MrsWatson-0.9.7.zip
- SHA256 9b4e3f40dd352a13bd33e1f5cd75a93250e68c59910e9bf19695c583e0f40bac
Overview
overview
3Static
static
3MrsWatson-...watson
ubuntu-18.04-amd64
MrsWatson-...tson64
ubuntu-18.04-amd64
1MrsWatson-...ontest
ubuntu-18.04-amd64
MrsWatson-...test64
ubuntu-18.04-amd64
3MrsWatson-...watson
macos-10.15-amd64
1MrsWatson-...tson64
macos-10.15-amd64
1MrsWatson-...ontest
macos-10.15-amd64
1MrsWatson-...test64
macos-10.15-amd64
1MrsWatson-...on.exe
windows10-2004-x64
3MrsWatson-...on.exe
windows11-ltsc_2024-x64
3MrsWatson-...64.exe
windows10-2004-x64
1MrsWatson-...64.exe
windows11-ltsc_2024-x64
1MrsWatson-...st.exe
windows10-2004-x64
3MrsWatson-...st.exe
windows11-ltsc_2024-x64
3MrsWatson-...64.exe
windows10-2004-x64
3MrsWatson-...64.exe
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MrsWatson-0.9.7/Linux/mrswatson
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
MrsWatson-0.9.7/Linux/mrswatson64
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
MrsWatson-0.9.7/Linux/mrswatsontest
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
MrsWatson-0.9.7/Linux/mrswatsontest64
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
MrsWatson-0.9.7/Mac OS X/mrswatson
Resource
macos-20260915-en
macos-10.15-amd64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
MrsWatson-0.9.7/Mac OS X/mrswatson64
Resource
macos-20260915-en
macos-10.15-amd64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
MrsWatson-0.9.7/Mac OS X/mrswatsontest
Resource
macos-20260915-en
macos-10.15-amd64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
MrsWatson-0.9.7/Mac OS X/mrswatsontest64
Resource
macos-20260915-en
macos-10.15-amd64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
MrsWatson-0.9.7/Windows/mrswatson.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
MrsWatson-0.9.7/Windows/mrswatson.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
MrsWatson-0.9.7/Windows/mrswatson64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
MrsWatson-0.9.7/Windows/mrswatson64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
MrsWatson-0.9.7/Windows/mrswatsontest.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
MrsWatson-0.9.7/Windows/mrswatsontest.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
MrsWatson-0.9.7/Windows/mrswatsontest64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
MrsWatson-0.9.7/Windows/mrswatsontest64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target MrsWatson-0.9.7.zip
- Size 1.1MB
- Sample261029-vce9ja1vas
- SHA256 9b4e3f40dd352a13bd33e1f5cd75a93250e68c59910e9bf19695c583e0f40bac
- MD5 fcacc85b653b937381a57b2ee50f28b2
- SHA1 b4f4bfdfbeb73317c8575146b765cbd607c9ffb9
- SHA512 bb0ea1d653f5f04eeb2f8982e95de7a3bb941ea74bcf5df386000857403af0dcc3c4b9e0ec7923f17d744c8b2f4493acffb5ea7807c4b0e5f75786e7ab8e3cbd
- SSDEEP 24576:6XyfMccZN6u7Olh+K5GC8IPGC/bSxkK2jsRp5T8jyWshs864FkxaIo/1:6XPbN1Mh5GC8IPGC/GxkK2ygjyhG864L
- TLSH T1183533CE442F7B62FADCB1F4D783A5E9DB4AA598912C2500886071539CFCE6910FF91E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/MrsWatson-0.9.7/Windows/mrswatson.exe unpack001/MrsWatson-0.9.7/Windows/mrswatson64.exe unpack001/MrsWatson-0.9.7/Windows/mrswatsontest.exe unpack001/MrsWatson-0.9.7/Windows/mrswatsontest64.exe
File Explorer
-
MrsWatson-0.9.7.zip.zip 1.1MB
-
MrsWatson-0.9.7/Docs/Building.txt5KB
-
MrsWatson-0.9.7/Docs/ChangeLog.txt2KB
-
MrsWatson-0.9.7/Docs/Hacking.txt4KB
-
MrsWatson-0.9.7/LICENSE.txt2KB
-
MrsWatson-0.9.7/Linux/mrswatson.elf 137KB
-
MrsWatson-0.9.7/Linux/mrswatson64.elf 142KB
-
MrsWatson-0.9.7/Linux/mrswatsontest.elf 274KB
-
MrsWatson-0.9.7/Linux/mrswatsontest64.elf 269KB
-
MrsWatson-0.9.7/Mac OS X/mrswatson.macho 108KB
-
MrsWatson-0.9.7/Mac OS X/mrswatson64.macho 118KB
-
MrsWatson-0.9.7/Mac OS X/mrswatsontest.macho 231KB
-
MrsWatson-0.9.7/Mac OS X/mrswatsontest64.macho 246KB
-
MrsWatson-0.9.7/README.txt8KB
-
MrsWatson-0.9.7/Windows/mrswatson.exe.exe 209KB
-
MrsWatson-0.9.7/Windows/mrswatson64.exe.exe 213KB
-
MrsWatson-0.9.7/Windows/mrswatsontest.exe.exe 276KB
-
MrsWatson-0.9.7/Windows/mrswatsontest64.exe.exe 321KB
MrsWatson-0.9.7/Docs/Building.txt
- SHA256 36ecc3835481b2a78316f0ed95b8caf0259f09757a38b096c8f62f7e1d693aa1
- MD5 a6b2ee3b4b246ef18526e18e19e6472f
- SHA1 32562b45a3e05a16ccf4ef099933856799c3dc77
- SHA512 e0a04835a1a7a69edad9168d1828373de05c4b7f66b341389620f45534d7f6b3a0b439d65614d7ff21dbf81b9b351581cce26317f8cc5e3ad69ee3cafe899132
- SSDEEP 96:xz4o+TzHSp1y99hgE6ytWYfq2LI+tJE+MRfJNnqnZONR32m:xz4o+Tu1yXgytW1hKCJNqno8m
- TLSH T166B1A33F4B1DC3350559425272BD9BF3EB6A917B53F082B6219C821A2323B61C1BF6D5
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/Docs/ChangeLog.txt
- SHA256 47225c77f093282e5f83cf328853423462dec79a966db3803406552a5f5c4918
- MD5 046d939a944a482e16fbde99a33defb2
- SHA1 7bf6529540669b509e865ff708578830d988589a
- SHA512 a3478851346a400f8a4c71f57505c46e8057a2110133f42beb11bb910ae2f291b68c1c96027b293c5c42d8bce8768257b42e495a555b22dcc4f4945314746b1e
- TLSH T1CD417475A63D0562516203CE26326123DFF8763DD3C5431810CC86166F0ABF6C23A2B6
- MD5 SHA1 SHA512 TLSH
MrsWatson-0.9.7/Docs/Hacking.txt
- SHA256 82c13b04ddde7292f24186b3d99d57175572b6bb2f9b6a81ebc7c051b73dc143
- MD5 7ab67df7a46b5699cc83cb9e55f7f2d4
- SHA1 2716f13b8a0beb1da68ff517bd01a9554734ba72
- SHA512 d8becb0882829fef9a36c89ea71dded82d14c8d279aa7502c38cd66575c4a81799f0bbab6019e998b51c43e56ac6113965b2205ef1be46f23813438752d18dc3
- SSDEEP 96:/uOo5iHYSVew8xrngGPWAV9vOAz3+jamjy1DQ:/3oYAw8JnFPbLvOAz3EaOAQ
- TLSH T14DA1B54E2F8663A8056BD266A38B6A64F72AD06E534489B8387D41041F21B2951BFACC
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/LICENSE.txt
- SHA256 8c2052e5747e5f34e501c7ee0257ffca7f1f5ad0bd986675126e9a0130ac69a5
- MD5 95dfa69705a90d7ab7f8a824e05af126
- SHA1 6ad768c50d3dfba05bfc1452d529568c64016d7e
- SHA512 fa5c7d0a5fbe645dd6e970d8fac89ae44731243c1350032a1ab3d479ac8618ecfe9ddef50b6f7baeda4deff69d0632d71d139dd40a35f1c676d057d32edde1dd
- TLSH T10A41B61A1E048BFB58C08791328995DDE29F902D3A2F6D00006AD38E573B13F99FE5E0
- MD5 SHA1 SHA512 TLSH
MrsWatson-0.9.7/Linux/mrswatson
- SHA256 56a7574584e2b1e1809651662986e7d75628c8b5c8783ed5bd2fa3d9e1622bad
- MD5 d3b0f358d9380dadf2535d2fe7bc2fb9
