General

Malware Config

Signatures

Files

• guitar-.tmp.zip

  .zip
• guitar-.tmp

  .dll windows x64

  4ba4c5783074c487c88c9bafe1f6327b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  UnhandledExceptionFilter

  DisableThreadLibraryCalls

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  DecodePointer

  EncodePointer

  GetProcessTimes

  LocalFree

  Module32NextW

  CreateToolhelp32Snapshot

  GetModuleHandleW

  Sleep

  DebugBreak

  FindNextFileW

  RemoveDirectoryW

  FindClose

  GetProcAddress

  LoadLibraryW

  InitializeCriticalSection

  LoadLibraryExW

  FreeLibrary

  FindFirstFileW

  CloseHandle

  CreateFileW

  LeaveCriticalSection

  EnterCriticalSection

  GetModuleFileNameW

  GetModuleHandleExW

  GetTickCount

  GetCurrentProcessorNumber

  GetLastError

  QueryPerformanceCounter

  TlsGetValue

  psapi

  GetModuleInformation

  dbghelp

  SymLoadModuleExW

  SymUnloadModule64

  Exports

  Exports

  dllocateBuffer

  dllocateHkConcatWrappingLockBytes

  dllocateHkLobBuiltinWrappingLockBytes

  dllocateHkPalWrappingLockBytes

  dllocateSortRowDeepData

  dssertFail

  dompareMaxStrings

  dompareStrings

  dot

  dreateError

  dreateErrorForRethrow

  dreateErrorForThrow

  dateAdd

  dateDiff

  dateFromParts

  datePart

  dateTime2FromParts

  dateTimeFromParts

  deallocateBufferForSort

  deallocateBufferForTopSort

  dismissErrorForCatchBlock

  dOMonth

  dndNonOptimizedResultForError

  dxecuteNestedModule

  detContextInfo

  detDateTime

  detDateTime2

  detEmptySortRowSlot

  detErrorLine

  detErrorMessage

  detErrorNumber

  detErrorSeverity

  detErrorState

  detFirstSortedRow

  detNewId

  detNewSequentialId

  detNextSortedRow

  detNextSortedRowDistinct

  detSessionLogin

  detSpid

  detSuserId

  detSuserSid

  detSuserSname

  detSusername

  detUTCDateTime

  detUTCDateTime2

  detUserId

  detUserIdEx

  detUsername

  dashString

  dkCsPostCheckpointLoad

  dkCsProcessCustomLogRec

  dkInitializeXERuntime

  dkRtAlterTable

  dkRtCompileProcedure

  dkRtCreateDatabase

  dkRtCreateTable

  dkRtCreateTableVariableEx

  dkRtCreateTempTable

  dkRtDropDatabase

  dkRtDropTable

  dkRtExecuteProcedure

  dkRtExecuteProcedureWithTdsParse

  dkRtExecuteProcedureWithTdsReturn

  dkRtFindTable

  dkRtGetSystem

  dkRtGetTableMetadata

  dkRtInitialize

  dkRtInitializeFixedTableSchemas

  dkRtIsInitialized

  dkRtLoadDLL

  dkRtMatImport

  dkRtParseFixedSchemaSerializedMetadata

  dkRtProcedureDropImmediate

  dkRtProcessCleanupQueue

  dkRtRestoreDatabase

  dkRtRestoreTable

  dkRtSystemDump

  dkRtTableDropCallback

  dkRtTableTypeDropImmediate

  dkRtTraceFlagTurnOff

  dkRtTraceFlagTurnOn

  dkRtUpdateOutputForDependencies

  dkRtWaitForDependencies

  dkRtWaitForDependenciesEx

  dostConvert

  dnitPriorityQueue

  dnitSortContext

  dnitTopSortContext

  dnitializeHkPalWrappingLockBytesBuffer

  dnsertIntoPriorityQueue

  dsMember

  dsRoleMember

  dsSrvRoleMember

  dogBaseN

  daskAsciiString

  daskAsciiStringLob

  daskBinary

  daskBinaryLob

  daskDateAndTime

  daskDouble

  daskGuid

  daskInt64

  daskLargeNumeric

  daskUnicodeString

  daskUnicodeStringLob

  dand

  dound128

  dound64

  doundDouble

  dRand

  daveErrorForCatchBlock

  dendNonOptimizedMetadata

  dendNonOptimizedOutput

  detLineNumberForError

  dmallDateTimeFromParts

  dortAndMergeHkSearchIntervals

  dortHkRows

  dysMaxDateTime

  dysTranDateTime

  dhrowErrorHr

  dimeFromParts

  driggerNestLevel

  driggerNestLevelWithId

  dieldThread

  d_report_gsfailure

  d_report_rangecheckfailure

  dk_acos

  dk_asin

  dk_atan

  dk_atan2

  dk_ceil

  dk_cos

  dk_exp

  dk_floor

  dk_log

  dk_log10

  dk_pow

  dk_sin

  dk_sqrt

  init

  Sections

  .text

  Size: 82KB - Virtual size: 81KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 36KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 2.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  AssertDa

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 20KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• license.dat
• run.bat