����NǕÄ��^��vƜX�v5"z�������<�(Z�����"0��w��V�ȠCǯ:Y؇h3u�!���}|x�� ��Ԫ��B�U��~�~6��"z�u���W_���<�ȧjy�l��!� ���EK�-��?��� ��t���ﺷ�;�K�>����~ ����i�<��roT#��?����Y�lA��R2�v��IG���x^Dq�����*��jɦR�"G�a�x��g)�/�"!�u�������} J��3H}�x�����|��A�D�F��1K梸���M8�f�����[i3�7��(ҹz�TK~����1~���w���P�;U���,>�M�巬�k6Hyb|i����4-���/�48h�#�ܼO �1��q-��fN�w�B�![~�t��7G�*v��1��~��{^k'���"s���BBEL�%��]��=�:TpLvQ�~U�_�O~R��ͭ¸���Z��;�g������np~g���ʒ�� �;j�;�#eB��w׳E�q�1�4Ua�9�<�/G�hr�V��Kl���R�J�_� �Lo��L��:�A'#xo�k�ZSb�P��Z];�c���o������3ӷNY"�qK�J��E�g���\OS��C��.?��Ômpr��l��#�p�`3��Pv�XT��'(��q��?����-r�^��K����&��a3*/����?�o(�{�E�[�.��=f��>���)�V���Ա]lm�TwƌC>�|�U���^�;ݕ�[�e�x�#�I7���x �WK�&;Lv�kH+7W�����k�������c�FV��y��D�X��_�,X 6���T��x�� ���S�\ڝK�Z�8�����0�Z�K p�zf �����-�Z���aP�'e����zRB|�7<خ�C��ǁC��=�#Q�-��+���#T6 � M��#�}.�y0"�P}�K�g7�����Y����#y����x-J�j ���:*풢?��4?�Ũ�6��>�5�,<v�ل���Y{�,7�zn�0�l7��l���~1k�Da���x�80v]�z�k�5��G�4�^5�*8ZFC*�4�cA�eԾ��#���bO�i�l�%Ha"���>B��I+-�~rUA�]'��ڥ*U� 47P�Mt�E��k�$�j����+�C�yٌ�� ��CC�@p��9�~�8��B&�&��,�^�T�c =#ł@� �K͉zٞ�ÌB����p��qt��R��3�pb��g͓��٣I~��,'V->K4S��c���a͗�����Wrbƾ�% ���m�aS� ��傊:�����D��]b�f�ŵ��2��>$b"��Ae)�{��G�?�*�h���f�����j#�c�/�?�H��l��E��4��+Ϧ ���Gm'_�'Ƿ���"�vZŕ��MQ5�{������"y����:3���f; �,re���wѼ�ԓ��x��C�4�\�k�up�R�� =���ȴ;Z��w���8�X�0�5�nP^�5@?^0��9m��I�� #q�F,�& ��[i�����.�?P���$P���V��Be�&�{^� �q��!�& �18=�����4[�~�3}��Ry�����HDw��*ɾ�w�\;\��~���k��4������zۦ`=�H�a���V��c���f� ��m$W�y76�r��b�.%����×I��X��[�c��'�m��ƽ{�C��H�����'��M+��װ���"�}$c�Q�ؘK��9�q�"��O٫~F3ړ5M앍�D~QW2��+�X�ǗyU�L��q��"9W��Z�66�45�#K�S������|{�&���K�:h.��Fn[�30�w6!�I��č�U���$���2둤��A^F&���^h8��BvlNQD�M4:�ǝ8�l9�k,����R!�S��OP �X�bl¶,�w�$��)�V�֤du������S������tM�L��'.�������]<+�j�(y~��N�ַ��EFFi ~c7�6;��{�k��FP��숫����� 4�5G��V��� Hh�q��У�2�m����v��wG�����+3� &���~�í��R�Au��� �er�R�,s�͝Q���i��� �^]Z�-���4-7"�R{3�頽� c6�?o⮞s����F�jdh�� ���+a��0[����u\y ���1O�#)�mF�45@��=��K��@�i+�q1� [^9@�h��i�*�¦��?�}�Q���F�I00�e��(�>�/P�C��;�.��I����lb&X0���f '4@.`�g�n���������9tD#ڬ���q��h�y4q����43.����<��n��y��ҋ�PTz!��M�j�$R7��m�U/�| FX����$>��3��褟�z���_hBo�9�!#hB�P�ģ�09b�����ʏo?����f����(6<�'�t�?q4��~�ӱ�M ��qÅA�gtl�5�1�����atʭ��Zߔ{�ƨ��"���"?��J<�����V8 ��q��&������-�Wʻ6��<�U�D՛���~���ѧ�,�J�ml�^��� �YzPc�J=�̳�!e�� d��o_pa����o�� �3@�L����3(��p�׃�OH��H����(W�wѺ��>���qk <�b(a����q��f�����,U�+~�Y���;)"�7�ގ�a���M �c��ŹƩ���H�'�K�Ô�]�zO�I�]��V��`+<?I�- Y��NVd3�9���7���R�k������hy�<StRb��W�uM����W����W�`4�X�\����1L/#y�&�"달Oh��}�8��ԞTG:%j��ĩ�@dOeH��04��PV9C��]k%-��Q��*&: L�\�z�{�U�ɑ�Z����`B�-�ܝwu�i�/țd+�,3�D�}�Uk���Q��&>��,-1Ŗ����2X�!��_�$zD\ެ�xr����Q�wL:,�b��'�-+?���39����*�Z.XQ '׳�x���~�U�Գ�6x%��;�"�_�h�w���5�r�l�Es�.�W�4��
Overview
overview
8Static
static
3KeyGen @RdpXL.exe
windows7-x64
5KeyGen @RdpXL.exe
windows10-2004-x64
5Mass @RDpXL.exe
windows7-x64
1Mass @RDpXL.exe
windows10-2004-x64
1NL Checker @RdpXL.exe
windows7-x64
8NL Checker @RdpXL.exe
windows10-2004-x64
8NLBrute @RdpXL.exe
windows7-x64
1NLBrute @RdpXL.exe
windows10-2004-x64
1NS2.exe
windows7-x64
1NS2.exe
windows10-2004-x64
1masscan.exe
windows7-x64
1masscan.exe
windows10-2004-x64
1winrar-x64-600.exe
windows7-x64
1winrar-x64-600.exe
windows10-2004-x64
1Behavioral task
behavioral1
Sample
KeyGen @RdpXL.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
KeyGen @RdpXL.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Mass @RDpXL.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Mass @RDpXL.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
NL Checker @RdpXL.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
NL Checker @RdpXL.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
NLBrute @RdpXL.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
NLBrute @RdpXL.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
NS2.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
NS2.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
masscan.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
masscan.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
winrar-x64-600.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
winrar-x64-600.exe
Resource
win10v2004-20220812-en
General
-
Target
NS2+Masscan+Keygen+NLBrute+NLChecker.7z
-
Size
28.8MB
-
MD5
889aa05d18de87b1cbd0da2beeafef78
-
SHA1
cfe447b8ca28d39d2b05ebf545753e2e4f2122a0
-
SHA256
ba15d38abec4911ee029dd02847ee89e8e0a42ea7f7aa9b18230b9463133a8fd
-
SHA512
344642880c1f2ff6db48d4fc89c62bc5e4cf07c5134aa894fd55b3af35f71377b5d9602b0617ac294ef4c8bde96d66520567b05a23679ea9da3e2b017e016ed2
-
SSDEEP
786432:TDCvlsOlBhyyr2CZTn233VDEw8xbWFGoddA2ddI:TGvWOFyJM2nmw8iddI
Malware Config
Signatures
-
Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/NL Checker @RdpXL.exe pyinstaller
Files
-
NS2+Masscan+Keygen+NLBrute+NLChecker.7z.7z
Password: infected
-
KeyGen @RdpXL.exe.exe windows x86
bc218d171102d713e75b8c44a7aedb14
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xpdata Size: - Virtual size: 17.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PC-RET Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xpdata Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xpdata Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Mass @RDpXL.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
NL @RdpXL.rar.rar
-
NL Checker @RdpXL.exe.exe windows x64
a62ff465f3ead2e578f02d3a2d749b7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
GetShortPathNameW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
CreateDirectoryW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException
ws2_32
ntohl
Sections
.text Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NLBrute @RdpXL.exe.exe windows x64
1d598436df3dc5afc05e45d3e373f4de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
gdi32
GetTextFaceW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
CreateBitmap
GetDIBits
CreateDIBSection
CreatePalette
GetPaletteEntries
SelectClipRgn
GdiFlush
GetTextMetricsW
GetFontData
CreateFontIndirectW
EnumFontFamiliesExW
GetRegionData
CreateRectRgn
CreateEllipticRgn
SelectPalette
RealizePalette
PtInRegion
GetStockObject
OffsetRgn
CombineRgn
GetObjectW
SelectObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
comdlg32
GetOpenFileNameW
oleaut32
SysFreeString
VariantClear
SysAllocStringLen
VariantInit
SysStringLen
SysAllocString
imm32
ImmGetDefaultIMEWnd
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionFontW
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
winmm
PlaySoundW
ws2_32
WSAStartup
WSACleanup
__WSAFDIsSet
closesocket
connect
WSAAsyncSelect
htonl
WSASetLastError
shutdown
gethostname
WSAEventSelect
WSACreateEvent
WSAGetLastError
socket
setsockopt
send
select
recv
inet_addr
htons
getsockopt
getsockname
ioctlsocket
ole32
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleInitialize
OleUninitialize
DoDragDrop
CoInitialize
CoTaskMemFree
OleSetClipboard
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
CoGetMalloc
ReleaseStgMedium
user32
LoadIconW
SetMenuItemInfoW
TrackPopupMenuEx
GetMenu
MapVirtualKeyW
ToUnicode
ToAscii
GetKeyboardState
GetKeyboardLayout
SetCaretPos
HideCaret
CreateCaret
TranslateMessage
GetKeyboardLayoutList
ChangeClipboardChain
SetClipboardViewer
GetWindowThreadProcessId
RegisterWindowMessageW
GetAsyncKeyState
RegisterClipboardFormatW
GetIconInfo
DrawIconEx
GetParent
GetSysColorBrush
GetSysColor
WindowFromPoint
SetCaretBlinkTime
GetCaretBlinkTime
ClipCursor
MessageBeep
InvalidateRgn
GetWindowRgn
GetUpdateRect
EndPaint
BeginPaint
GetKeyState
FlashWindowEx
RegisterClassExW
GetClassInfoW
UnregisterClassW
SetDoubleClickTime
GetDoubleClickTime
DefWindowProcW
PostMessageW
PeekMessageW
CreateIconIndirect
GetClipboardFormatNameW
DestroyCursor
CreateCursor
GetCursorPos
SetCursorPos
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetParent
GetDesktopWindow
SetWindowLongPtrW
ScreenToClient
ClientToScreen
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
SetWindowTextW
ScrollWindowEx
ValidateRgn
InvalidateRect
SetWindowRgn
SetForegroundWindow
UpdateWindow
GetSystemMetrics
ReleaseCapture
SetCapture
IsZoomed
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
CreateWindowExW
SendMessageW
SetWindowLongW
GetWindowLongW
ReleaseDC
GetDC
GetFocus
GetActiveWindow
SetFocus
EnableMenuItem
GetSystemMenu
IsChild
SystemParametersInfoW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
CharNextExA
DispatchMessageW
RegisterClassW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
GetWindowLongPtrW
LoadImageW
DestroyCaret
advapi32
RegisterEventSourceW
ReportEventW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegQueryInfoKeyW
RegSetValueExW
OpenProcessToken
CopySid
FreeSid
GetLengthSid
GetTokenInformation
DeregisterEventSource
shell32
ShellExecuteW
Shell_NotifyIconW
SHGetFileInfoW
kernel32
UnhandledExceptionFilter
RtlCaptureContext
GetCPInfo
SetFileAttributesW
SetStdHandle
GetConsoleCP
ReadConsoleW
ExitThread
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetConsoleCtrlHandler
GetTimeZoneInformation
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
AreFileApisANSI
GetModuleHandleExW
HeapAlloc
GetCommandLineA
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
GetSystemTimeAsFileTime
HeapFree
lstrlenA
GetStringTypeW
DecodePointer
EncodePointer
FindNextChangeNotification
FindFirstChangeNotificationW
FindCloseChangeNotification
GetModuleFileNameA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
MoveFileW
CopyFileW
DeviceIoControl
GetTempPathW
RemoveDirectoryW
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
GetUserDefaultUILanguage
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
ResetEvent
QueryPerformanceFrequency
SetFilePointerEx
SetEndOfFile
GetLogicalDrives
GetSystemDirectoryW
LoadLibraryExW
GetModuleFileNameW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
OutputDebugStringW
GetCommandLineW
GetLocalTime
WaitForMultipleObjects
GetSystemInfo
TlsFree
TlsSetValue
SetUnhandledExceptionFilter
TlsAlloc
ResumeThread
TerminateThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
SwitchToThread
GetCurrentProcess
CreateEventW
SetEvent
DuplicateHandle
VerifyVersionInfoW
FormatMessageW
LocalFree
GetVersionExW
VerSetConditionMask
CreateSemaphoreW
ReleaseSemaphore
GetUserDefaultLCID
CompareStringW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
WriteFile
SetFilePointer
ReadFile
CreateFileW
ExitProcess
GlobalSize
CreateProcessW
ExpandEnvironmentStringsW
lstrcmpW
IsValidLocale
IsValidLanguageGroup
CheckRemoteDebuggerPresent
OpenProcess
GetLongPathNameW
GlobalUnlock
GlobalLock
GetUserDefaultLangID
GetLocaleInfoW
SetErrorMode
GetVolumeInformationW
GetStartupInfoW
FlushConsoleInputBuffer
LoadLibraryW
GlobalMemoryStatus
GetTickCount
CreateDirectoryA
GetCurrentProcessId
QueryPerformanceCounter
WideCharToMultiByte
FindNextFileW
FindFirstFileW
FindClose
RtlVirtualUnwind
MultiByteToWideChar
GetModuleHandleW
GetFileType
GetStdHandle
GetLastError
SetLastError
lstrlenW
FreeLibrary
GetCurrentThreadId
CreateMutexW
ReleaseMutex
lstrcpyW
LoadLibraryA
GlobalFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
TerminateProcess
LCMapStringW
EnumSystemLocalesW
HeapSize
GetProcessHeap
IsValidCodePage
GetACP
TlsGetValue
GetOEMCP
FlushFileBuffers
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteConsoleW
GetFullPathNameA
FileTimeToLocalFileTime
PeekNamedPipe
FindFirstFileExW
GlobalAlloc
GetProcAddress
GetVolumeInformationA
GetDriveTypeW
CloseHandle
WaitForSingleObject
CreateThread
Sleep
Exports
Exports
Deinitialize
Initialize
Test
Sections
.text Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 242KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 326KB - Virtual size: 325KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 325KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NS2.exe.exe windows x86
0b0d8152ea7241cce613146b80a998fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
WaitForSingleObject
SetVolumeMountPointW
GetLogicalDrives
Sleep
HeapDestroy
HeapCreate
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
GetLastError
WaitForMultipleObjects
ReleaseMutex
CloseHandle
FindFirstVolumeW
CreateThread
lstrcpyA
WriteConsoleW
SetStdHandle
SetFilePointerEx
SetEnvironmentVariableA
FindVolumeClose
CreateMutexW
QueryDosDeviceW
ExitProcess
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
GetFileAttributesExW
CreateProcessA
GetExitCodeProcess
RtlUnwind
OutputDebugStringW
LoadLibraryExW
MultiByteToWideChar
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
GetCommandLineA
EncodePointer
DecodePointer
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
GetProcessHeap
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
WideCharToMultiByte
GetStdHandle
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
DeleteCriticalSection
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
CompareStringW
LCMapStringW
CreateFileW
user32
wsprintfW
mpr
WNetAddConnection2W
iphlpapi
IcmpCreateFile
GetAdaptersInfo
IcmpSendEcho
ws2_32
htonl
gethostbyname
gethostname
inet_addr
inet_ntoa
WSAStartup
ntohl
netapi32
NetShareEnum
NetApiBufferFree
shlwapi
StrStrW
Sections
.text Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
masscan.exe.exe windows x86
9b0b559e373d62a1c93e615f003f8af8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetModuleFileNameA
CreateFileA
GetLastError
GetProcessAffinityMask
QueryPerformanceCounter
GetSystemTimeAsFileTime
Sleep
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
EncodePointer
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
QueryPerformanceFrequency
GetCurrentProcess
IsProcessorFeaturePresent
msvcr100
fwrite
_gmtime64_s
strftime
isprint
isdigit
_strdup
_localtime64_s
_open_osfhandle
_fdopen
memmove
isspace
toupper
_memicmp
isalnum
ispunct
realloc
fflush
tolower
vfprintf
feof
fgets
isalpha
isxdigit
getc
clock
signal
_ftelli64
rename
_access
_errno
strrchr
_beginthread
_mktime64
strstr
_fseeki64
_snprintf
fopen
ftell
fclose
_stat64i32
atoi
strerror
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_CIsqrt
memset
memcpy
__iob_func
fprintf
_time64
free
malloc
printf
exit
strtoul
fread
sprintf_s
strchr
strcpy_s
perror
fopen_s
fseek
ws2_32
recv
select
getservbyport
htons
WSAStartup
