Bat2EXE.zip
- SHA256 4869eb7d2f3a3750539ee56947623670c86dd9df475cc2832e2a02f671a0658e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Bat2EXE.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
900 seconds
Behavioral task
behavioral2
Sample
Bat2EXE.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target Bat2EXE.zip
- Size 12.3MB
- Sample261101-1ppavsdv2x
- SHA256 4869eb7d2f3a3750539ee56947623670c86dd9df475cc2832e2a02f671a0658e
- MD5 bfef6d69dc6e9d3bac0122c1faab4cf4
- SHA1 bbc9fa80277288b592205f0bb422a788ff9fcc54
- SHA512 0ccaf2adb6d1262604b44e1c4b32632102f32c13253abd8d40e8dd6d1ac88ce9688181766e5a3b54c447e21061a78cb8256015b929a703e80d2ae506958a407e
- SSDEEP 196608:wCBLXDRaNB0RRL5z6eN3L0NtPlE1TRovsywgzQaXB+eE+xYbt6Ka5I244:wCVkNBCRlv0NJlcHg9X35+onIs
- TLSH T14BD6334FBFC0EDD87A5E64690A110A1CBD4DF08D6A2C1A0259E93E7D2A0D3DDB37E851
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bat2EXE/AppData/PS2EXE/Win-PS2EXE.exe unpack001/Bat2EXE/Bat2EXE.exe
File Explorer
-
Bat2EXE.zip.zip 12.3MB
-
Bat2EXE/AppData/AppSrc.ps1.ps1 3KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/colors.xml.xml 1KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/configure.xml.xml 1KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/delegates.xml.xml 9KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/english.xml.xml 53KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/locale.xml.xml 2KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/log.xml.xml 1KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/magick.exe.exe 30.6MB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/mime.xml.xml .pdf 133KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/policy.xml.xml 7KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/sRGB.icc59KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/sRGB_b64.txt158KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/thresholds.xml.xml 11KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/type-ghostscript.xml.xml 9KB
-
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/type.xml.xml 691B
-
Bat2EXE/AppData/PS2EXE/PSGetModuleInfo.xml22KB
-
Bat2EXE/AppData/PS2EXE/Win-PS2EXE.exe.exe 61KB
-
Bat2EXE/AppData/PS2EXE/ps2exe.ps1.ps1 96KB
-
Bat2EXE/AppData/PS2EXE/ps2exe.psd16KB
-
Bat2EXE/AppData/PS2EXE/ps2exe.psm1663B
-
Bat2EXE/AppData/application_bootstrap.bat122B
-
Bat2EXE/Bat2EXE.exe.exe .ps1 99KB
Bat2EXE/AppData/AppSrc.ps1
- SHA256 ece8168022219d4680fb47d689eed546283f77277678c05fcb673f0c5805d0f0
- MD5 45a7687c7e9beb6be9a1ef763ec66347
- SHA1 63d2bfb1c03bfbb91b4cb09397f42c837f2116f8
- SHA512 ad61458b155c6e2799ef6fe2a6e8473f05fd810042f7592f235ac3235702531a4fdb3b3b8d2d3549392a99174b5663fcc97e5724c918100af8220820c323e9c3
- TLSH T1EC715432DD03242506F043179786A459EB12902FA2701CA1B4EC99C97BFDD198BED7FD
- MD5 SHA1 SHA512 TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/colors.xml
- SHA256 37b986dc355641021434859f77b5e1f30b21670c847706ee9b77418e0874dfa6
- MD5 12be3e5feaad31faa3a6ab08803222ae
- SHA1 aa4920b8d37e13a7e0f928d2cc29f25f2c7ffa48
- SHA512 2c9c1aa511cc26970935d3594303f6a7c911bf85fabd4df97bbcacc662c8ae2980ea842d4f9bd95580b581685e23c94eabcca74823dcf9f5d47c616731f70296
