Rewind.Launcher.exePE analysis report - Suspicious
Run integrity
sample ranThe guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.
44.0sto launch
3telemetry events
3observed
37agent notes
Suspicious
35/100
0 points past the suspicious line at 35, 35 short of malicious at 70.
Clean0-34
Suspicious35-69
Malicious70-100
Why this verdict
+34
Static analysis
- 2 suspicious signature match(es)
- Anti-debug API name(s) IsDebuggerPresent, OutputDebugString: ONE observation read by two static sources, not two findings - signature Suspicious_Anti_Debug_API matched them in the file and the Anti-debugging capability bucket read the same names from the import table; both charges kept.
- 3 high-risk capability bucket(s): Process injection, Privilege escalation, Anti-debugging
+1
Inconclusive
- This run did not finish testing the sample, so it is not cleared. Read the analysis notes above for what was missing.
+0
Execution
- The capability analysis did not finish (capability analysis timed out), so what this file is able to do was never established. The result is inconclusive, not clean.
Model reading
Measured
SUSPICIOUS35 of 100
Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.
Model reads it asadvisory, no points
NOT ASSESSEDnot shown on this page
Reads this report's derived findings, never the sample itself.
A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.
Other high-severity findings
- HIGH Early-bird / QueueUserAPC on suspended process
- HIGH Thread-context hijack injection (SetThreadContext)
Analysis layers
Static
ran
moved the score
Dynamic
ran
no points
Threat intel
local feeds only
no points
AI
not included
Detection signatures
20 detected · 10 withheld as common| Severity | Detection | Evidence | Layer |
|---|---|---|---|
| HIGH |
APC injection primitive (QueueUserAPC)
MITRE T1055.004
|
import
kernel32.dll!QueueUserAPC
|
static |
| HIGH |
Early-bird / QueueUserAPC on suspended process
MITRE T1055.004
|
import
kernel32.dll!QueueUserAPC
requires queueuserapc
import
kernel32.dll!ResumeThread
requires resumethread
|
static |
| HIGH |
Thread-context hijack injection (SetThreadContext)
MITRE T1055.003
|
import
kernel32.dll!SetThreadContext
requires setthreadcontext
import
kernel32.dll!GetThreadContext
requires getthreadcontext
|
static |
| MED |
Creates a suspended process then resumes (hollowing/hijack)
MITRE T1055.012
|
import
kernel32.dll!CreateProcessW
requires createprocess
import
kernel32.dll!ResumeThread
requires resumethread
|
static |
| MED |
Exception-based anti-debug (SEH/VEH install)
MITRE T1622
|
import
kernel32.dll!AddVectoredExceptionHandler
|
static |
| MED |
High file entropy (encrypted/compressed payload)
MITRE T1027
|
entropy
7.96
threshold 7.20, maximum 8.00
|
static |
| MED |
Opens/suspends remote threads
MITRE T1055
|
import
advapi32.dll!OpenThreadToken
requires openthread
import
kernel32.dll!SuspendThread
requires suspendthread
|
static |
| MED |
TLS callback (pre-main execution)
MITRE T1055
|
pe_header
IMAGE_DIRECTORY_ENTRY_TLS present
callbacks run before the entry point
|
static |
| LOW |
Adjusts token privileges (SeDebug / escalation)
MITRE T1134
seen in 8% of benign software
|
import
advapi32.dll!AdjustTokenPrivileges
|
static |
| LOW |
Checks for WOW64 (bitness/anti-analysis)
MITRE T1497
seen in 9% of benign software
|
import
kernel32.dll!IsWow64Process
|
static |
| LOW |
Checks system uptime (sandbox age check)
MITRE T1497.001
seen in 12% of benign software
|
import
kernel32.dll!GetTickCount64
|
static |
| LOW |
Direct memory execution (VirtualProtect + memory copy)
MITRE T1055
seen in 9% of benign software
|
import
kernel32.dll!VirtualProtect
requires virtualprotect
import
kernel32.dll!VirtualAlloc
requires virtualalloc
|
static |
| LOW |
Drops + executes from temp (GetTempPath + CreateProcess)
MITRE T1204
seen in 7% of benign software
|
import
kernel32.dll!GetTempPathW
requires gettemppath
import
kernel32.dll!CreateProcessW
requires createprocess
|
static |
| LOW |
Duplicates a process handle (handle theft)
MITRE T1134
seen in 10% of benign software
|
import
kernel32.dll!DuplicateHandle
|
static |
| LOW |
Executes via ShellExecute
MITRE T1204
seen in 12% of benign software
|
import
shell32.dll!ShellExecuteW
|
static |
| LOW |
Process-injection capability
MITRE T1055
seen in 5% of benign software
|
capability
getthreadcontext
capability: injection
capability
queueuserapc
capability: injection
capability
setthreadcontext
capability: injection
|
static |
| LOW |
Reflective/manual DLL load pattern
MITRE T1620
seen in 8% of benign software
|
import
kernel32.dll!VirtualAlloc
requires virtualalloc
import
kernel32.dll!GetProcAddress
requires getprocaddress
import
kernel32.dll!LoadLibraryA
requires loadlibrary
import
kernel32.dll!CreateThread
requires createthread
|
static |
| LOW |
Sleep-based sandbox evasion
MITRE T1497.003
|
import
kernel32.dll!SleepEx
|
static |
| LOW |
Spawns child processes
MITRE T1106
seen in 16% of benign software
|
import
kernel32.dll!CreateProcessW
|
static |
| INFO |
Stages in the temp directory (GetTempPath)
MITRE T1074
seen in 15% of benign software
|
import
kernel32.dll!GetTempPathW
|
static |
Withheld: 10 rules fired and were not reported above
These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.
Timing-based anti-analysis (QueryPerformanceCounter/rdtsc)
fires on 92% of benign software
Anti-debugging capability
fires on 65% of benign software
Dynamic API resolution (obfuscation)
fires on 65% of benign software
Anti-debug: checks for a debugger
fires on 60% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress)
fires on 49% of benign software
Anti-debug via OutputDebugString probe
fires on 41% of benign software
Creates a named mutex (single-instance / infection marker)
fires on 31% of benign software
Executes external code / commands
fires on 30% of benign software
Queries system information (host recon)
fires on 25% of benign software
Enumerates files recursively (staging/collection)
fires on 21% of benign software
What the tests returned
9 testsEach test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.
| Test | Result |
|---|---|
| Persistence mechanisms | not tested - the autostart surfaces were snapshotted before the sample ran, but this run left no record of the comparison afterwards, so an empty result cannot be read as a clean one |
| Cross-process injection | none observed |
| Payloads written to disk | none observed |
| Network connections | the capture came up and attributed no outbound connection; this run had no route out, so none could have succeeded in any case |
| Behavioural rule matches (Sigma) | none observed |
| Known-malicious hash (reputation sources) | no source reported this file |
| Local anti-virus engine | reported no detection |
| Capability analysis of the file's code | not checked - the check ran past its time limit and was stopped |
| Anti-analysis / evasion checks | not measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched |
Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.
Arguing against malice
- The local anti-virus engine reported no detection.
- No reputation source reported this file as malicious.
How much weight this carries
Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: capability analysis of the file's imports.
Instrument coverage
0 of 2 measuredWhat this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.
| Layer | Ran | What that means |
|---|---|---|
| Runtime anti-analysis watch | not measured | Not measured. No in-process monitor reported in on this run, so the runtime anti-debug and anti-VM calls were never watched and an empty list is not a finding about the sample. |
| Network capture | not on this plan | Not included on this scan's plan. |
| Live kernel introspection | not measured | Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop. |
This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.
Structure
What the file is made of: headers, imports, how it was built and whether it was signed.
Sections & resources
How the file is laid out in memory, and what is embedded in it: section roles, access rights, entropy and every resource entry.
Signatures & packing
What matched and what is hidden: signature rules, detected capabilities, family attribution, packer detection, unpacked payloads and recovered configuration.
Strings
The readable content: embedded secrets, flagged strings and everything extraction recovered.
Code
What the sample would execute: the emulated API call sequence, and the disassembled entry point.
Signature
Microsoft Visual C/C++(19.36.35228)[LTCG/C++]
CompilerMicrosoft Visual C/C++(19.36.35228)[LTCG/C++]
LinkerMicrosoft Linker(14.36.35228)
Library.NET Core(Loader)
Identity
File
typeexecutable
size91.0 MB
file arch64-bit (x64)
subsystemGUI
entropy7.957
date2026-08-20 21:04:36 UTC
version1.6.9.0
descriptionRewind.Launcher
productRewind.Launcher
original nameRewind.Launcher.dll
languageNEU
Antivirus engine
no signature matched signature set 28151 - 3.6M signaturesNothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.
| Signature set | Value |
|---|---|
| Set version | 28151 |
| Signatures in the set | 3,642,867 |
| Set published | 12 Oct 2026 06:24 +0000 |
| Age when this file was scanned | same day |
A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.
Local ML assessment
no model scoreNo model score exists for this file: the file is larger than the 32 MB the local model is allowed to read in one scan, so it got a static heuristic instead. That is a gap in coverage and not a finding - the absence of a score here says nothing about the file.
Structural rules of thumb, not a model. 3 cheap static signals fired, for 45 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.
- high entropy 7.957
- unsigned executable
- TLS callback
Packing
Not packed
This file's code is readable on disk - nothing is compressed or encrypted around it.
30/100
packer confidence
Static analysis reads this file directly
Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed 3 signals
- Non-standard section names: .CLR_UEF, Section, _RDATA
- Embedded executable in resources
- TLS callback present
Family configuration search
Not attemptedThe sample is 91.0 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.
| Sample size | 91.0 MB |
|---|---|
| Bound | 16.0 MB |
| Limit reached | Sample size, before any parser was loaded. |
Capabilities
8 behaviour buckets · 3 high-risk| Severity | Capability | MITRE | APIs |
|---|---|---|---|
| high | Process injection Writes and runs code inside another process |
T1055.004, T1055.012 | getthreadcontext, queueuserapc, setthreadcontext |
| high | Privilege escalation Adjusts tokens / privileges |
T1134, T1134.001 | adjusttokenprivileges, openprocesstoken, setthreadtoken |
| high | Anti-debugging Detects or obstructs a debugger |
T1622 | isdebuggerpresent, outputdebugstringa |
| med | Evasion / stalling Sleeps, times, or otherwise stalls analysis |
T1497, T1497.003 | getsystemtimeasfiletime, gettickcount, gettickcount64, queryperformancecounter, sleep, sleepex |
| med | Dynamic API resolution Resolves APIs at runtime (obfuscation) |
T1129 | getprocaddress, loadlibrarya, loadlibraryexa, loadlibraryw |
| med | Code execution Creates processes / runs commands or shellcode |
T1106, T1203 | createprocessw, createthread, shellexecutew |
| med | Ransomware behaviour Enumerates + encrypts files, deletes backups |
T1083 | findnextfilew |
| low | Discovery Enumerates the host, users, processes or network |
T1082 | getsysteminfo |
Security mitigations
strong posture
ON
ASLR (DynamicBase)
ON
High-entropy ASLR (64-bit)
ON
DEP / NX (NxCompat)
ON
Control Flow Guard
OFF
SafeSEH
ON
Stack cookies (GS)
OFF
Force Integrity
OFF
AppContainer isolation
OFF
Authenticode signed
Rich header (toolchain)
richhash f0983f26bfb762b1| Tool | Build | Uses |
|---|---|---|
| prodid_147 | 30729 | 22 |
| Utc1900 (VS2017) | 35207 | 20 |
| Cvtres 14.10 | 35207 | 18 |
| Export 14.10 | 35207 | 96 |
| Cvtres 14.10 | 33145 | 8 |
| Utc1900 (VS2017) | 33145 | 13 |
| Import (linker) | 0 | 521 |
| Utc1900 (VS2017) | 35228 | 21 |
| prodid_265 | 35228 | 653 |
| Alias | 35228 | 1 |
| Implib | 35228 | 1 |
| AliasObj 14.10 | 35228 | 1 |
Sections
10 sections · the file's memory layout| Section | Virtual addr | Raw size | Virtual size | Access | Entropy |
|---|---|---|---|---|---|
|
.textEP
Executable code
|
0x1000 |
6.1 MB
|
6.1 MB
|
EXECUTEREAD
|
6.4518
|
|
.CLR_UEF
Non-standard section
|
0x610000 |
512.0 B
|
221.0 B
|
EXECUTEREAD
|
3.0923
|
|
.rdata
Read-only data
|
0x611000 |
1.5 MB
|
1.5 MB
|
READ
|
5.6744
|
|
.data
Initialised data
|
0x790000 |
38.0 KB
|
127.9 KB
expands
|
READWRITE
|
3.3151
|
|
.pdata
Exception unwind data
|
0x7b0000 |
216.5 KB
|
216.1 KB
|
READ
|
6.4787
|
|
.didat
Delay-load imports
|
0x7e7000 |
512.0 B
|
56.0 B
|
READWRITE
|
0.4098
|
|
Section
Non-standard section
|
0x7e8000 |
512.0 B
|
8.0 B
|
READWRITE
|
0.0
|
|
_RDATA
Non-standard section
|
0x7e9000 |
77.0 KB
|
76.5 KB
|
READ
|
5.4827
|
|
.rsrc
Resources
|
0x7fd000 |
1.3 MB
|
1.3 MB
|
READ
|
6.3549
|
|
.reloc
Base relocations
|
0x947000 |
32.0 KB
|
31.6 KB
|
READ
|
5.4457
|
code
data
imports/exports
resources
metadata
packer
non-standard
Entropy above 7.0 means compressed or encrypted content.
Imports
458 funcs / 17 DLLs · 19 suspicious▸KERNEL32.dll196 funcs 15 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| RaiseException | 0x006110a8 | - | - |
| FreeLibrary | 0x006110b0 | - | - |
| SetErrorMode | 0x006110b8 | - | - |
| RaiseFailFastException | 0x006110c0 | - | - |
| GetExitCodeProcess | 0x006110c8 | - | - |
| TerminateProcess | 0x006110d0 | - | - |
| UnhandledExceptionFilter | 0x006110d8 | - | - |
| SetUnhandledExceptionFilter | 0x006110e0 | - | - |
| AddVectoredExceptionHandler | 0x006110e8 | - | - |
| MultiByteToWideChar | 0x006110f0 | - | - |
| GetTickCount | 0x006110f8 | - | T1497 |
| FlushInstructionCache | 0x00611100 | - | - |
| QueryPerformanceFrequency | 0x00611108 | - | - |
| QueryPerformanceCounter | 0x00611110 | - | T1497 |
| RtlLookupFunctionEntry | 0x00611118 | yes | - |
| LocateXStateFeature | 0x00611120 | - | - |
| RtlDeleteFunctionTable | 0x00611128 | yes | - |
| InterlockedPushEntrySList | 0x00611130 | - | - |
| InterlockedFlushSList | 0x00611138 | - | - |
| InitializeSListHead | 0x00611140 | - | - |
| GetTickCount64 | 0x00611148 | - | - |
| DuplicateHandle | 0x00611150 | - | - |
| QueueUserAPC | 0x00611158 | - | T1055 |
| WaitForSingleObjectEx | 0x00611160 | - | - |
| SetThreadPriority | 0x00611168 | - | - |
| GetThreadPriority | 0x00611170 | - | - |
| GetCurrentThreadId | 0x00611178 | - | - |
| TlsAlloc | 0x00611180 | - | - |
| GetCurrentThread | 0x00611188 | - | - |
| GetCurrentProcessId | 0x00611190 | - | - |
| CreateThread | 0x00611198 | - | - |
| GetModuleHandleW | 0x006111a0 | - | - |
| WaitForMultipleObjectsEx | 0x006111a8 | - | - |
| SignalObjectAndWait | 0x006111b0 | - | - |
| RtlCaptureContext | 0x006111b8 | yes | - |
| SetThreadStackGuarantee | 0x006111c0 | - | - |
| VirtualQuery | 0x006111c8 | - | - |
| WriteFile | 0x006111d0 | - | - |
| GetStdHandle | 0x006111d8 | - | - |
| GetConsoleOutputCP | 0x006111e0 | - | - |
| MapViewOfFileEx | 0x006111e8 | - | - |
| UnmapViewOfFile | 0x006111f0 | - | - |
| GetStringTypeExW | 0x006111f8 | - | - |
| InterlockedPopEntrySList | 0x00611200 | - | - |
| ExitProcess | 0x00611208 | - | - |
| Sleep | 0x00611210 | - | - |
| CreateMemoryResourceNotification | 0x00611218 | - | - |
| VirtualAlloc | 0x00611220 | - | T1055 |
| VirtualFree | 0x00611228 | - | - |
| VirtualProtect | 0x00611230 | - | T1055 |
| SleepEx | 0x00611238 | - | - |
| SwitchToThread | 0x00611240 | - | - |
| SuspendThread | 0x00611248 | - | - |
| ResumeThread | 0x00611250 | - | - |
| InitializeContext | 0x00611258 | - | - |
| SetXStateFeaturesMask | 0x00611260 | - | - |
| RtlRestoreContext | 0x00611268 | yes | - |
| CloseThreadpoolTimer | 0x00611270 | - | - |
| CreateThreadpoolTimer | 0x00611278 | - | - |
| SetThreadpoolTimer | 0x00611280 | - | - |
| ReadFile | 0x00611288 | - | - |
| GetFileSize | 0x00611290 | - | - |
| GetEnvironmentVariableW | 0x00611298 | - | - |
| SetEnvironmentVariableW | 0x006112a0 | - | - |
| CreateEventW | 0x006112a8 | - | - |
| SetEvent | 0x006112b0 | - | - |
| ResetEvent | 0x006112b8 | - | - |
| GetThreadContext | 0x006112c0 | - | - |
| SetThreadContext | 0x006112c8 | - | T1055 |
| GetEnabledXStateFeatures | 0x006112d0 | - | - |
| CopyContext | 0x006112d8 | - | - |
| WerRegisterRuntimeExceptionModule | 0x006112e0 | - | - |
| RtlInstallFunctionTableCallback | 0x006112e8 | yes | - |
| GetSystemDefaultLCID | 0x006112f0 | - | - |
| GetUserDefaultLCID | 0x006112f8 | - | - |
| RtlUnwind | 0x00611300 | yes | - |
| HeapAlloc | 0x00611308 | - | - |
| HeapFree | 0x00611310 | - | - |
| GetProcessHeap | 0x00611318 | - | - |
| HeapCreate | 0x00611320 | - | - |
| HeapDestroy | 0x00611328 | - | - |
| GetEnvironmentStringsW | 0x00611330 | - | - |
| FreeEnvironmentStringsW | 0x00611338 | - | - |
| FormatMessageW | 0x00611340 | - | - |
| CreateSemaphoreExW | 0x00611348 | - | - |
| ReleaseSemaphore | 0x00611350 | - | - |
| GetACP | 0x00611358 | - | - |
| LCMapStringEx | 0x00611360 | - | - |
| LocalFree | 0x00611368 | - | - |
| VerSetConditionMask | 0x00611370 | - | - |
| VerifyVersionInfoW | 0x00611378 | - | - |
| QueryThreadCycleTime | 0x00611380 | - | - |
| GetLogicalProcessorInformationEx | 0x00611388 | - | - |
| SetThreadGroupAffinity | 0x00611390 | - | - |
| GetThreadGroupAffinity | 0x00611398 | - | - |
| GetProcessGroupAffinity | 0x006113a0 | - | - |
| GetCurrentProcessorNumberEx | 0x006113a8 | - | - |
| GetProcessAffinityMask | 0x006113b0 | - | - |
| QueryInformationJobObject | 0x006113b8 | - | - |
| CloseHandle | 0x006113c0 | - | - |
| GetSystemTimeAsFileTime | 0x006113c8 | - | - |
| GetModuleFileNameW | 0x006113d0 | - | - |
| CreateProcessW | 0x006113d8 | - | T1106 |
| GetCPInfo | 0x006113e0 | - | - |
| LoadLibraryExW | 0x006113e8 | - | - |
| CreateFileW | 0x006113f0 | - | - |
| GetFileAttributesExW | 0x006113f8 | - | - |
| GetFullPathNameW | 0x00611400 | - | - |
| LoadLibraryExA | 0x00611408 | - | - |
| OutputDebugStringA | 0x00611410 | - | T1622 |
| OpenEventW | 0x00611418 | - | - |
| ReleaseMutex | 0x00611420 | - | - |
| ExitThread | 0x00611428 | - | - |
| CreateMutexW | 0x00611430 | - | T1027 |
| HeapReAlloc | 0x00611438 | - | - |
| CreateNamedPipeA | 0x00611440 | - | - |
| WaitForMultipleObjects | 0x00611448 | - | - |
| DisconnectNamedPipe | 0x00611450 | - | - |
| CreateFileA | 0x00611458 | - | - |
| CancelIoEx | 0x00611460 | - | - |
| GetOverlappedResult | 0x00611468 | - | - |
| ConnectNamedPipe | 0x00611470 | - | - |
| FlushFileBuffers | 0x00611478 | - | - |
| SetFilePointer | 0x00611480 | - | - |
| MapViewOfFile | 0x00611488 | - | - |
| GetActiveProcessorGroupCount | 0x00611490 | - | - |
| GetSystemTime | 0x00611498 | - | - |
| SetConsoleCtrlHandler | 0x006114a0 | - | - |
| GetLocaleInfoEx | 0x006114a8 | - | - |
| GetUserDefaultLocaleName | 0x006114b0 | - | - |
| RtlAddFunctionTable | 0x006114b8 | yes | - |
| LoadLibraryW | 0x006114c0 | - | T1129 |
| CreateDirectoryW | 0x006114c8 | - | - |
| RemoveDirectoryW | 0x006114d0 | - | - |
| CreateActCtxW | 0x006114d8 | - | - |
| ActivateActCtx | 0x006114e0 | - | - |
| FindResourceW | 0x006114e8 | - | - |
| GetWindowsDirectoryW | 0x006114f0 | - | - |
| GetFileSizeEx | 0x006114f8 | - | - |
| FindFirstFileExW | 0x00611500 | - | - |
| FindNextFileW | 0x00611508 | - | T1083 |
| GetTempPathW | 0x00611510 | - | - |
| FindClose | 0x00611518 | - | - |
| LoadLibraryA | 0x00611520 | - | T1129 |
| GetCurrentDirectoryW | 0x00611528 | - | - |
| IsWow64Process | 0x00611530 | - | - |
| EncodePointer | 0x00611538 | - | - |
| DecodePointer | 0x00611540 | - | - |
| CreateFileMappingA | 0x00611548 | - | - |
| TlsSetValue | 0x00611550 | - | - |
| TlsGetValue | 0x00611558 | - | - |
| GetSystemInfo | 0x00611560 | - | - |
| GetCurrentProcess | 0x00611568 | - | - |
| OutputDebugStringW | 0x00611570 | - | T1622 |
| IsDebuggerPresent | 0x00611578 | - | T1622 |
| LeaveCriticalSection | 0x00611580 | - | - |
| EnterCriticalSection | 0x00611588 | - | - |
| DeleteCriticalSection | 0x00611590 | - | - |
| InitializeCriticalSection | 0x00611598 | - | - |
| WideCharToMultiByte | 0x006115a0 | - | - |
| GetCommandLineW | 0x006115a8 | - | - |
| GetProcAddress | 0x006115b0 | - | T1129 |
| GetModuleHandleExW | 0x006115b8 | - | - |
| SetThreadErrorMode | 0x006115c0 | - | - |
| FlushProcessWriteBuffers | 0x006115c8 | - | - |
| SetLastError | 0x006115d0 | - | - |
| DebugBreak | 0x006115d8 | - | - |
| WaitForSingleObject | 0x006115e0 | - | - |
| GetNumaHighestNodeNumber | 0x006115e8 | - | - |
| SetThreadAffinityMask | 0x006115f0 | - | - |
| SetThreadIdealProcessorEx | 0x006115f8 | - | - |
| GetThreadIdealProcessorEx | 0x00611600 | - | - |
| VirtualAllocExNuma | 0x00611608 | - | - |
| GetNumaProcessorNodeEx | 0x00611610 | - | - |
| VirtualUnlock | 0x00611618 | - | - |
| GetLargePageMinimum | 0x00611620 | - | - |
| IsProcessInJob | 0x00611628 | - | - |
| K32GetProcessMemoryInfo | 0x00611630 | - | - |
| GetLogicalProcessorInformation | 0x00611638 | - | - |
| GlobalMemoryStatusEx | 0x00611640 | - | - |
| ReleaseSRWLockExclusive | 0x00611648 | - | - |
| AcquireSRWLockExclusive | 0x00611650 | - | - |
| WakeAllConditionVariable | 0x00611658 | - | - |
| SleepConditionVariableSRW | 0x00611660 | - | - |
| RtlVirtualUnwind | 0x00611668 | yes | - |
| IsProcessorFeaturePresent | 0x00611670 | - | - |
| RtlUnwindEx | 0x00611678 | yes | - |
| InitializeCriticalSectionAndSpinCount | 0x00611680 | - | - |
| TlsFree | 0x00611688 | - | - |
| RtlPcToFileHeader | 0x00611690 | yes | - |
| TryAcquireSRWLockExclusive | 0x00611698 | - | - |
| GetExitCodeThread | 0x006116a0 | - | - |
| GetStringTypeW | 0x006116a8 | - | - |
| InitializeCriticalSectionEx | 0x006116b0 | - | - |
| GetLastError | 0x006116b8 | - | - |
| CreateFileMappingW | 0x006116c0 | - | - |
▸ADVAPI32.dll20 funcs 3 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| ReportEventW | 0x00611000 | - | - |
| AdjustTokenPrivileges | 0x00611008 | - | T1134 |
| RegGetValueW | 0x00611010 | - | - |
| SetKernelObjectSecurity | 0x00611018 | - | - |
| GetSidSubAuthorityCount | 0x00611020 | - | - |
| GetSidSubAuthority | 0x00611028 | - | - |
| GetTokenInformation | 0x00611030 | - | - |
| OpenProcessToken | 0x00611038 | - | T1134 |
| DeregisterEventSource | 0x00611040 | - | - |
| RegisterEventSourceW | 0x00611048 | - | - |
| RegQueryValueExW | 0x00611050 | - | - |
| RegOpenKeyExW | 0x00611058 | - | - |
| RegCloseKey | 0x00611060 | - | - |
| EventRegister | 0x00611068 | - | - |
| SetThreadToken | 0x00611070 | - | - |
| RevertToSelf | 0x00611078 | - | - |
| OpenThreadToken | 0x00611080 | - | - |
| EventWriteTransfer | 0x00611088 | - | - |
| EventWrite | 0x00611090 | - | - |
| LookupPrivilegeValueW | 0x00611098 | - | T1134 |
▸ole32.dll18 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| CoCreateFreeThreadedMarshaler | 0x00611e40 | - | - |
| CreateStreamOnHGlobal | 0x00611e48 | - | - |
| CoRevokeInitializeSpy | 0x00611e50 | - | - |
| CoGetContextToken | 0x00611e58 | - | - |
| CoGetObjectContext | 0x00611e60 | - | - |
| CoUnmarshalInterface | 0x00611e68 | - | - |
| CoMarshalInterface | 0x00611e70 | - | - |
| CoGetMarshalSizeMax | 0x00611e78 | - | - |
| CLSIDFromProgID | 0x00611e80 | - | - |
| CoReleaseMarshalData | 0x00611e88 | - | - |
| CoTaskMemFree | 0x00611e90 | - | - |
| CoTaskMemAlloc | 0x00611e98 | - | - |
| CoCreateGuid | 0x00611ea0 | - | - |
| CoInitializeEx | 0x00611ea8 | - | - |
| CoRegisterInitializeSpy | 0x00611eb0 | - | - |
| CoWaitForMultipleHandles | 0x00611eb8 | - | - |
| CoUninitialize | 0x00611ec0 | - | - |
| CoGetClassObject | 0x00611ec8 | - | - |
▸OLEAUT32.dll28 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| CreateErrorInfo | 0x006116d0 | - | - |
| SysFreeString | 0x006116d8 | - | - |
| GetErrorInfo | 0x006116e0 | - | - |
| SetErrorInfo | 0x006116e8 | - | - |
| SysStringLen | 0x006116f0 | - | - |
| SysAllocString | 0x006116f8 | - | - |
| SysAllocStringLen | 0x00611700 | - | - |
| SafeArrayGetDim | 0x00611708 | - | - |
| SafeArrayGetLBound | 0x00611710 | - | - |
| SafeArrayDestroy | 0x00611718 | - | - |
| QueryPathOfRegTypeLib | 0x00611720 | - | - |
| LoadTypeLibEx | 0x00611728 | - | - |
| SafeArrayGetVartype | 0x00611730 | - | - |
| VariantChangeType | 0x00611738 | - | - |
| VariantChangeTypeEx | 0x00611740 | - | - |
| VariantClear | 0x00611748 | - | - |
| VariantInit | 0x00611750 | - | - |
| VarCyFromDec | 0x00611758 | - | - |
| SafeArrayAllocDescriptorEx | 0x00611760 | - | - |
| GetRecordInfoFromTypeInfo | 0x00611768 | - | - |
| SafeArraySetRecordInfo | 0x00611770 | - | - |
| SafeArrayAllocData | 0x00611778 | - | - |
| SafeArrayGetElemsize | 0x00611780 | - | - |
| SysStringByteLen | 0x00611788 | - | - |
| SysAllocStringByteLen | 0x00611790 | - | - |
| SafeArrayCreateVector | 0x00611798 | - | - |
| SafeArrayPutElement | 0x006117a0 | - | - |
| LoadRegTypeLib | 0x006117a8 | - | - |
▸USER32.dll2 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| LoadStringW | 0x006117c8 | - | - |
| MessageBoxW | 0x006117d0 | - | - |
▸SHELL32.dll1 func 1 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| ShellExecuteW | 0x006117b8 | - | T1106 |
▸api-ms-win-crt-string-l1-1-0.dll37 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| strncat_s | 0x00611ce0 | - | - |
| wcsncat_s | 0x00611ce8 | - | - |
| _wcsicmp | 0x00611cf0 | - | - |
| wcsnlen | 0x00611cf8 | - | - |
| wcscat_s | 0x00611d00 | - | - |
| towupper | 0x00611d08 | - | - |
| iswascii | 0x00611d10 | - | - |
| _strdup | 0x00611d18 | - | - |
| strncpy | 0x00611d20 | - | - |
| strnlen | 0x00611d28 | - | - |
| wcstok_s | 0x00611d30 | - | - |
| isdigit | 0x00611d38 | - | - |
| isupper | 0x00611d40 | - | - |
| isalpha | 0x00611d48 | - | - |
| towlower | 0x00611d50 | - | - |
| _wcsdup | 0x00611d58 | - | - |
| iswspace | 0x00611d60 | - | - |
| isspace | 0x00611d68 | - | - |
| islower | 0x00611d70 | - | - |
| strtok_s | 0x00611d78 | - | - |
| strcmp | 0x00611d80 | - | - |
| strcspn | 0x00611d88 | - | - |
| __strncnt | 0x00611d90 | - | - |
| _wcsnicmp | 0x00611d98 | - | - |
| strlen | 0x00611da0 | - | - |
| wcscpy_s | 0x00611da8 | - | - |
| toupper | 0x00611db0 | - | - |
| wcsncpy_s | 0x00611db8 | - | - |
| strcpy_s | 0x00611dc0 | - | - |
| strcat_s | 0x00611dc8 | - | - |
| strncpy_s | 0x00611dd0 | - | - |
| _strnicmp | 0x00611dd8 | - | - |
| tolower | 0x00611de0 | - | - |
| wcsncmp | 0x00611de8 | - | - |
| iswupper | 0x00611df0 | - | - |
| strncmp | 0x00611df8 | - | - |
| _stricmp | 0x00611e00 | - | - |
▸api-ms-win-crt-stdio-l1-1-0.dll35 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| __stdio_common_vsscanf | 0x00611bc0 | - | - |
| fflush | 0x00611bc8 | - | - |
| __acrt_iob_func | 0x00611bd0 | - | - |
| __stdio_common_vfprintf | 0x00611bd8 | - | - |
| __stdio_common_vswprintf | 0x00611be0 | - | - |
| __stdio_common_vfwprintf | 0x00611be8 | - | - |
| fputws | 0x00611bf0 | - | - |
| fputwc | 0x00611bf8 | - | - |
| _get_stream_buffer_pointers | 0x00611c00 | - | - |
| _fseeki64 | 0x00611c08 | - | - |
| fread | 0x00611c10 | - | - |
| fsetpos | 0x00611c18 | - | - |
| ungetc | 0x00611c20 | - | - |
| fgetpos | 0x00611c28 | - | - |
| fgets | 0x00611c30 | - | - |
| fgetc | 0x00611c38 | - | - |
| fputc | 0x00611c40 | - | - |
| _wfsopen | 0x00611c48 | - | - |
| _wfopen | 0x00611c50 | - | - |
| __p__commode | 0x00611c58 | - | - |
| _set_fmode | 0x00611c60 | - | - |
| __stdio_common_vsnprintf_s | 0x00611c68 | - | - |
| setvbuf | 0x00611c70 | - | - |
| _setmode | 0x00611c78 | - | - |
| _dup | 0x00611c80 | - | - |
| _fileno | 0x00611c88 | - | - |
| ftell | 0x00611c90 | - | - |
| fseek | 0x00611c98 | - | - |
| fputs | 0x00611ca0 | - | - |
| __stdio_common_vsnwprintf_s | 0x00611ca8 | - | - |
| __stdio_common_vsprintf_s | 0x00611cb0 | - | - |
| fwrite | 0x00611cb8 | - | - |
| _flushall | 0x00611cc0 | - | - |
| fopen | 0x00611cc8 | - | - |
| fclose | 0x00611cd0 | - | - |
▸api-ms-win-crt-runtime-l1-1-0.dll25 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _crt_atexit | 0x00611af0 | - | - |
| _cexit | 0x00611af8 | - | - |
| _seh_filter_exe | 0x00611b00 | - | - |
| _set_app_type | 0x00611b08 | - | - |
| _register_onexit_function | 0x00611b10 | - | - |
| _configure_wide_argv | 0x00611b18 | - | - |
| _initialize_wide_environment | 0x00611b20 | - | - |
| _get_initial_wide_environment | 0x00611b28 | - | - |
| _initterm | 0x00611b30 | - | - |
| _initterm_e | 0x00611b38 | - | - |
| _exit | 0x00611b40 | - | - |
| _invoke_watson | 0x00611b48 | - | - |
| __p___argc | 0x00611b50 | - | - |
| __p___wargv | 0x00611b58 | - | - |
| _c_exit | 0x00611b60 | - | - |
| _register_thread_local_exe_atexit_callback | 0x00611b68 | - | - |
| _initialize_onexit_table | 0x00611b70 | - | - |
| _beginthreadex | 0x00611b78 | - | - |
| terminate | 0x00611b80 | - | - |
| _controlfp_s | 0x00611b88 | - | - |
| _wcserror_s | 0x00611b90 | - | - |
| _invalid_parameter_noinfo | 0x00611b98 | - | - |
| _errno | 0x00611ba0 | - | - |
| exit | 0x00611ba8 | - | - |
| abort | 0x00611bb0 | - | - |
▸api-ms-win-crt-convert-l1-1-0.dll9 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _atoi64 | 0x006117e0 | - | - |
| _ltow_s | 0x006117e8 | - | - |
| _wtoi | 0x006117f0 | - | - |
| strtoul | 0x006117f8 | - | - |
| _wcstoui64 | 0x00611800 | - | - |
| atol | 0x00611808 | - | - |
| _itow_s | 0x00611810 | - | - |
| strtoull | 0x00611818 | - | - |
| wcstoul | 0x00611820 | - | - |
▸api-ms-win-crt-heap-l1-1-0.dll5 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| free | 0x00611868 | - | - |
| _set_new_mode | 0x00611870 | - | - |
| calloc | 0x00611878 | - | - |
| malloc | 0x00611880 | - | - |
| realloc | 0x00611888 | - | - |
▸api-ms-win-crt-utility-l1-1-0.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| qsort | 0x00611e30 | - | - |
▸api-ms-win-crt-math-l1-1-0.dll64 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| asinhf | 0x006118e8 | - | - |
| atanhf | 0x006118f0 | - | - |
| cbrtf | 0x006118f8 | - | - |
| acoshf | 0x00611900 | - | - |
| cosh | 0x00611908 | - | - |
| cbrt | 0x00611910 | - | - |
| coshf | 0x00611918 | - | - |
| exp | 0x00611920 | - | - |
| expf | 0x00611928 | - | - |
| acosh | 0x00611930 | - | - |
| atanh | 0x00611938 | - | - |
| floor | 0x00611940 | - | - |
| floorf | 0x00611948 | - | - |
| fma | 0x00611950 | - | - |
| fmaf | 0x00611958 | - | - |
| cosf | 0x00611960 | - | - |
| _fdopen | 0x00611968 | - | - |
| cos | 0x00611970 | - | - |
| ceilf | 0x00611978 | - | - |
| _copysignf | 0x00611980 | - | - |
| _isnanf | 0x00611988 | - | - |
| trunc | 0x00611990 | - | - |
| truncf | 0x00611998 | - | - |
| ilogb | 0x006119a0 | - | - |
| ilogbf | 0x006119a8 | - | - |
| tanhf | 0x006119b0 | - | - |
| ceil | 0x006119b8 | - | - |
| fmod | 0x006119c0 | - | - |
| fmodf | 0x006119c8 | - | - |
| atanf | 0x006119d0 | - | - |
| frexp | 0x006119d8 | - | - |
| atan2f | 0x006119e0 | - | - |
| atan2 | 0x006119e8 | - | - |
| log | 0x006119f0 | - | - |
| log10 | 0x006119f8 | - | - |
| log10f | 0x00611a00 | - | - |
| atan | 0x00611a08 | - | - |
| asinf | 0x00611a10 | - | - |
| log2 | 0x00611a18 | - | - |
| log2f | 0x00611a20 | - | - |
| logf | 0x00611a28 | - | - |
| pow | 0x00611a30 | - | - |
| powf | 0x00611a38 | - | - |
| sin | 0x00611a40 | - | - |
| sinf | 0x00611a48 | - | - |
| asin | 0x00611a50 | - | - |
| sinh | 0x00611a58 | - | - |
| sinhf | 0x00611a60 | - | - |
| sqrt | 0x00611a68 | - | - |
| sqrtf | 0x00611a70 | - | - |
| tan | 0x00611a78 | - | - |
| tanf | 0x00611a80 | - | - |
| tanh | 0x00611a88 | - | - |
| acosf | 0x00611a90 | - | - |
| _copysign | 0x00611a98 | - | - |
| asinh | 0x00611aa0 | - | - |
| _isnan | 0x00611aa8 | - | - |
| _finite | 0x00611ab0 | - | - |
| modf | 0x00611ab8 | - | - |
| modff | 0x00611ac0 | - | - |
| _dclass | 0x00611ac8 | - | - |
| _ldclass | 0x00611ad0 | - | - |
| acos | 0x00611ad8 | - | - |
| __setusermatherr | 0x00611ae0 | - | - |
▸api-ms-win-crt-time-l1-1-0.dll3 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _time64 | 0x00611e10 | - | - |
| _gmtime64_s | 0x00611e18 | - | - |
| wcsftime | 0x00611e20 | - | - |
▸api-ms-win-crt-environment-l1-1-0.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| getenv | 0x00611830 | - | - |
▸api-ms-win-crt-locale-l1-1-0.dll9 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _unlock_locales | 0x00611898 | - | - |
| setlocale | 0x006118a0 | - | - |
| __pctype_func | 0x006118a8 | - | - |
| ___lc_locale_name_func | 0x006118b0 | - | - |
| _lock_locales | 0x006118b8 | - | - |
| ___lc_codepage_func | 0x006118c0 | - | - |
| ___mb_cur_max_func | 0x006118c8 | - | - |
| _configthreadlocale | 0x006118d0 | - | - |
| localeconv | 0x006118d8 | - | - |
▸api-ms-win-crt-filesystem-l1-1-0.dll4 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _wrename | 0x00611840 | - | - |
| _unlock_file | 0x00611848 | - | - |
| _wremove | 0x00611850 | - | - |
| _lock_file | 0x00611858 | - | - |
Binary metadata
what the headers declare about this build| Resource langs | NEU |
|---|---|
| Debug info | yes |
| TLS callbacks | yes |
Code signing
UnsignedThis binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.
Resources
Everything the binary carries inside it: icons, bitmaps, cursors, dialogs, string tables, the manifest and the version block. Select an entry to preview it and take a copy.
Resources
Resource Hacker view
Manifest1RCData3Version Info1
▸Manifest1
1NEU
▸RCData3
CLRDEBUGINFONEU
CLRDEBUGINFOWINDOWSAMD64NEU
MINIDUMP_EMBEDDED_AUXILIARY_PROVIDERNEU
▸Version Info1
1NEU
Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.
Manifest 1
Download
| Type | Manifest |
|---|---|
| Name / ID | 1 |
| Language | NEU |
| Size | 490.0 B |
| RVA offset | 0x946a88 |
| Content signature | XML manifest |
| MD5 | b7db84991f23a680df8e95af8946f9c9 |
| Entropy | 5.001 |
Application manifest
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
RCData CLRDEBUGINFO
Download
| Type | RCData |
|---|---|
| Name / ID | CLRDEBUGINFO |
| Language | NEU |
| Size | 36.0 B |
| RVA offset | 0x7fd190 |
| Content signature | RCData |
| MD5 | 2f1e91fd43c76f244eec9cb299568a71 |
| Entropy | 4.337 |
RCData CLRDEBUGINFOWINDOWSAMD64
Download
| Type | RCData |
|---|---|
| Name / ID | CLRDEBUGINFOWINDOWSAMD64 |
| Language | NEU |
| Size | 36.0 B |
| RVA offset | 0x7fd1b4 |
| Content signature | RCData |
| MD5 | 2f1e91fd43c76f244eec9cb299568a71 |
| Entropy | 4.337 |
RCData MINIDUMP_EMBEDDED_AUXILIARY_PROVIDER
Download
| Type | RCData |
|---|---|
| Name / ID | MINIDUMP_EMBEDDED_AUXILIARY_PROVIDER |
| Language | NEU |
| Size | 1.3 MB |
| RVA offset | 0x7fd1d8 |
| Content signature | PE executable |
| MD5 | ca2800e841ca7076c2a51e6a4c5915cf |
| Entropy | 6.356 |
Version Info 1
Download
| Type | Version Info |
|---|---|
| Name / ID | 1 |
| Language | NEU |
| Size | 848.0 B |
| RVA offset | 0x946738 |
| Content signature | Version Info |
| MD5 | 7cd8e0c0f6595d3dee0adf62cac53930 |
| Entropy | 3.44 |
Parsed version info
| CompanyName | Rewind.Launcher |
|---|---|
| FileVersion | 1.6.9.0 |
| ProductName | Rewind.Launcher |
| InternalName | Rewind.Launcher.dll |
| LegalCopyright | |
| ProductVersion | 1.6.9+bfc4c96ae12135ec57bd79d3d6d63290a8cdad53 |
| FileDescription | Rewind.Launcher |
| Assembly Version | 1.6.9.0 |
| OriginalFilename | Rewind.Launcher.dll |
Similar samples
3 related samplesRanked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.
| Relation | Sample | Verdict | Why it matched |
|---|---|---|---|
| variant | EvoVisLauncher.exe | Malicious | TLSH distance 55 |
| variant | SACGUI.exe | Suspicious | TLSH distance 65 · identical import table (imphash) · identical export table (exphash) |
| related | Universal_Video_Downloader.exe | Suspicious | identical export table (exphash) |
Threat classification
Signature family candidates| Family | Agreeing rules | Matched rules | Disposition |
|---|---|---|---|
| COD3NYM DOTNET Singlefilehost Bundled App | 1 | COD3NYM_DOTNET_Singlefilehost_Bundled_App | Not a classification: one rule cannot establish a family, so this named nothing and scored nothing. |
Capability detection
not completedThe capability analysis of this file's code did not finish, so what the file is able to do was not established from its instructions. This narrows what the run covered - read it alongside Coverage rather than as a finding about the file. Cause: the check ran past its time limit and was stopped.
Signature matches
3 findings · 6 file properties · 2 scored| Rule | What it matched | Corpus | Weight |
|---|---|---|---|
|
Suspicious_Anti_Debug_API
|
Anti-debugging API names referenced
2 of 4 strings matched
$a
IsDebuggerPresent
at 0x78b9ee · 2 hits
$d
OutputDebugString
at 0x78ba02 · 2 hits
|
Built-in
ruleset this platform ships, and the only one the score reads
|
SCORED 5
Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
|
|
Embedded_PE_In_Overlay
|
A second MZ/PE header appears inside the file body
1 of 1 string matched
$mz
MZ
at 0x0 · 1222 hits
|
Built-in
ruleset this platform ships, and the only one the score reads
|
SCORED 5
Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
|
|
COD3NYM_DOTNET_Singlefilehost_Bundled_App
FILE
rule dated 2024-01-02
|
Detects single file host .NET bundled apps.
1 of 2 strings matched
$
singlefilehost.exe
at 0x78a82a
$
singlefilehost.pdb
at 0x711075
|
Tier 2 - community rule feed
may confirm a family name, never establish one on its own
|
SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
Names COD3NYM DOTNET Singlefilehost Bundled App, but one rule cannot establish a family: two independent rules must agree, so this named nothing.
|
File properties - not findings
IsPE64IsWindowsGUIIsPackedHasOverlayHasDebugDataHasRichSignature
These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.
Extracted strings
showing 137- !This program cannot be run in DOS mode.
- Rich+j
- .text
- `.CLR_UEF
- `.rdata
- @.data
- .pdata
- @.didat
- Section
- _RDATA
- @.rsrc
- @.reloc
- VWATAVAWH
- @pRCC
- { ATAVAWH
- |$ ATAVAWH
- ugeH
- EH;Ehs
- USVWATAUAVAWH
- UWATAVAWH
- t$ AWH
- l$ VWATAVAWH
- @USVH
- @USVWATAVAWH
- FhA+FlA+F`A
- @UVATH
- UVWATAWH
- t$ AWD
- \$ VATAWH
- t$xHcEL;EH
- |$ ATAUAVH
- @UWATAVAWH
- t$ UWATAVAWH
- t$ WATAUAVAW
- @USVWATAUAVAWH
- t$ AVH
- ATAUAVAWH
- VATAUAVH
- UVATAVAWH
- UVWATAVH
- TOORt
- TOOR
- UWATAUAWH
- @VWATAUAWH
- L$ ATAVAWH
- ATAVAWH
- l$ AVL
- @USWATAUAVAWH
- USVWATAVAWH
- USWH
- VWATAUAVH
- RLCH
- %s \
- [ VWATAVAWH
- HESt
- = HESuCH
- EDA9E@u
- UATAVH
- @UVWATAWH
- USVWATAUAWH
- USVWH
- ulfA
- @UATAVH
- @SATAUAWL
- @USVWH
- s.ff
- \$ UVATAVAWH
- ouLI
- @SUVATH
- VWATH
- t.fA
- uoxmE3
- WATAVH
- @UATAVAWH
- UVWATAUH
- USVWATAWH
- VWATAUAWH
- oufH
- AH;Ahu
- @UWATAUAVH
- @SUATAVH
- %.aT
- ureH
- =a%l
- @SVWATH
- H9A0wff
- @USATAVAWH
- @UWATH
- @UVWATAUH
- OTLH
- HESH
- OTLt
- fpt/I
- @UVWATH
- %s1O
- e,ttM
- k VWATAVAWH
- @SWATAWH
- D$PEH
- |$ ATAUAVAW
- \$ VWATAVAWH
- USAWH
- CHD9p
- CHD;x
- @USWH
- OXD9I
- L$ USVWATAVAWH
- USATAVAWH
- tiff
- SUVWATAVH
- @USATAUAVH
- @SUATAVAWH
- \$ UVWATAWH
- L$ VWATAVAWH
- L$ USVWATAUAVAWH
- %d?G
- u.fff
- tVL9A
- uveH
- tCD9mot
- =D:\
- WATAUAVAW
- tafD
- @SUVWATH
- @USWATH
- L$ SUATAVAWH
- }.Hc
- p AWH
- ADHc
- NDHc
- GDIc
- h VWATAVAWH
- @u tPH
- @SATAVH
- @VATH
- @SVATH
- @VWATH
No strings match this filter.
Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.
Disassembly
entry point · x64 · 60 insns (listing capped)AddressBytesMnemonicOperands
0x1405c39d04883ec28subrsp, 0x28
0x1405c39d4e8eb040000call0x1405c3ec4
0x1405c39d94883c428addrsp, 0x28
0x1405c39dde96afeffffjmp0x1405c384c
0x1405c39e2ccint3
0x1405c39e3ccint3
0x1405c39e44883ec28subrsp, 0x28
0x1405c39e8e8b31bcfffcall0x1402b55a0
0x1405c39edeb02jmp0x1405c39f1
0x1405c39ef33c0xoreax, eax
0x1405c39f14883c428addrsp, 0x28
0x1405c39f5c3ret
0x1405c39f6ccint3
0x1405c39f7ccint3
0x1405c39f848895c2410movqword ptr [rsp + 0x10], rbx
0x1405c39fd48896c2418movqword ptr [rsp + 0x18], rbp
0x1405c3a024889742420movqword ptr [rsp + 0x20], rsi
0x1405c3a0757pushrdi
0x1405c3a084883ec10subrsp, 0x10
0x1405c3a0c33c0xoreax, eax
0x1405c3a0e33c9xorecx, ecx
0x1405c3a100fa2cpuid
0x1405c3a1281f16e74656cxorecx, 0x6c65746e
0x1405c3a1881f2696e6549xoredx, 0x49656e69
0x1405c3a1e0bd1oredx, ecx
0x1405c3a208be8movebp, eax
0x1405c3a22b801000000moveax, 1
0x1405c3a2781f347656e75xorebx, 0x756e6547
0x1405c3a2d0bd3oredx, ebx
0x1405c3a2f8d48ffleaecx, [rax - 1]
0x1405c3a320fa2cpuid
0x1405c3a348bf9movedi, ecx
0x1405c3a36755ejne0x1405c3a96
0x1405c3a3825f03fff0fandeax, 0xfff3ff0
0x1405c3a3d48c70550c61c0000800000movqword ptr [rip + 0x1cc650], 0x8000
0x1405c3a4848c7054dc61c00ffffffffmovqword ptr [rip + 0x1cc64d], 0xffffffffffffffff
0x1405c3a533dc0060100cmpeax, 0x106c0
0x1405c3a587428je0x1405c3a82
0x1405c3a5a3d60060200cmpeax, 0x20660
0x1405c3a5f7421je0x1405c3a82
0x1405c3a613d70060200cmpeax, 0x20670
0x1405c3a66741aje0x1405c3a82
0x1405c3a6805b0f9fcffaddeax, 0xfffcf9b0
0x1405c3a6d83f820cmpeax, 0x20
0x1405c3a707724ja0x1405c3a96
0x1405c3a7248b90100010001000000movabsrcx, 0x100010001
0x1405c3a7c480fa3c1btrcx, rax
0x1405c3a807314jae0x1405c3a96
0x1405c3a82448b0593631d00movr8d, dword ptr [rip + 0x1d6393]
0x1405c3a894183c801orr8d, 1
0x1405c3a8d44890588631d00movdword ptr [rip + 0x1d6388], r8d
0x1405c3a94eb07jmp0x1405c3a9d
0x1405c3a96448b057f631d00movr8d, dword ptr [rip + 0x1d637f]
0x1405c3a9d4533c9xorr9d, r9d
0x1405c3aa0418bf1movesi, r9d
0x1405c3aa3458bd1movr10d, r9d
0x1405c3aa6458bd9movr11d, r9d
0x1405c3aa983fd07cmpebp, 7
0x1405c3aac7c40jl0x1405c3aee
0x1405c3aae418d4107leaeax, [r9 + 7]
callbranchretstackarithregisterimmediatememory
Nothing in this view
This sample produced no results for this part of the static analysis.
Import fingerprint
1 related sample| Fingerprint | 192:PBeF7V9j0WPDyjGh9MjJWwZlvFNCj8PeQdhDltaWan:Pm7PL4E4PeQ/3aWan |
|---|---|
| Imports read | 458 functions from 17 libraries (458 distinct) |
| Comparable | yes |
| Compared against | 23 stored samples |
Samples built on the same import table (1)
An identical import table survives repacking, so a high score usually means the same code rebuilt. It is corroboration, not a verdict of its own.
| Score | Sample | Verdict |
|---|---|---|
| 100 identical | 047fced4482c008ba656ac5… | suspicious |
Screen recording
28 frames · screen recording · 58s · ended earlyThe run was ended early from the console, so the recording covers only the 58s the sample actually ran.
1 / 28
Download this recording
Download video (.mp4)
Download GIF (.gif)
Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.
Behavior summary
ran 57s · ended early1 process(es) observed
LaunchedC:\Users\user\Desktop\Rewind.Launcher.exe
Privilegestandard
Telemetry sources:
Kernel ETW (0 events)
agent poll: 1
Evasion / anti-analysis checks
2 checks
MED
Anti-debug API imports static-api
MITRE T1622 · getthreadcontext, isdebuggerpresent
MED
YARA: Suspicious_Anti_Debug_API Signature
MITRE T1497
Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).
Command lines, unwrapped
1 read1 captured text was read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.
Network activity
The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.
This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.
Process tree
What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.
1process
2file operations
Rewind.Launcher.exe
1 process
1 process
Attributed activity
Rewind.Launcher.exe
PID 2936
Image
C:\Users\user\Desktop\Rewind.Launcher.exe
Command
C:\Users\user\Desktop\Rewind.Launcher.exe
Parent
not captured - its parent is outside the sample's tree
File operations2
createC:\Users\user\AppData\Local\Temp\.net
createC:\Users\user\AppData\Local\Temp\.net\Rewind.Launcher
0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity
Persistence mechanisms
cleanNo persistence established
None of the 90 auto-start methods below were established during this run.
Detection coverage
0 / 90Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".
