Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Community Scans 358381238a840831da8a6cda...

Community Scan Report

Flagged

358381238a840831da8a6cda16721692df91a74bc44847ff0285da12de788a8d

Detection Ratio

1 / 98 rules matched

9541 ms scan time
1 rule matched

Matches rule Shellcode_NOP_Sled

Matched Strings

$int3
Offset (hex) Offset (dec) Length Matched Data
0x1D5E264 30794340 4 \xCC\xCC\xCC\xCC

Hashes

SHA-256

358381238a840831da8a6cda16721692df91a74bc44847ff0285da12de788a8d

SHA-1

fa6a977048e1eece474e7c38c659f6baba4b5a56

MD5

5b28b5d2ef5830ce3231e4bde29f804f

SHA-512

5cef5739ae83e20d54f349c0e7cbaf6289acc2d5c8472e98bd329e77d87fd16d5d05054dde2281b6f8f4f8daf0d10d4a5318791066febe3ddef85295130de5ce

File Properties

Detected Type Windows Executable (PE)
Magic PE32 executable for MS Windows 4.00 (GUI), Intel i386, UPX compressed, 3 sections
Client MIME application/vnd.microsoft.portable-executable
Size 83.5 MB
Entropy 8.000 / 8.0
possibly packed
Times Analyzed 1
First Analyzed Aug 9, 2026 23:45
Last Analyzed Aug 9, 2026 23:45

Executable (PE) Details

Machine x86 (32-bit)
Bitness 32-bit (PE32)
Subsystem Windows GUI
Compiled 2018-08-30 22:18:33 UTC
Entry Point 0x34FA0
Type EXE
Imphash 05d3dce2be32df01ca249872dd2cc117
Imported DLLs 2
Imported Functions 5
Digitally signed
Section Virtual Size Raw Size Entropy
UPX0 147456 0
UPX1 69632 66048 7.88
.rsrc 65536 64512 7.53
Imported DLLs (2)
KERNEL32.DLL — 4 function(s)
MSVCRT.dll — 1 function(s)

Extracted IOCs

5 indicator(s) found in file content
IP Address
2
1.0.0.0 6.0.0.0
URL
1
http://schemas.microsoft.com/SMI/2005/WindowsSettings
Domain
2
Microsoft.Windows.Common 1.lh