- TLSH T1D4219C70D74CCA270863467C1DFBF54F1724AC2978081F9C355665476E1352BE08B2B5
- MD5 SHA1 SHA512 TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/configure.xml
- SHA256 e5c1bde8c9eeb9369e99944a7f8ffa69c2238585e499747765bb6b2e39ed894b
- MD5 41f540d777420f439a40ce897874d81e
- SHA1 887016b415ff6ea59fe185f04be5755de000aa1d
- SHA512 e9097accd7eed393d5aed9460f46f69f87e5b3dc4cbd4cb3c69542a02e18153edb7ddf810529ff437a627c80f85c3a2b2e566c760d7035f0f7ea1ad88cc13ffc
- TLSH T17121F373F88C8D034FB18CE9F929BA289868F7FD514C28DC70BB320B64E7800101769A
- MD5 SHA1 SHA512 TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/delegates.xml
- SHA256 d6447b0e9c748690b63717d7942987f854b021761613fcb212f6148c8a63d665
- MD5 6d02ccb45e780362462abd42e1f9f942
- SHA1 6f28b5880c58a630dc481a3d6686c901755a4793
- SHA512 83bda61e053a6a7313158f32603e1013f92a3747baf7ec04e19b57c87d0e9243e4fd385894c5062af77c1078b801e8b92352a3f11ebbcbba921d127bb921f80e
- SSDEEP 192:xGvy1vsp4gDho+/xcW9SO9iu9ETTNcgIqSBOuFt34EkyDiDE2:04uTablzvuZ7ko9t9mY2
- TLSH T14322EE5A83F32CE7C1FF31026944276D8E1FB7861FA457E238DE5B64A691E0096EB250
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/english.xml
- SHA256 d32c7b50db08bd3be6a5d898f34eac1e34460fb91bec3b18f7364defe8774cb2
- MD5 ea359be41fa344f507251a6b9061602b
- SHA1 ca0d23c79b78438d5bc7d1976d0c8336208a91b7
- SHA512 7956345d9cc5b2a43f9646b8fd7e04659f651010e9f3d7645f00a168ad094ea7ba29a032f673125cc517b83f635f6394f67a28c08d503a21ea125ab2225d9985
- SSDEEP 768:7dDl7YU/dTpJnD3dXT0/Hjb1V5z4B7r9TpN9t/tJTp4hVjjtp3rNlPv3rpLLJ3+D:DN0C3awNv
- TLSH T1E633E445C9D42C0E103380AB7B953191FE448EB35A1A72B331CD776F9F71E4666ABB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/locale.xml
- SHA256 9a22865c9ba728a88aeea2bd64d238e39886ec1a87d791353e9266a3198ab296
- MD5 1f3daa42c3bfd4bfd139543dff10e09f
- SHA1 4e2cfc92e3e24fd3c1f3209d7a61c9947c87944f
- SHA512 45354592f5491e70671a59b81ffa489b08c8efa54bafa925557b9918c6dce0052aef27fb7cc2e4b51963459b6383bb896531cae9cf226799c9201fc8857afdb4
- TLSH T1F051262688EE7D878B6143E97E8AD9111349E5FC514B1E02309621EFF45777EC0C7B41
- MD5 SHA1 SHA512 TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/log.xml
- SHA256 c246daab249adda19a7754fe8769e6ef08a7d0b5c8ce4742a036593a6e47ea17
- MD5 99afe9649a722e6ee7276753aac2fb01
- SHA1 23fff1e7668aa59c2b46458453d4c12a9447ac52
- SHA512 dd08f690b18cc81560242a58534f1273013683b79cf51edf385b25524d0fd2f24ec0afa4b99450ce1912e6e010df46e34244c3e85ce46c77147771808b1dcab8
- TLSH T19C3111CE5E0C4472933856B86F5A7419F334F1E731140479318A4E473F3AA58E1C6ECA
- MD5 SHA1 SHA512 TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/magick.exe
- IMPHASH c3c4ed6aec7f1b13a9c52e23df0cd911
- SHA256 1232979c05fa7c4bd28a7a1d0101568b10afeb0c31b8a04414a463b4c0e007d0
- MD5 616ed0ad3b4101ed82669921ffc3b397
- SHA1 d3883c3ac06d553187e1b67569339b924bee089a
- SHA512 33c47c2ccd77cd4a7e2bb650eccb42c143507377f8c5c5c9d972772fbc7624999002075bc92a9062befedbf49083ce55902204c45fe5b81cc862af6c7af37282
- SSDEEP 393216:en1LJSyukVu7n/3N+nip7ZS0B43O/8G2EoDasBT0zD+DBaQGOQnZVqTGLdbYK96m:TVStb0D+JQZIK0781
- TLSH T15E67B042F1A510E8E577C07CC6A7A617FBB1701903319AEB26E485A62F27FE1293F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
67:7f:d9:71:39:78:b2:1c:1f:78:73:fb:a1:b2:4f:c8:47:50:87:8f:66:0e:51:27:95:53:ba:14:86:9f:f5:f9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ImageMagick Studio LLC,O=ImageMagick Studio LLC,L=Landenberg,ST=Pennsylvania,C=US
Chains
Oct 14, 2026
CN=ImageMagick Studio LLC,O=ImageMagick Studio LLC,L=Landenberg,ST=Pennsylvania,C=US
CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=ImageMagick Studio LLC,O=ImageMagick Studio LLC,L=Landenberg,ST=Pennsylvania,C=US
Serial Number
33:00:08:44:c4:43:f9:56:3c:8d:b5:45:d1:00:00:00:08:44:c4
Issuer
CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 13, 2026 - Oct 16, 2026
Subject
CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 26, 2026 - Mar 26, 2031
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 1, 2021 - Apr 1, 2036
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:5f:2a:e4:f8:23:45:bc:1a:49:00:00:00:00:00:5f
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 17, 2026 - Sep 14, 2027
Minor OS version
0
Major OS version
6
Entry point
3469312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\ImageMagick\ImageMagick\Artifacts\bin\magick.pdb
kernel32
CreateThread
GetLogicalDrives
OutputDebugStringA
GetFileSize
GetDriveTypeA
ReadDirectoryChangesW
GetLongPathNameW
GetSystemDirectoryA
GetModuleHandleExA
GetVolumePathNameW
GetVolumeInformationW
ReadConsoleInputW
GetNumberOfConsoleInputEvents
TzSpecificLocalTimeToSystemTime
RemoveDirectoryW
GetConsoleCP
FreeLibraryAndExitThread
ExitThread
CompareStringEx
LCMapStringEx
DecodePointer
GetSystemTimePreciseAsFileTime
RtlCaptureStackBackTrace
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetLogicalProcessorInformationEx
SwitchToThread
CreateSymbolicLinkW
CreateHardLinkW
CopyFile2
CreateDirectoryExW
AreFileApisANSI
SetFileInformationByHandle
GetDiskFreeSpaceExW
GetLocaleInfoEx
GetCurrentThreadId
MultiByteToWideChar
SystemTimeToFileTime
MoveFileExW
FindResourceA
GetStartupInfoA
CreateFileMappingA
FormatMessageA
LocalFree
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GlobalFree
SetEnvironmentVariableA
GetCurrentProcessId
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetModuleHandleA
SetConsoleCtrlHandler
WriteFile
GetConsoleOutputCP
GetDriveTypeW
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
DuplicateHandle
CreateProcessW
DeleteFileW
GetFileAttributesExW
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
GetStdHandle
GetCommandLineA
GetCommandLineW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
GetTempPathW
IsThreadAFiber
VirtualProtect
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentThread
GetCPInfo
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetFileSizeEx
HeapReAlloc
HeapSize
HeapQueryInformation
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
OutputDebugStringW
FindFirstFileExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
WriteConsoleW
GetTempFileNameW
InitializeCriticalSection
TryEnterCriticalSection
InitOnceBeginInitialize
InitOnceComplete
FormatMessageW
GetVersionExA
CreateEventA
SignalObjectAndWait
TerminateThread
QueueUserWorkItem
LoadLibraryW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateFile2
LocalAlloc
lstrlenA
ReplaceFileW
GetNativeSystemInfo
InitOnceExecuteOnce
DebugBreak
ReleaseSemaphore
CreateSemaphoreA
