Black Worm v4.1 Expert Edition.7z
- SHA256 d945e86205e708b0cbcbd101e4309a5e6fda3e2e65c274c00dde8c9cee1edcd1
Password
infected
Static task
static1
4 signatures
General
- Target Black Worm v4.1 Expert Edition.7z
- Size 1.9MB
- Sample261102-yzs1pacz9t
- SHA256 d945e86205e708b0cbcbd101e4309a5e6fda3e2e65c274c00dde8c9cee1edcd1
- MD5 7155559229df2ebe7edb820932efa05e
- SHA1 d23d9989080fb80492558e472fab51951b88bd1b
- SHA512 a1a5c7362c8008d037c8543a47660df09c7e6dabaae566766425a16289f2ea0ad12e22c7e2d89ffea677c9e9f219ea2ea1c2282f81a2e2b493808461670e47cf
- SSDEEP 49152:GNQLbphiIXEQwmuep8qL1IGQ/fAi+mzGv0GabP/k3ANbDQktSRNXZ:GNuyyBwi8qL1IGQwazGTarkA1DQVJZ
- TLSH T1C49533482D82DA1E7D76631BF64A59F78E46CF2CD1447AA2C904397F34DE606E039BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 9 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/Black WorM v4.1 Expert Edition By Black.Hacker/plugin/pwd.dll Nirsoft static1/unpack006/pwdPlugin/WindowsApplication42/Resources/ProduKey.exe Nirsoft static1/unpack006/pwdPlugin/WindowsApplication42/Resources/WebBrowserPassView.exe Nirsoft static1/unpack006/pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.dll Nirsoft static1/unpack006/pwdPlugin/WindowsApplication42/bin/Debug/pwd.exe Nirsoft static1/unpack006/pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.Resources.resources Nirsoft static1/unpack006/pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.exe Nirsoft static1/unpack006/pwdPlugin/WindowsApplication42/obj/Debug/pwd.Resources.resources Nirsoft static1/unpack006/pwdPlugin/WindowsApplication42/obj/Debug/pwd.exe Nirsoft - NirSoft WebBrowserPassView 8 IoCs
Password recovery tool for various web browsers
resource yara_rule static1/unpack001/Black WorM v4.1 Expert Edition By Black.Hacker/plugin/pwd.dll WebBrowserPassView static1/unpack006/pwdPlugin/WindowsApplication42/Resources/WebBrowserPassView.exe WebBrowserPassView static1/unpack006/pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.dll WebBrowserPassView static1/unpack006/pwdPlugin/WindowsApplication42/bin/Debug/pwd.exe WebBrowserPassView static1/unpack006/pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.Resources.resources WebBrowserPassView static1/unpack006/pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.exe WebBrowserPassView static1/unpack006/pwdPlugin/WindowsApplication42/obj/Debug/pwd.Resources.resources WebBrowserPassView static1/unpack006/pwdPlugin/WindowsApplication42/obj/Debug/pwd.exe WebBrowserPassView - Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack001/Black WorM v4.1 Expert Edition By Black.Hacker/Black Worm.exe unpack001/Black WorM v4.1 Expert Edition By Black.Hacker/Mono.Cecil.dll unpack001/Black WorM v4.1 Expert Edition By Black.Hacker/plugin/desktop.dll unpack001/Black WorM v4.1 Expert Edition By Black.Hacker/plugin/pwd.dll unpack006/pwdPlugin/WindowsApplication42/Resources/WebBrowserPassView.exe unpack006/pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.dll unpack006/pwdPlugin/WindowsApplication42/bin/Debug/pwd.exe unpack006/pwdPlugin/WindowsApplication42/obj/Debug/TempPE/My Project.Resources.Designer.vb.dll unpack006/pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.exe unpack006/pwdPlugin/WindowsApplication42/obj/Debug/pwd.exe unpack001/Black WorM v4.1 Expert Edition By Black.Hacker/stub.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack006/pwdPlugin/WindowsApplication42/Resources/ProduKey.exe
File Explorer
-
Black Worm v4.1 Expert Edition.7z.7z 1.9MB
-
Black WorM v4.1 Expert Edition By Black.Hacker/Black Worm.exe.exe 864KB
-
Black WorM v4.1 Expert Edition By Black.Hacker/Mono.Cecil.dll.dll 305KB
-
Black WorM v4.1 Expert Edition By Black.Hacker/plugin/desktop.dll.exe 11KB
-
Black WorM v4.1 Expert Edition By Black.Hacker/plugin/pwd.dll.exe 434KB
-
Black WorM v4.1 Expert Edition By Black.Hacker/pwdPlugin.rar.rar 1.6MB
-
pwdPlugin/WindowsApplication42.sln916B
-
pwdPlugin/WindowsApplication42.v11.suo32KB
-
pwdPlugin/WindowsApplication42/Module1.vb860B
-
pwdPlugin/WindowsApplication42/My Project/Application.Designer.vb441B
-
pwdPlugin/WindowsApplication42/My Project/Application.myapp469B
-
pwdPlugin/WindowsApplication42/My Project/AssemblyInfo.vb1KB
-
pwdPlugin/WindowsApplication42/My Project/Resources.Designer.vb.vbs 3KB
-
pwdPlugin/WindowsApplication42/My Project/Resources.resx.vbs 6KB
-
pwdPlugin/WindowsApplication42/My Project/Settings.Designer.vb.vbs 2KB
-
pwdPlugin/WindowsApplication42/My Project/Settings.settings279B
-
pwdPlugin/WindowsApplication42/Resources/ProduKey.exe.exe 79KB
-
pwdPlugin/WindowsApplication42/Resources/WebBrowserPassView.exe.exe 343KB
-
pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.dll.exe 445KB
-
pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.pdb31KB
-
pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.vshost.exe.manifest490B
-
pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.xml1KB
-
pwdPlugin/WindowsApplication42/bin/Debug/pwd.exe.exe 444KB
-
