PlutoExec 1.0.8.zip
- SHA256 4b6caf521d93ccd4448f268de4a2b0b255c5facbd03fde4b9af43b1f3ed49778
Static task
static1
1 signatures
General
- Target PlutoExec 1.0.8.zip
- Size 61.2MB
- Sample261110-1j445abe22
- SHA256 4b6caf521d93ccd4448f268de4a2b0b255c5facbd03fde4b9af43b1f3ed49778
- MD5 598c79edc49227672271789cee74ec94
- SHA1 783e1d4b91ebc1f91ec480890fc6997762a04fed
- SHA512 19059c7bdde3b79fcc6b25e35293572009e64dc5acdc7dd3cb6fffde25893a9f9fe88e91b73fd40b8f9e02e55c3575bc5b1a427695188a34152c9387b1e86cb2
- SSDEEP 1572864:qEFRqICTgDrehV4kgeuQT8cGPeOIiX49WEiHI/zWquP6X+KkgKI+:qSq50ehL3T8cvs44WqxP6vN+
- TLSH T158E733C4571263D38C46A1DD383FEA0BC8CD7679B89D4D18784047A38A4E7EAF8A2D57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Injector.exe unpack001/Pluto.dll unpack001/Pluto.exe
File Explorer
-
PlutoExec 1.0.8.zip.zip 61.2MB
-
Injector.exe.exe 26.0MB
-
Pluto.dll.dll 7.1MB
-
Pluto.exe.exe 40.2MB
Injector.exe
- IMPHASH 86e4bc38eb73579d086e975280562079
- SHA256 15e90cd5504290144bd606c7d806c021106c71b3d3911f0946aecd8f99689154
- MD5 cff55e3309722f150741bdf35938a57d
- SHA1 f4ac0086d4e98a57b3a7ed11de1fe4e6eb329e08
- SHA512 8a0f3aa52becd310c666cc3a8d8eaf793bdf36e1da8be7501198295f34ec35a94a8bdd42111af88fee32b0501a1b3b43a6285f98922f4924e9d8a6faa6dfcd8c
- SSDEEP 786432:3sdlF/02sfrCIqvx2VHwMWLN1f3I9ZSOw:3+lG3rCIqvMVHCNp34Z
- TLSH T1975723E2A9D663F4D3934B0892CB138B53D2729BC59F851E27C65C032521D97CA4BD3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
31818147
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcrypt
BCryptOpenAlgorithmProvider
ntdll
NtQueryObject
kernel32
GetSystemFirmwareTable
user32
MessageBoxW
advapi32
GetSecurityDescriptorDacl
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
winhttp
WinHttpSendRequest
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
wcslen
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.x^u
Size
Virtual Size
15.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.{-S
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pa\
Size
26.0MB
Virtual Size
26.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
673B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
260B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Pluto.dll
- IMPHASH 3a1ca3f6f5f74d7c8701580f9988127a
- SHA256 7ebbfc30202e53be171e8c8aff3f85c193db9deaa7758dd28df0aa58a2986780
- MD5 0453eda374d7164653b3a7b32b4824c2
- SHA1 e6f66ad3ce9c5bd8b00f34cdc5af4dbbf9ccc4eb
- SHA512 22796aa6c26f36f294b30e6e0fba4757dce6297d8d75069e5dd40ee0c4f44e838d3794d2c765ae8f30296a5ed4c61b7580a008abb6a3c775fb1bebcfc3d0b6f4
- SSDEEP 98304:yuCx1K9g7vvSlCril4hR3/jhiO8lUqAQUDMxejbqaQGw:yLvA+gCB3bhV8KqA7wxejbl
- TLSH T1FB76BE7A5E9801BCE977D6788F872353DBA5BA40032158EB21D04AAB1E3FFC41779643
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3001344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
WSACleanup
accept
bind
closesocket
setsockopt
getaddrinfo
listen
WSAStartup
inet_addr
send
socket
connect
recv
htonl
htons
freeaddrinfo
ntohl
crypt32
CryptBinaryToStringA
d3d11
D3D11CreateDevice
winhttp
WinHttpReadData
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryHeaders
WinHttpWebSocketSend
WinHttpQueryDataAvailable
WinHttpWebSocketCompleteUpgrade
WinHttpConnect
WinHttpSetTimeouts
WinHttpWebSocketClose
WinHttpSendRequest
WinHttpCloseHandle
WinHttpWebSocketReceive
WinHttpSetOption
WinHttpOpenRequest
kernel32
SleepConditionVariableSRW
GetCurrentThreadId
WakeAllConditionVariable
CreateDirectoryW
GetSystemFirmwareTable
ReadFile
GetModuleFileNameA
FillConsoleOutputCharacterA
CancelIo
FindFirstFileW
GetFileSizeEx
GetConsoleScreenBufferInfo
HeapFree
SetConsoleTextAttribute
