ghost-sandbox-windows-x64.zip
- SHA256 63e25b8f215b6ec7b689e887c0e49d9906a23647dc64039518b6b746df0fcda8
Overview
overview
3Static
static
3ghost.exe
windows10-2004-x64
1ghost.exe
windows11-ltsc_2024-x64
1ghost_host.exe
windows10-2004-x64
1ghost_host.exe
windows11-ltsc_2024-x64
1ghost_lab.exe
windows10-2004-x64
1ghost_lab.exe
windows11-ltsc_2024-x64
1ghost_sandbox.exe
windows10-2004-x64
1ghost_sandbox.exe
windows11-ltsc_2024-x64
1sandbox_shim.dll
windows10-2004-x64
1sandbox_shim.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ghost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ghost.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
ghost_host.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
ghost_host.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
ghost_lab.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
ghost_lab.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
ghost_sandbox.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
ghost_sandbox.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
sandbox_shim.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
sandbox_shim.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target ghost-sandbox-windows-x64.zip
- Size 6.5MB
- Sample261030-xgdbva1vb1
- SHA256 63e25b8f215b6ec7b689e887c0e49d9906a23647dc64039518b6b746df0fcda8
- MD5 998106c2677d82ec298f3d8a39525d49
- SHA1 37175f343835b38bbed7694a1236f04de214308a
- SHA512 957cad76fce2007a78640b58ec773ce6fb9c59eb62447271a25218fbef96a13cf59d1d39699bb740b0e55f8b2c158e0e8cb38bce40933200a853b8f122c75f99
- SSDEEP 196608:BxFqfrDpln41023xxqLeY8NIjrYZ4DeODugai96sdCiPgexeP:LofrDpl4iExYH8NirYaeuV/9lddg3
- TLSH T1E866333C115C7B417B284B3E8607F4BB8E2E611D42FA27B90DD7E4AE155BA525BF3082
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/ghost.exe unpack001/ghost_host.exe unpack001/ghost_lab.exe unpack001/ghost_sandbox.exe unpack001/sandbox_shim.dll
File Explorer
-
ghost-sandbox-windows-x64.zip.zip 6.5MB
-
AGENTS.md15KB
-
LICENSE34KB
-
README.md41KB
-
ghost.exe.exe 1.7MB
-
ghost_host.exe.exe 139KB
-
ghost_lab.exe.exe 1.4MB
-
ghost_sandbox.exe.exe 12.5MB
-
sandbox_shim.dll.dll 342KB
AGENTS.md
- SHA256 319787aca072c834c6b8a53772b39e8ffcc7c5ce8403a30779834144d81951d9
- MD5 61e2755635c82331db154f0b479d027b
- SHA1 6fa2e2515c33b32115c7300ed87adad88cee2686
- SHA512 bf80754ca5032aa6476d1160209f0cbc01074129c45dd409bb0e68a135a23d9aaa31ce99cb05eb3aeaa910df7cea52802860969333ca954ae5982ee3e7c48d15
- SSDEEP 384:dssQiWiSz/J9381+jQ/v81Dis4TYOGL9A9VY+Gm:dsHbzR58178liZ29A9VCm
- TLSH T178720A87736CE33916B68197720E62EBDF3390A862650C70347D926C7749A7443BB7E8
- MD5 SHA1 SHA512 SSDEEP TLSH
LICENSE
- SHA256 e0eedba615d5cd1b986afb6c5b3a4b1ae33713e7e9dc74d19daec5e3221f9d2e
- MD5 11da06444afc8233c93d92f2ff286607
- SHA1 7e267f9e6ce70f49526ef7e1a08068413453facf
- SHA512 fe080c915a3766cf5779be29767b454a2b3264dfacc3343a6d6ed4a1a36b5bfac1382b8657857c45fa8fcea53a345033b70c63cb6e5034706a3e2f4b2ef77b0b
- SSDEEP 384:ZMRJzlQ0Lf8KnYz3ZlqXstCTyVqtGJEuzFrb3CNHroNjOK1gxuCfJDbQ9:ZSndSz3ZlqXOWoInuzx3Y8N3W9xD09
- TLSH T18DF2845BB74513B2029202516E4BA4CEF31E907A776A40A4785DC15C27B7E3883BFAED
- MD5 SHA1 SHA512 SSDEEP TLSH
README.md
- SHA256 36487a22a63cea8942d3bfdc13a71192109a35df427383781dc4d14e0f279351
- MD5 62af06b238cbbbce4b90c8d660d72868
- SHA1 cbb2e789db5f1bf7047648a759156d2281a5a74f
- SHA512 716492b4feefd7e1390340abee49b2ba970e9876fd8d987662049a0c1f72317833daf1f03d47e968e16f7ef269df308a3f8181de2f53288f0646e23f78019a07
- SSDEEP 768:SZshCzuSO/nUyxU5BqO58zkjJlXuM//kBVdALmnaTLQEIFvcukSGBJC:UshGwdxU5BqO58zkTd/tkaPSvR5
- TLSH T13D130933B329D33D27A3C24D720A92D6E712B0A472550864B49DF21C63DD9B463B67FA
- MD5 SHA1 SHA512 SSDEEP TLSH
ghost.exe
- IMPHASH bed7ae69116b57cddba5b1c4ce601f70
- SHA256 4dbd00a921838e17b80d86dc829f2655eac2d2525c3317d5797256012f15623c
- MD5 b60cea0e8aa916e13a263191cd5a439a
- SHA1 31fb1088bea6ab6de54c129d590ea3979d241c44
- SHA512 5a52d52bf54391cb30ffc2b9398397f24089a9de6472420415dc9d1015231a60212f76f58973f25ea694ef093cce95e558d8fc6d8fe9830ff883961c936f3d77
- SSDEEP 24576:Oqt92StZ/MvVrTzf8+HW6iWuFmyxXSY0fY1T/ZYwCP:Oqt9h/MvVHzf7HLitcyEPfY1T/FC
- TLSH T15585F7067B9F99ACD15AC474930A8AB34A2170CB0B36B8FF44D855753FAEAB45B3C314
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1421936
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ghost.pdb
kernel32
GetFullPathNameW
CreateFileW
SetFileTime
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
ExitProcess
GetSystemDirectoryW
WriteFileEx
GetFileAttributesW
DuplicateHandle
FlsSetValue
GetTempPathW
IsThreadAFiber
FlsAlloc
WriteConsoleW
GetModuleHandleA
GetWindowsDirectoryW
ReadFileEx
GetTimeZoneInformationForYear
GetSystemTimeAsFileTime
GetConsoleOutputCP
GetConsoleMode
GetProcessHeap
HeapFree
HeapReAlloc
AddVectoredExceptionHandler
QueryPerformanceCounter
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
SleepEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualAllocEx
WriteProcessMemory
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
LoadLibraryA
lstrlenW
RtlVirtualUnwind
WideCharToMultiByte
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
HeapAlloc
GetEnvironmentVariableW
QueryPerformanceFrequency
CompareStringOrdinal
GetCommandLineW
GetStdHandle
ReleaseMutex
CreateMutexA
GetCurrentProcessId
WaitForSingleObjectEx
SetLastError
GetCurrentThreadId
DisconnectNamedPipe
FlushFileBuffers
ReadFile
PeekNamedPipe
CreateThread
GetNamedPipeClientProcessId
UnmapViewOfFile
ConnectNamedPipe
CreateNamedPipeW
OpenProcess
FindFirstFileExW
FindNextFileW
FindClose
CreateFileA
TerminateProcess
CreateRemoteThread
CreateProcessA
CreateProcessW
LocalFree
GetCurrentProcess
SwitchToThread
ResumeThread
WriteFile
Sleep
CloseHandle
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerExW
GetSystemTimePreciseAsFileTime
GetCurrentThread
SetThreadStackGuarantee
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
GetLastError
SetUnhandledExceptionFilter
FlsFree
InitializeSListHead
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
WakeByAddressAll
advapi32
CreateProcessAsUserW
GetTokenInformation
CreateRestrictedToken
SetTokenInformation
OpenProcessToken
LookupPrivilegeValueW
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW
ntdll
NtOpenFile
RtlNtStatusToDosError
NtWriteFile
NtReadFile
NtCreateNamedPipeFile
bcryptprimitives
ProcessPrng
vcruntime140
__CxxFrameHandler3
memcpy
memmove
memset
memcmp
_CxxThrowException
__current_exception_context
__C_specific_handler
__current_exception
api-ms-win-crt-math-l1-1-0
fmod
log2
__setusermatherr
api-ms-win-crt-string-l1-1-0
wcslen
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initialize_onexit_table
_initterm_e
exit
_exit
_register_onexit_function
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_cexit
terminate
_initterm
_seh_filter_exe
_crt_atexit
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
297KB
Virtual Size
297KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35721,