pwdPlugin/WindowsApplication42/bin/Debug/pwd.pdb31KB
-
pwdPlugin/WindowsApplication42/bin/Debug/pwd.vshost.exe.exe 20KB
-
pwdPlugin/WindowsApplication42/bin/Debug/pwd.xml942B
-
pwdPlugin/WindowsApplication42/obj/Debug/DesignTimeResolveAssemblyReferences.cache789B
-
pwdPlugin/WindowsApplication42/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache6KB
-
pwdPlugin/WindowsApplication42/obj/Debug/TempPE/My Project.Resources.Designer.vb.dll.dll 7KB
-
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.Resources.resources422KB
-
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.exe.exe 445KB
-
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.pdb31KB
-
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.vbproj.FileListAbsolute.txt1KB
-
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.vbproj.GenerateResource.Cache883B
-
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.xml1KB
-
pwdPlugin/WindowsApplication42/obj/Debug/pwd.Resources.resources422KB
-
pwdPlugin/WindowsApplication42/obj/Debug/pwd.exe.exe 444KB
-
pwdPlugin/WindowsApplication42/obj/Debug/pwd.pdb31KB
-
pwdPlugin/WindowsApplication42/obj/Debug/pwd.vbproj.FileListAbsolute.txt954B
-
pwdPlugin/WindowsApplication42/obj/Debug/pwd.vbproj.GenerateResource.Cache883B
-
pwdPlugin/WindowsApplication42/obj/Debug/pwd.xml942B
-
pwdPlugin/WindowsApplication42/pwd.vbproj4KB
-
Black WorM v4.1 Expert Edition By Black.Hacker/stub.exe.exe 41KB
-
Black WorM v4.1 Expert Edition By Black.Hacker/stubSRC.rar.rar 125KB
Black WorM v4.1 Expert Edition By Black.Hacker/Black Worm.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 72a7a0918a9a352ae1e81ec88eb40cf281454258920343f3ff49d5f638194bc7
- MD5 01f5ca95bf85f4a33ad6fef9ad879079
- SHA1 3965db258dd7f730bd3345feec23e4f5c3bedfa2
- SHA512 69c4c6fb5e72352e9af8537b54368f9d06beb9ffc8b51c59c7446b26c95fa0c35bfa161b03c33ef6132ff57d41fedd65f241cab5ff9b0ea7389713e869e6ba83
- SSDEEP 12288:O2gjnGg7zBnAoAiR48OyJ+Sriqs9EL5QIyTTH2gTn:SFxFRAqsT/
- TLSH T1921570037B85FD28C53855F9B2805FD4A20B1F5D9A758AFA68457F7630E26C038EA7C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infuced
Minor OS version
0
Major OS version
4
Entry point
746046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Black\Desktop\‫jnRAT\jnRAT\obj\Debug\Black Worm.pdb
mscoree
_CorExeMain
Name
.text
Size
721KB
Virtual Size
720KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
115B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Black WorM v4.1 Expert Edition By Black.Hacker/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infuced
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Black WorM v4.1 Expert Edition By Black.Hacker/plugin/desktop.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6190cd96949a84f411716d291f6b462f2a79012bce3105482af4acbef4214115
- MD5 632282e9cb99a6f8b9e2a94cc5b77e00
- SHA1 eafdf510252dc85cd57c13ada3c900d6d7841870
- SHA512 3d3e095266bd2f295436b7e8b72e729350e2f818a7316403771c52f6e7220d67739948c8e5ba9a936f6ff2f0b8ee402ba1b619ece14b927dfa0fed9a0cf085b9
- SSDEEP 192:XvCyJgs40B3A8O67KZmKnloYk46XNIDLRLtlPpk:XvVS0BfaW46d+LR7R
- TLSH T113321B366780C676CE7D0FB24CA399900775C306C647BB3F68D8A9365BE325A4B63631
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infuced
Minor OS version
0
Major OS version
4
Entry point
16382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\black\documents\visual studio 2012\Projects\desktop\desktop\obj\Debug\desktop.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Black WorM v4.1 Expert Edition By Black.Hacker/plugin/pwd.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 744dec77f62db44ebb1c86a68591cd0018d7ade737d3bcd3a3af63dcaa069986
- MD5 93f138ddb534d7188e11deee4290ebf3
- SHA1 8ec7a1541625129f438f2cb7ca1b393f7eb4d25f
- SHA512 597eec6cedb5ce2b86569f4f9e71de044141c1f745d29b042a52607a5487d429e54fee9c8d4a1dc711dac8e6d00649cb237d7c7e1a8c1869ce260ec215d42a4b
- SSDEEP 6144:GD+B3TFdbbkIVYwKclE2rl4yQt15xk62c+IyaLLqcVpVAt1Mkihs:GqB3TH3uLArUQy+Iyofnkd
- TLSH T192949E13B3E18036E4B7057016BB4B329EFDB9305539C95B97D42D49AEB02D1EA3A34B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infuced
Minor OS version
0
Major OS version
4
Entry point
449294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\black\documents\visual studio 2012\Projects\WindowsApplication42\WindowsApplication42\obj\Debug\pwd.pdb
mscoree
_CorExeMain
Name
.text
Size
431KB
Virtual Size
430KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Black WorM v4.1 Expert Edition By Black.Hacker/pwdPlugin.rar
- SHA256 779c4e74ca339642d0f651b4c2ae3e8513b42bd7e58e73b50ffba98e5f8fdbc4
- MD5 a7eb3785f0a3b35e24ca55fcccfb2c5c
- SHA1 224c9b965fe4020c2c882e7a5451bb7c82ca2964
- SHA512 333f5f615b8ad38d3fab6a5405e28387bd02350a9a89c5693a0d6b21076b10ad6a992fbecf6100dabd56a6af3b73ab50e568860df6443bf5a91b9ce6febc6e4a
- SSDEEP 49152:edjfhI0nzGgcEi9T11+eSsxVjL21sxYhV+ZG:edjJI0KEih3bNVjq+YWE
- TLSH T15275335DCE363A84F2BAEF3016387768B11ECB2276FF9C618E098C31AA8D74127545D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infuced