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
SetThreadPriority
GetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
ExpandEnvironmentStringsW
GetFileInformationByHandleEx
SetConsoleMode
GetSystemDirectoryW
GetWindowsDirectoryW
VirtualQuery
GetComputerNameW
GetProcessAffinityMask
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetVersion
GetLocaleInfoA
GetThreadLocale
AllocConsole
AttachConsole
LoadLibraryA
IsDBCSLeadByteEx
SetEvent
ResetEvent
ReadConsoleInputA
PeekConsoleInputA
GetConsoleWindow
DeviceIoControl
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateEventW
WaitForMultipleObjects
GetExitCodeThread
ReleaseMutex
CreateMutexA
CreateFileA
TlsFree
RegisterWaitForSingleObject
UnregisterWait
SetFileAttributesW
GetTickCount
GetFileTime
GetModuleFileNameW
GetModuleFileNameA
FreeResource
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GlobalMemoryStatusEx
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
QueryPerformanceFrequency
QueryPerformanceCounter
PeekNamedPipe
CreatePipe
SetErrorMode
GetLastError
SetHandleInformation
CloseHandle
SetFileTime
SetFilePointer
SetEndOfFile
ReadFile
GetShortPathNameW
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileInformationByHandle
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
GetEnvironmentVariableW
WideCharToMultiByte
Sleep
SetConsoleOutputCP
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
user32
EnumDisplayDevicesA
IsClipboardFormatAvailable
EmptyClipboard
GetClipboardData
IntersectRect
CloseClipboard
OpenClipboard
GetDC
MessageBoxA
ReleaseDC
SystemParametersInfoA
LoadStringW
MsgWaitForMultipleObjectsEx
FillRect
PeekMessageA
InflateRect
PostMessageA
IsWindow
SetClipboardData
advapi32
GetSecurityDescriptorGroup
RegEnumValueW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegNotifyChangeKeyValue
RegDeleteValueW
RegCreateKeyExW
GetFileSecurityW
RegQueryInfoKeyW
RegEnumKeyExW
GetSecurityInfo
RegGetValueW
RegLoadMUIStringW
RegOpenKeyExW
GetUserNameW
LookupAccountSidW
GetSecurityDescriptorOwner
RegSetValueExW
vcomp140
omp_get_thread_num
omp_destroy_lock
omp_get_max_threads
omp_unset_lock
_vcomp_reduction_r8
_vcomp_leave_critsect
_vcomp_atomic_add_i8
_vcomp_for_static_end
_vcomp_for_static_simple_init_i8
_vcomp_for_dynamic_init
_vcomp_for_dynamic_next
_vcomp_for_static_simple_init
_vcomp_atomic_add_i4
omp_set_lock
omp_init_lock
_vcomp_set_num_threads
_vcomp_fork
omp_set_nested
_vcomp_for_static_init_i8
_vcomp_for_dynamic_next_i8
_vcomp_for_dynamic_init_i8
_vcomp_single_end
_vcomp_single_begin
_vcomp_barrier
_vcomp_enter_critsect
ws2_32
htonl
htons
getservbyname
WSASetEvent
WSAEventSelect
WSAEnumNetworkEvents
ntohs
ntohl
accept
bind
closesocket
connect
listen
WSASetLastError
recv
send
setsockopt
socket
WSACreateEvent
WSACloseEvent
getsockopt
ioctlsocket
inet_ntop
WSAStartup
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
inet_pton
WSACleanup
freeaddrinfo
getaddrinfo
WSAGetLastError
getservbyport
gdiplus
GdipGraphicsClear
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromFile
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImageHorizontalResolution
GdipLoadImageFromFileICM
GdipGetImageVerticalResolution
urlmon
URLDownloadToFileA
gdi32