count=3, id=259, version=35721,
count=9, id=260, version=35721,
count=23, id=261, version=35721,
count=3, id=257, version=33145,
count=160, id=1, productName=Unmarked objects,
count=16, productName=Unmarked objects (old),
count=1, id=258, version=36260,
ghost_host.exe
- IMPHASH d97dbc7584a2a553ecb28e1ab8bcc100
- SHA256 c80a1379c64df1ab31d34df8efeef0c8047ff1fd176dfefeff9f6b38c2c2b905
- MD5 4549911f9312149497859df3e3d55159
- SHA1 06877c8b09349c5b3e77be6724bbf5ba803ab290
- SHA512 7b4eea9223220163c01e5000e22d838108ad27f96b910c6e7118b9e74a8d69ddf15f3b3986a17e7d6a61690a7d71401906aeacfa50153e6b36ce61a380572e7f
- SSDEEP 3072:Dw8nac/VaICNgV5vvoOtH4S64tHBIoqGTOFpEN9:ntjCNUJtH4p+BcEN9
- TLSH T19BD35C5BB3E631F9E573963985614605F7B2B83107319BEF0394436A2F236D09E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6544
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFullPathNameW
GetLastError
Sleep
FreeLibrary
GetProcAddress
LoadLibraryW
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CloseHandle
CreateFileW
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=141, id=261, version=33145,
count=12, id=260, version=33145,
count=6, id=259, version=33145,
count=3, id=257, version=33145,
count=90, id=1, productName=Unmarked objects,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=1, id=261, version=36260,
count=1, id=258, version=36260,
ghost_lab.exe
- IMPHASH 01ee4253178667cf43dd90e62adf97ab
- SHA256 b5dbaa8841d8ca1d11abedf910f4ec7bee4fd0b8f6b8b4396e3f72a49779a577
- MD5 00f9126370f22821c11490965ee91de8
- SHA1 5679ed545947e84792a19e965a7520ac999c3cf0
- SHA512 81b1931d4c26db28fbe5a76aca53fe78e3e8f0992fc36a93e3804e3c14b27c68713cad49bcfca1a584c85a63f331275c49a48f490c1ce6ed4478bfc1ce2d18af
- SSDEEP 24576:UAs0O8TEPHtJIGyncJufOv26ZXxhoXruYfY77zS:803TEPHtJIGycJWwNZXxhoXyiYm
- TLSH T15C65E6027B9FA9ACD15AC470C30A4A734E2174DB0B36B9BF44C492353FAEAA45B3D715
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1122704
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ghost_lab.pdb
kernel32
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
DuplicateHandle
CreateThread
WaitForMultipleObjects
GetExitCodeProcess
GetTempPathW
DeleteFileW
CreateWaitableTimerExW
SetWaitableTimer
Sleep
WriteFileEx
ReadFileEx
SleepEx
GetModuleHandleA
FlsFree
GetOverlappedResult
CancelIo
IsThreadAFiber
FlsAlloc
GetProcessHeap
HeapFree
WriteConsoleW
GetConsoleOutputCP
GetConsoleMode
InitializeSListHead
GetCommandLineW
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetStdHandle
ReleaseMutex
CreateMutexA
GetCurrentProcessId
CreateEventW
CreateDirectoryW
FlushFileBuffers
WaitForSingleObjectEx
GetFullPathNameW
SetLastError
GetCurrentThreadId
GetFileInformationByHandle
SetFileTime
FlsSetValue
CreateFileA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
AddVectoredExceptionHandler
HeapReAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualAllocEx
WriteProcessMemory
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
LoadLibraryA
lstrlenW
RtlVirtualUnwind
WideCharToMultiByte
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
HeapAlloc
GetEnvironmentVariableW
QueryPerformanceFrequency
QueryPerformanceCounter
CompareStringOrdinal
WaitForSingleObject
FindFirstFileExW
CreateRemoteThread
CreateProcessA
CreateProcessW
LocalFree
GetCurrentProcess
ResumeThread
CopyFileExW
SwitchToThread
SetFileInformationByHandle
GetSystemTimeAsFileTime
GetFileInformationByHandleEx
GetCurrentThread