socket
htonl
connect
send
iphlpapi
GetAdaptersInfo
wpcap
pcap_sendqueue_transmit
pcap_sendqueue_queue
pcap_datalink_val_to_name
pcap_next
pcap_perror
pcap_sendqueue_alloc
pcap_open_live
pcap_close
pcap_setfilter
pcap_sendpacket
pcap_datalink
pcap_sendqueue_destroy
pcap_lib_version
pcap_findalldevs
pcap_compile
Sections
.text Size: 141KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
winrar-x64-600.exe.exe windows x64
e2a1496c94d52a035fe47259ee6587b7
Code Sign
04:00:00:00:00:01:2f:4e:e1:52:d7Certificate
IssuerCN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BENot Before13-04-2011 10:00Not After28-01-2028 12:00SubjectCN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BEKey Usages
KeyUsageCertSign
KeyUsageCRLSign
48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate
IssuerCN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSignNot Before15-06-2016 00:00Not After15-06-2024 00:00SubjectCN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BEExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate
IssuerCN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BENot Before24-05-2016 00:00Not After24-06-2027 00:00SubjectCN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SGExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
73:1d:40:ae:3f:3a:1f:b2:bc:3d:83:95Certificate
IssuerCN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BENot Before25-08-2020 13:42Not After26-08-2023 13:42SubjectCN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate
IssuerCN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSignNot Before15-06-2016 00:00Not After15-06-2024 00:00SubjectCN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BEExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
73:1d:40:ae:3f:3a:1f:b2:bc:3d:83:95Certificate
IssuerCN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BENot Before25-08-2020 13:42Not After26-08-2023 13:42SubjectCN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate
IssuerCN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BENot Before19-02-2018 00:00Not After18-03-2029 10:00SubjectCN=GlobalSign TSA for Advanced - G2Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
04:00:00:00:00:01:31:89:c6:50:04Certificate
IssuerCN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSignNot Before02-08-2011 10:00Not After29-03-2029 10:00SubjectCN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BEKey Usages
KeyUsageCertSign
KeyUsageCRLSign
cd:db:76:83:4d:46:21:47:96:2f:ca:f7:19:61:ff:b6:a5:2e:e5:92:87:65:c9:fb:2f:75:fc:5e:cb:fe:7a:63Signer
Actual PE Digestcd:db:76:83:4d:46:21:47:96:2f:ca:f7:19:61:ff:b6:a5:2e:e5:92:87:65:c9:fb:2f:75:fc:5e:cb:fe:7a:63Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedtrueVerification
Signing CertificateCN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE01-12-2020 18:01 Valid: true
Chain 1
CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE
CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
b1:7b:fb:c3:a4:32:b7:0e:de:08:83:bb:1c:2d:f5:72:51:db:00:55Signer
Actual PE Digestb1:7b:fb:c3:a4:32:b7:0e:de:08:83:bb:1c:2d:f5:72:51:db:00:55Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedtrueVerification
Signing CertificateCN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE01-12-2020 18:01 Valid: true
Chain 1
CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE
CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
TerminateProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
gdiplus
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