GetClipRgn
GetGraphicsMode
IntersectClipRect
SelectClipRgn
ExtSelectClipRgn
GetWorldTransform
GdiFlush
ExtTextOutW
GetObjectW
StretchDIBits
CreateFontIndirectA
EnumFontFamiliesExW
CreatePen
GetGlyphOutlineA
GetStockObject
Rectangle
Polyline
ModifyWorldTransform
SetWorldTransform
GetTextMetricsA
ExtCreateRegion
CreateCompatibleDC
CreateDCA
DeleteDC
DeleteObject
GetDeviceCaps
SelectObject
CreateDIBSection
CreateFontIndirectW
GetCharWidth32A
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsA
GetFontUnicodeRanges
GetGlyphIndicesW
RestoreDC
SaveDC
SetBkMode
SetGraphicsMode
SetMapMode
SetTextColor
CreateRectRgn
GetClipBox
BitBlt
CreateCompatibleBitmap
CreateSolidBrush
SetTextAlign
shell32
SHFileOperationW
SHGetFileInfoW
CommandLineToArgvW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ole32
CoInitializeEx
CoCreateInstance
CoTaskMemFree
msimg32
AlphaBlend
bcrypt
BCryptDeriveKeyPBKDF2
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptGenRandom
BCryptDestroyKey
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptCreateHash
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
dnsapi
DnsFree
DnsQuery_A
iphlpapi
CancelMibChangeNotify2
NotifyRouteChange2
GetIpForwardTable2
Name
.text
Size
22.3MB
Virtual Size
22.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6.9MB
Virtual Size
6.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
444KB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
950KB
Virtual Size
950KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=240, id=261, version=33145,
count=37, id=259, version=33145,
count=2, id=257, version=35721,
count=18, id=253, version=35721,
count=19, id=259, version=35721,
count=20, id=260, version=35721,
count=111, id=261, version=35721,
count=90, id=260, version=33145,
count=27, id=257, version=33145,
count=461, id=1, productName=Unmarked objects,
count=2, productName=Unmarked objects (old),
count=1, id=259, version=36260,
count=1309, id=260, version=36260,
count=797, id=261, version=36260,
count=1, id=255, version=36260,
count=1, id=151,
count=1, id=258, version=36260,
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/mime.xml
- SHA256 e7ca58e71b1e30cf2d18453e3fce2e266e3c85a090253f6d5a1d2ed2011b1c81
- MD5 8aa5c19d0920166ad8daf5d26e570dee
- SHA1 b064066742af87df5a60c64e643d572cdc7fe430
- SHA512 d6dff8b9e0e2bc12272ceb0d26b07a4e6ce9be8f1b232859bf42b60836cad92a9ec3b2bef82840db06bb55496f38cde0db820db9c310e50aefdf7aba03c200f5
- SSDEEP 768:kQ93tzbrNnGRedVLYtW46dIKznxepggDt1T9gZXPC3Wtf1ItY7D4CsmeL6yH:P91brN+cFZXwu7LKH
- TLSH T109D345922D41DC964AA7370FEF73C449A6B9D386850CCE91F4E6A6376503BD3487338A
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/policy.xml
- SHA256 0a0abfe60f9ba85c50660a998f9e9894c1f809bafaa91414f9cf0f1bc8d13138
- MD5 2c11b0b0c3b9cf2ea5c3e1079c16cef7
- SHA1 b8c1dacf6c96cad84d3348678350e30763b992ee
- SHA512 f9f891e1cf806aa935ea53e372bf767bdd3bf9c5df88e84b0b7b26e7968a83c9236559f9f89420f36f4d07c769be23ca8e9cd81ab3c6cfc8c086aa76fbeb268f
- SSDEEP 96:C4mrfOLAiwQR6KXS9ThQAjC6Ur8dFF3GOKkNGa2tdmIAdRphBNfijsQ9lRO:C4mrfOLCKXS9aj8FFW6NZAdmIAfpv6W
- TLSH T1EEF1DB098945BC320072234BBCA4A95FCBB2E4AB364C1CA034AD9A6D7FF735551BB5DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/sRGB.icc