- SHA1 d646ffdd1f07195d9f776bf1521dc467004fea1f
- SHA512 91b4ccab6b31675bda80537d66e22cf32ef34c8a89245975f6affaef64150b5ed77e950f45bc45672aedf1480c3e919f31c783ff0f795f6e3af4815a817ff3f8
- SSDEEP 3072:0PI/+qqdqcS2qO8n5+tVgEb2tloXxpLjCnfLPlnKhGWdw5:0qqdqctqO2MtIl46nfLPsEWdw
- TLSH T1D0D3285FFA4B85F7DDE306719187D2BF16A0D285961ACF34FA1C86086CE3A2E3125784
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/Linux/mrswatson64
- SHA256 43242a212aaf945d4563206ffafa13d7d50933e938af507cd7b1a72fb16674a1
- MD5 2353efd2947108b9d6218ba332f4080f
- SHA1 2eb40ed23956d31e6a174cc6960fb503f0ff1350
- SHA512 1e797efb240dff2711c9c378b5fa566c4aa874918ff6654a6509b84a9331f0217a102d6633fe206b37f74bfe3a5ecb3bd0d969ae6b1b9e6ad82c018e354e6754
- SSDEEP 3072:IwQuR9qC+ZrfaKo/T+Mx7e+8sPfjE/f7f/TiS01gKBi0nFV:XQFwKoKMx7e3/f7fb90BE0n/
- TLSH T11DE33B13749508FDC9DAC1314A9F85B1A5B2F0786331BA3F2914C7643EC6E6D1F6ABA0
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/Linux/mrswatsontest
- SHA256 003124166ad65400690203d43f13d97a9a32b4fb399dff042812349afc238718
- MD5 d4160949d03f2f57d49ed7cace7f4c82
- SHA1 504ce938800257d34cec7b7bd04dce6367dd18a3
- SHA512 e5c8d2ecbe4498f34785d97e059c8d5397856a3de67d9b1064049c089bb8bd1a44c600d90ce58c71a8899a8d321097cdb073022676f0da4b07c94e83478337cf
- SSDEEP 6144:S29dMg4XO9agOCBKWL9UQrhPbSkFqsMERCdyioEs:S2sg4e9NL9UuPHMEBioEs
- TLSH T19754D49EE90B88BADD970E329557F33F43B18260892DCD75EF0C9505EDB3509A418BE8
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/Linux/mrswatsontest64
- SHA256 9747157ba021aa05cf2f33eb4ca8ba1b565dee35a5d5e7075c4e87e11a85b805
- MD5 6e698707ac58d2389dcd03224ab79112
- SHA1 d5b4a0dab6b93c81a4bcfbda247d3bb2e522da2b
- SHA512 da7f18fa04cb50896828fae67cbdbdf98db486eaecac71f26267cc7421768494c29cba81f76fa5b53b138c781a8e6df26122060e69b3c7c79394745c18a1bb4f
- SSDEEP 6144:G966y3ig8zG4pjwxYjatc+TqrvtkXBibMSghY/ZVdUfJbM64zHUxQBbZyyMaJr:Gi2y4mxYjatc+TqrvtaBibM0/ZkfxMhH
- TLSH T1A8444A53B86204FDCAA6D134466E4131D8FDF6E41272BA3B2B64D3743D86E341F1ABA4
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/Mac OS X/mrswatson
- SHA256 b3733de9580476b85a75c00bd586b54fac8536e9f1771334b6bca1e8dd8923d8
- MD5 13d4578fde13ef4a0d907b1ab02e8233
- SHA1 fc3a96b7fa8d2cd7a70d1fb509357bb9daf31aa4
- SHA512 d67338c70db5b15a02924a8298dfba5203aa1bbbb303b3334ec9dde628c8f2090c73251046700b9c984122fd778b66c18b85f749790d456df06ef2f9b5bc8270
- SSDEEP 1536:O0QFQof9fpDwVrXlaKhX/FpuLlrhcBDjlesX9rZvDgk1yGTQ:JQFQofhperVdhPTuwjUM9rZ7UGTQ
- TLSH T107B3390BA50241F5C9561231E29DE27FEB29D31999328F49CF54C410EF23D3BBD2AB91
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/Mac OS X/mrswatson64
- SHA256 597134cb500a9a7202330673c2909157f5a3de588b648d3d89ae45392c03af30
- MD5 49529cabd9bb865548d77b69b7b56a40
- SHA1 7568ead1deb97aafaa9dd15ab1a391a4faf1ff4a
- SHA512 75f8a2adadd2139c813c35c76c6623030453f8aef0bdf0b2f57725f47cc9d952bb9e4b0b35aab3fc43f801199a339e5345ae8188e07102f707f3019533a84c6e
- SSDEEP 1536:j0pX38HpasEPxHA6Fs+wplQHrjlesX9rZLpBAOzqWCGT:j0pnxsN6FVPLjUM9rZVBA93GT
- TLSH T15FC32C1773548078C54A8134CB2FC272E6D8F9891726773BAB9AF3243E73C367A56528
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/Mac OS X/mrswatsontest
- SHA256 7d9fa232e1d2e9148085e6b0a3694ae1f7bc401e1ed6ef37530e28bd6c2f17b6
- MD5 6eaf35af3ed885ce5acb7c29cfb00ae5
- SHA1 c22bc9f29007ac48dc5b65e137df3e240ea8bf1e
- SHA512 1671e138c35fa04db74263760a729401e8848188c3455dbdd028c10173900c4550318b8c127a603f2880fb2af0ed7cf546a35458d764bffbdb1797eb76aa0707
- SSDEEP 3072:mNg+gJOhIjCk7b0S8IrV9FPGj4EVaJUCnoSP4CMZq8W5oTShJDnMi/wGeaKihezn:mWeqrV9FumlP4CiW8Sht+zObZxCq2
- TLSH T1F234E706E40A80FACD0B0B71905DE32FAE65D305ED765E94CF509920EF57D3A6C2BA78
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/Mac OS X/mrswatsontest64
- SHA256 75d217b1f27fb666d41228c56e539f94e257ede5c5b77fd69c51f1729af37c78
- MD5 857fe5b9fac974fb8dc4b16851d2a940
- SHA1 5a5af74883350f51aa0ba708773443eaa8636d65
- SHA512 24da27622f1ee05390a0d85f8d6a120c257fe94b02a925799fbe34d7839660f3dd4122feaf5c152a8e7c7bf95e8e91cb6ec2b416362e0fb0ce6e1450c7f64abf
- SSDEEP 6144:WwdROEBpNP0WPuYtOMQv6t1kjEKzObZNDig:WwdAxit1IEKAZNDV
- TLSH T15F34D71773514168D48A913C8F3F9331E6D4FB941A2AF67AAF26E7103E73E719E06128
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/README.txt
- SHA256 c2eac882ef3369cd0ffc018396255bd424514763915452bfaa625fbbf6136571
- MD5 f419a4de9c74ac31d64fcea39ad79344
- SHA1 7b45019fd20a05d8111264620f5bb432f9bf4971
- SHA512 f3c5e53108f9578e3e99ecabde294a523a98a148111414f805c95840feeeefaa9a15db2cac60bb23a50d2e644177df1e8948eabceed94f5f0730f6260f4c565c
- SSDEEP 192:rbLLZGIG5hVl6+oIYqM62IR5SY16QmsukbhNQZ3TKm:/LLZ3EJGIYqM62xYPekbXJm
- TLSH T12E02D4579F4C1332869E41773299B6F3FB0F327A63C1959418BD818827079B583BFA98
- MD5 SHA1 SHA512 SSDEEP TLSH
MrsWatson-0.9.7/Windows/mrswatson.exe
- IMPHASH 0da09b7c0d373a183d971dab5f3b44d6
- SHA256 61235a2901f03c88eb0a8bb79a01dd6499ff74db1e56d00238454f304ffa8e4f
- MD5 96b7407262015dc4f5313319752322c1
- SHA1 5babb32dc8d6d442429e753b6d1aff817c13b152
- SHA512 b381ec138ca979ac8cd5fffc59b039c7b160e5862cd94769ae2dc4df8eaaec3909de0c0ed29c7fa0c5a4dc4d95ef5f3a9e030b1449cfed6fe08bb67c4a1e0547
- SSDEEP 6144:xQRbjXrW13Z+EonHPIdDUvzAAOQ4AOR8:qrOZ+EoHA2zAi438
- TLSH T17F248C32B4E2C072D4F2027409ED9FB79AAE75161739C4F767E8478D1C201F29A76B62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
51472
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
FormatMessageA
GetCurrentDirectoryA
GetCurrentProcess
GetVersionExA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
CreateDirectoryA
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
GetLastError
FreeLibrary
LoadLibraryExA
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
SetConsoleCtrlHandler
GetCommandLineA
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
ReadFile
IsDebuggerPresent
IsProcessorFeaturePresent
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetProcessHeap
GetFileType
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlUnwind
RaiseException
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
OutputDebugStringW
HeapSize
CompareStringW
LCMapStringW
GetStringTypeW
SetStdHandle
GetTimeZoneInformation
WriteConsoleW
CreateFileW
SetEndOfFile
SetEnvironmentVariableA
shell32
SHGetFolderPathA
