SentinelAgentCore[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SentinelAgentCore.dll
Size

33.7MB
MD5

07ca03bb9b31e93b9e64896e7342212b
SHA1

63df1ec22919bddb02deca76a1093ebce4fa3090
SHA256

807ba14eabab544609c0b14d8ed068912d328363aa3654805e35bdde7ac60140
SHA512

3b6d359630e5d575afa1a687cc35a3580004ed6f8d6f5e3463e5711d0f15c18845887ad290012c64152993349811473a5c324a7c0577b7f4d26da42b28ade2fd
SSDEEP

393216:2ROTfrdFO/KzLfsp9uIw8eSMotVcX0VsHoXS:2ROndFZLfkuIwAtyErXS

Score

N/A

Malware Config

Signatures

Files

SentinelAgentCore.dll
.dll windows x64

3413ef83e273921b698cce04fec8ca1f

Code Sign

04:9c:5c:fc:1a:b2:51:64:20:07:1f:bf:48:94:22:13
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/02/2020, 00:00

Not After

01/03/2023, 12:00

Subject

SERIALNUMBER=5278570,CN=Sentinel Labs\, Inc.,OU=Sentinel Labs\, Inc.,O=Sentinel Labs\, Inc.,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a1:60:06:3b:f7:fb:75:47:53:ac:9d:bc:90:53:4d:7c:55:fa:50:76:4d:54:af:e5:45:44:ff:bd:2e:03:a7:d5
Signer

Actual PE Digest

a1:60:06:3b:f7:fb:75:47:53:ac:9d:bc:90:53:4d:7c:55:fa:50:76:4d:54:af:e5:45:44:ff:bd:2e:03:a7:d5

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=5278570,CN=Sentinel Labs\, Inc.,OU=Sentinel Labs\, Inc.,O=Sentinel Labs\, Inc.,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

12/07/2022, 13:28
Valid: true

Chain 1

SERIALNUMBER=5278570,CN=Sentinel Labs\, Inc.,OU=Sentinel Labs\, Inc.,O=Sentinel Labs\, Inc.,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetProcessTimes
GetThreadId
ProcessIdToSessionId
GetModuleHandleExA
GetModuleHandleExW
K32GetMappedFileNameW
K32GetProcessImageFileNameW
IsProcessorFeaturePresent
RaiseFailFastException
Sleep
GetSystemWindowsDirectoryW
GetSystemWow64DirectoryW
QueryDosDeviceW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
FindFirstVolumeW
FindNextVolumeW
GetTempFileNameW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetLongPathNameW
GetFullPathNameW
OpenFileById
GetVolumeNameForVolumeMountPointW
GetFileSizeEx
GetVolumeInformationW
DeviceIoControl
GetVolumePathNameW
SetFilePointerEx
GetFileInformationByHandle
GetFileInformationByHandleEx
GetProductInfo
RegisterWaitForSingleObject
SetConsoleCtrlHandler
UnregisterWait
GetVolumeInformationByHandleW
MoveFileExW
CopyFileW
GetFileAttributesExW
GetFileTime
LocalAlloc
GetDriveTypeW
FindFirstStreamW
FindNextStreamW
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushViewOfFile
QueryPerformanceCounter
QueryPerformanceFrequency
TerminateProcess
CreatePipe
GetSystemTimes
K32GetProcessMemoryInfo
GetDiskFreeSpaceExW
WaitForMultipleObjectsEx
GetCompressedFileSizeW
GetThreadTimes
SetProcessWorkingSetSizeEx
GetPhysicallyInstalledSystemMemory
GetLocalTime
GetSystemPowerStatus
GetLogicalProcessorInformation
GlobalFree
SetThreadPreferredUILanguages
FormatMessageA
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
SystemTimeToTzSpecificLocalTime
K32EnumProcesses
QueryFullProcessImageNameW
K32GetModuleBaseNameW
OpenJobObjectW
IsProcessInJob
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateEventExW
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject
CreateNamedPipeW
FindResourceExW
SizeofResource
LoadResource
LockResource
SetFileCompletionNotificationModes
CancelSynchronousIo
UnlockFileEx
CreateFileTransactedW
LockFileEx
DeleteFileTransactedW
IsDebuggerPresent
GetComputerNameExW
SetThreadPriority
QueryInformationJobObject
CreateThreadpoolIo
WaitForThreadpoolIoCallbacks
CloseThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
WTSGetActiveConsoleSessionId
WaitForSingleObjectEx
GetCommandLineW
GetStdHandle
SetHandleInformation
FreeConsole
AttachConsole
ReadConsoleOutputW
GenerateConsoleCtrlEvent
GetConsoleScreenBufferInfoEx
WriteConsoleInputW
CreateFileA
InitializeSRWLock
TryEnterCriticalSection
GetStringTypeW
FindFirstFileExW
AreFileApisANSI
CreateSymbolicLinkW
InitOnceExecuteOnce
RtlPcToFileHeader
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetLocaleInfoEx
InitOnceComplete
InitOnceBeginInitialize
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
SwitchToThread
GetExitCodeThread
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
CreateTimerQueue
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
FreeLibraryAndExitThread
SignalObjectAndWait
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
SetThreadAffinityMask
GetVersionExW
InitializeCriticalSectionAndSpinCount
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetStartupInfoW
RtlUnwindEx
RtlUnwind
ExitThread
ExitProcess
SetStdHandle
GetFileType
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
PostQueuedCompletionStatus
QueueUserAPC
CreateIoCompletionPort
GetQueuedCompletionStatus
SleepEx
SetWaitableTimer
CreateWaitableTimerA
VerifyVersionInfoA
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
ReleaseMutex
CreateMutexW
ReadProcessMemory
GetOverlappedResult
CancelIoEx
GetExitCodeProcess
CreateProcessW
GetNativeSystemInfo
VirtualQuery
VirtualProtect
FormatMessageW
GetSystemTimeAsFileTime
LoadLibraryW
FreeLibrary
VirtualQueryEx
GetProcessId
ResumeThread
TerminateThread
OpenThread
CreateThread
SetUnhandledExceptionFilter
RtlCaptureContext
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
GetSystemDirectoryW
GetTickCount
GetCurrentThreadId
GetTempPathW
SetFileAttributesW
RemoveDirectoryW
DeleteFileW
CreateDirectoryW
GetProcAddress
GetModuleHandleA
GetLogicalDriveStringsW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
WriteFile
SetFileTime
SetFilePointer
SetEndOfFile
ReadFile
GetFileSize
GetCurrentDirectoryW
CompareFileTime
GetProcessAffinityMask
GetSystemInfo
GlobalMemoryStatusEx
WaitForMultipleObjects
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreW
CreateEventW
WaitForSingleObject
ReleaseSemaphore
ResetEvent
InitializeCriticalSection
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionEx
LoadLibraryExW
LoadLibraryExA
GetModuleFileNameW
SetEvent
HeapSetInformation
GetHandleInformation
DuplicateHandle
SetLastError
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
SetFileInformationByHandle
VerSetConditionMask
VerifyVersionInfoW
GetCurrentThread
CloseHandle
OpenProcess
GetCurrentProcess
GetFinalPathNameByHandleW
CreateFileW
LocalFree
GetCurrentProcessId
GetLastError
QueryUnbiasedInterruptTime
GetTimeFormatEx
GetDateFormatEx
TerminateJobObject
CallbackMayRunLong
FileTimeToLocalFileTime
VirtualUnlock
FindResourceW
CreateThreadpool
SetThreadpoolThreadMaximum
CloseThreadpool
TrySubmitThreadpoolCallback
WaitForThreadpoolWorkCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
PeekNamedPipe
LoadLibraryA
GetModuleFileNameA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
SetConsoleMode
ReadConsoleA
UnlockFile
HeapCompact
DeleteFileA
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
FindFirstFileExA
FindNextFileA
GetCurrentDirectoryA
CreateDirectoryA
GetDiskFreeSpaceExA
GetFileAttributesExA
RemoveDirectoryA
MapViewOfFileEx
CreateFileMappingA
MoveFileExA
CreateHardLinkA
GetComputerNameA
OutputDebugStringW
GetTickCount64