pwdPlugin/WindowsApplication42.sln
- SHA256 de2b2551cb177b7d37d43b8ffd009574972dd689163cf0a083104c05aa1b5fe6
- MD5 2ffc532370298a278f7a575118797f25
- SHA1 a3f3e1ae9b0f7f628655d9e2aebe6351da7df818
- SHA512 acfc7402c2d4b0899e528289e7112e3049220f10b47304fdf372549a0f16221854e785af186e8378e8b0bffe80c49490249805991766bfe4ebcfcc45ff114116
- TLSH T1DE1129D910095CA07D86235F92F62CD23E334191C69E4D7C094D64AC6F1F9D4547698F
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42.v11.suo
- SHA256 938636628cf31819fb852c8f46a0897e513e201c33ea9ca83f152c5dcd84f515
- MD5 7cd184ac40ec4c3a26e8ec65ec2d5624
- SHA1 57ae9b34c063631c9e77662568376000c3f33c7d
- SHA512 85ca9afbf4c70f81a988bd2fed34c33f5d09c38649ffd8456816049065bb719e41c6859122fb43f9ab8c05a70b33a38931443b79facaa4562526647e49908d76
- SSDEEP 384:1ZMkIEt32QVjE/GT4UiVbEId2QVjE/GT4UiV:1GDEt3VVjE1jdVVjE
- TLSH T144E2231532F88244F3F38F7AADF6E6951876BC26AD51C29E2290734E0931E41DD71B27
- MD5 SHA1 SHA512 SSDEEP TLSH
pwdPlugin/WindowsApplication42/Module1.vb
- SHA256 1460025ac1d67cee33b8d8f9c1a5bd9a80316845aa3a05b3e0f7aefe66db767e
- MD5 65efdc2401f71d347042c47b25cb3fe7
- SHA1 071538057edd244922f674fe8eb566eba0a82d51
- SHA512 c273f1c64049bf2149fc103ccf86fa7dc1929090f7bf64b6b110087ce1dad7fcc07a4bb3c72600ca8365be86023465c81f9c4e4228e09332fdca9d71c1818e08
- TLSH T1B2116682E12D0720E5B8099634B866C4F5F1936BAECD041A39AE12AD8BF4C3827D43CD
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/My Project/Application.Designer.vb
- SHA256 a813d89eb4e79d8956f945c84e49d8784ecbd36ec692d4dc05e1154d2e487823
- MD5 9ab4249ffdd29aa630e238acaec1aa17
- SHA1 79d141dc99f455bf4930be382958a398431057ed
- SHA512 f47220362285b432b4870dce6cbc114fc95b22e5a01efa09b1589e454097601ceed946a8bf7d126b1636bdfb6b6f961429e32a8dd8fabfd2b660cc8a0abd59c9
- TLSH T165F02B711C85AA3191B2C1C1210BC921C576B2CECE95CD7B3D4E9B4FEB2461D911C9D4
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/My Project/Application.myapp
- SHA256 e69372cea4393f112c90992c3b642885974295cb5e7480b15b17ddfa2a9f74aa
- MD5 8f82544887e61248a31c46ecc6abe31c
- SHA1 c47948c2c9f24ab1638ebaefc91591ee060ff6a2
- SHA512 797dbdede2ecb1cbb742d654ec921f36c90164dbacde4aa22579d84ac84e99e5106944044c082ff2c28724a1e62f175e46e3af9fb45d4d83a817f76e6f4e9b9a
- TLSH T101F05C4C43D0143486E1D676F578C98925A3E6388BF4CCA8B8E05DCE624004922C398F
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/My Project/AssemblyInfo.vb
- SHA256 d09512123dd7e928b14fde6e6144a43fdd0c83ea5a4611a6977db428cd012ea6
- MD5 ec379db64db0c8b055b5dc2094e73d28
- SHA1 2abb62642526f38e93ff558ac05409238c158871
- SHA512 c58ed6700414ffe174c533b6e95fb313e6475fb7f23591fbe0bc75e492c874c4e3d7b3f627f890abe4cafac039df5861163fdd1fc375fe1dddac36774158ffe7
- TLSH T1E22125E18642F7690F620193AE6FB194427C4324A3E50D6A3C687867D652E7C02B15EB
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/My Project/Resources.Designer.vb
- SHA256 0dd6225975fe634273b60910f4631275daf56e25460bf939df64f2c1a8705061
- MD5 29b0c952ca9142f220f034997229cb0e
- SHA1 a8497a94a91aff0bc0271f28aecbdfcfaef4222b
- SHA512 c9907c1100a7301e36ec7b6258b5493302c449cd667c2ac1ef1620fed9a1800a55817b6e264b7ecece5daf24589c87253a1bd972c46e16089599f2ff50037684
- TLSH T12A71A8B71F8E84311472DC872A05B052C9A101A3C53C6DA9F9DE41EA8FF2384077EEB2
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/My Project/Resources.resx
- SHA256 f28670cce428b9896c59ac8f4c5706fc986f43a73af8c802c1566ce4a54eaaae
- MD5 c80a437f6eace3f25b68a6e77e38853f
- SHA1 945256b0128742be6212ee5a49aeb04f26f21b75
- SHA512 00673e94f3fd1b0f6cfc08e5779125d5e80d26cbffea2b763421f981b40ab40d86d1aadf34ae80bd3d27b92d6203096aecf88c007250277780d2b6a4f7808262
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3Fqv2LiW3il:KjrbLPD9sLvIzSvKgIqUya27l
- TLSH T121D14344B1C5DD220BB3482CD6527984F7A8823B02356C40B4EC661FAF73986A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
pwdPlugin/WindowsApplication42/My Project/Settings.Designer.vb
- SHA256 962af90639baa2e11c61f9ff5529a7f1ea7ac0c88b53e3cc1d1eed6b792676e3
- MD5 8a09a2c25d46f83f584e6602c27ed561
- SHA1 5748e4d13516f2147aaaf5d90a5cc7825b72a111
- SHA512 3f14f54e31a3d05b9120e62bcac31b60bbd7ca29b5f62f9e2ab12ba967b573f7c70b6fb73dfbb21aaa13a2cc4d222e63abd95cad6e5dd656a43a7c2506f6a27c
- TLSH T1EF51EDBE2F49A67D1571DE85DB0AB553CEB002A78A1D7CB0718C21C9CF3668413BDA60
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/My Project/Settings.settings
- SHA256 aee1c3cda12a474a7a8ead292418eb734cde3c4a74a4977e0bb0ed160613a1eb
- MD5 4a12ce12282d0ee237b12e7513037c50
- SHA1 9a820bef12266f5e641770f44af881f9517f5222
- SHA512 c8229ffec5e3a2df33855a22f53fade99c88e7c92404c35529d2168ef21597de0477164fb888da7192fb3745d47980fa4e8a6259485dfe5a34b481ddd780a432
- TLSH T189D0A789A4C88C0A93317AB0F4ACE33C95146767856E9974B2743C4F19071D61AD75EB
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/Resources/ProduKey.exe
- IMPHASH bb3cb68609cba2be12b5cb405eec13fc
- SHA256 33da091e5a972e184d0ad313398d7ee52afbcee5f5ba8af8f871ec9850a5a5ea
- MD5 24ce2a2f94f0fe572973f5389bedaaeb