- SHA256 83174717332326ddc198d9df188a4daec27b8979ba152cebbfc470c793d0bb11
- MD5 a3fe13b83e7cb992f9ecc60c21ed9722
- SHA1 3c3c6c65ab8b4ba09d67bcb0edfdc2345e8285dd
- SHA512 cba135c43b9b3090cd4ba483ab93dcbdf0cbabb7360037aa0d5c2a901637a040d2ceed5edde8abdc133575df94bab5ffd7002e7ea5f3365468bf814717848c05
- SSDEEP 1536:lSGnc9KG4wRNaSTK0xOXJqXWfmUhWJlIfskbFWBERijf:lSNUiBM2EulIk/f
- TLSH T1C953F112FB216EE8C87D23316CDEE74A9916D770B26B1B470728570E600E7AC1D1F993
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/sRGB_b64.txt
- SHA256 1f35aaebf6f6c7a9e47f8a0744693a9278aff5cf2a751b3b54701cc52c65e8b8
- MD5 a89b35369c824a5e47e0265201429d6b
- SHA1 64b42e32205654adb00685313fc9c5ce971f8421
- SHA512 2cc5d78cade15d73274dd4cff52d3e75b82a6b0894204060aa1eeaabecb7f569b33527863203703df46b25001b21e79f399a89f4bb53442c946685b8db77cb18
- SSDEEP 3072:8VkMOv7K4S3XfIlUmPwS+zSllKnY5LeK2v5FcC6Ceiv99ffHtAkgbeJ3i:U0w+l4S+zSllPeZ6CBTi
- TLSH T18AF32A2439FA901AB2B3EF525BD479DBDD6FB7333A06545D1081034A4A23E81EE9173E
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/thresholds.xml
- SHA256 068487187c65f8ba9963ee0d73b31261cde9cd255bf879edcb093241e1c6a36b
- MD5 f011459e118ffb6456ae96686786e7ce
- SHA1 09a5e65ff029178a06477c27e6d123b92f762707
- SHA512 6825233268d24ecbcb54f547592506dc1d16b0b4001837b765db01c26373366c7b24a5799ccfbb1a1f2211d871319c8d9c43f37f1db7b2d183968c6c8ccd52ce
- SSDEEP 192:iuXJDXv/ebr0Jfiyorr0KGJc3RfkvBEB6EUJMbnGog9ngQdGXGK4KufPjuX0MKI9:5J73eDyoX0KicNkvaQEwM639nglGKKQt
- TLSH T1323242640C8EA605863AC7901EA48389E337C31FD31C3C5D748E2A691F2FA167BE749D
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/type-ghostscript.xml
- SHA256 8cdd0a89929342e438d90b4b95b4417fc90737858cefc9161f454e0f7e1435b4
- MD5 378a34f7e42a6cdbb321974ecf3f75bf
- SHA1 f15657b946378fa987363dfe0b90c0437fdbbe52
- SHA512 2697636075d511bd9c2f03b127f8470974669c888ff65d5e64a2efcd89e2bc9c0895c243814711e4f0002fbd933090e2d1eb69e72203079e23477ab3b420c524
- SSDEEP 96:UGxOYArDJfVMNcA/fhM0kb+JZ7vdtCtLtCt9R32jH9CfCJGCGmY1A4A7r2Mrsm+M:XiRoSvlQ6TltMWz
- TLSH T100129C949D2C9CCE817F0357B64CA9A24B4DF6F2DB2CBC1278E49C7256494B4A80372F
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/ImageMagick-7.1.2-34-portable-Q16-x64/type.xml
- SHA256 ba4160241fb0fff29563b40430b24f5d993cd5f1e423f85ee99c17749901c8ad
- MD5 59db9fddfcd6fb9f80bb6fec1f219c48
- SHA1 f66e9eac2cbdcc55819f6019f79167eba0f4a6df
- SHA512 38307ef4c4faa6c3d6aa2d9fdad071d21a977b7e5978007c279317997ebe3bf29d734da85b6767667f490b0fbf865737f5bd0978a27ebd962df4469ec730a7d0
- TLSH T16501DAE84848DC0623324A723F8CB0A8A52EF2722E453E6C10D65C3B795F4999C0AF53
- MD5 SHA1 SHA512 TLSH
Bat2EXE/AppData/PS2EXE/PSGetModuleInfo.xml
- SHA256 78c165d74a056cffebafd7318d4fff57c5f0a7d82ab580f3e9931612c23705ad
- MD5 c85a8d8a262eed5386d1a81a5f1c15b7
- SHA1 5d3bff54314580af451769f2050a5788b221c05b
- SHA512 5d67960149b43d5ee56858722d18f46d445cd80e1803c6a6a193851ad25a14279d8a70809204c083223940af73a9be53857f0100c24f6c99e4cef6f0273a3567
- SSDEEP 384:dbm6UF87D/z8qFzETWeYDU3FzETWeYDhM:w6U87D/zPAWRDUZAWRDm
- TLSH T186A2E4066BFB0104B1B2AB1C6AF510A30E777DD1BC34969D419C1B0F8BA3D519BA1F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/PS2EXE/Win-PS2EXE.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9c6eafbb809c6c5135629cf43c9ac5e9380661a759b9eab0e1d0bcde3e7bd83a