SetThreadStackGuarantee
PeekNamedPipe
ReadFile
ConnectNamedPipe
CreateNamedPipeW
FindNextFileW
WriteFile
CreateFileW
TerminateProcess
OpenProcess
CloseHandle
FindClose
SetUnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
GetLastError
ntdll
NtCreateNamedPipeFile
RtlNtStatusToDosError
NtWriteFile
NtReadFile
NtOpenFile
advapi32
CreateRestrictedToken
LookupPrivilegeValueW
GetTokenInformation
GetLengthSid
CreateProcessAsUserW
OpenProcessToken
SetTokenInformation
ConvertSidToStringSidW
ConvertStringSidToSidW
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
bcryptprimitives
ProcessPrng
user32
EnumWindows
PrintWindow
GetWindow
IsWindowVisible
GetWindowThreadProcessId
ShowWindow
GetDC
SetWindowPos
SetForegroundWindow
ReleaseDC
SetProcessDPIAware
GetWindowRect
gdi32
DeleteObject
BitBlt
GetDIBits
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
vcruntime140
_CxxThrowException
memset
memmove
memcmp
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
memcpy
api-ms-win-crt-string-l1-1-0
wcslen
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
exit
__p___argc
__p___argv
_register_onexit_function
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
_initterm_e
_exit
_cexit
_initterm
_get_initial_narrow_environment
_seh_filter_exe
_set_app_type
terminate
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
249KB
Virtual Size
249KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35721,
count=3, id=259, version=35721,
count=9, id=260, version=35721,
count=23, id=261, version=35721,
count=3, id=257, version=33145,
count=177, id=1, productName=Unmarked objects,
count=20, productName=Unmarked objects (old),
count=1, id=258, version=36260,
ghost_sandbox.exe
- IMPHASH 7fad6599aad43caecdd5b83a9b752ba6
- SHA256 29d9873129a3ac257e7825057232e60ccb02f837548ee54414e7595201701916
- MD5 88dc36600f98e8699fdd729eb80fd936
- SHA1 e6a338ef6c4954eba3082cd1fc13332aaf91316e
- SHA512 877da38af5cf6064cc220476099d2cbb7d95430035c27661aa5505ecb70ee4f0481a82ec6bcc1e083936533fc95d0b1ff25ebaf877e4ed5d235e9f8df4f3b6ff
- SSDEEP 98304:7B3pQ+vuRRsqFWSbM0zo+ZFR4he9ug5/3GapwakZv3LDY8jRoIek+u/fXYze1qFa:NNufUOwx4S
- TLSH T1ACD65B11BA5F55ACD15AC8B483078A739A2174CB0B36B9FF01C452393F6EBE05B2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9038176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ghost_sandbox.pdb
kernel32
DuplicateHandle
GetFileAttributesW
GetWindowsDirectoryW
GetSystemDirectoryW
ExitProcess
CreateDirectoryW
GetFileInformationByHandleEx
GetFileInformationByHandle
SetFileInformationByHandle
SetFileTime
CreateFileW
GetFullPathNameW
WriteFileEx
ReadFileEx
SleepEx
FlsFree
FlsSetValue
IsThreadAFiber
FlsAlloc
WriteConsoleW
GetConsoleOutputCP
GetConsoleMode
GetStdHandle
SetLastError
ReleaseMutex
CreateMutexA
GetCurrentProcessId
WaitForSingleObjectEx
GetExitCodeProcess
SetThreadStackGuarantee
DisconnectNamedPipe
FlushFileBuffers
ReadFile
PeekNamedPipe
GetNamedPipeClientProcessId
ConnectNamedPipe
CreateNamedPipeW
OpenProcess
GlobalAlloc
GlobalLock
FindClose
FindFirstFileExW
FindNextFileW
CreateFileA
TerminateProcess
CreateRemoteThread
CreateProcessA
GlobalSize
WideCharToMultiByte
GetModuleHandleA
LocalFree
GetCurrentProcess
ResumeThread
GetProcessHeap
HeapFree
HeapReAlloc
GlobalUnlock
MultiByteToWideChar
InitializeSListHead
FormatMessageW
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualAllocEx
WriteProcessMemory
CreateToolhelp32Snapshot
Process32First
Process32Next
AddVectoredExceptionHandler