- SHA1 0cb2e3a4e662a57264d588440b303054e5c17516
- SHA512 e724cf8b66a0a890b63598a156ad743556a616702854687b3b8655622fd9df0878eca66f72397fb7f6a4d60d466f961e319fb68a76ab0c47f725ed94a8e22810
- SSDEEP 1536:g59/+iBjsB7ySvVkVoJE436SXKQmcfPo2GGeeTLW7R:gnSQbVoJBXKQTGGeeW
- TLSH T148835C03B6D04472E6E3157019B2DB229EFAFC316538D91FA7566E8B6CB06C0DE2534B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infuced
PE Signature issue
Digest
f4:fd:e8:7c:38:35:d8:cc:72:30:8e:46:c1:74:5a:02:41:df:1b:11
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Jul 28, 2015
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 5, 2015 - Dec 31, 2015
Subject
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 24, 2011 - May 30, 2020
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Issuer
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 12, 2014 - Sep 12, 2019
Minor OS version
0
Major OS version
4
Entry point
51168
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Projects\VS2005\ProduKey\Release\ProduKey.pdb
mpr
WNetCloseEnum
WNetOpenEnumA
WNetEnumResourceA
msvcrt
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_purecall
qsort
_strlwr
_itoa
_XcptFilter
strtoul
strchr
_memicmp
malloc
free
??3@YAXPAX@Z
??2@YAPAXI@Z
atoi
_exit
__dllonexit
_c_exit
_onexit
strcmp
_strnicmp
_mbsicmp
_stricmp
_strcmpi
memcpy
strrchr
strlen
atof
memcmp
strcpy
memset
strcat
strncat
sprintf
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
comctl32
ord6
CreateToolbarEx
ImageList_SetImageCount
ImageList_Create
ImageList_AddMasked
ord17
ImageList_ReplaceIcon
ws2_32
gethostbyname
WSAStartup
WSACleanup
WSASetLastError
htons
WSAGetLastError
connect
WSAAsyncSelect
gethostbyaddr
closesocket
kernel32
OpenProcess
ResumeThread
ReadProcessMemory
ExitProcess
GetCurrentProcessId
SetErrorMode
DeleteFileA
GetStdHandle
GetPrivateProfileIntA
EnumResourceNamesA
WritePrivateProfileStringA
GetStartupInfoA
GetTimeFormatA
CreateThread
GetModuleFileNameA
GetFileAttributesA
MultiByteToWideChar
FindFirstFileA
WriteFile
GetDateFormatA
GlobalUnlock
GetWindowsDirectoryA
GetFileSize
LoadLibraryExA
FormatMessageA
CreateFileA
FindNextFileA
GetSystemDirectoryA
WideCharToMultiByte
GetPrivateProfileStringA
Sleep
GetCurrentProcess
CompareFileTime
FileTimeToLocalFileTime
GetLogicalDrives
GetComputerNameA
GetDriveTypeA
LoadLibraryA
FreeLibrary
FileTimeToSystemTime
GetProcAddress
GetModuleHandleA
GlobalAlloc
GetLastError
GetVersionExA
CloseHandle
GetTempFileNameA
GetTempPathA
FindClose
LocalFree
GlobalLock
ReadFile
user32
DispatchMessageA
GetWindowTextA
GetMenuItemInfoA
EnumChildWindows
DestroyMenu
RegisterWindowMessageA
DialogBoxParamA
DestroyWindow
ModifyMenuA
CreateDialogParamA
LoadStringA
LoadMenuA
GetFocus
KillTimer
EndDeferWindowPos
TrackPopupMenu
PostQuitMessage
GetDlgCtrlID
GetSubMenu
DeferWindowPos
GetMessageA
IsDialogMessageA
BeginDeferWindowPos
TranslateMessage
SetCursor
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
LoadCursorA
EndDialog
GetDlgItem
CreateWindowExA
SetDlgItemInt
SendDlgItemMessageA
GetDlgItemInt
SetDlgItemTextA
GetDlgItemTextA
SetWindowTextA
MessageBoxA
GetWindowPlacement
SendMessageA
GetWindowRect
RegisterClassA
UpdateWindow
GetSystemMetrics
PostMessageA
SetMenu
LoadAcceleratorsA
SetWindowPos
DefWindowProcA
TranslateAcceleratorA
LoadImageA
LoadIconA
GetWindowLongA
SetWindowLongA
InvalidateRect
SetFocus
SetClipboardData
EnableWindow
MapWindowPoints
EmptyClipboard
EnableMenuItem
GetClassNameA
GetClientRect
ReleaseDC
CloseClipboard
OpenClipboard
GetParent
GetMenuItemCount
GetMenuStringA
GetMenu
MoveWindow
GetCursorPos
GetDC
CheckMenuItem
GetSysColor
SetTimer
gdi32
GetTextExtentPoint32A
SetBkColor
GetStockObject
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
GetDeviceCaps
comdlg32
GetSaveFileNameA
FindTextA
GetOpenFileNameA
advapi32
RegOpenKeyExA
RegEnumValueA
RegLoadKeyA
RegCloseKey
RegQueryInfoKeyA
RegConnectRegistryA
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA
RegUnLoadKeyA
shell32
ShellExecuteA
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ole32
CoUninitialize
CoInitialize
Name
.text
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=2, id=25, version=9210,
count=21, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=277, id=1, productName=Unmarked objects,
count=24, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
pwdPlugin/WindowsApplication42/Resources/WebBrowserPassView.exe
- IMPHASH bc0eede5fb8e94465221a7599820d41e
- SHA256 7d005098e2d422ac97a3d0497f0c4238d9fdcbb4cf3fdc3264cd784e66485806
- MD5 e8151c3940b5fa3e788d4ba14e7a8dc0
- SHA1 6e7ab63b1dfaaac4b4ec27684fa0e1ca5c2b1963
- SHA512 5823460ca60d62e472ff11fd307c182c5d30114953e09cd182a7aab2b2331f88e9984ec3c95a42d4697d10be2b3dff953517066a018de635cf81630f3bf2d5a3
- SSDEEP 6144:hdbbkIVYwKclE2rl4yQt15xk62c+IyaLLqcVpVAt1MkihR:r3uLArUQy+Iyofnke
- TLSH T12474AE13B3E28036E4BB0130166B5B32EEFD7A301635895797D41C49AEB06D1FA3A75B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infuced
Minor OS version
0