Name
.text
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=40, id=225, version=20806,
count=33, id=223, version=20806,
count=160, id=224, version=20806,
count=3, id=225, productName=VS2013 build 21005, version=21005,
count=5, id=203, version=65501,
count=99, id=1, productName=Unmarked objects,
count=35, id=224, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
MrsWatson-0.9.7/Windows/mrswatson64.exe
- IMPHASH d67d0199af79e5de65ab989d16e93c78
- SHA256 c0e275578d5136876a1b75405e27345e4bceca2bdf6695430a5c3470970767c4
- MD5 5aa9d59f348dafb18cf2093c652c9f96
- SHA1 9443b970528d9ca35d35263ac8625a23b2e141db
- SHA512 3d42cbefeae992d21253456c9a2064a3d70cf83aeead186603495db027aaea4965af85a80f0db27366428e1bf7c66fbb788daeaaee919927ecd7e933168c3e50
- SSDEEP 6144:MosSTzNhCQtYEBT/ZC4pIrXTsO0DjTohsAB:7/VtYEhZMWjToiA
- TLSH T13F246C4A22500CF9E8775138CA928546E3F2785A0735DBEF07B443669F235D6BE3BB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetTickCount
FormatMessageA
GetCurrentDirectoryA
GetCurrentProcess
GetVersionExA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
CreateDirectoryA
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
GetLastError
FreeLibrary
LoadLibraryExA
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
SetConsoleCtrlHandler
GetCommandLineA
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
ReadFile
IsDebuggerPresent
IsProcessorFeaturePresent
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetProcessHeap
GetFileType
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
OutputDebugStringW
HeapSize
CompareStringW
LCMapStringW
GetStringTypeW
SetStdHandle
GetTimeZoneInformation
WriteConsoleW
RaiseException
CreateFileW
SetEndOfFile
SetEnvironmentVariableA
shell32
SHGetFolderPathA
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=40, id=225, version=20806,
count=153, id=224, version=20806,
count=15, id=223, version=20806,
count=3, id=225, productName=VS2013 build 21005, version=21005,
count=5, id=203, version=65501,
count=102, id=1, productName=Unmarked objects,
count=35, id=224, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
MrsWatson-0.9.7/Windows/mrswatsontest.exe
- IMPHASH 47810cab023a9ba0e938eeb50beb32ac
- SHA256 3bafbeeae8c2f8e9d73d04f6376f57541989e7665ab224c244f4c871f87c9fa8
- MD5 4cbed07c5774d58e50874222578ba9ea
- SHA1 1900f738f105a77fde401997aca3241873397caf
- SHA512 e60b090629c26875471d923bfca707ed97814970392f414f8e8a6543fd8a622a868b9459837ea6a3f7922bc076e1a939c3414025dc18318e30971f175c4c045b
- SSDEEP 6144:GZYSgmQYD4yw4TWpiJDFy4KizoAOdFAO5:O/gmpDrTqiJDFyAzoXFb
- TLSH T125547C23B88280B1E7E212723E784B73CABD65251738C0F3DB951EB99C749E1953275E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
121379
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTempPathA
Sleep
CloseHandle
GetLastError
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
CreateDirectoryA
CreateFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetFileSize
GetCurrentDirectoryA
GetCurrentProcess
GetVersionExA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetTickCount
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
LoadLibraryExA
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
GetCommandLineA
HeapReAlloc
ReadFile
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
SetLastError
GetCurrentThreadId
DeleteCriticalSection
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetFileType
GetStartupInfoW
GetProcessHeap
WriteFile
GetModuleFileNameW
RtlUnwind
DeleteFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadConsoleW
RaiseException
SetFilePointerEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
OutputDebugStringW
SetStdHandle
GetStringTypeW
LCMapStringW
WriteConsoleW
HeapSize
CreateFileW
SetEndOfFile
shell32
SHFileOperationA
Name
.text
Size
182KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=35, id=225, version=20806,
count=30, id=223, version=20806,
count=148, id=224, version=20806,
count=3, id=225, productName=VS2013 build 21005, version=21005,
count=5, id=203, version=65501,
count=100, id=1, productName=Unmarked objects,
count=61, id=224, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
MrsWatson-0.9.7/Windows/mrswatsontest64.exe
- IMPHASH 1f6fb5363f89247b8dff91918858a07d
- SHA256 f5b7baa94471aa51f80bf5c5cd3aa4c601dd44101d8bf6ae0cc70e5dfd2e9f99
- MD5 6fb397ff3bf095cfad9ef8b5aa1be403
- SHA1 c3bb3b45ce69b77f7bdba2b405df8154f2819a42
- SHA512 08b9649373b94d441b0843261d422033cfa8767c697e5b9ca1b515706acd0edbc586cbdebcb0f262c96add8393600d8545ecd3eaa602f34265ccc7d92b454001
- SSDEEP 6144:kktz5ntq935lDZwj9vTGqfPH00I2xXHTfaIReWPMGyjHohHV9:Jtp49DZMlv00I2JhojHol7
- TLSH T1ED64178AB36630E8E96E60B8C6D08107E2F6B956137247DF2B7042651F335C6BD3AF54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
163172
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetTempPathA
Sleep
CloseHandle
GetLastError
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
CreateDirectoryA
CreateFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetFileSize
GetCurrentDirectoryA
GetCurrentProcess
GetVersionExA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetTickCount
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
LoadLibraryExA
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
GetCommandLineA
HeapReAlloc
ReadFile
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
RtlUnwindEx
SetLastError
GetCurrentThreadId
DeleteCriticalSection
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetFileType
GetStartupInfoW
GetProcessHeap
WriteFile
GetModuleFileNameW
DeleteFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadConsoleW
SetFilePointerEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
OutputDebugStringW
SetStdHandle
RaiseException
GetStringTypeW
LCMapStringW
WriteConsoleW
HeapSize
CreateFileW
SetEndOfFile
shell32
SHFileOperationA
Name
.text
Size
221KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=35, id=225, version=20806,
count=142, id=224, version=20806,
count=15, id=223, version=20806,
count=3, id=225, productName=VS2013 build 21005, version=21005,
count=5, id=203, version=65501,
count=103, id=1, productName=Unmarked objects,
count=61, id=224, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,