Logon & Startup
22 clean
- Active Setup Installed Component T1547.014 clean
- Explorer Delay-Load Object T1547.001 clean
- Explorer Run Key T1547.001 clean
- Explorer SharedTaskScheduler T1547.001 clean
- Group Policy Extension DLL T1547.004 clean
- Group Policy Run Key T1547.001 clean
- Logon Script T1037.001 clean
- RDP WDS Startup Program T1547.001 clean
- Registry Run Key T1547.001 clean
- Registry RunEx Key T1547.001 clean
- Registry RunOnce Key T1547.001 clean
- Registry RunOnceEx Key T1547.001 clean
- Registry RunServices Key T1547.001 clean
- Startup Folder Item T1547.001 clean
- Startup Folder Redirection T1547.001 clean
- Terminal Services Initial Program T1547.001 clean
- Winlogon GINA DLL T1547.004 clean
- Winlogon MPNotify Value T1547.004 clean
- Winlogon Notify Package T1547.004 clean
- Winlogon Shell Value T1547.004 clean
- Winlogon Taskman Value T1547.004 clean
- Winlogon Userinit Value T1547.004 clean
Services & Tasks
9 clean
- BITS Job T1197 clean
- Print Monitor DLL T1547.010 clean
- Print Processor DLL T1547.012 clean
- Scheduled Task T1053.005 clean
- Scheduled Task Registry Implant T1053.005 clean
- Service Control Manager Security Descriptor T1574.011 clean
- Service DLL Hijack T1543.003 clean
- Time Provider DLL T1547.003 clean
- Windows Service Creation T1543.003 clean
Execution Hijack
17 clean
- .NET Managed Debugger T1546.012 clean
- Accessibility Tool Hijack T1546.008 clean
- AeDebug Postmortem Debugger T1546.012 clean
- App Paths Hijack T1546.012 clean
- Application Shim Database T1546.011 clean
- Boot Verification Program T1547.002 clean
- Command Processor AutoRun T1546.011 clean
- Explorer Load Value T1547.001 clean
- Explorer MyComputer Tool Hijack T1546.001 clean
- Registry Image File Execution Options T1546.012 clean
- Screensaver Hijack T1546.002 clean
- Setup ErrorHandler Script T1546 clean
- Shell Open Command Hijack T1546.001 clean
- SilentProcessExit Monitor T1546.012 clean
- Telemetry Controller Command T1546.015 clean
- WER ReflectDebugger T1546.012 clean
- Windows Error Reporting Debugger T1546.012 clean
DLL Load Order
12 clean
- .NET CLR Profiler DLL T1574.012 clean
- .NET Startup Hook DLL T1574 clean
- AppCert DLLs T1546.009 clean
- AppInit DLLs T1546.010 clean
- AutodialDLL Winsock Injection T1546.006 clean
- DLL Search-Order Hijack T1574.001 T1574.002 clean
- DNS Server Plugin DLL T1574.001 clean
- HTML Help Helper DLL T1546 clean
- KnownDLLs Manipulation T1574.001 clean
- Natural Language Platform DLL Override T1546 clean
- Netsh Helper DLL T1546.007 clean
- Winsock Layered Service Provider T1546.006 clean
COM & Browser
6 clean
- Browser Extension T1176 clean
- Browser Helper Object T1176 clean
- COM Server Hijack T1546.015 clean
- HTML Help COM Object Hijack T1546.015 clean
- Shell Context Menu Handler T1546.001 clean
- Shell Extension Handler T1546.001 clean
Security Providers & Accounts
11 clean
- Account RID Hijack T1098 clean
- AMSI Provider T1562.001 clean
- Credential Provider T1547.014 clean
- DSRM Admin Logon Backdoor T1556 clean
- Hidden Local Account T1136.001 clean
- LSA Authentication Package T1547.002 clean
- LSA Extension DLL T1547.005 clean
- LSA Notification Package T1547.005 clean
- LSA Security Package T1547.005 clean
- Network Provider DLL T1556.008 clean
- Security Support Provider T1547.005 clean
Scripting & Applications
9 clean
- Netsh Port Proxy T1090.001 clean
- Office Add-in T1137.006 clean
- Office Executable Sideload T1574.002 clean
- Office Startup Template T1137.001 clean
- Office Test Key T1137.002 clean
- Power Automate Flow T1546 clean
- PowerShell Profile T1546.013 clean
- Windows Terminal Startup Action T1546 clean
- WMI Event Subscription T1546.003 clean
Boot & Firmware
4 clean
- BootExecute Native Image T1547.002 clean
- PlatformExecute Native Image T1547.002 clean
- SetupExecute Native Image T1547.002 clean
- UEFI / Bootkit Artifact T1542.003 T1542.001 clean
File activity summary
create 2
write 0
modify 0
delete 0
rename 0
Dropped payload analysis
none keptThe sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.
File & registry ops
2 file · 0 registry · sample scope
File operation times: 2 not observed
| Operation | Target | Process |
|---|---|---|
| create |
C:\Users\user\AppData\Local\Temp\.net
|
Rewind.Launcher.exe pid 2936 |
| create |
C:\Users\user\AppData\Local\Temp\.net\Rewind.Launcher
|
Rewind.Launcher.exe pid 2936 |
No operations match your filter.
External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.
1Sources with a hit
18Sources queriedof 23 available
470.6kFeed records
1Could not answer
File reputation
4 clear · 3 not checked| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| MalwareBazaar hash feed | File hash | clean | not in feed | 3,003 records 57 minutes ago |
| MalwareBazaar ransomware feed | File hash | clean | not in feed | 3,348 records 4 hours ago |
| ThreatFox hash IOCs | File hash | clean | not in feed | 1,153 records 57 minutes ago |
| URLhaus payload hashes | File hash | clean | not in feed | 1,680 records 57 minutes ago |
| filescan.io | File hash | not checked | no hash lookup ran for this scan | live lookup |
| MalwareBazaar | File hash | not checked | no hash lookup ran for this scan | live lookup |
| VirusTotal | File hash | not checked | no hash lookup ran for this scan | live lookup |
Hash lookups only - the sample itself is never uploaded to any third party.
Network indicators
7 clear · 1 could not answer| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| URLhaus | IP / domain / URL | feed unavailable | 1 observed indicator, none listed | no records ingested |
| blocklist.de | IP / domain / URL | clean | 1 observed indicator, none listed | 27.6k records 57 minutes ago |
| CINS Army | IP / domain / URL | clean | 1 observed indicator, none listed | 15k records 57 minutes ago |
| Emerging Threats | IP / domain / URL | clean | 1 observed indicator, none listed | 482 records 57 minutes ago |
| Feodo Tracker | IP / domain / URL | clean | 1 observed indicator, none listed | 5 records 57 minutes ago |
| IPsum | IP / domain / URL | clean | 1 observed indicator, none listed | 19.7k records 57 minutes ago |
| Phishing.Database | IP / domain / URL | clean | 1 observed indicator, none listed | 391.5k records 4 hours ago |
| ThreatFox | IP / domain / URL | clean | 1 observed indicator, none listed | 1,153 records 57 minutes ago |
TLS fingerprints
nothing of this kind to check| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| JA3 / JA4 fingerprint blocklists | JA3 / JA4 | not checked | no TLS client fingerprint observed | 97 records 10 hours ago |
| SSL blocklist | Server certificate | not checked | no server certificate fingerprint is extracted to check | live lookup |
Detection rules
1 of 2 listed| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| Signature rules | Sample content | 3 matches | Suspicious_Anti_Debug_API, Embedded_PE_In_Overlay, COD3NYM_DOTNET_Sin… | 110 records 57 minutes ago |
| Sigma rules | Behavior log | clean | - | 2,275 records 6 hours ago |
Tooling catalogs
4 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| LOLBAS | Process image paths | clean | 1 process image path, none masqueraded | 245 records 57 minutes ago |
| LOLBootloaders | File hash | clean | not a known vulnerable bootloader | 520 records 56 minutes ago |
| LOLDrivers | File hash | clean | not a known vulnerable driver | 2,333 records 57 minutes ago |
| LOLRMM | Names and domains | clean | 3 name/domain indicators checked, no remote-management tooling | 360 records 56 minutes ago |
AI analysis
The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.
Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.
0 malicious
3 suspicious
0 info
File indicators
3| Severity | Type | Indicator | Description |
|---|---|---|---|
| suspicious | sample_sha256 | 7716819fdf5adeed0aac330c6f4735046f70d81371f456a1da8c02d82658348f | Submitted sample (SHA256) |
| suspicious | sample_md5 | 3510cff9b3431116071b5a0f4914605c | Submitted sample (MD5) |
| suspicious | imphash | 70d2e884fa127843c5bcbb53da86b6c8 | Import table hash (imphash) |
Sigma detections
0 matches of 2275 rulesThe Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.
Generated rules
No generated rules
Detection rules are auto-generated after analysis.
Extracted files
What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.
Artifacts
2 files| Type | Name | Size | What it is | SHA-256 | Download | |
|---|---|---|---|---|---|---|
| Extracted file | embedded_pe_7cdab7647e06 | 1.3 MB | PEno detection | 7cdab7647e06b1de6eafe87191f0096a3cd54f28998cf6d47ebcb859e77a0982 | ZIP | |
| Extracted file | embedded_pe_b394a5966f13 | 22.7 MB | PEno detection | b394a5966f13260d1512511ffa32833e645ab0a7fd547b7c425357d86e1d2665 | ZIP |
Export & download
/s/2736Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.
AI analysis report
An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).
Generating AI report
Building your report...Compiling the AI narrative and derived evidence. This can take a moment.
Report readyYour report has been generated.
Download
Could not generate the reportPlease try again.
Not available for this scanIt was submitted under ultra privacy, so no derived data from it is sent to the model - and this document is written from that data. Every other section of this report is unaffected.
Headers
Body
Headers
Body
Download live malware sample
You are about to download the raw, live sample. It is real, potentially destructive malware and can harm your machine if opened or run. Only handle it inside an isolated analysis environment.
Delivered as a ZIP encrypted with the password infected so the bytes are never handled unprotected.
Report this analysis
Analysis reports are produced automatically from files, addresses and text submitted by visitors. If this one publishes your material, identifies you, or should not be public for any other reason, tell us why and an administrator will review it.
Public analyses of this file
1 run| Submitted | Environment | Verdict | Score |
|---|---|---|---|
| 2026-10-13 01:20 Shown below | Windows 10 22H2 | Suspicious | 35/100 |