Major OS version
4
Entry point
276156
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Projects\VS2005\WebBrowserPassView\Command-Line\WebBrowserPassView.pdb
msvcrt
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
wcscat
__set_app_type
_controlfp
strftime
qsort
_itow
_strlwr
_wcsupr
_wcslwr
_initterm
wcsncmp
memmove
malloc
free
modf
_memicmp
wcstoul
_XcptFilter
_wtoi64
strcmp
strcpy
wcsrchr
__wgetmainargs
_wcmdln
exit
strchr
_cexit
_wcsnicmp
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
wcslen
wcscmp
abs
log
_purecall
_wtoi
_wcsicmp
wcschr
memcpy
wcscpy
memset
strlen
wcsncat
_snwprintf
_except_handler3
_exit
_c_exit
_onexit
__dllonexit
memchr
realloc
_gmtime64
comctl32
ord17
ImageList_Create
ImageList_AddMasked
ImageList_SetImageCount
ImageList_ReplaceIcon
CreateStatusWindowW
CreateToolbarEx
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
wininet
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
kernel32
InterlockedCompareExchange
DeleteCriticalSection
GetFileAttributesExW
QueryPerformanceCounter
GetFileAttributesA
LeaveCriticalSection
SetEndOfFile
GetSystemInfo
Sleep
GetDiskFreeSpaceA
InitializeCriticalSection
GetFullPathNameA
DeleteFileA
GetDiskFreeSpaceW
UnlockFile
FlushFileBuffers
LockFile
GetTickCount
GetModuleHandleA
GetStartupInfoW
CreateFileA
GetFullPathNameW
AreFileApisANSI
EnterCriticalSection
GetSystemTime
LockFileEx
FormatMessageA
GetSystemTimeAsFileTime
GetTempPathA
UnlockFileEx
EnumResourceTypesW
LocalFree
GetFileSize
SystemTimeToFileTime
CloseHandle
FileTimeToLocalFileTime
DeleteFileW
CopyFileW
CreateFileW
WriteFile
WideCharToMultiByte
CompareFileTime
FreeLibrary
LoadLibraryW
GetProcAddress
GetLastError
FileTimeToSystemTime
SetFilePointerEx
GetCurrentDirectoryW
ExpandEnvironmentStringsW
MultiByteToWideChar
FindFirstFileW
GetTimeFormatW
GetModuleHandleW
SetFilePointer
GetFileAttributesW
GetWindowsDirectoryW
ReadFile
GetModuleFileNameW
LockResource
lstrcpyW
FindResourceW
lstrlenW
LoadResource
SystemTimeToTzSpecificLocalTime
GlobalAlloc
LoadLibraryExW
GlobalUnlock
GetTempPathW
FindNextFileW
SizeofResource
GlobalLock
GetFileTime
GetDateFormatW
FormatMessageW
GetTempFileNameW
GetVersionExW
FindClose
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
DuplicateHandle
GetCurrentProcessId
OpenProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetStdHandle
SetErrorMode
ExitProcess
ReadProcessMemory
SetCurrentDirectoryW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
user32
GetKeyState
EndDeferWindowPos
DispatchMessageW
BeginDeferWindowPos
TranslateMessage
IsDialogMessageW
DrawTextExW
GetMessageW
PostQuitMessage
TrackPopupMenu
RegisterWindowMessageW
CreateDialogParamW
ChildWindowFromPoint
LoadCursorW
SetCursor
GetSysColorBrush
ShowWindow
SetWindowTextW
SetDlgItemInt
UpdateWindow
SetDlgItemTextW
GetDlgItemTextW
GetClientRect
GetSystemMetrics
DeferWindowPos
CreateWindowExW
GetWindowRect
SendDlgItemMessageW
GetDlgItemInt
EndDialog
SetWindowLongW
GetDlgItem
InvalidateRect
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
SendMessageW
PostMessageW
RegisterClassW
MessageBoxW
TranslateAcceleratorW
SetMenu
SetWindowPlacement
LoadIconW
LoadImageW
GetWindowLongW
SetFocus
CheckMenuItem
GetMenuItemCount
CloseClipboard
GetCursorPos
SetClipboardData
GetParent
EnableWindow
GetSysColor
MapWindowPoints
GetMenu
GetDC
GetSubMenu
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
OpenClipboard
MoveWindow
GetMenuStringW
EnumChildWindows
DestroyWindow
LoadStringW
SetWindowPos
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DialogBoxParamW
gdi32
GetTextExtentPoint32W
SelectObject
GetDeviceCaps
SetBkMode
SetTextColor
DeleteObject
CreateFontIndirectW
GetStockObject
SetBkColor
comdlg32
GetSaveFileNameW
GetOpenFileNameW
FindTextW
advapi32
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
SHGetFileInfoW
ShellExecuteW
ole32
CoUninitialize
CoInitialize
CoTaskMemFree
Name
.text
Size
268KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=22, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=11, id=64, version=9210,
count=11, id=28, version=9178,
count=334, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=51, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 652796b03eb9154cd35df87e66a3cd4561ca9d3d0b4fcaface126632130fe3c3
- MD5 fdd3d394fc50b187d55c6e64d7d9524a
- SHA1 28806a22b6e5066a666f3f0aa4b878446530889d
- SHA512 f5ba4603cb423fe13223591261ce6094a39ee40c64e3d42af38ae47fef06e75447eaaecfdc72d773a64acba5ed9b300c1ad343e7827416458a73653b0dd0c187
- SSDEEP 6144:BD+B3TFdbbkIVYwKclE2rl4yQt15xk62c+IyaLLqcVpVAt1Mkihn:BqB3TH3uLArUQy+Iyofnk
- TLSH T12CA48C13B3D19436E4B7063027774772DEBDBE201535C91B97D42C49AAB4292FA3A38B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infuced
Minor OS version
0
Major OS version
4
Entry point
449470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\black\documents\visual studio 2012\Projects\WindowsApplication42\WindowsApplication42\obj\Debug\WindowsApplication42.pdb
mscoree
_CorExeMain
Name
.text
Size
431KB
