SONdpi-0.1.1-windows-x64.zip
- SHA256 1dc9f0f682d6d20c07ce50ad3e16e2f0c07ec309f96c008a8d4ebd7e4e5c2e5f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SONdpi-0.1.1\WinDivert.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SONdpi-0.1.1\WinDivert.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SONdpi-0.1.1\WinDivert64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
SONdpi-0.1.1\sondpi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
SONdpi-0.1.1\sondpi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target SONdpi-0.1.1-windows-x64.zip
- Size 715KB
- Sample261113-we3y2set8t
- SHA256 1dc9f0f682d6d20c07ce50ad3e16e2f0c07ec309f96c008a8d4ebd7e4e5c2e5f
- MD5 9974c5df2d2eaa977d3d1ddaaeb6ed65
- SHA1 57b808c6c98be0e0c7d0ac5ae8b58cdbe85878ca
- SHA512 4c5da32e19289841d0db159e2d8fd8e43566b409d44ec8bda6952f115afa6067584bb52b25b4545802ec5b8f62c4be0a974bd2917b3da006eea1d5c3ef90e50b
- SSDEEP 12288:kZJsy2hQcgfx02iARIlAKStsbwB/+JLYE2I8HxusmpS+aJvcXiLZ8+6bEeoi9Hve:WJJ2yFfxLLIlAxikB/M1kXmOvcyLZb6Q
- TLSH T118F423A2238973DCCB5749BBBAC17E10AD0810DCAD9948E19CFEBCE55F07A2434915DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SONdpi-0.1.1\WinDivert.dll unpack001/SONdpi-0.1.1\sondpi.exe
File Explorer
-
SONdpi-0.1.1-windows-x64.zip.zip 715KB
-
SONdpi-0.1.1\LICENSE.txt1KB
-
SONdpi-0.1.1\OKU.txt1KB
-
SONdpi-0.1.1\WinDivert-LICENSE.txt39KB
-
SONdpi-0.1.1\WinDivert.dll.dll 46KB
-
SONdpi-0.1.1\WinDivert64.sys.sys 89KB
-
SONdpi-0.1.1\sondpi.exe.exe 1.3MB
SONdpi-0.1.1\LICENSE.txt
- SHA256 ff5b4a3a994f8261026d4e93ba18777b56d63adfaae95909ddd0b1bcedf46173
- MD5 9bfa4e0827d789900705ce017a8659f8
- SHA1 cd2e48c35685e1ceade6476f30efe81de7d39209
- SHA512 b9ae7d80b551ff90701e35f647d14e52f88970427193add136ca16dadb114739940701737557cf11db2c30f03839cd5d0b32eec50495f12161da4ab582d21c13
- TLSH T1BA11822EB25007621C9A13A05578A8C5B23BB25FBA9F2A85246DF345232A06CC6FF840
- MD5 SHA1 SHA512 TLSH
SONdpi-0.1.1\OKU.txt
- SHA256 58af262eb83dfedf30ad17aebe8426bdd65bc43b8e99b35e95a19e66ca971451
- MD5 e3ad9312b8a27705d2a518f0b569b2e8
- SHA1 da3a72e99508920b179eaf983f0bb83f16f03f54
- SHA512 5a4d923dbb4ab6d2faa2279c9b509f41daa1a925732ad89adde158dbe0d277d83c3ebd1f5b8f354796e62d473711ebadc7e64072e90da7032f72c988b6920171
- TLSH T1A23186A8387389114F73B8DB9D9F0627712BC0ABE307F58299655F26AA00345D2A5A58
- MD5 SHA1 SHA512 TLSH
SONdpi-0.1.1\WinDivert-LICENSE.txt
- SHA256 e5453b2e71e4c4dcdb89a2539655add3a63202521cf3012b768e8bfeda199312
- MD5 b864fbb188a7c3a11cef80f3ee902d77
- SHA1 7a3f0538f8fd2ee1c30fc1952cbf83b13b360b3f
- SHA512 eb03bb26490535d98e270c89d70dfc9d1a0e2a22ad2bc09ed316e522fb52177b24bb6a2c023c9b010837b6b9a28dfe6492dc0b77f45883385a7e66dd00463c32
- SSDEEP 768:Qs57D0LVw7Y+tNdSz3ZlqXOWoInuzx3Y8N3Wib:QspD8VwVtNIq1uzZY1I
- TLSH T1E703735BA74513B202E202516E4FA4CEE32E907A376A4464786DC15C27B7D3483BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
SONdpi-0.1.1\WinDivert.dll
- IMPHASH 0b649f8e17494bb31b47f6e959a1769c
- SHA256 6110bfa44667405179c3e15e12af1b62037e447ed59b054b19042032995e6c7e
- MD5 88e1c19b978436258f7c938013408a8a
- SHA1 09b77c8c85757e11667a7b83231598dd67fe0b8b
- SHA512 eaa0d8369b76fd9a4978f14702716ae31d801cd0dc36a86531f9320b4ddb683265c4f0e07af2b9d2e85f513270d98d1b11ae7d501d08287442bc505176d16e14
- SSDEEP 768:itSVluu2agCfRSB3QEw2VWHxWYuaO6JXtltdUUwhqWB8TicI:bUZWECHxWDABdIyTic
- TLSH T13E23C703F64251BBC568C27083AED3526E22FCC66354FADF829FF7952885F42DB1A509
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31106
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CloseServiceHandle
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegSetValueExW
StartServiceW
kernel32
CloseHandle
CreateEventW
CreateFileW
CreateMutexW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
HeapAlloc
HeapCreate
HeapDestroy
ReleaseMutex
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WinDivertClose
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperCompileFilter
WinDivertHelperDecrementTTL
WinDivertHelperEvalFilter
WinDivertHelperFormatFilter
