General

Malware Config

Signatures

Files

• PentagonRAT.zip

  .zip
• PentagonRAT/Bunifu_UI_v1.52.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 218KB - Virtual size: 217KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/DevComponents.DotNetBar2.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .textxc

  Size: 4.9MB - Virtual size: 4.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .datax

  Size: 4KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 86B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• PentagonRAT/Hantu/01.jpg

  .jpg
• PentagonRAT/Hantu/02.jpg

  .jpg
• PentagonRAT/Hantu/03.jpg

  .jpg
• PentagonRAT/Hantu/04.jpg

  .jpg
• PentagonRAT/Hantu/05.jpg

  .jpg
• PentagonRAT/Hantu/06.jpg

  .jpg
• PentagonRAT/Hantu/07.png

  .png
• PentagonRAT/Hantu/08.gif

  .gif
• PentagonRAT/Hantu/09.jpg

  .jpg
• PentagonRAT/Icones/Control Panel/AuthFWGP_100.ico
• PentagonRAT/Icones/Control Panel/Faultrep_5201.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_139.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_168.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_17.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_240.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_242.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_244.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_5000.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_5001.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_5002.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_5003.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_5004.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_5005.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_5006.ico
• PentagonRAT/Icones/Control Panel/Printers/prnfldr_5007.ico
• PentagonRAT/Icones/Control Panel/baaupdate_1.ico
• PentagonRAT/Icones/Control Panel/explorer_262.ico
• PentagonRAT/Icones/Control Panel/imageres_27.ico
• PentagonRAT/Icones/Control Panel/imageres_78.ico
• PentagonRAT/Icones/Control Panel/imageres_80.ico
• PentagonRAT/Icones/Control Panel/imageres_87.ico
• PentagonRAT/Icones/Control Panel/powercfg_202.ico
• PentagonRAT/Icones/Control Panel/powercpl_506.ico
• PentagonRAT/Icones/Control Panel/powercpl_507.ico
• PentagonRAT/Icones/Control Panel/powercpl_512.ico
• PentagonRAT/Icones/Control Panel/powercpl_513.ico
• PentagonRAT/Icones/Control Panel/powercpl_514.ico
• PentagonRAT/Icones/Control Panel/powercpl_515.ico
• PentagonRAT/Icones/Control Panel/powercpl_516.ico
• PentagonRAT/Icones/Control Panel/powrprof_512.ico
• PentagonRAT/Icones/Control Panel/powrprof_513.ico
• PentagonRAT/Icones/Control Panel/powrprof_514.ico
• PentagonRAT/Icones/ico/1.ico
• PentagonRAT/Icones/ico/10.ico
• PentagonRAT/Icones/ico/11.ico
• PentagonRAT/Icones/ico/12.ico
• PentagonRAT/Icones/ico/13.ico
• PentagonRAT/Icones/ico/14.ico
• PentagonRAT/Icones/ico/15.ico
• PentagonRAT/Icones/ico/16.ico
• PentagonRAT/Icones/ico/17.ico
• PentagonRAT/Icones/ico/18.ico
• PentagonRAT/Icones/ico/2.ico
• PentagonRAT/Icones/ico/3.ico
• PentagonRAT/Icones/ico/4.ico
• PentagonRAT/Icones/ico/5.ico
• PentagonRAT/Icones/ico/6.ico
• PentagonRAT/Icones/ico/7.ico
• PentagonRAT/Icones/ico/8.ico
• PentagonRAT/Icones/ico/9.ico
• PentagonRAT/KeyPentagonRAT Final Version.txt
• PentagonRAT/Microsoft.VisualBasic.PowerPacks.Vs.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:cf:3e:00:00:00:00:00:0f

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  07-12-2009 22:40

  Not After

  07-03-2011 22:40

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:05:a2:30:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:01

  Not After

  25-07-2013 19:11

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  b6:38:c0:8a:ed:04:03:14:45:96:73:9e:19:11:75:c9:68:02:98:cb

  Signer

  Actual PE Digest

  b6:38:c0:8a:ed:04:03:14:45:96:73:9e:19:11:75:c9:68:02:98:cb

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  19-03-2010 03:09

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 244KB - Virtual size: 243KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .sdata

  Size: 512B - Virtual size: 128B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/Mono.Cecil.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 303KB - Virtual size: 302KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 824B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/Notificação.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/PentagonRAT Final Relasex.exe

  .exe windows x64

  77d45b1ee20c3b020c48ab42d23ce5ef

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  CloseHandle

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  EncodePointer

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  RtlPcToFileHeader

  RtlUnwindEx

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  DeleteFileW

  SetEnvironmentVariableA

  user32

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetWindowLongW

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongPtrW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  SetWindowLongPtrW

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  GetCursorInfo

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  TranslateMessage

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongPtrW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  TrackPopupMenuEx

  DispatchMessageW

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  PeekMessageW

  ScreenToClient

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  CreateCompatibleBitmap

  CreateCompatibleDC

  Ellipse

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  CreateDispTypeInfo

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysAllocString

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  SafeArrayAccessData

  VariantInit

  Sections

  .text

  Size: 672KB - Virtual size: 672KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 23KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 13.4MB - Virtual size: 13.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/Plugin/Notificação.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/Plugin/cam.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 61KB - Virtual size: 61KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 512B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/Plugin/ch.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 512B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/Plugin/fm.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 512B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/Plugin/pw.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 36KB - Virtual size: 35KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/Plugin/sc2.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/README/Help.txt
• PentagonRAT/README/LICENSE AGGREMENT.txt
• PentagonRAT/Stub/MemoryDiagnostic.exe

  .exe windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/Stub/Security.exe

  .exe windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 97KB - Virtual size: 96KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PentagonRAT/UPX/mpress.exe

  .exe windows x86

  51e7ef6b1d43d0d05d7109dee9789560

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  GetModuleHandleA

  GetProcAddress

  imagehlp

  CheckSumMappedFile

  Sections

  .MPRESS1

  Size: 88KB - Virtual size: 216KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .MPRESS2

  Size: 1024B - Virtual size: 862B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE