Releases.rar
- SHA256 edb5f94fc885c5b92112bbaa7a621cbcd6ba9ee3b6dd22993094ead66180a87e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Releases/Stalin.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Releases/Stalin.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Releases.rar
- Size 2.9MB
- Sample261030-bfjatach89
- SHA256 edb5f94fc885c5b92112bbaa7a621cbcd6ba9ee3b6dd22993094ead66180a87e
- MD5 c2993341ee31d191d88233fa1f97afce
- SHA1 c74c99a9af3bd94d824fe00d89d507a6eddfc821
- SHA512 1c8e6e36cd652b8d078cd99b893d449c73fc71710e14308fb79b14636842461decaf0768b27aa0069bae3d8b4e70bf95fe9a4b2f85a760fee737e9fc420e00c2
- SSDEEP 49152:LSPTCE18LYnojOhahsBLe4q3zkRhmdTUTtksUM44ofjmeWkdbpmRZwwAkbF16R9z:27D18LYMuosBLe4CW/BksUMAKe8Rawfg
- TLSH T137D5330661582F13A55353B788442A15A78B7B0BAF1AC7CE60A37C873F52CBD92BD70D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/Releases/AngryVirus.exe unpack001/Releases/Chernobyl.exe unpack001/Releases/Commandos.exe unpack001/Releases/HighHappy.exe unpack001/Releases/Knuckles.exe unpack001/Releases/Magellan.exe unpack001/Releases/MasonChess.exe unpack001/Releases/MasonExln9.exe unpack001/Releases/MatrixVirus.exe unpack001/Releases/PEEKABOO.COM unpack001/Releases/Smil.exe unpack001/Releases/Squidward.exe unpack001/Releases/Stalin.exe
File Explorer
-
Releases.rar.rar 2.9MB
-
Releases/AngryVirus.exe.exe 482KB
-
Releases/Chernobyl.exe.exe 1.2MB
-
Releases/Commandos.exe.exe 79KB
-
Releases/HighHappy.exe.exe 82KB
-
Releases/Knuckles.exe.exe 289KB
-
Releases/Magellan.exe.exe 167KB
-
Releases/MasonChess.exe.exe 1.3MB
-
Releases/MasonExln9.exe.exe 77KB
-
Releases/MatrixVirus.exe.exe 14KB
-
Releases/PEEKABOO.COM.exe 921KB
-
Releases/Smil.exe.exe 365KB
-
Releases/Squidward.exe.exe 535KB
-
Releases/Stalin.exe.exe 30KB
Releases/AngryVirus.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
- MD5 85e11c1d67aec0150757e3255d8231b7
- SHA1 9167c5ea4a23d59f38e82f128f2b1a2dbbd88cea
- SHA512 a25fcf6c359a00e5671b08dbf91fde79fe14e9720d8d8b4980584fbb32f9bba78a8cc8760e5c504fad894e34df1d2693bd1d161539ad4597df3c50c84c1c5e51
- SSDEEP 12288:IJvK+727xaxunsCoFJse5vKNkuCCT3X7t8OP:IJKDAxuPondKNHj7hP
- TLSH T1E9A42382B21AE061E2CAF43727BD7A9273F6B0136352F91F51688A213D35FC0977525D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
358686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Chernobyl.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2342b3d3120400baea76a500a710fc239ea8d1c587459c4c20bc070e44281c27
- MD5 07b111536b5f2e251b3db0cd83b2d1ee
- SHA1 2a1b9c115a5d703a8dbd75796544bc88cf0ae29e
- SHA512 b99b35fb10432fa70c233bf6acda5f06047332e5aa631446221284c6659bd9a1ac697c4123cbd4ddce603a4d8810ee4940574bcdef9d59189edb4433c18741f1
- SSDEEP 24576:EzYx3PgYWwocek/r2+AAYNh3tBULAkS7LeB:EkoA/qhlL3rmzS7
- TLSH T17C55A522A687D9A3C41E1270DDC7D32977B2E0F46B368B87BA4C87AF7D213A11CC5546
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1289610
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\F1r4e8e3m6a0s5o7n9r2y\F1r4e8e3m6a0s5o7n9r2y\obj\Release\Chernobyl.pdb
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Commandos.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e0c0bb0b89ded0bcad1a4fbd9d7d989cacffe9c2dd963a89e86e13582cdf8262
- MD5 fe571936aa4654825c1c5df9cfe49227
- SHA1 c1ffe14039561511724621bf385ddc4c4291b156
- SHA512 646a1b1e5b02973df005c084d3a70f65a1f572563aa971b0247fbd4c1877ed7cd58d77c507e4f44bf7ac85f78b779b355025259cba9e5aec728aaf09a9dbec42
- SSDEEP 768:4Kxnvyx9lZYS8tu7Qi4eyulHCuytnY9QRcgQorIbjWqor2hCaK:1nqx975EQQi4LaHC1Y9QR/rIbjUP
- TLSH T1BD83E40235736D85C7BC25F706974AE443E5EC8106F189876A7BA60EFDEC6A84C47E83
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/HighHappy.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0f9617c86fd1a744a7185e1060b928cd05ddd63c70633dbe847d5582e60101fe
