSuspendResumeNotification
SetClipboardData
RegisterClipboardFormatW
CloseClipboard
OpenClipboard
UnregisterSuspendResumeNotification
RegisterClassW
CreateWindowExW
DestroyWindow
ShowWindow
advapi32
SetNamedSecurityInfoW
AdjustTokenPrivileges
CreateProcessWithTokenW
GetUserNameW
SetFileSecurityW
ConvertSidToStringSidW
GetNamedSecurityInfoW
SetEntriesInAclW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegDeleteTreeW
RegUnLoadKeyW
RegNotifyChangeKeyValue
RegLoadKeyW
RegEnumKeyW
RegDeleteKeyExW
RegCreateKeyTransactedW
GetAclInformation
FreeSid
DuplicateTokenEx
CreateWellKnownSid
AllocateAndInitializeSid
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegGetValueW
RegSetKeyValueW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
shell32
SHSetKnownFolderPath
ord526
SHFileOperationW
SHGetSpecialFolderPathW
SHGetKnownFolderPath
SHChangeNotify
SHParseDisplayName
ShellExecuteExW
SHCreateItemFromParsingName
SHGetFolderPathW
SHGetPropertyStoreFromParsingName
SHAssocEnumHandlers
SHCreateDirectoryExW
SHGetFolderPathAndSubDirW
CommandLineToArgvW
ole32
CoInitialize
CoInitializeSecurity
CoUninitialize
StringFromCLSID
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CreateBindCtx
CoCreateGuid
CoInitializeEx
CoSetProxyBlanket
CreateItemMoniker
GetRunningObjectTable
oleaut32
LoadTypeLi
LoadRegTypeLi
GetRecordInfoFromTypeInfo
crypt32
CertFindExtension
CryptStringToBinaryW
CryptBinaryToStringW
rpcrt4
RpcBindingFree
RpcBindingFromStringBindingW
RpcBindingVectorFree
RpcStringBindingComposeW
RpcStringFreeW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcServerUseProtseqW
RpcBindingSetAuthInfoExW
RpcEpRegisterW
RpcEpUnregister
RpcServerInqCallAttributesW
UuidCreate
secur32
GetUserNameExW
shlwapi
PathIsDirectoryW
PathFileExistsW
SHRegGetValueW
SHRegGetBoolUSValueW
PathStripPathW
SHRegGetUSValueW
PathIsPrefixW
SHDeleteKeyW
SHDeleteValueW
SHGetValueA
SHSetValueW
SHRegGetPathW
PathIsDirectoryEmptyW
SHGetValueW
PathRemoveFileSpecW
StrStrIW
SHCreateStreamOnFileW
AssocQueryStringW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
wininet
InternetCheckConnectionW
InternetCanonicalizeUrlW
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW
userenv
GetDefaultUserProfileDirectoryW
CreateEnvironmentBlock
Name
.text
Size
674KB
Virtual Size
674KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
195KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=172, id=261, version=30795,
count=8, id=259, version=34321,
count=17, id=260, version=34321,
count=92, id=261, version=34321,
count=7, id=259, version=30795,
count=22, id=260, version=30795,
count=1, id=262, version=30795,
count=29, id=257, version=30795,
count=382, id=1, productName=Unmarked objects,
count=44, id=261, version=34436,
count=5, id=265, version=34436,
count=1, id=255, version=34436,
count=1, id=258, version=34436,
vcruntime140.dll
- IMPHASH 7f07fd94e5bb907093556781cc464017
- SHA256 f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
- MD5 699dd61122d91e80abdfcc396ce0ec10
- SHA1 7b23a6562e78e1d4be2a16fc7044bdcea724855e
- SHA512 2517e52f7f03580afd8f928c767d264033a191e831a78eed454ea35c9514c0f0df127f49a306088d766908af7880f713f5009c31ce6b0b1e4d0b67e49447bfff
- SSDEEP 1536:KqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbsecbWcmpCGa3QFzFtjXzp:KqvQFDUXqWn7CkRG7YecbWb9a3kDX9
- TLSH T16AC37C4573A802B7D62EC274C1E25E46EB75B5418770ABCF03B589AA0F13BE1AE3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e7:1b:05:a2:b2:f0:a6:12:61:97:88:cb:ee:0e:ee:3a:79:f9:ca:91:b1:c4:cc:82:09:1d:a1:88:ba:51:d8:d0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 26, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
e7:1b:05:a2:b2:f0:a6:12:61:97:88:cb:ee:0e:ee:3a:79:f9:ca:91:b1:c4:cc:82:09:1d:a1:88:ba:51:d8:d0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 26, 2023
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 2, 2023 - Jan 31, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d6:27:69:ff:72:2d:56:c8:ae:00:01:00:00:01:d6
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
67072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
abort
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
api-ms-win-crt-string-l1-1-0
strcpy_s
strncmp
wcsncmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsprintf_s
api-ms-win-crt-convert-l1-1-0
atol
kernel32
GetLastError
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlUnwindEx
GetModuleHandleW
GetModuleFileNameW
RtlUnwind
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetProcAddress
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
_CreateFrameInfo
_CxxThrowException
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__C_specific_handler_noexcept
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__intrinsic_setjmpex
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_get_purecall_handler
_get_unexpected
_is_exception_typeof
_local_unwind
_purecall
_set_purecall_handler
_set_se_translator
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
732B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=29395,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=21, id=259, version=33030,
count=16, id=260, version=33030,
count=31, id=261, version=33030,
count=1, id=256, version=33030,
count=1, id=255, version=33030,
count=1, id=258, version=33030,
version.dll
- IMPHASH 4ddbc2027f4fd6c9cfff88feeafc0e8b
- SHA256 00f6b47ed70472f6b7cf95b8cdeb33d254906d780148df205320a0f7d25298e4
- MD5 410af86d672a4886ff7ecae3c8c0c5a7
- SHA1 e2308e96a4f97972dc3f382b8e23f776e5206aac
- SHA512 96695a111688b87f6c7073878a0f80190ca2fc1b5ec7b91f9e8f10cc2aae9a3b9b5a34596242dd9210f409502aa927f77f9a3404c354f8e95de5034800fb83a1
- SSDEEP 3072:PArsEFFJFC9pVpcGgD4H3zFOSwCYnn6iouckVPxIiTON4F:PArsqF7cpMdDC3JO6A
- TLSH T1D2C34B1BB6B5507BE26A8938C4530A05DF72BC918BA0ABDF07900DDA1E637D49F3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
14988
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
FindFirstFileA
FindNextFileA
FindClose
WriteConsoleW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=138, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=14, id=260, version=35207,
count=38, id=261, version=35207,
count=3, id=257, version=33145,
count=98, id=1, productName=Unmarked objects,
count=2, id=265, version=35228,
count=1, id=259, version=35228,
count=1, id=256, version=35228,
count=1, id=258, version=35228,