WinDivertHelperFormatIPv4Address
WinDivertHelperFormatIPv6Address
WinDivertHelperHashPacket
WinDivertHelperHtonIPv6Address
WinDivertHelperHtonIpv6Address
WinDivertHelperHtonl
WinDivertHelperHtonll
WinDivertHelperHtons
WinDivertHelperNtohIPv6Address
WinDivertHelperNtohIpv6Address
WinDivertHelperNtohl
WinDivertHelperNtohll
WinDivertHelperNtohs
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
WinDivertShutdown
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
SONdpi-0.1.1\WinDivert64.sys
- IMPHASH 505c54af7fa8f0482014ca4fe5cdd53d
- SHA256 e69b5ba3f0cd6cfb2983e442636e7f0b342b61b15264b0328317d4559c82cf50
- MD5 6a33620de63bccaf5e5314ee49cd58fb
- SHA1 ac728b339681b2e27099fecc1419821f01d04b34
- SHA512 638d1b8aa4dc0e4ac504f51aaa3ec8375ccc3d69a4d36821f6bb98060b58586007f47966b9d58d222b9f067e12e80755f56559286cbabec8746146acaf24f945
- SSDEEP 1536:8ovgCRgYL/h//oJJw5AdPtey2AyWpdsihch9WXi2v6MuO2:84jmJJsKle9A5pdsiqg/vsO2
- TLSH T1D9934C46A2E201C5F9F6C97895B59213EF31FA81AB22D7DF11D0981E4F61BE0BD78321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 24, 2019
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Nov 24, 2019
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2a
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 13, 2017 - Oct 12, 2020
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 5, 2019 - Jun 3, 2020
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
4484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\WinDivert\install\MSVC\amd64\WinDivert64.pdb
ntoskrnl.exe
ExFreePoolWithTag
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAllocateErrorLogEntry
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
IoWriteErrorLogEntry
RtlCopyUnicodeString
ObfReferenceObject
ObfDereferenceObject
KeBugCheckEx
IoGetRequestorProcess
PsGetProcessId
ExUuidCreate
ExAllocatePoolWithTag
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
RtlGetVersion
RtlIntegerToUnicodeString
hal
KeQueryPerformanceCounter
ndis.sys
NdisAllocateNetBufferPool
NdisFreeNetBufferPool
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
fwpkclnt.sys
FwpsAllocateNetBufferAndNetBufferList0
FwpmFilterDeleteByKey0
FwpmFilterAdd0
FwpmCalloutDeleteByKey0
FwpmCalloutAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerAdd0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpsQueryPacketInjectionState0
FwpsInjectNetworkReceiveAsync0
FwpsInjectForwardAsync0
FwpsInjectNetworkSendAsync0
FwpsCalloutRegister0
FwpsCalloutUnregisterByKey0
FwpsFlowAssociateContext0
FwpsFlowRemoveContext0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsFreeNetBufferList0
wdfldr.sys
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=262, version=24610,
count=3, id=136, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=55, id=1, productName=Unmarked objects,
count=9, id=257, version=24610,
count=5, id=259, version=24610,
count=5, id=260, version=24610,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
SONdpi-0.1.1\sondpi.exe
- IMPHASH e5cab18212d5af0e8ac110146a481e04
- SHA256 c8fdfc28eef905ea46a167bc4b1e53bf9a010c8bcb0d5d0688c309294affc31c
- MD5 e62d93384d8a97f936c0cc3f86fd0dfe
- SHA1 5c5f2663e9e519b18c929b6b3127445d01b3a59d
- SHA512 c0290b1e4f343aa998027f52f0acd6af23dce4b47a9e796af9cedc31aca5db7262b3348424234777b25a42d3c32fc748bd804d24e2a7e26653bf7535db744c49
- SSDEEP 24576:7hJnE8H+cHzuGK6HNCExwV0MWzxQedCo6ths10iF/e0X:7nnE8HXuGhtXwqMGxQaCG10ik0X
- TLSH T1B3553A536E579978E45AE47082074A621E313CCF1B3778EB40A8B739BEB99F41B39314
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
662592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
sondpi.pdb
kernel32
CreateMutexW
GetStdHandle
GetCurrentProcessId
CreateFileW
SetStdHandle
FindClose
GetModuleHandleW
GetSystemTimePreciseAsFileTime
SetEvent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleWindow
SetUnhandledExceptionFilter
GetCurrentProcess
CreateThread
SetConsoleCtrlHandler
LocalFree
WaitForSingleObject
GetExitCodeProcess
GetLocalTime
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