advapi32

AuditFree
AuditQuerySystemPolicy
AuditSetSystemPolicy
AuditQueryPerUserPolicy
AuditSetPerUserPolicy
LookupPrivilegeNameW
CryptEnumProvidersA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorSacl
LogonUserW
ImpersonateLoggedOnUser
DuplicateToken
CredWriteW
CredReadW
CredFree
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
PrivilegeCheck
CreateRestrictedToken
GetSidSubAuthorityCount
CreateWellKnownSid
NotifyServiceStatusChangeW
ChangeServiceConfig2W
QueryServiceConfig2W
QueryServiceStatusEx
QueryServiceStatus
ControlService
ChangeServiceConfigW
StartServiceW
CreateServiceW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW
QueryServiceConfigW
ProcessTrace
OpenTraceW
EventUnregister
EventRegister
LookupAccountSidW
StartTraceW
EnumerateTraceGuidsEx
EnableTraceEx2
PerfSetCounterRefValue
PerfDeleteInstance
PerfCreateInstance
PerfSetCounterSetInfo
PerfStartProviderEx
PerfStopProvider
ControlTraceW
EventAccessRemove
TreeSetNamedSecurityInfoW
EventAccessQuery
CloseTrace
CryptHashData
CryptGetHashParam
SetThreadToken
AccessCheck
RegFlushKey
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteValueW
RegDeleteTreeW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegNotifyChangeKeyValue
AllocateAndInitializeSid
FreeSid
SetNamedSecurityInfoW
ConvertStringSidToSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetNamedSecurityInfoW
SetServiceStatus
SetKernelObjectSecurity
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
CryptEnumProvidersW
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
EventWrite
CloseServiceHandle
RevertToSelf
ImpersonateSelf
OpenThreadToken
GetTokenInformation
OpenProcessToken
GetLengthSid
CopySid
IsValidSid
GetAce
GetAclInformation
GetSecurityInfo
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetEntriesInAclW
AddAce
InitializeAcl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
MakeAbsoluteSD
MakeSelfRelativeSD
GetSecurityDescriptorLength
DuplicateTokenEx
SetTokenInformation
AddMandatoryAce
SetSecurityInfo
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegCloseKey
RegSetValueExW
EqualSid
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
RegGetValueW
InitiateSystemShutdownExW
CheckTokenMembership
CreateProcessAsUserW
ConvertSidToStringSidW
EventWriteTransfer
IsTextUnicode

ntdll

NtQuerySection
NtQueryTimerResolution
NtQueryKey
NtQueryAttributesFile
RtlImageNtHeader
NtQueryInformationFile
RtlGetVersion
NtCreateFile
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U
NtQueryInformationProcess
NtGetNextThread
NtRenameKey
RtlNtStatusToDosError
NtSystemDebugControl
NtQuerySystemInformation
RtlIpv4StringToAddressExA
RtlIpv6StringToAddressExA
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
RtlIpv4AddressToStringExA
RtlIpv6AddressToStringExA
RtlQueryElevationFlags
NtClose
NtOpenKey
NtCreateKey
NtEnumerateKey
NtSetValueKey
NtDeleteValueKey
NtDeleteKey