Static Strings

500 strings · printable ASCII ≥ 6 chars
Offset (hex) Offset (dec) String
0x4D 77 !This program cannot be run in DOS mode.
0xCE 206 `YRich
0x4BC 1212 [uN+sn
0xA32 2610 7SLVMd
0xAB7 2743 f ~FB^
0xBA0 2976 mI[J8G
0xBD1 3025 iOTQ'ma
0xDB8 3512 HX,bkl
0xFD1 4049 d'i8^5[
0x1249 4681 jF(chd
0x125E 4702 m,Lq(Gy
0x1349 4937 9^$DSL
0x13E8 5096 %9wsd=
0x145D 5213 gj8#ZD
0x18C3 6339 elptx0|
0x1CF8 7416 IJbdddKLNM
0x1E70 7792 0"-VbK<
0x1EE6 7910 ^Mu;Fr
0x1F6C 8044 u@?hl#Es
0x23C3 9155 %U|I<V'
0x24E0 9440 R*L/PG6;
0x2554 9556 PVN6}3q
0x27AC 10156 i{ /{,
0x281A 10266 LF8GU8s+
0x2BA4 11172 8:^$<W
0x2BCD 11213 W@pZ]:
0x3021 12321 3BU';M
0x325F 12895 F\rvzhP
0x3472 13426 Fps8l+
0x35CD 13773 v,YSt9DMYw,`U
0x3A2D 14893 S-' }Y2Pa
0x3BC2 15298 ~(um6A
0x3DA5 15781 U#^;s/2
0x4033 16435 `]]b?7
0x406E 16494 xrr2xhXD
0x4693 18067 *++bt|
0x4944 18756 wPDZ?@P
0x49FA 18938 999FFFW
0x4B57 19287 V0>~T^
0x4CE0 19680 !9uv}~hPa1,
0x4DA9 19881 X;NTt&
0x4E1A 19994 ..DY8C:
0x4E63 20067 AKs48AD
0x4E92 20114 p6i&,;
0x4F3F 20287 ^Lw;9r
0x558A 21898 5(5\#^
0x55EC 21996 m/D`9n
0x57ED 22509 q*f)9;
0x59A2 22946 LqxzpF
0x5D9C 23964 #j`T,o
0x5F88 24456 ItAVwD
0x5F94 24468 %HtD=u
0x603A 24634 ]G70%u
0x60B3 24755 lYRPP0
0x630D 25357 AZT7;~
0x654F 25935 *xJP^w
0x66DC 26332 w]a0vX-=
0x6732 26418 G=DlEU
0x6780 26496 rin!WPp
0x6829 26665 6`8>&t
0x685B 26715 ,!4|MR(
0x6AB4 27316 #G^(hP
0x6ADD 27357 `\lVWU
0x6F52 28498 e.`t%!
0x7096 28822 0y*.qdl
0x78DA 30938 AN$gA(R
0x7916 30998 ,:9~0t
0x79A8 31144 9r d$T
0x79B6 31158 [Ma0BD
0x7A42 31298 xuqaAq
0x7A5A 31322 FFFENNNFFF
0x7B9E 31646 9^`t\8^=
0x7BAD 31661 73FD+NH
0x7BEA 31722 ^Ln25uo
0x7F02 32514 ,*^X-#
0x8133 33075 }LtkI@
0x8143 33091 yz2_dh
0x81CA 33226 fNQhpP
0x82B1 33457 IuT 4PB
0x832C 33580 jHTlt;
0x848E 33934 <p.u14#
0x8A18 35352 .2\YjGC
0x8A4B 35403 OKSLrr
0x8C03 35843 hh@<V&
0x8FF1 36849 [h@t-j
0x921D 37405 SF[U}ap
0x94FD 38141 x-*ZTn
0x95DC 38364 KBT%.|
0x9A2D 39469 /cF0|"
0x9B36 39734 QSGW:7
0x9C06 39942 HVHHUb
0x9FF7 40951 6q/y$+
0xA56C 42348 WPoJl'
0xA876 43126 P7xccW^i_3
0xA921 43297 X~[]_T
0xAA12 43538 5?9>#0
0xAA1D 43549 _YN][8>tt
0xAAB5 43701 a@4oVT2
0xAB79 43897 Mn6'n P
0xAD1E 44318 (~qGIt8Ftu
0xAE77 44663 K,WOQg
0xAF6D 44909 xK;Ue$n,
0xAFCA 45002 X*}T|v
0xB002 45058 ?989~8B]
0xB032 45106 zfVUF;
0xB0AD 45229 MU>^`r
0xB26B 45675 =<nUt
0xB2E8 45800 3wXrVA
0xB63B 46651 -Dm5|`
0xB683 46723 (pC0HC
0xBA18 47640 20?LAh
0xBF6C 49004 E'fp@]1
0xC366 50022 _?;X5Wr
0xC4E2 50402 ;FS~Xt.
0xC66A 50794 B/RL|@d