Virtual Size
430KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.pdb
- SHA256 949c0259e48b4df3af94a47c2d3477d9f3fda93e22d8b7f785d0a22daef71030
- MD5 cb934bdc0528cf079c2b3e88564a0dd5
- SHA1 4ebfa30126c3ede419cce51ba6a34ce2b4bbd455
- SHA512 6b5bd2c91567306860e0c0a1cdb7869839fa36288ceaa194ceb4a6e14fdd491b5e6606f1d07d1f03dcaa9a9479ac6378ef573cfc6b17c3b5c436fda0a57cc94b
- SSDEEP 384:rl+jolyWkcYFDe2Q+x3Q+xaQ+xAbQ+xiBKUf3xgQnWV0o:rl+jWkcI24
- TLSH T1F4E22E83B388D871C5626B3EAA6FEF0E9679FC446FD9835B2284702D3D723452F06154
- MD5 SHA1 SHA512 SSDEEP TLSH
pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.vshost.exe.manifest
- SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
- MD5 a19a2658ba69030c6ac9d11fd7d7e3c1
- SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650
- SHA512 fa583ba012a80d44e599285eb6a013baf41ffbe72ee8561fc89af0ec5543003ba4165bfe7b1ba79252a1b3b6e5626bf52dc712eacd107c0b093a5a2757284d73
- TLSH T1F1F0DCC1D188CA6AD73042A13A66E420A2AD435B19DD49EC74DC2ABB6F0BBC680C30F1
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/bin/Debug/WindowsApplication42.xml
- SHA256 ec9e12a4277c1f801df889bde6a3555faaf8f8eb9dfc0a558877a6ecfd29fd55
- MD5 14b6a658d1f57d2f48fea695d699bbb7
- SHA1 a187e76da6e379dbe2119de40605bc69f1cbc952
- SHA512 b7a7d4e40ed657ef33822bdc69ccb775661f4ea2dc0f8fb730ae7e6274771d31c77feeab6b71d9eac4d852a0b137241f479772b0a0542ef64ab4dbcd8e6ec3bf
- TLSH T1E911568793986E304E7214BF2D66F4D03567A916C9FD200DEC6518330BE028E63FBDA5
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/bin/Debug/pwd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 043a19a508036cfb06a0f5a4bef5dc9bd3d8517f82aefdf56bd9bce3c26d73f4
- MD5 195472ba3953ca3c331fb6fcae059e63
- SHA1 931a2bf8c2ace9e867f021eec03986a08e3e1ef0
- SHA512 dc3940fcd2ef74b04c581a012e536d6fbe37601103714918bb4ac3d8c9161a9580a601ffe22b5bb0b2ea7dc03a5426e6aeb67e51635a3a020afe1f0aaeae0a77
- SSDEEP 6144:wD+B3TFdbbkIVYwKclE2rl4yQt15xk62c+IyaLLqcVpVAt1Mkihs:wqB3TH3uLArUQy+Iyofnkd
- TLSH T150A48C13B3D19436E4B7053027774B72DEBDBE201535C91B97D42C49AAB4292FA3A38B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
449294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\black\documents\visual studio 2012\Projects\WindowsApplication42\WindowsApplication42\obj\Debug\pwd.pdb
mscoree
_CorExeMain
Name
.text
Size
431KB
Virtual Size
430KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
pwdPlugin/WindowsApplication42/bin/Debug/pwd.pdb
- SHA256 cfcbe1fdc4c1c48b0b1b30efa484177099ad10dea0ca4caa88eb11c1616f6fbb
- MD5 e9ba917a925b8990501170ade677b609
- SHA1 0b228fc6d602c8b24b3d32c5ead30a25f34a1d88
- SHA512 8d2668615645b790c07d206480dff53282323d770c090093e166ed2e7c6e29bf67f48efc0c59042c4b740c4770a81b4388f509a2e8134e172253f5ad2f5c5415
- SSDEEP 384:2lUjuBUWWaQ+x5Q+xw0Q+xBQ+xssK+pJ5YFeu47k:2lUjqMsK+pJ5lk
- TLSH T1F2E24042B385D432C1666B3DA6AFEF0E5678FC846FDA835B1288B13D3DB23456F06164
- MD5 SHA1 SHA512 SSDEEP TLSH
pwdPlugin/WindowsApplication42/bin/Debug/pwd.vshost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b881680c84d75daee6d21d653616b13e3170f54012b15c4de844722f7c944ccc
- MD5 d52505b82e995fc1125f01e20b764864
- SHA1 4be2e06bba273008d87e2ea407d5a31eb53075a2
- SHA512 68d2f359d1f4c52945f2392d01debec1d124a83736356f36b792dc804a506700ee7c93167347b24ed43e4119e9442d9e5c16d09b855285866ee24df2f9ea16d3
- SSDEEP 384:KbejW7aWk1LHB0GftpBjiPIhFtAHRN7clXNhezL:+e0wWiLy2Ev
- TLSH T1CDA24A96C77C8143ED935C7062A8EAC37C3CE7D31D21A56A05DAF6991C837C5EB24A2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d2:cc:4b:b5:07:ba:a6:e1:d1:26:53:5a:7f:1e:77:ab:18:e7:d7:d4:ec:d9:b1:0c:8a:bc:5e:db:5f:92:a7:40
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 27, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
29:12:3d:93:6b:98:fa:9f:ba:5c:75:a5:e5:de:33:9d:a1:6c:19:0e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 27, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:19:cc:93:00:01:00:00:00:66
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:19:96:00:00:00:00:00:1b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
11230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries\Intermediate\vsproject\vshostneutral-clr2.csproj__1974420004\objr\x86\vshost-clr2.pdb
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
pwdPlugin/WindowsApplication42/bin/Debug/pwd.xml
- SHA256 36780eda8827b432b1bed9cb1bb4208bb160867769bf61450812c5a383215ac5
- MD5 8e67b985ddde7f66c315b6ed2eaf47b3
- SHA1 be49058c9be86f5ded026a745fa962bc5ce2f775
- SHA512 700c2802877bcb3308b0a0a89c0fa2d2aa878c89f4c16b45d2ad2992574d50f676dca1897e0e24cde054fe7a5e336daf314aca1b63301850744d4b902bc034b2
- TLSH T1C411E342A3986E318D3014BF2EA1B5D53257A922C67D340EEC7A583703E56DA33FBD24
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/obj/Debug/DesignTimeResolveAssemblyReferences.cache
- SHA256 ae6a028a325155bc7e2d3ed9277bea2182f14c6267d980546a45004e52e6e997
- MD5 54b5823e60e61794f73c6484d6b46b24
- SHA1 8e037f160bb666d52cdcd63bf36781c32bdd1af0