Exports

Exports

?AgentMain@sentinel@@YAHHQEAPEB_W@Z
?AgentWorker_wWinMain@sentinel@@YAHPEAUHINSTANCE__@@0PEA_WH@Z
?ApplyConfig@helper@sentinel@@YAJPEA_W@Z
?BrowserNativeHostMain@sentinel@@YAHHQEAPEB_W@Z
?ContextMenuScanner_wWinMain@sentinel@@YAHPEAUHINSTANCE__@@0PEA_WH@Z
?Dump@helper@sentinel@@YAJKPEA_W0@Z
?DumpEncrypted@helper@sentinel@@YAJKPEA_W0EEEPEAUtagSAFEARRAY@@1PEAU_MINIDUMP_EXCEPTION_INFORMATION@@@Z
?GetAgentStatusJSON@helper@sentinel@@YAJPEAPEA_W@Z
?GetConfig@helper@sentinel@@YAJPEA_W0PEAPEA_W@Z
?GetServiceToken@helper@sentinel@@YAJPEA_K@Z
?GetServiceTokenEx@helper@sentinel@@YAJPEAPEAX@Z
?Initialize@helper@sentinel@@YAXXZ
?InitializeSecurity@helper@sentinel@@YAJPEB_W@Z
?IsCOMClientAdmin@helper@sentinel@@YA_NXZ
?LiveKernelDump@helper@sentinel@@YAJPEA_W@Z
?MemoryScanner_wWinMain@sentinel@@YAHPEAUHINSTANCE__@@0PEA_WH@Z
?RegisterClassObjects@helper@sentinel@@YAJXZ
?Remediation_wWinMain@sentinel@@YAHPEAUHINSTANCE__@@0PEA_WH@Z
?RemoteShellHostMain@sentinel@@YAHHQEAPEB_W@Z
?RevokeClassObjects@helper@sentinel@@YAJXZ
?SentinelCtlMain@sentinel@@YAHHQEAPEB_W@Z
?ServiceHostMain@sentinel@@YAHHQEAPEB_W@Z
?SetAppIdLaunchAndAccessPermissions@helper@sentinel@@YAJPEAUHKEY__@@@Z
?SetConfig@helper@sentinel@@YAJPEA_W00@Z
?SetProtectionState@helper@sentinel@@YAJ_N@Z
?StaticServiceMain@sentinel@@YAHHQEAPEB_W@Z
?Uninitialize@helper@sentinel@@YAXXZ
?UnprotectPPL@helper@sentinel@@YAJPEA_W@Z
__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s

Sections

.text
Size: 24.2MB - Virtual size: 24.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 199B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 935KB - Virtual size: 935KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 377KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3413ef83e273921b698cce04fec8ca1f

Code Sign

04:9c:5c:fc:1a:b2:51:64:20:07:1f:bf:48:94:22:13Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

a1:60:06:3b:f7:fb:75:47:53:ac:9d:bc:90:53:4d:7c:55:fa:50:76:4d:54:af:e5:45:44:ff:bd:2e:03:a7:d5Signer

Signature Validations

Verification

12/07/2022, 13:28 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ntdll

Exports

Exports

Sections

.text Size: 24.2MB - Virtual size: 24.2MB

.orpc Size: 512B - Virtual size: 199B

.rdata Size: 5.9MB - Virtual size: 5.9MB

.data Size: 1.8MB - Virtual size: 2.0MB

.pdata Size: 935KB - Virtual size: 935KB

.didat Size: 4KB - Virtual size: 3KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 377KB - Virtual size: 376KB

.reloc Size: 171KB - Virtual size: 171KB

04:9c:5c:fc:1a:b2:51:64:20:07:1f:bf:48:94:22:13
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

a1:60:06:3b:f7:fb:75:47:53:ac:9d:bc:90:53:4d:7c:55:fa:50:76:4d:54:af:e5:45:44:ff:bd:2e:03:a7:d5
Signer

12/07/2022, 13:28
Valid: true

.text
Size: 24.2MB - Virtual size: 24.2MB

.orpc
Size: 512B - Virtual size: 199B

.rdata
Size: 5.9MB - Virtual size: 5.9MB

.data
Size: 1.8MB - Virtual size: 2.0MB

.pdata
Size: 935KB - Virtual size: 935KB

.didat
Size: 4KB - Virtual size: 3KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 377KB - Virtual size: 376KB

.reloc
Size: 171KB - Virtual size: 171KB