- MD5 88b3fa04b870d39cf0a1d8cb60697a09
- SHA1 233441b0d4b88b30f8c3da6d6934b290f3b8e290
- SHA512 27141624ee0d35e3926b8bbf6eca6084908b54581c1eb40ba148ff2a69b85ea35c021dc8603e1c450719fbfd350e19e571390a5380802e7f99c15b0af3babe79
- SSDEEP 1536:kXjTikUWSTBCmVvkDNYtKgdkRYCR3hRkNRqFRRkmF+rbCa5G2NfAo:QfikUWSTBCmVvkDNYtKguRYCR3hRkNR0
- TLSH T10F53AA0367FA0108F1F26A78A9B654704A77BD52593CC56D11AC3D0E9BB3E828952FF3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
58494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Bat2EXE/AppData/PS2EXE/ps2exe.ps1
- SHA256 94613e703fa2ec67a01255e5917a056a9406fd31c557685b7ae76417f706a09a
- MD5 e71d46e4f523ed9db904a5e2d6cf0a75
- SHA1 e70bf03fa878062b085a5eb776119d8e6b6cf4f9
- SHA512 4672cbef31ebb5469465373fd9aaeddd73e25c098e9573d740f755190d5be6c3ef151c8e1999c407e6bb0015e4a325ef85cb9077f11312ebd9b9785da357bab1
- SSDEEP 1536:P6nDvbhx+6WsQofhNz1A3wOaxMOw5dxXgM+qyyD9:IvbhUShNz15OaxMOw5dxX8yJ
- TLSH T12CA3FA61FB8E816E4E83205A9976968ADF3FD172503E65F6F8CD0968F29040C43787F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/PS2EXE/ps2exe.psd1
- SHA256 385d548833bab9599ad8f6b936f695a2f107fe172a4f9b411819223563573ba3
- MD5 62f75adad17f0fef620c4ce6f6807703
- SHA1 1694b0b1dc714bdcfcf18452e06b6df32f2aeeb7
- SHA512 b9c815e5431d3e61847603df66d2dda7a1edcc53c4d976a98ace5d9677e8b87140835f1e7d540d590624fe61d866a637f9928701a92e6277ffd52c385b7acc63
- SSDEEP 96:PVQCG/gQatlU8DU8npfwCmqDR3iCatimn+QAnlCjLsjt96Ilf:PuCG/gQaWaR3Q98wS6Ilf
- TLSH T129D196691BFAB213157E00C3FA16D23567DA8074737A9752B45C81DC2282D38C7DAA7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Bat2EXE/AppData/PS2EXE/ps2exe.psm1
- SHA256 e27da8205a1281e0089dbb06036eeaa9568d22c4a26edc0cff66234efe9a735b
- MD5 3f3f8980072e1fe9ad3a7bf84a9efeca
- SHA1 0d00dfebfa26b07b8a4c6e635e26f1c3d811bb46
- SHA512 f65712fa7b6050ada46be59808ad1dc0aeac8bde9d873c813def6ef6ead2b5a90a6d544f86731c06a3cb5198c3c35005ecb688d0e9b07eee915c27be0cc65896
- TLSH T1F1019E9ADA2FB395F46A49BFF032D84B5A83F191657ECC95380887EC4112EFCD5E6048
- MD5 SHA1 SHA512 TLSH
Bat2EXE/AppData/application_bootstrap.bat
- SHA256 01e0e1dfb22d10e53f5547a3163419cd9c1df27aa9f041764324cab6b37bb37e
- MD5 52364312cf551fed09aa3d12238004ea
- SHA1 3c7c5155ad7d308ba34f5a84ba38ed4d58ca9a5e
- SHA512 f7cf3bb52d1ad2bdd5047bae870f029bf6a5a87d333735f6df5befb06b68b291aa477a7b61c2fb74b8f3dab5f631123bb69617bd07d856f55b5bf9839e8021b5
- TLSH T191B09B41B515E34815668C6F10D7D57C182E91417301C546743146B97C05715CA64285
- MD5 SHA1 SHA512 TLSH
Bat2EXE/Bat2EXE.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7df5c1bbfc00cb62b4e0ad3137fea54e4903b16fd82a67102c1d8d69eb03c243
- MD5 e1f9dd15c7e869f8e5b2cf15edb8692b
- SHA1 164f53172aac292158a52798c7a003c0c21d205d
- SHA512 897f43dbf2b43b95b92f9ff6e1e05fd77eec01dc7d4a92af6e2475448c14a1b868acdaf0ae55a916f7de2514158ad3389754c62128a0f7f0a8a8502db456a786
- SSDEEP 768:QmQZqx1lYcTYbFGLbiLL+dcE7fzuTAH6eyXbYC1iSsgUZmuA:Q0lY8UyZwIGbbsgU7
- TLSH T1F5A394A2EB588D35F01F89BE7921525A103BDDB240C5D7852DADD5AE28B7B4210F0F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
39278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