VirtualFree
SetConsoleTitleA
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
WriteConsoleA
WriteFile
TryAcquireSRWLockExclusive
GetModuleHandleExW
SetConsoleMode
OutputDebugStringA
VirtualAlloc
TerminateProcess
RemoveDirectoryW
WaitForMultipleObjects
SetFilePointer
GetEnvironmentVariableW
FindClose
GetVolumeInformationA
WaitForSingleObject
CreateFileW
GetFileAttributesW
ReadConsoleA
GetSystemDirectoryW
GetModuleHandleA
OpenProcess
SetFileAttributesW
CreateToolhelp32Snapshot
CreateEventW
Sleep
GetConsoleMode
GetTickCount64
GetLastError
ReleaseSRWLockExclusive
Process32NextW
SetEvent
DisableThreadLibraryCalls
GetCurrentThread
AcquireSRWLockExclusive
TerminateThread
GlobalAlloc
DeleteFileW
Process32FirstW
GlobalFree
CloseHandle
FreeConsole
GetSystemInfo
LoadLibraryW
CreateThread
HeapAlloc
FillConsoleOutputAttribute
GetOverlappedResult
AddVectoredExceptionHandler
ReadDirectoryChangesW
GetWindowsDirectoryW
GetProcAddress
GlobalLock
MoveFileExW
GetCurrentProcessId
GetProcessHeap
GlobalMemoryStatusEx
GetModuleHandleW
CopyFileW
WideCharToMultiByte
GetConsoleWindow
SetConsoleOutputCP
IsBadReadPtr
SetConsoleCursorPosition
GetTickCount
GlobalUnlock
AllocConsole
VirtualQuery
IsWow64Process
GetComputerNameA
SetUnhandledExceptionFilter
GetExitCodeProcess
LoadLibraryA
QueryPerformanceFrequency
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
AreFileApisANSI
CreateFile2
GetSystemTimeAsFileTime
InitializeSListHead
GetFileInformationByHandleEx
GetDiskFreeSpaceExW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
GetLocaleInfoEx
CopyFile2
FormatMessageA
LocalFree
MultiByteToWideChar
user32
SetWindowPos
GetWindowTextW
SendInput
IsIconic
FindWindowA
GetWindowDisplayAffinity
GetClientRect
SetClipboardData
mouse_event
SendMessageA
GetClipboardData
TranslateMessage
SetLayeredWindowAttributes
EnumWindows
GetForegroundWindow
MessageBoxA
MapVirtualKeyA
SetWindowTextA
SetWindowDisplayAffinity
IsChild
PeekMessageW
EmptyClipboard
CloseClipboard
ClientToScreen
DispatchMessageW
OpenClipboard
ShowWindow
GetWindowLongW
AdjustWindowRectEx
GetKeyState
GetDC
MonitorFromWindow
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
GetCapture
GetMonitorInfoW
TrackMouseEvent
SetFocus
BringWindowToTop
LoadCursorW
SetCapture
SetCursor
SetWindowLongW
ReleaseCapture
SetForegroundWindow
SetCursorPos
ReleaseDC
GetCursorPos
GetWindowThreadProcessId
DefWindowProcW
LoadImageA
GetWindow
DestroyWindow
IsWindowVisible
IsWindow
MessageBoxW
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
gdi32
GetDeviceCaps
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
CryptCreateHash
CryptDestroyKey
GetCurrentHwProfileW
RegCloseKey
CryptAcquireContextW
CryptReleaseContext
RegQueryValueExW
CryptGetHashParam
CryptImportKey
CryptSetKeyParam
RegOpenKeyExW
CryptDestroyHash
CryptHashData
CryptGenRandom
RegEnumKeyExW
CryptDecrypt
CryptEncrypt
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetKnownFolderPath
SHGetFolderPathW
ole32
CoTaskMemFree
msvcp140
__crtLCMapStringA
??1_Facet_base@std@@UEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bios_base@std@@QEBA_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
_Cnd_signal
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??_7_Facet_base@std@@6B@
_Strxfrm
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
??_7facet@locale@std@@6B@
_Mtx_lock
_Strcoll
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
_Thrd_join
_Mtx_unlock
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
bcrypt
BCryptGenRandom
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
dcomp
DCompositionCreateDevice
d3dcompiler_47
D3DCompile