0xC7C6 51142 ^j^d][z
0xC7FD 51197 Q^0&G9ht
0xC8A2 51362 s09H,Q
0xC977 51575 UFy+}J
0xC9E5 51685 n!*\hM
0xCB4D 52045 VhAjAA
0xCE02 52738 }QUKUO
0xCFF9 53241 8v5TP(
0xD384 54148 *Yc} xa
0xD647 54855 6D zPS
0xD72F 55087 PJpH.;
0xD8D4 55508 dhCc6i
0xD9B4 55732 w )8n
0xDC8D 56461 +$@:PmU
0xDE10 56848 $$%'
0xDE26 56870 \488<r
0xDE34 56884 \rDDHH
0xDE42 56898 \rrPTTX
0xDE4D 56909 X\\\rr
0xDE54 56916 ``dd%'
0xDE6A 56938 \txx|r
0xE870 59504 g!B4a7
0xE881 59521 c)l`/'
0xE944 59716 0DXj~4M
0xE991 59793 46LXfv
0xEB0F 60175 %<0~gv+
0xEC72 60530 \`7*u]
0xEDE9 60905 GenuineIntelAuth
0xEDFE 60926 ticAMDC
0xEEC3 61123 d`P@&dH
0xEED4 61140 76C2$C542$C2$1(2$C2'&%C2$C$"
0xEF19 61209 USER3_
0xF25B 62043 'HWS/A
0xF780 63360 ?DX<yv
0xF7AB 63403 @6`W8/
0xF86D 63597 PrevExA
0xF881 63617 WGetDialogBaseUnit
0xF89A 63642 ystemP(am
0xF8A7 63655 o)sInfoIMap-Rect
0xF8BC 63676 =Window
0xF8D2 63698 enToCli!u
0xF8F7 63735 ypAaLong
0xF915 63765 WBadStrNg
0xF954 63828 L>gthA
0xF988 63880 Kill([o
0xF992 63890 v`'E6BsC
0xF9FD 63997 .?AVCI
0xFA0B 64011 ivmcepti
0xFA1E 64030 @@/Unsuppor
0xFAD9 64217 T:$DATv
0xFAEE 64238 of memz
0xFAF7 64247 GlobalM}
0xFB6B 64363 #1?'UXTHEME
0xFB7A 64378 gENVwETUjPI\
0xFB8E 64398 ROPSYSQ
0xFB9C 64412 CRYPTBA&
0xFBD4 64468 :an noWpb74
0xFBE2 64482 `pcfil
0xFC1B 64539 l@!UTF-8!
0xFC34 64564 31b?7qia
0xFD29 64809 FyRunP
0xFD78 64888 Qi[pcc
0xFD8A 64906 __MOZHSTOM
0xFDD2 64978 +=Oae4M
0xFDF0 65008 4M9K]o
0xFE5E 65118 JFUQU%
0xFE6A 65130 dTUUU2
0xFF85 65413 LeaveCriP
0xFFCC 65484 G>Last(
0xFFDB 65499 ApisANSI
0xFFFD 65533 AGModW
0x10033 65587 eHandlAS!ZTi
0x1006B 65643 PTcAdd
0x100B3 65715 7f"TkCount"T
0x100F4 65780 Poi85}
0x10114 65812 Aff6%yMCk
0x1015B 65883 VGP]Aldc
0x10164 65892 ]a7)BUVeeME
0x1023B 66107 @@YAXXZ
0x102AA 66218 t$lfp9
0x102C2 66242 Jamyjpu*hR
0x10514 66836 XPTPSW
0x15118 86296 B0E&L?<
0x15302 86786 bN@5'a
0x1550B 87307 4iaL3/
0x15755 87893 PynNu3
0x15BC6 89030 hvZrjZ6
0x15CCC 89292 T%|t+-9
0x161BB 90555 &x5eaG
0x161C5 90565 =n-?fG
0x161D7 90583 ?>Ri,Q
0x16453 91219 C?<T.~
0x16469 91241 u;,fM\M
0x16856 92246 vAI)U[?
0x16B05 92933 Jorze}Xv!3
0x16C64 93284 WqeZv/}
0x17119 94489 E>).r8
0x17293 94867 l$4q,L
0x1749B 95387 +3i\Ytmg
0x17608 95752 Uq|?\[
0x17802 96258 CY>dG@
0x1786D 96365 KVZp#*X
0x17D16 97558 aC[uXw
0x17E0C 97804 dZL1#1
0x18475 99445 JKFqGP
0x18783 100227 =t|ht;
0x18B8E 101262 "lG}NB
0x18E5F 101983 s/.sF7ZBB
0x18ED8 102104 ~:>^Lm
0x19142 102722 (c6FwC
0x19770 104304 y5Q"aD
0x19AA7 105127 8>&lM~
0x19BE6 105446 rCN^n(
0x19F19 106265 &7]}R9
0x1A097 106647 dIA6UUiaP
0x1A2E0 107232 !q`+E;
0x1A458 107608 A7b%%N
0x1B1FD 111101 iGK^a)g
0x1B5D9 112089 =@/tQ^8
0x1B8C8 112840 'SNoiY$0
0x1BE5C 114268 \`xaS#
0x1C0A5 114853 '.6n:!rY9
0x1C333 115507 4'Gs[M
0x1C33B 115515 -]70#)C
0x1CB71 117617 Al^P4F
0x1CC3F 117823 Q~x9 x
0x1CDAA 118186 E$&>-N
0x1CFB0 118704 )mIDAT
0x1D1E0 119264 8Q~,v+;
0x1D60D 120333 $`P!hl
0x1D8D4 121044 ASA)#n6
0x1D923 121123 2^[cZn
0x1DEDD 122589 0dx(.v
0x1E407 123911 D}V/&S
0x1E465 124005 @9(p\\
0x1E6A0 124576 tn^i5_3z
0x1E844 124996 X"G#we
0x1ECC5 126149 fdh,-]^
0x1EDBE 126398 DQ!XeJ
0x1FBF4 130036 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
0x1FC2D 130093 <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
0x1FC78 130168 <assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="7zS.sfx.exe" type="win32"/>
0x1FCDB 130267 <description>7-Zip Self-extracting Archive v18.05</description>
0x1FD1C 130332 <dependency>
0x1FD2A 130346 <dependentAssembly>
0x1FD3F 130367 <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"/>
0x1FDE7 130535 </dependentAssembly>
0x1FDFD 130557 </dependency>
0x1FE0C 130572 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
0x1FE42 130626 <security>
0x1FE4E 130638 <requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/>
0x1FEA2 130722 </requestedPrivileges>
0x1FEBA 130746 </security>
0x1FEC7 130759 </trustInfo>
0x1FED5 130773 <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
0x1FF19 130841 <application>
0x1FF28 130856 <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
0x1FF64 130916 <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
0x1FFA0 130976 <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
0x1FFDC 131036 <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
0x20018 131096 <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
0x20054 131156 </application>
0x20064 131172 </compatibility>
0x20076 131190 <application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings>
0x200BF 131263 <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
0x20118 131352 </windowsSettings>
0x2012C 131372 </application>
0x2013C 131388 </assembly>
0x201A4 131492 KERNEL32.DLL
0x201B1 131505 MSVCRT.dll
0x201BE 131518 ExitProcess
0x201CC 131532 GetProcAddress
0x201DC 131548 LoadLibraryA
0x201EA 131562 VirtualProtect
0x20200 131584 ;!@Install@!UTF-8!
0x20213 131603 Title="Mozilla Firefox"
0x2022B 131627 RunProgram="setup.exe"