- MD5 788b0974f73acea93c7af807cbec1317
- SHA1 8a5482beb542396efef378d2556698ba4aebf363
- SHA512 487bab2035cef1a90f8c1f619af9b57784a4203b6291ef871db2340437f24184825ca931cb64f9fc58ebcc8b51e428f1261e8ff040cac2e919a285d00f8f1051
- SSDEEP 1536:KahfyS/+TAODerDpbuEpPEUwsbuUrVzBq05j9aJggFSoHdduVm0A9SBwwVcl:KahfyS/+TAODer9bFpPEobbxN5M2gFSM
- TLSH T1F283A1557394E65AC4231735D991D3F4A730DD85EA46C34B36E8BE2B3EBD2E28E412C0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\HighHappy\HighHappy\obj\Debug\HighHappy.pdb
mscoree
_CorExeMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Knuckles.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1f98a3f8852d28ed3b2f64e529c1ae1eafc5ef942a962ec89163f3db2744c8a4
- MD5 7e9d3109b138c0a67be983159fbbde98
- SHA1 012308407fada7ecb5edfe4e067fa4d18acba424
- SHA512 ac6a5a4ec87fe8770c1903f62d181f94366b2f9b3d3a4e8a04ec7f25b9e9d026762efc96ba5883474b9d1c2d0cca4a99e12f0343f6eac51af12d628a926a5e12
- SSDEEP 3072:Fxv5UYlnaArTD3FzIO4vphViwmtSEGsvXRUeMlyXxUpT1OXfqY:FxvaYlnaArvF8bzVi1SQPuluxWqq
- TLSH T1E5546B3A79788F95C60C0AB1BA61C1B3EB2F5D3D3481931F22DB77B9AEB5D4A1D01106
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
130478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\Freemasonry\Freemasonry\obj\Debug\Knuckles.pdb
mscoree
_CorExeMain
Name
.text
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Magellan.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
- MD5 dcea41cf1d8e08ba9cf571fdb21f1db4
- SHA1 da14f6d77d84da5e4290a28ce04e215d7cbfb937
- SHA512 d094aad5cd856683e551a519039c183ba440052639f82c0fc9e9124714f4bd843f83fa5a400386add08ed30b1dfb51c095e0055c96f601bca0c18acff5bcaf2f
- SSDEEP 3072:ia6Q7bFVzmHQg9Ug644RrO4gGBGhFxwzhk24UoobktbVZ:pz7bFVzvgP4O4bBG/qzhk+abV
- TLSH T138F3F26872FC6272E2BFC27645A6BE44572111B72B26FB6B0CC5E3F938137C54B20419
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
176414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
164KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/MasonChess.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9be0c047cea06ab24bdb1711ca7d4608e179826d079206ed36a1aea830cc5149
- MD5 10956f1eceb4c919805661a5bf59bbe9
- SHA1 51bda4e573711789db96a1755563246e39623af3
- SHA512 001b6eb588a6ac9d41abfe1a7fe001734fc9edb9db0502564532e029f1c30bf317261f63634527deb37ea9e1bb064818c57ec0a94194b23e4a6159039b02514d
- SSDEEP 24576:gfCzYx3PgYWwocek/r2+AAYNh3tBULAkS7LeS:gfCkoA/qhlL3rmzS7
- TLSH T1A455C622A687D993C40E1270DDD7D32977B2E0B46B368B87BA4C9BEF7D213A11CC5146
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1345930
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\Desktop\MasonRouletteV2\MasonRouletteV2\obj\Release\MasonChess.pdb
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/MasonExln9.exe
- IMPHASH 9442b6fa045237488f87bce426d95b06
- SHA256 622cce1035f8cdb86e362c430557e5c30f39a27bc53f7ccf201f51ba1bb3a965
- MD5 c30245645d088e11e6b57851f0e3b5c5
- SHA1 95853546db82c20be611714eaec91ab6a1e32bde
- SHA512 9979c6f19c7d48abc8eba634d5c4eb923b4c4c22882c78e6e7d77e633da8bbf1913a78ee02d4fcf64fb4a744c862d14b9c8ff08f23165187516c31b6d241f009
- SSDEEP 1536:14onCorR67Q3SaRO7IPqi/rhxdhsCJjmGasWhQcdQk/hO2o:v/RsQRIMPqizhxUqreRQk/hXo
- TLSH T1A0734B43B5D29CB2E5B21D311871CAA19A2FB9210E248E6B7794137E5F340D0AE35FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Owner\source\repos\StringMbrBuilder\mbr\overwrite\Release\overwrite.pdb
kernel32
ReadFile
GetModuleFileNameA
WriteFile
SetFilePointer
CreateFileW
GetModuleHandleA
Sleep
CreateFileA
CloseHandle
LoadLibraryW
GetProcAddress
GetFileSize
ExitProcess
FreeLibrary
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapAlloc
HeapFree
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
DecodePointer
user32
ExitWindowsEx
MessageBoxW
Name
.text
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=122, id=243, version=40116,
count=24, id=242, version=40116,
count=36, id=261, version=26706,
count=17, id=260, version=26706,
count=18, id=259, version=26706,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=93, id=1, productName=Unmarked objects,
count=1, id=264, version=27049,
count=1, id=255, version=27049,
count=1, id=258, version=27049,
Releases/MatrixVirus.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5906dc7c3cd938b874cfb12cd9a14a6e72116c31385f4584f997f1544e3da492
- MD5 13e1f4bc5b116e4ec87f055715563193
- SHA1 9eea7e9fce555b6c35730ec3dba29a13921f53f1
- SHA512 a53f446a2063684e401ad8c7da70ea7be4d23a2043341d9ab280dd36a1e91ef43b11ff510405125b957d88f5d9c7c00edb35977d8fe512e6fd0236f6447a030f
- SSDEEP 384:PX//sbBzFbtTLqr/tS2Ab9FhV0beOrptYcFwVc03K:PXCbgSn1IeAtYcFwVc6K
- TLSH T143620A4AE7944275D5BA027319B3A745CB32E22B8D47DB6A3CCCA05E7FA32064733395
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\MatrixVirus\MatrixVirus\obj\Debug\MatrixVirus.pdb
mscoree
_CorExeMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/PEEKABOO.COM
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
- MD5 d0ae6aea701de9f127f91e7efdb50252
- SHA1 cb9ef64cbcb999372fb4046e99fe89a03df9bc81
- SHA512 505d11808e9923ff0ec1a51acd51509711f8c5c42da81b47a97249954b06f6f45ddda4655446daeb7f231785cd484ebc6e9ada92b857ad3a8d7ce04276536f13
- SSDEEP 24576:lCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATb:oF+LL+fIWybB8
- TLSH T15915339832772A1FC8E73B37E5E739A463AE323D1936215C04A5F37D1E415C05726EA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
948526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
918KB
Virtual Size
918KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Smil.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f534bb9d7cc4c0f8abf8adcc592a328a64a902211ab66bafd9a0c7a333e86a20
- MD5 ea210a16c2cd0f7d84d3961bccbfe73a
- SHA1 598a97e9c7aef20ccc65ed04aa9449564b53f48f
- SHA512 baad73a63e0e4c56bea3283f0072ff7682e37afa96403c99e714373ab49b20e990044f6a221a89d27fd8c763af06e7418886880d41cc557be9892daeb3877c65
- SSDEEP 6144:iT+DPxVn9PvkYyeryYpaVexc6dJ1QYsjHf6EnJrNlT9Fb+3jqSd6A5n6n9TCX+Ct:iT+rxV93k4HpaVexd/FuHfFLEjdnC9At
- TLSH T18A84135561BDF193EAF9917318FFA004961A972FA3056BAF1C84D937AF0AF84320791C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
235934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
222KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Squidward.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
- MD5 82bf26203c5d76dfa3a591f1cb60d7b5
- SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
- SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
- SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
- TLSH T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
305038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
244KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Stalin.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4f50bb2cd893f1f225e02f66ecf0765830f078265e81096dbf551589cc641d43
- MD5 65f583c1c4322f11c7f947948d9c70fd
- SHA1 b570e11c47d64af6b00a3b6f362e067144a692ab
- SHA512 da14e6ffc9ebb593f0f5fcf199cfe3db48fb16683ad617fddac27b49e2b911e35fbbde271ab7d82d702b80d3558c6ee25c3759d01dafa8c1229a1efee4f44fe5
- SSDEEP 384:aIyoju/Dgxy0hpT8embLGG/tT2f7VXMeQTj0HeRcQyyyWuptYcFwVc03K:aIFj7XoTi76Jvaem0atYcFwVc6K
- TLSH T14BD2191D6266C027C56832B9EC2796F2817DDD89E455AEA335ECBD0D3F7620780A12EC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\Stalin\Stalin\obj\Debug\Stalin.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