MoveFileExW
SwitchToThread
CreateEventW
GetLastError
GetProcAddress
CreateNamedPipeW
WaitNamedPipeW
WriteFile
ResetEvent
DisconnectNamedPipe
ConnectNamedPipe
WaitForMultipleObjects
GetOverlappedResult
CancelIoEx
ReadFile
SleepEx
ReadFileEx
WriteFileEx
QueryFullProcessImageNameW
GetFullPathNameW
GetCurrentThreadId
DuplicateHandle
CopyFileExW
LoadLibraryW
SetFileTime
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
CreateDirectoryW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetCurrentDirectoryW
GetCommandLineW
RemoveDirectoryW
FindFirstFileExW
ExitProcess
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetFinalPathNameByHandleW
DeleteFileW
GetEnvironmentVariableW
HeapAlloc
GetModuleFileNameW
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
CreateWaitableTimerExW
SetWaitableTimer
Sleep
GetFileAttributesW
FlsFree
FlsAlloc
GetModuleHandleExW
IsThreadAFiber
FlsSetValue
FormatMessageW
GetModuleHandleA
GetTempPathW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
FindNextFileW
CloseHandle
HeapReAlloc
OpenProcess
GetTickCount64
HeapFree
AttachConsole
SetLastError
GetProcessHeap
IsProcessorFeaturePresent
QueryPerformanceFrequency
WideCharToMultiByte
lstrlenW
CompareStringOrdinal
MultiByteToWideChar
QueryPerformanceCounter
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
user32
GetWindowThreadProcessId
IsWindowVisible
FindWindowExW
SetWindowTextW
DestroyMenu
TrackPopupMenu
SetForegroundWindow
AppendMenuW
MonitorFromPoint
CreatePopupMenu
PostMessageW
GetCursorPos
DefWindowProcW
DrawTextW
GetSysColor
DrawIconEx
FillRect
GetSysColorBrush
SystemParametersInfoForDpi
DestroyWindow
PostQuitMessage
LoadImageW
GetWindowTextW
DispatchMessageW
TranslateMessage
GetMessageW
SetTimer
CreateWindowExW
RegisterWindowMessageW
RegisterClassExW
SetProcessDpiAwarenessContext
MessageBoxW
DestroyIcon
GetSystemMetricsForDpi
GetDpiForSystem
GetDpiForWindow
FindWindowW
CheckMenuItem
ModifyMenuW
CreateIconIndirect
ReleaseDC
GetDC
KillTimer
winhttp
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpQueryOption
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpOpen
WinHttpConnect
WinHttpSendRequest
advapi32
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenSCManagerW
CreateServiceW
ConvertSidToStringSidW
DeleteService
OpenServiceW
ControlService
ChangeServiceConfigW
RegisterServiceCtrlHandlerExW
SetServiceStatus
QueryServiceConfigW
StartServiceCtrlDispatcherW
ChangeServiceConfig2W
QueryServiceStatusEx
RegQueryValueExW
CloseServiceHandle
RegDeleteTreeW
RegOpenKeyExW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegSetValueExW
StartServiceW
GetTokenInformation
gdi32
GetTextMetricsW
SetBkMode
SetTextColor
CreateDIBSection
CreateFontIndirectW
SelectObject
CreateBitmap
DeleteObject
shell32
ShellExecuteW
SHGetKnownFolderPath
Shell_NotifyIconW
ShellExecuteExW
api-ms-win-shcore-scaling-l1-1-1
GetDpiForMonitor
combase
CoTaskMemFree
ntdll
NtCreateNamedPipeFile
NtOpenFile
NtWriteFile
RtlNtStatusToDosError
NtReadFile
bcryptprimitives
ProcessPrng
vcruntime140
_CxxThrowException
__current_exception
memmove
__C_specific_handler
memcpy
memset
__current_exception_context
memcmp
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
wcslen
strlen
api-ms-win-crt-math-l1-1-0
roundf
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
terminate
_initialize_onexit_table
_exit
__p___argv
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_cexit
_configure_narrow_argv
_crt_atexit
_c_exit
__p___argc
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
exit
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Name
.text
Size
666KB
Virtual Size
665KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
499KB
Virtual Size
499KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=9, id=260, version=35207,
count=23, id=261, version=35207,
count=3, id=257, version=33145,
count=254, id=1, productName=Unmarked objects,
count=56, productName=Unmarked objects (old),
count=1, id=255, version=35229,
count=1, id=258, version=35229,