WriteFile
CreateThread
GlobalFree
LoadLibraryW
GetCurrentThreadId
SwitchToThread
Sleep
CloseHandle
WaitForSingleObject
SetWaitableTimer
RtlCaptureContext
RtlLookupFunctionEntry
LoadLibraryA
lstrlenW
RtlVirtualUnwind
GetCurrentDirectoryW
GetModuleHandleW
HeapAlloc
GetEnvironmentVariableW
QueryPerformanceFrequency
CompareStringOrdinal
CreateWaitableTimerExW
GetCurrentThread
GetSystemTimePreciseAsFileTime
LoadLibraryExA
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
SetThreadErrorMode
GetProcAddress
GetTempPathW
CreateProcessW
QueryPerformanceCounter
FreeLibrary
GetLastError
SetUnhandledExceptionFilter
GetTimeZoneInformationForYear
oleaut32
SafeArrayCreateVector
SetErrorInfo
GetErrorInfo
VariantClear
SysStringLen
SafeArrayPutElement
SysFreeString
SysAllocStringLen
advapi32
CreateRestrictedToken
SetTokenInformation
GetLengthSid
RevertToSelf
ImpersonateAnonymousToken
OpenProcessToken
GetTokenInformation
LookupPrivilegeValueW
CreateProcessAsUserW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
ntdll
NtOpenFile
NtReadFile
RtlNtStatusToDosError
NtWriteFile
NtCreateNamedPipeFile
bcryptprimitives
ProcessPrng
user32
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetKeyboardState
TrackMouseEvent
ToUnicodeEx
GetMenu
GetClassInfoExW
GetClassNameW
ScreenToClient
DestroyCursor
ShowWindow
SetWindowPlacement
GetWindowPlacement
GetKeyboardLayout
ChangeDisplaySettingsExW
GetClipboardData
IsClipboardFormatAvailable
MonitorFromRect
SetCursor
LoadCursorW
SetClipboardData
EmptyClipboard
ValidateRect
SendInput
MapVirtualKeyW
GetForegroundWindow
SetCursorPos
SetWindowDisplayAffinity
ReleaseCapture
GetWindowTextW
GetWindowTextLengthW
MonitorFromWindow
GetWindowRect
DestroyIcon
CreateIcon
InvalidateRgn
SetWindowPos
GetSystemMenu
RegisterRawInputDevices
CreateWindowExW
RegisterClassExW
SetCapture
GetWindowLongPtrW
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
SendMessageW
GetSystemMetrics
GetActiveWindow
CreateIconFromResourceEx
DestroyWindow
DispatchMessageW
TranslateMessage
PeekMessageW
SetPropW
MapVirtualKeyExW
RedrawWindow
EnableMenuItem
IsIconic
ReleaseDC
GetClientRect
PostMessageW
AdjustWindowRectEx
GetDC
SystemParametersInfoA
CloseClipboard
RegisterClipboardFormatW
OpenClipboard
GetWindowLongW
ShowCursor
GetRawInputData
MsgWaitForMultipleObjectsEx
GetTouchInputInfo
ClipCursor
GetClipCursor
RemovePropW
SetWindowLongPtrW
DefWindowProcW
ClientToScreen
SetWindowTextW
CallWindowProcW
GetPropW
CloseTouchInputHandle
IsProcessDPIAware
GetAsyncKeyState
SetWindowLongW
RegisterTouchWindow
GetCursorPos
RegisterWindowMessageA
SetForegroundWindow
GetKeyState
FlashWindowEx
uiautomationcore
UiaLookupId
UiaGetReservedNotSupportedValue
UiaHostProviderFromHwnd
UiaRaiseAutomationEvent
UiaRaiseAutomationPropertyChangedEvent
UiaReturnRawElementProvider
gdi32
ChoosePixelFormat
DescribePixelFormat
CreateRectRgn
GetDeviceCaps
SetPixelFormat
SwapBuffers
DeleteObject
GetPixelFormat
opengl32
wglMakeCurrent
wglGetCurrentDC
wglShareLists
wglCreateContext
wglDeleteContext
wglGetProcAddress
wglGetCurrentContext
shlwapi
AssocQueryStringW
ole32
RegisterDragDrop
RevokeDragDrop
CoTaskMemFree
CoUninitialize
CoCreateInstance
OleInitialize
CoInitializeEx
imm32
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmGetContext
ImmAssociateContextEx
ImmGetCompositionStringW
shell32
DragQueryFileW
DragFinish
SHCreateItemFromParsingName
dwmapi
DwmSetWindowAttribute
DwmEnableBlurBehindWindow
uxtheme
SetWindowTheme
vcruntime140
memcpy
memset
__CxxFrameHandler3
memmove
memcmp
_CxxThrowException
__current_exception
__C_specific_handler
__current_exception_context
api-ms-win-crt-math-l1-1-0
atan2f
_hypotf
expf
powf
fmodf
__setusermatherr
log10
ceil
sin
cos
ceilf
fmod
round
log
pow
floor
truncf
cosf
exp2f
roundf
cbrtf
floorf
log2
cosh
coshf
sinh
sinhf
tan
log1p
tanf
log1pf
fmaf
tanh
tanhf
acos
asin
asinf
sinf
atan
atanf
asinh
asinhf
acosh
acoshf
trunc
exp
exp2
logf
log2f
fma
acosf
api-ms-win-crt-string-l1-1-0
strlen
wcslen
api-ms-win-crt-runtime-l1-1-0
exit
_exit
__p___argc
_initterm
_cexit
_set_app_type
strerror
_get_initial_narrow_environment
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_configure_narrow_argv
_initialize_narrow_environment
terminate
_crt_atexit
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Name
.text
Size
9.0MB
Virtual Size
9.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
259KB
Virtual Size
259KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35721,
count=3, id=259, version=35721,
count=9, id=260, version=35721,
count=23, id=261, version=35721,
count=3, id=257, version=33145,
count=364, id=1, productName=Unmarked objects,
count=41, productName=Unmarked objects (old),
count=1, id=258, version=36260,
sandbox_shim.dll
- IMPHASH bbaf79b4f6a4c47b04ce832cc9ba50c1
- SHA256 33fb43d74a21c26c7c1290f70676f655d60449c2b2b6ab4e476af6d454613996
- MD5 814f5604b8c6ceb122e042dc91998523
- SHA1 1b2c0950d1c4de251ed7cc4487c63a9de9a6b6c5
- SHA512 9e284bcfaadf74d2f60d8a6d570a66f992e32ce65416115c9eb43083d5891323ebb68d0f8d88a26b5b3e190b3136cf7cd702ebb2e28c5130307089b8ec1a6a19
- SSDEEP 6144:EexodQDIqgtBdr1q7qkXKywQZ3tAbVrLMzI6fHgWmc679nCwKW:Eex8QDIqgtBdr1q7XXYytulLhc6sw
- TLSH T1C0747C19F7A114F8E077C138C9B79117FA72BC180760AADB17A44A657F33BE0963A712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
117296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetEnvironmentVariableW
CreateDirectoryW
CreateFileA
DeleteFileW
GetFileAttributesW
ReadFile
WriteFile
GetTempPathA
CloseHandle
DuplicateHandle
GetLastError
SetLastError
AddVectoredExceptionHandler
SetNamedPipeHandleState
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
SetEvent
WaitForSingleObject
CreateEventA
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetThreadContext
FlushInstructionCache
GetSystemInfo
GetLocalTime
GetSystemDirectoryW
VirtualAlloc
VirtualProtect
VirtualFree
MapViewOfFile
UnmapViewOfFile
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryA
OpenFileMappingA
CopyFileW
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Thread32First
Thread32Next
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
ReadConsoleW
CreateFileW
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
ExitProcess
FreeLibrary
GetModuleFileNameW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
LCMapStringW
GetProcessHeap
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
SetStdHandle
oleaut32
SysFreeString
VariantInit
SysAllocString
ws2_32
ntohs
WSASetLastError
Name
.text
Size
249KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
793KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=156, id=261, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35721,
count=16, id=260, version=35721,
count=33, id=261, version=35721,
count=14, id=260, version=33145,
count=7, id=257, version=33145,
count=136, id=1, productName=Unmarked objects,
count=1, id=261, version=36260,
count=1, id=258, version=36260,