0x20242 131650 ;!@InstallEnd@!7z
0x2045C 132188 :A J|KD
0x2047E 132222 -uMo&?3
0x2102C 135212 z?8Z!/
0x2136A 136042 KK\pi}
0x21424 136228 (Nm;qt-
0x21452 136274 [Jry0r`
0x21523 136483 !=tO-!9 |
0x2156C 136556 4X>${j
0x216E8 136936 y"}8sw
0x2196E 137582 c]+#S,
0x21BC3 138179 7L,2Nb
0x21C14 138260 ZegPnW m
0x21E22 138786 rRm8BQ
0x21E5A 138842 !ve2C"R
0x22143 139587 :?U-^]U
0x22587 140679 P8\rpJ
0x22605 140805 j}O>7Wj
0x2295A 141658 IFn)7Y
0x22A9B 141979 vjm8V\i
0x22CB1 142513 T;]8nCR|
0x22CEA 142570 yw{G>2
0x22F88 143240 ?D|5Zb
0x23007 143367 &jY.8^
0x2309E 143518 _8M48g
0x23771 145265 7ICm*Z
0x23F89 147337 T0C`he
0x2403A 147514 xZ%6,f
0x24345 148293 eRR^V:2
0x244C0 148672 y63?7H
0x245DF 148959 YMNW_\~F
0x2489D 149661 cfo.^]
0x248BC 149692 ##.( f
0x24A94 150164 Zw+Kj-
0x24EF6 151286 =WX?|E
0x251BC 151996 +DMa8)
0x2524D 152141 dB~vzmuj
0x26064 155748 =Q& \k
0x2611E 155934 XEp:vZ1
0x26281 156289 `O;ndY
0x26325 156453 *11Lk1$
0x26460 156768 d~-BNy
0x264DE 156894 -M,By\'
0x2691F 157983 5U;Ck;
0x26AE5 158437 <d7++]
0x26ECA 159434 Dw8]c$
0x26FCA 159690 CawRX8
0x26FDB 159707 m {n)x
0x27283 160387 a)t/9E
0x274A2 160930 /*FcJ\ZD
0x27870 161904 /M+U_X/m}UP
0x27ACB 162507 +9*&7
0x27D94 163220 T4nrJ'
0x28217 164375 `/POy~
0x28511 165137 dr{CX6
0x28547 165191 Z.X<8/
0x28C12 166930 .~S,rb
0x28CDC 167132 m-+A[Z
0x28CFD 167165 h>?ecZp
0x28E6F 167535 5=PJ,C
0x29465 169061 JV,a(}{3
0x299DD 170461 9Py},5
0x29A5C 170588 l?c&".(
0x29AF7 170743 bj??_&
0x29DF6 171510 3p&*g$%
0x29EC2 171714 o\1m3g
0x2AB15 174869 .o<4l|
0x2ABAA 175018 U9;X26
0x2AE2F 175663 m#/cIs
0x2AE47 175687 gF`WB3+
0x2AF63 175971 oG{6lU
0x2B0B6 176310 x#c}G,
0x2B446 177222 t+My]:V
0x2B7F9 178169 6n|j)*
0x2BA87 178823 Fa0`?=k
0x2BB1F 178975 g.>V8@.
0x2BD84 179588 9D2Uw5cN4
0x2BE4C 179788 T i"UfL
0x2C331 181041 >|nZIL
0x2C584 181636 JH<c_(
0x2C659 181849 GnEwzi
0x2C69B 181915 Ag:y1S
0x2C915 182549 sEY=em9
0x2C9BD 182717 E$\('$wJ
0x2C9E7 182759 <B6(0\
0x2CB5B 183131 >xX[S~v
0x2CBD1 183249 eAcDFL
0x2CD78 183672 r$6:H1
0x2D2A2 184994 {2AY^PqV
0x2D2C6 185030 nyx{P}
0x2D49A 185498 4Q*I={
0x2D5EF 185839 @2Y|tE
0x2D6EA 186090 ^L>m&gbVq
0x2D7F9 186361 'xY^ko
0x2DB5E 187230 P<TG?f
0x2DB8F 187279 :#st3E
0x2DC58 187480 WV9tbI
0x2DD66 187750 9(klMgq*<
0x2E2E4 189156 KqC|fE
0x2F062 192610 q'(!K&
0x2F08C 192652 ?MdJp"
0x2F30D 193293 U|~ Ab&1
0x2F53E 193854 _.iS~9
0x2F7D9 194521 !(L[JC
0x2F9BF 195007 Bwj*6&
0x2FD4F 195919 I +PxE
0x300C7 196807 dFoPAA
0x302D0 197328 k996-q
0x304A6 197798 YpQsuV
