Far[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Far.zip
Size

2.3MB
MD5

e84547d67d04ce92db9bb1d8d067b81a
SHA1

e5fd6ae21f2ef583d1f1e69363496011e78929ee
SHA256

dfe307fa972157ee23a1638eb2d9ed164bc5d454d33088cfb30ead774c6e235b
SHA512

b7e08d9f6e98dd80618782da694a80ca4397b937bf3784889a062bdc11c1646c71edcc6c8496062401e52d02a3b6f7b43793cfdcd043c84cfab5349cef85053e
SSDEEP

49152:VNAvlvieIINaQO1GrI/cxMsd4VA5wDhq28PcfJ7TULPuhjumc:VNpINc7bXA5UY2rBKx

Score

N/A

Malware Config

Signatures

Files

Far.zip
.zip
Far/Far.exe
.exe windows x86

79d5ea631b0eaf9b0eb952a80d4aac39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetProcAddress
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FreeLibrary
FormatMessageW
FormatMessageA
FlushFileBuffers
DeleteFileW
DeleteFileA
CreateMutexW
CreateFileMappingW
CreateFileMappingA
CreateFileW
CreateFileA
CloseHandle
AreFileApisANSI
DeleteCriticalSection
InterlockedCompareExchange
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
InterlockedDecrement
DeviceIoControl
GetDriveTypeW
SetThreadPriority
GetThreadPriority
GetCurrentThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CompareStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetACP
GetOEMCP
GetCPInfo
GetCPInfoExW
EnumSystemCodePagesW
GetPrivateProfileStringW
SetEvent
CreateEventW
WaitForMultipleObjects
InterlockedIncrement
ResetEvent
InterlockedExchangeAdd
AllocConsole
FreeConsole
GetStdHandle
GetConsoleWindow
GetConsoleScreenBufferInfo
SetConsoleWindowInfo
GetConsoleCP
SetConsoleCP
GetConsoleOutputCP
SetConsoleOutputCP
SetConsoleCtrlHandler
GetConsoleMode
SetConsoleMode
WriteConsoleInputW
WriteConsoleW
SetConsoleTextAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
FlushConsoleInputBuffer
GetNumberOfConsoleInputEvents
GetConsoleAliasW
GetConsoleDisplayMode
SetConsoleActiveScreenBuffer
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
ScrollConsoleScreenBufferW
SetConsoleScreenBufferSize
GetConsoleTitleW
SetConsoleTitleW
PeekConsoleInputW
ReadConsoleInputW
SetConsoleCursorPosition
GetConsoleFontSize
GetCurrentConsoleFont
GetLargestConsoleWindowSize
ReadConsoleOutputW
WriteConsoleOutputW
SetThreadExecutionState
SetLastError
GetShortPathNameW
GetLongPathNameW
GetCalendarInfoW
GetLocaleInfoW
SystemTimeToTzSpecificLocalTime
GetTempPathA
LocalFileTimeToFileTime
GetLocalTime
GetLogicalDrives
GetCurrentProcess
GetCurrentThreadId
DisconnectNamedPipe
CreateDirectoryExW
CreateDirectoryW
RemoveDirectoryW
MoveFileExW
SetFileAttributesW
CreateHardLinkW
DuplicateHandle
OpenProcess
TerminateProcess
GetOverlappedResult
ConnectNamedPipe
AssignProcessToJobObject
SetInformationJobObject
CreateJobObjectW
QueryInformationJobObject
CreateNamedPipeW
LocalAlloc
CopyFileExW
WaitNamedPipeW
SetErrorMode
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFilePointerEx
GetFileInformationByHandle
GetFileSizeEx
GetLogicalDriveStringsW
GetEnvironmentVariableW
GetModuleFileNameW
GetVolumeInformationW
SearchPathW
QueryDosDeviceW
MoveFileW
ExpandEnvironmentStringsW
GetFileType
GetDiskFreeSpaceExW
GetVolumeNameForVolumeMountPointW
FindClose
GetProcessHeaps
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
FileTimeToDosDateTime
CompareFileTime
FindCloseChangeNotification
FindFirstChangeNotificationW
LCMapStringW
SetVolumeMountPointW
DefineDosDeviceW
GetVersionExW
CreateProcessW
GetModuleHandleW
GetSystemPowerStatus
GlobalMemoryStatusEx
GetComputerNameW
GetComputerNameExW
ExitThread
SetStdHandle
QueryPerformanceFrequency
GetPrivateProfileIntW
InterlockedExchange
GetTempFileNameW
LoadLibraryExW
SetFileApisToOEM
SetFileApisToANSI
ReleaseMutex
GetProcessTimes
GetNumberFormatW
WriteProcessMemory
VirtualProtect
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStartupInfoW
SetHandleCount
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetStringTypeW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSetInformation
GetCommandLineW
ExitProcess
HeapQueryInformation
GetTimeZoneInformation
CreateThread
RaiseException
RtlUnwind
GetTempPathW
GetTickCount
GetVersionExA
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetFilePointer
Sleep
SystemTimeToFileTime
UnlockFile
UnlockFileEx
UnmapViewOfFile
WideCharToMultiByte
WriteFile
WaitForSingleObject
OutputDebugStringA
OutputDebugStringW
FileTimeToSystemTime
GetProcessHeap
SetEnvironmentVariableA

user32

GetWindowTextLengthW
GetWindowTextW
PostMessageW
ToUnicodeEx
VkKeyScanW
GetWindowLongW
IsWindowVisible
EnumWindows
GetWindowThreadProcessId
ShowWindowAsync
GetWindowInfo
PostQuitMessage
DefWindowProcW
GetWindowPlacement
IsZoomed
IsCharAlphaW
CharUpperW
MessageBeep
UnregisterClassW
RegisterClassExW
CreateWindowExW
RegisterClipboardFormatW
OpenClipboard
GetDoubleClickTime
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
EmptyClipboard
SetClipboardData
DispatchMessageW
GetMessageW
SystemParametersInfoW
SetForegroundWindow
IsCharAlphaNumericW
CharLowerA
CharUpperA
IsCharUpperA
IsCharLowerA
IsCharAlphaA
OemToCharA
CharToOemA
OemToCharBuffA
IsCharAlphaNumericA
CharToOemBuffW
CharLowerW
ShowWindow
DestroyWindow
FlashWindowEx
IsIconic
GetSystemMetrics
GetKeyboardLayoutList
TranslateMessage
VkKeyScanExW
IsCharUpperW
MapVirtualKeyW
GetKeyState
keybd_event
LoadImageW
IsCharLowerW
CharLowerBuffW
SendMessageW
WaitForInputIdle
CharUpperBuffW

winspool.drv

ord203
ClosePrinter
EndDocPrinter
WritePrinter
EnumPrintersW
OpenPrinterW
StartDocPrinterW

advapi32

RegCloseKey
RegQueryValueExW
FreeSid
SetSecurityDescriptorDacl
SetEntriesInAclW
InitializeSecurityDescriptor
AllocateAndInitializeSid
RegOpenKeyW
RegEnumValueW
RegEnumKeyExW
DecryptFileW
EncryptFileW
SetFileSecurityW
GetFileSecurityW
SetNamedSecurityInfoW
LookupAccountNameW
ConvertStringSidToSidW
EqualSid
ConvertSidToStringSidW
LookupAccountSidW
CopySid
GetLengthSid
IsValidSid
GetSecurityDescriptorOwner
IsTextUnicode
CheckTokenMembership
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
GetTokenInformation
RegOpenKeyExW

shell32

ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
SHFileOperationW

netapi32

NetUserGetInfo
NetServerGetInfo
NetApiBufferFree

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
WNetGetConnectionW
WNetGetUniversalNameW

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
GetRunningObjectTable
CoTaskMemFree
CoCreateGuid
CreateFileMoniker

psapi

GetModuleFileNameExW

secur32

GetUserNameExW

setupapi

CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Locate_DevNodeW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
CM_Request_Device_EjectW
CM_Get_DevNode_Status
CM_Get_Child
CM_Get_Device_IDW
SetupDiGetClassDevsW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
CM_Get_Sibling

rpcrt4

UuidFromStringW
UuidHash
UuidCreate

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Far/Far.exe.example.ini
Far/Far.map
Far/FarEng.hlf
Far/FarEng.lng
.vbs
Far/FarRus.hlf
Far/FarRus.lng
Far/File_id.diz
Far/RestoreOldPluginSettings.cmd
.cmd .vbs
Far/SaveOldPluginSettings.cmd
.cmd .vbs
Far/lua5.1.dll
.dll windows x86

54766d082d6befa91f90c2d875df2079

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
InterlockedExchange
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
__mb_cur_max
_assert
_errno
_filbuf
_iob
_isctype
_pclose
_pctype
_popen
_setjmp
_winmajor
abort
acos
asin
atan
atan2
calloc
ceil
clearerr
clock
cos
cosh
difftime
exit
exp
fclose
fflush
fgets
floor
fmod
fopen
fprintf
fputc
fputs
fread
free
freopen
frexp
fscanf
fseek
ftell
fwrite
getenv
gmtime
ldexp
localeconv
localtime
log
log10
longjmp
malloc
memchr
memcpy
mktime
modf
pow
rand
realloc
remove
rename
setlocale
setvbuf
sin
sinh
sprintf
sqrt
srand
strcat
strchr
strcmp
strcoll
strcspn
strerror
strftime
strlen
strncat
strncpy
strpbrk
strrchr
strstr
strtoul
system
tan
tanh
time
tmpfile
tmpnam
tolower
toupper
ungetc
vfprintf

Exports

Exports

luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlevel
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Far/lua51.dll
.dll windows x86

9acf63e294ec137682995804d4ae2afe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

lua5.1

luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Exports

Exports

luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Far/luafar3.dll
.dll windows x86

dae591969f8d63ce2c93eb66097d4608

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetModuleFileNameW
FreeLibrary
LoadLibraryW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
GetDriveTypeW
SearchPathW
FormatMessageW
GetLastError
EnumSystemCodePagesW
GetCPInfoExW
GetLogicalDriveStringsW
GlobalMemoryStatusEx
SetFileAttributesW
GetProcAddress
ReadConsoleInputW
PeekConsoleInputW
FindClose
FindFirstFileW
FileTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
CompareStringW
CopyFileW
MoveFileExW
DeleteFileW
CreateDirectoryW
RemoveDirectoryW
GetModuleHandleW
HeapSize
WriteConsoleW
GetEnvironmentVariableW
GetFileAttributesW
SwitchToThread
CreateThread
GetSystemTimeAsFileTime
Sleep
GetStdHandle
SetEnvironmentVariableW
GetConsoleScreenBufferInfo
GetProcessHeap
SetEndOfFile
RaiseException
GetStringTypeW
LCMapStringW
CreateFileW
HeapReAlloc
SetStdHandle
GetTickCount
QueryPerformanceCounter
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
CreateFileA
GetCurrentProcessId
WaitForSingleObject
GetExitCodeProcess
CreatePipe
IsValidCodePage
GetCPInfo
RtlUnwind
DeleteCriticalSection
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
SetFilePointer
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ReadFile
WriteFile
ExitProcess
HeapDestroy
HeapCreate
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
CreateProcessW
GetCurrentProcess
DuplicateHandle
CloseHandle
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapFree

user32

wsprintfW

advapi32

RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumValueW

shell32

ShellExecuteW
SHGetFolderPathW

lua5.1

luaL_checknumber
luaL_newstate
lua_close
lua_setallocf
luaL_prepbuffer
luaL_checkstack
lua_dump
lua_typename
lua_tocfunction
luaL_checkoption
luaL_gsub
lua_iscfunction
luaL_findtable
lua_isuserdata
lua_getfenv
lua_setfenv
lua_settable
luaL_typerror
luaL_checkany
lua_next
luaopen_base
luaopen_table
luaopen_os
luaopen_string
luaopen_math
luaopen_debug
lua_getstack
lua_getinfo
luaL_addvalue
luaL_error
luaL_checklstring
luaL_optlstring
lua_replace
luaL_checkudata
luaL_buffinit
luaL_addlstring
luaL_pushresult
lua_error
lua_rawget
lua_load
lua_pushfstring
luaL_loadstring
lua_checkstack
lua_pushlightuserdata
lua_pushlstring
lua_isnumber
lua_tointeger
lua_toboolean
luaL_ref
luaL_unref
lua_gettable
lua_isstring
lua_objlen
lua_rawseti
lua_createtable
lua_setfield
lua_rawgeti
lua_pushcclosure
lua_insert
lua_pcall
lua_remove
lua_gc
lua_pushvalue
lua_pushinteger
lua_call
luaL_newmetatable
luaL_register
lua_pushboolean
lua_pushstring
lua_tolstring
lua_pushnil
luaL_checkinteger
lua_gettop
lua_tonumber
luaL_argerror
lua_type
lua_getmetatable
lua_rawequal
lua_settop
lua_touserdata
lua_pushnumber
lua_newuserdata
lua_getfield
lua_setmetatable
luaL_checktype
luaL_optnumber
lua_rawset
lua_concat
lua_getallocf
luaL_optinteger

rpcrt4

UuidFromStringA
RpcStringFreeA
UuidToStringA
UuidCreate

Exports

Exports

LF_Analyse
LF_CloseAnalyse
LF_ClosePanel
LF_Compare
LF_Configure
LF_DeleteFiles
LF_DlgProc
LF_DoFile
LF_ExitFAR
LF_FreeCustomData
LF_FreeFindData
LF_GetCustomData
LF_GetFiles
LF_GetFindData
LF_GetGlobalInfo
LF_GetOpenPanelInfo
LF_GetPluginInfo
LF_Gsub
LF_InitLuaState1
LF_InitLuaState2
LF_LoadFile
LF_LuaClose
LF_LuaOpen
LF_MacroCallback
LF_MakeDirectory
LF_Message
LF_Open
LF_ProcessConsoleInput
LF_ProcessDialogEvent
LF_ProcessEditorEvent
LF_ProcessEditorInput
LF_ProcessEnvVars
LF_ProcessHostFile
LF_ProcessPanelEvent
LF_ProcessPanelInput
LF_ProcessSynchroEvent
LF_ProcessViewerEvent
LF_PutFiles
LF_RunDefaultScript
LF_SetDirectory
LF_SetFindList

Sections

.text
Size: 259KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Far/luafar3.map

Sharing

General

Malware Config

Signatures

Files

79d5ea631b0eaf9b0eb952a80d4aac39

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

shell32

netapi32

mpr

ole32

psapi

secur32

setupapi

rpcrt4

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 312KB - Virtual size: 311KB

.data Size: 63KB - Virtual size: 417KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 200KB - Virtual size: 200KB

.reloc Size: 134KB - Virtual size: 133KB

54766d082d6befa91f90c2d875df2079

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 123KB - Virtual size: 122KB

.data Size: 512B - Virtual size: 32B

.rdata Size: 13KB - Virtual size: 12KB

.bss Size: - Virtual size: 2KB

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 4KB - Virtual size: 3KB

9acf63e294ec137682995804d4ae2afe

Headers

File Characteristics

Imports

lua5.1

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 252B

dae591969f8d63ce2c93eb66097d4608

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

lua5.1

rpcrt4

Exports

Exports

Sections

.text Size: 259KB - Virtual size: 259KB

.data Size: 36KB - Virtual size: 43KB

.rsrc Size: 1024B - Virtual size: 952B

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 312KB - Virtual size: 311KB

.data
Size: 63KB - Virtual size: 417KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 200KB - Virtual size: 200KB

.reloc
Size: 134KB - Virtual size: 133KB

.text
Size: 123KB - Virtual size: 122KB

.data
Size: 512B - Virtual size: 32B

.rdata
Size: 13KB - Virtual size: 12KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 2KB - Virtual size: 1KB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 252B

.text
Size: 259KB - Virtual size: 259KB

.data
Size: 36KB - Virtual size: 43KB

.rsrc
Size: 1024B - Virtual size: 952B

.reloc
Size: 12KB - Virtual size: 11KB