- SHA512 d59d8f2cd70614a88760483fbeea2e06eaa87a03fbf03465fa9c6409c6a518ec622a9c2c63c8ce4a971ecb012f9f96d535436a3482b849737854000155adc593
- TLSH T1B9018934A300E722DDB01931156A45E03AB512A36521EB2C70C91429CEA378B677F38B
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache
- SHA256 d762e93e924f82e4443c7599e9c2c5479ed983a837f695ca09b4e60deeee2458
- MD5 c9a6d0198e2d14262bd2e9270d805710
- SHA1 c7e1b764b878969030fd4b6264b5ddd77def021e
- SHA512 e25e4952743276d8f3eab6f0ff90efc42a1c691b30ec478d1641437429dd0738e3d768aef909bc0f2fc71ad7ccf149bbf3f01b28744ece550daa95875d735f53
- SSDEEP 192:riV1EA1E6mrFmrFmrFi1EA1E6mrFmrFmrFM1EA1E6mrFmrFmrFpcx1EA1E6mrFmd:riV1EA1E6eFeFeFi1EA1E6eFeFeFM1E0
- TLSH T13CD1BF303119A3F94DA32EA12454B68113FF938F3A746D8CB964272DDD2292F4736BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
pwdPlugin/WindowsApplication42/obj/Debug/TempPE/My Project.Resources.Designer.vb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0b2e339d8f7592f9f20d94754347344e17357be583740d22858977f515a4c10f
- MD5 8cced6dd728108d0ca3c2c7d54af236c
- SHA1 b1177e29c01d73f9cf32e4a3e54ccab1e9506d06
- SHA512 40b5833d44a0edf5e9ab5de49c37f74af0afa38adb639b55760737c9c2b2e6b685f705d13338f04a47c35e61e4df825eb84969e311c7fd298743de3ba98d9e9f
- SSDEEP 192:6Fg4K8oy5K7SZV5nlYJL/erzIDLT9l69r:6Fg+DfsqX+LTW9
- TLSH T1A9F1092A53F48376CFAE0B3319A356115732E344CF6BBB7F0890927648E32448763A72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.Resources.resources
- SHA256 2dfa855a924e6e183d11cffce94e52a45e82fd47ebe355c210162f7c2cd3be7c
- MD5 e7a8dd996703b28cfcf5a69d92f4fe5a
- SHA1 857a08a1b3559e00220489c386c8cfd9a68963ce
- SHA512 37bbcbd2cb5af5f4b25f40bf250cd16ba6d5aecc3b9cde30205aa90b82eaaac7023eabed385e221289ed6b2ac405c84cddd875955856e6ed0a659d0401592e9c
- SSDEEP 6144:sD+B3TFdbbkIVYwKclE2rl4yQt15xk62c+IyaLLqcVpVAt1MkihR:sqB3TH3uLArUQy+Iyofnke
- TLSH T127949D13B3E18036E4B70570166B4B329EFDBD301539C95B97D41D49AEB06D1EA3A34B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 652796b03eb9154cd35df87e66a3cd4561ca9d3d0b4fcaface126632130fe3c3
- MD5 fdd3d394fc50b187d55c6e64d7d9524a
- SHA1 28806a22b6e5066a666f3f0aa4b878446530889d
- SHA512 f5ba4603cb423fe13223591261ce6094a39ee40c64e3d42af38ae47fef06e75447eaaecfdc72d773a64acba5ed9b300c1ad343e7827416458a73653b0dd0c187
- SSDEEP 6144:BD+B3TFdbbkIVYwKclE2rl4yQt15xk62c+IyaLLqcVpVAt1Mkihn:BqB3TH3uLArUQy+Iyofnk
- TLSH T12CA48C13B3D19436E4B7063027774772DEBDBE201535C91B97D42C49AAB4292FA3A38B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
449470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\black\documents\visual studio 2012\Projects\WindowsApplication42\WindowsApplication42\obj\Debug\WindowsApplication42.pdb
mscoree
_CorExeMain
Name
.text
Size
431KB
Virtual Size
430KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.pdb
- SHA256 949c0259e48b4df3af94a47c2d3477d9f3fda93e22d8b7f785d0a22daef71030
- MD5 cb934bdc0528cf079c2b3e88564a0dd5
- SHA1 4ebfa30126c3ede419cce51ba6a34ce2b4bbd455
- SHA512 6b5bd2c91567306860e0c0a1cdb7869839fa36288ceaa194ceb4a6e14fdd491b5e6606f1d07d1f03dcaa9a9479ac6378ef573cfc6b17c3b5c436fda0a57cc94b
- SSDEEP 384:rl+jolyWkcYFDe2Q+x3Q+xaQ+xAbQ+xiBKUf3xgQnWV0o:rl+jWkcI24
- TLSH T1F4E22E83B388D871C5626B3EAA6FEF0E9679FC446FD9835B2284702D3D723452F06154
- MD5 SHA1 SHA512 SSDEEP TLSH
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.vbproj.FileListAbsolute.txt
- SHA256 1454da364128439756febd2c15ca0924470bae3f7ad026275233843012fc10eb
- MD5 e66ecd21940598c727396dd81eea914f
- SHA1 cbabb1c1fa87156d99b85e484561f352894e4ba0
- SHA512 f003529a4336a3127bdc81c2778f50c70b8f7ad15908f91e6b35235eaa768bc87d167345d71d4e2bcf13104d9900e5d791026fde4fc560d65b7d6b9900e7c2c3
- TLSH T11A11F4DA003864B4D6E33C2FF26EFAC45FB7C51C7EE9048A50182404EF1D84D02A56E9
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.vbproj.GenerateResource.Cache
- SHA256 e151f39478361f9cb67bc07bb38b1467110bfb0cdc29cfae6a8f0720a4f8f252
- MD5 757f7341a96dbfb5e9127272299a3b69
- SHA1 c783044639ba5ab61922f872825b82ec839297ce
- SHA512 9092eb4a38acf9ce7fd1eae0326401d58f450302f77ced909e43ec6b82486f96624021919d3a9706dc9816f55567b8845606780ae2c3eacf796b1f62cf662ffb
- TLSH T1A81180257A09F311CAA560E400E199753A3393D3905CDF2C2499551C5E6B247737E4FF
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/obj/Debug/WindowsApplication42.xml
- SHA256 ec9e12a4277c1f801df889bde6a3555faaf8f8eb9dfc0a558877a6ecfd29fd55
- MD5 14b6a658d1f57d2f48fea695d699bbb7
- SHA1 a187e76da6e379dbe2119de40605bc69f1cbc952
- SHA512 b7a7d4e40ed657ef33822bdc69ccb775661f4ea2dc0f8fb730ae7e6274771d31c77feeab6b71d9eac4d852a0b137241f479772b0a0542ef64ab4dbcd8e6ec3bf
- TLSH T1E911568793986E304E7214BF2D66F4D03567A916C9FD200DEC6518330BE028E63FBDA5
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/obj/Debug/pwd.Resources.resources
- SHA256 2dfa855a924e6e183d11cffce94e52a45e82fd47ebe355c210162f7c2cd3be7c
- MD5 e7a8dd996703b28cfcf5a69d92f4fe5a
- SHA1 857a08a1b3559e00220489c386c8cfd9a68963ce
- SHA512 37bbcbd2cb5af5f4b25f40bf250cd16ba6d5aecc3b9cde30205aa90b82eaaac7023eabed385e221289ed6b2ac405c84cddd875955856e6ed0a659d0401592e9c
- SSDEEP 6144:sD+B3TFdbbkIVYwKclE2rl4yQt15xk62c+IyaLLqcVpVAt1MkihR:sqB3TH3uLArUQy+Iyofnke
- TLSH T127949D13B3E18036E4B70570166B4B329EFDBD301539C95B97D41D49AEB06D1EA3A34B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
pwdPlugin/WindowsApplication42/obj/Debug/pwd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 043a19a508036cfb06a0f5a4bef5dc9bd3d8517f82aefdf56bd9bce3c26d73f4
- MD5 195472ba3953ca3c331fb6fcae059e63
- SHA1 931a2bf8c2ace9e867f021eec03986a08e3e1ef0
- SHA512 dc3940fcd2ef74b04c581a012e536d6fbe37601103714918bb4ac3d8c9161a9580a601ffe22b5bb0b2ea7dc03a5426e6aeb67e51635a3a020afe1f0aaeae0a77
- SSDEEP 6144:wD+B3TFdbbkIVYwKclE2rl4yQt15xk62c+IyaLLqcVpVAt1Mkihs:wqB3TH3uLArUQy+Iyofnkd
- TLSH T150A48C13B3D19436E4B7053027774B72DEBDBE201535C91B97D42C49AAB4292FA3A38B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
449294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\black\documents\visual studio 2012\Projects\WindowsApplication42\WindowsApplication42\obj\Debug\pwd.pdb
mscoree
_CorExeMain
Name
.text
Size
431KB
Virtual Size
430KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
pwdPlugin/WindowsApplication42/obj/Debug/pwd.pdb
- SHA256 cfcbe1fdc4c1c48b0b1b30efa484177099ad10dea0ca4caa88eb11c1616f6fbb
- MD5 e9ba917a925b8990501170ade677b609
- SHA1 0b228fc6d602c8b24b3d32c5ead30a25f34a1d88
- SHA512 8d2668615645b790c07d206480dff53282323d770c090093e166ed2e7c6e29bf67f48efc0c59042c4b740c4770a81b4388f509a2e8134e172253f5ad2f5c5415
- SSDEEP 384:2lUjuBUWWaQ+x5Q+xw0Q+xBQ+xssK+pJ5YFeu47k:2lUjqMsK+pJ5lk
- TLSH T1F2E24042B385D432C1666B3DA6AFEF0E5678FC846FDA835B1288B13D3DB23456F06164
- MD5 SHA1 SHA512 SSDEEP TLSH
pwdPlugin/WindowsApplication42/obj/Debug/pwd.vbproj.FileListAbsolute.txt
- SHA256 43b6d8b755836842609ac349034af1ceb15646d6c7d66da928bb784711b10925
- MD5 dc8401c14ef8d2480262d2c852251007
- SHA1 4575a26514e05858b7524ab93ea4fa660f0a804f
- SHA512 10ed0388996088b2bbe425be43bb2fbbcf4876d81ea935e4173b822ffea22c8666104e9f5b5a5eb5864d10d9a89c63af7316e235e146b3574e864113061d389b
- TLSH T1901142DA003854759AD32C2FF27EEE84AFB7C82C7EE904CB501C2814DF5E84E4195AE9
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/obj/Debug/pwd.vbproj.GenerateResource.Cache
- SHA256 e148c93233614a7d6fd6999685ec2dda18f1f66813716a4a3a0ece828fbbf1f2
- MD5 5cfb68b0cd2a5a7b93580f66538cee0a
- SHA1 beb2e9f8b443470dd5ca208ccb2978ec991e78b2
- SHA512 b293979f6fe3ad3932c2009f4b453db1a84836534cee1842737bae2de4a747f8aa0fb347a181b1dbea1b49ededa0fa01e05b9a92e5ecccc10084f6a607f68e33
- TLSH T17311E3257909F311CAA560E400E189753A3393D3905CCF2C2499541C5E6B247737F4FF
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/obj/Debug/pwd.xml
- SHA256 36780eda8827b432b1bed9cb1bb4208bb160867769bf61450812c5a383215ac5
- MD5 8e67b985ddde7f66c315b6ed2eaf47b3
- SHA1 be49058c9be86f5ded026a745fa962bc5ce2f775
- SHA512 700c2802877bcb3308b0a0a89c0fa2d2aa878c89f4c16b45d2ad2992574d50f676dca1897e0e24cde054fe7a5e336daf314aca1b63301850744d4b902bc034b2
- TLSH T1C411E342A3986E318D3014BF2EA1B5D53257A922C67D340EEC7A583703E56DA33FBD24
- MD5 SHA1 SHA512 TLSH
pwdPlugin/WindowsApplication42/pwd.vbproj
- SHA256 2cc3fa2991187759e00fbb15e457bf2acb536bd217fe03538139acb8a3167ec5
- MD5 e58c370c888e233618c564563494f64a
- SHA1 2bc68e08140e3de4a087361ff259c6dd46b99f04
- SHA512 884ae6a43b48f94f5e26eaa7cddc84d060858f47b4857ed6aee838161a9fc3e0560496654e7b5cc8c6afcd798ea251338323f9c5e7bf44992be78b18f69458fb
- SSDEEP 96:yWnpu5QGYO/pM/PMlHzEEOdsHSW+NA1g4JR7RpR7UBjL+U:kpYOBcu8NAXNUwU
- TLSH T1AAA12234E2CC7EAC07B22037A163AA04EE6193D314B00C64F68DE5879FB35945157B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Black WorM v4.1 Expert Edition By Black.Hacker/stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fbfdbf55dab1122096f4887fed3b150452222ca350355eddda54a5697f62418f
- MD5 34d91dfb34a7283483d0aaba9d10147d
- SHA1 f992436c22c96f783602828d8066a8efe92cca26
- SHA512 0f9471b26385d97eef5e6c320153798b8acc023f0417f1729c35f3c3d61b3056b2682a02ce56996642d85f78c6ab97edd3d9f5737efb1080598d2004ee4e551e
- SSDEEP 768:QB6JXnzE+C2U2PxrleyBx6jygM9qsD0u:QTt2UyqyBx2FQw
- TLSH T119132A8873E89914E57E5AB309F064460275FC171A22EB0E0EF171DA2B77345CF54EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Black\Desktop\‫jnRAT\Stub Folder\E\obj\Debug\E.pdb
mscoree
_CorExeMain
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
114B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Black WorM v4.1 Expert Edition By Black.Hacker/stubSRC.rar
- SHA256 1e6d19481ee3fea6db7f7e7750d3a41656678d64e9427df97dfc1885aacd0435
- MD5 977c21257351d01d112df3b2fb3d2bbe
- SHA1 fad8d3e9e81e357cdb3eb9959c59d0e56381eb7b
- SHA512 b8307367fb1c19b124200170a2770d6eb7ee401d087ca950fe8d36f15a301358bb66e3e842f1101bd648b1be18c6e695e6e1c107dd0f8b9c851142d46f459f3e
- SSDEEP 3072:dmGT9GGz8DuJWbAGPOPcevhGg0POPdpeu/T7dEl+:MSTz84kAG8zvIg08dpl/T7dq+
- TLSH T109C302D9F23C88C5E248C77A00851693529E1FF9B6321BAFAC5BA72B5DD789C013760D
- MD5 SHA1 SHA512 SSDEEP TLSH