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmAssociateContextEx
ImmGetContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
_CxxThrowException
__current_exception_context
__current_exception
memcmp
memchr
memset
memmove
memcpy
strstr
wcsrchr
__RTtypeid
strchr
_set_purecall_handler
_purecall
__C_specific_handler_noexcept
__std_type_info_compare
__std_exception_copy
__std_exception_destroy
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
set_terminate
terminate
_set_invalid_parameter_handler
_beginthreadex
_errno
_initterm_e
_initterm
_cexit
signal
_crt_atexit
_resetstkoflw
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
abort
_configure_narrow_argv
_seh_filter_dll
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
setvbuf
ungetc
fsetpos
fclose
fgetpos
fread
_fseeki64
_get_stream_buffer_pointers
__acrt_iob_func
__stdio_common_vfprintf
fputc
__stdio_common_vswprintf_s
ftell
fseek
fwrite
_wfopen
__stdio_common_vsnprintf_s
fgetc
__stdio_common_vsscanf
__stdio_common_vsprintf_s
__stdio_common_vsprintf
fflush
api-ms-win-crt-heap-l1-1-0
free
malloc
realloc
_callnewh
api-ms-win-crt-math-l1-1-0
sinf
sinh
_dsign
sin
pow
sqrt
llround
acos
acosf
asin
atan
atan2
log2
ceil
log10
ceilf
cos
tanh
tan
sqrtf
cosf
log
ldexp
round
cosh
fmod
modf
frexp
floorf
floor
exp
api-ms-win-crt-string-l1-1-0
strncpy_s
tolower
wcscmp
_wcsicmp
islower
isdigit
ispunct
strncpy
strncmp
strlen
strcmp
wcscpy_s
wcscat_s
strcpy_s
_stricmp
_wcsnicmp
strnlen
toupper
strspn
isspace
strcspn
strncat
strpbrk
isgraph
isupper
isalpha
iscntrl
isalnum
isxdigit
wcslen
api-ms-win-crt-convert-l1-1-0
atoi
strtod
strtoull
_wtoi
strtoll
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
___lc_locale_name_func
___lc_collate_cp_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_time64
clock
strftime
_localtime64_s
_gmtime64_s
_difftime64
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
148KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.3qW
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
233B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Pluto.exe
- IMPHASH 4d3e1ff64a92dbac452f8113a9c3a538
- SHA256 4de88d796f59864a29d42a3c166400504b4888fc83ebc4f7d1df24e6d9ffaa6f
- MD5 9f6a80c7bc1a245a45a785040bd8a92e
- SHA1 5119546d099337767220d5ef7f2a69d176e0c5b2
- SHA512 7b76df77f6fc68f7771d7d19358b3d4345e5f7680c889e7a9b88ff7139ed50655acb67045dfd7d1f4cdf5cabd9531690ac5381bf22c2ee94f43bc23fc8d9ca9c
- SSDEEP 786432:Sb5pf4TSRkemSoQPrcbu6YrL1SY0lzyA44mqgo5enoQsCwUEJ5h:Sb4TSRkkzcb9wEkqgo52oQspBHh
- TLSH T1A89723D761EAA3D484C30644A64E42D761C164FEC9EF852C2ECB5C037924DEB498EBB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57287436
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleHandleW
advapi32
EventUnregister
oleaut32
GetErrorInfo
bcryptprimitives
ProcessPrng
ntdll
NtQuerySystemInformation
shell32
ShellExecuteExW
ole32
RevokeDragDrop
api-ms-win-core-synch-l1-2-0
WaitOnAddress
gdi32
SelectObject
comctl32
DefSubclassProc
user32
GetWindowTextW
shlwapi
SHCreateMemStream
dwmapi
DwmSetWindowAttribute
ws2_32
freeaddrinfo
crypt32
CertCloseStore
secur32
AcceptSecurityContext
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-convert-l1-1-0
_ultow_s
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_callnewh
Name
.text
Size
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
6.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.<2I
Size
Virtual Size
20.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.YcD
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.2?y
Size
40.2MB
Virtual Size
40.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