0x306AA 198314 ,YbJD1
0x30D7E 200062 QNxkq\n
0x30EB5 200373 R$0amip
0x310F3 200947 M^T/BGwP
0x313ED 201709 -tV".k
0x315DE 202206 p@hW;dVc
0x31782 202626 1<KZ,/
0x318D5 202965 e?IZQlbG\
0x318EB 202987 C24<S/
0x31E74 204404 %zkj6N
0x31FD6 204758 Ogoq3uk
0x32151 205137 creqDb6
0x324DA 206042 W)7gDb
0x3262F 206383 .N6LH%
0x32854 206932 XcIRS%
0x32A0D 207373 7jXg$w
0x3319F 209311 N*_IO/m
0x3339D 209821 haDu{?
0x33488 210056 ;'NnaN
0x33637 210487 y4"*Q:
0x33795 210837 p/XMtI
0x339C0 211392 UD]>jB
0x33A98 211608 ,m8;F8#Y>I
0x33AF9 211705 eVIYB~
0x33B8D 211853 Y%1x0q
0x33CD7 212183 DK`]Qn
0x33E1A 212506 rQ eeu
0x3444D 214093 /r@hEi;
0x345E7 214503 ,4"[;Y
0x34626 214566 d..wW"
0x34BA7 215975 m.A0d*BDr
0x3516F 217455 J28 m&
0x35344 217924 o/V[:_
0x358F5 219381 <h!=L[!
0x35904 219396 >kzqd;
0x36094 221332 ~B5dN@}
0x360FD 221437 I,~t&+
0x3612D 221485 -WOj1/
0x3642A 222250 D\LCOq
0x366F7 222967 W<N$MA~.f
0x36840 223296 }]SSyX
0x3688F 223375 G6J|[,
0x36E5A 224858 (#O0,ni
0x370AA 225450 Y9Ki|`
0x37204 225796 $XY\ni
0x373FD 226301 lGrmJT
0x37507 226567 liaBo^
0x37852 227410 .wKlvr
0x37C80 228480 vdKZEF
0x37C9B 228507 v~16.A|
0x37CDB 228571 wi]>W2C!//9R)
0x37D2A 228650 wSOF1M
0x3835A 230234 -'G[mc
0x38495 230549 V_)MRO
0x38B48 232264 9[#0PN
0x38B88 232328 +/@]Oo
0x38CDE 232670 REg!Y\
0x38E25 232997 QY7XGo
0x39240 234048 c@/`xP
0x39763 235363 ^NsU}@
0x39795 235413 Ns_q)5duQO
0x39AF4 236276 1A=EW`
0x39C5E 236638 47khxQ
0x39EDE 237278 _vMs3{/
0x3A58D 238989 |#()`{k
0x3A9C2 240066 Igdk?_Jgm
0x3ACC9 240841 7"|"}>
0x3B06A 241770 3Z^aQs
0x3B18D 242061 ',=;gR
0x3B219 242201 ~TK&"2?GhK
0x3B59C 243100 6%n;Y})3
0x3B5EF 243183 Y<}3gh
0x3B6A1 243361 OdbK;'T
0x3BBE8 244712 t)-JIv!
0x3BCE5 244965 \l!@w
0x3C3A9 246697 ~wQ1$E
0x3C5A9 247209 _9uI^?
0x3C729 247593 qD0[s$t
0x3C74A 247626 W_[7=}7
0x3CBFA 248826 8o0Ta T
0x3D034 249908 w2%$.['`
0x3D1A7 250279 :]j,e(
0x3D63F 251455 4^1.lh
0x3D95F 252255 dN.>_(
0x3DC8E 253070 kGv,s;`
0x3DF13 253715 8rhc,E
0x3E0F8 254200 {6 [EL
0x3E332 254770 ap@qg!
0x3E5AD 255405 <4i0P>2R
0x3E981 256385 }a3*-:
0x3EADC 256732 JC.4[h
0x3EB3E 256830 KnlX}HM7<\
0x3EBAD 256941 aYpA"3
0x3EC47 257095 !Sff/\
0x3ECC5 257221 1$*`we
0x3F30E 258830 9kt~l7
0x3F317 258839 UJgV&m
0x3F3B2 258994 *!EOd/
0x3F824 260132 e<Pvo?

Request takedown

Explain why this item should be unpublished from the community. A platform admin will review your request.

Reason
Leaving Threaticon

This link opens an external site that isn't part of the platform.