libLauncher_nbt++[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

libLauncher_nbt++.dll
Size

342KB
MD5

a8fd1d3ca86576af970775e814578dc0
SHA1

b600843f2c8ef110fcbb5dd5f57211bbe189056d
SHA256

0de8b725ff2074290b6c9f5f38a4650b84eaf299456c2dc5cd9e71b1e1962824
SHA512

48042b9b3f5e6471261f663351b86d5c231cc2158f71cb2cdc3bdc2f667a90175d908b7325b8ab156366eddf037baf788abd6555825a04b90f8f85cb44386cb8
SSDEEP

6144:eIUgcH0hzdJ8UOxWbc5sCDPB/Qll7a56FBTYb4Y7pHhW6dJjgGoo5Nheff1ByLca:eIUgcH0hGV/Qll7W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libLauncher_nbt++.dll

Files

libLauncher_nbt++.dll
.dll windows x86

69befada6c154f29dced012d4f62e0f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

libgcc_s_dw2-1

_Unwind_Resume
__deregister_frame_info
__register_frame_info
__udivdi3
__umoddi3

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

__dllonexit
__mb_cur_max
_amsg_exit
_errno
_initterm
_iob
_lock
_onexit
_unlock
abort
atoi
calloc
fputc
free
fwrite
getenv
localeconv
malloc
memcmp
memcpy
memset
setlocale
strchr
strerror
strlen
strncmp
vfprintf
wcslen

libssp-0

__stack_chk_fail
__stack_chk_guard

libstdc++-6

_ZNKSt13runtime_error4whatEv
_ZNKSt15basic_stringbufIcSt11char_traitsIcESaIcEE3strEv
_ZNKSt9type_infoeqERKS_
_ZNSi3getERc
_ZNSi3getEv
_ZNSi4readEPci
_ZNSo3putEc
_ZNSo5writeEPKci
_ZNSo9_M_insertIdEERSoT_
_ZNSo9_M_insertImEERSoT_
_ZNSo9_M_insertIxEERSoT_
_ZNSolsEi
_ZNSolsEs
_ZNSs12_M_leak_hardEv
_ZNSs12_S_constructEjcRKSaIcE
_ZNSs4_Rep10_M_destroyERKSaIcE
_ZNSs4_Rep10_M_disposeERKSaIcE
_ZNSs4_Rep9_S_createEjjRKSaIcE
_ZNSs4swapERSs
_ZNSs6insertEjPKcj
_ZNSsC1EPKcRKSaIcE
_ZNSsC1ERKSs
_ZNSsC1EjcRKSaIcE
_ZNSt11logic_errorC1ERKSs
_ZNSt11logic_errorD1Ev
_ZNSt12length_errorC1ERKSs
_ZNSt12length_errorD1Ev
_ZNSt13runtime_errorC2ERKSs
_ZNSt13runtime_errorD2Ev
_ZNSt16invalid_argumentC1ERKSs
_ZNSt16invalid_argumentD1Ev
_ZNSt19basic_ostringstreamIcSt11char_traitsIcESaIcEEC1ESt13_Ios_Openmode
_ZNSt19basic_ostringstreamIcSt11char_traitsIcESaIcEED1Ev
_ZNSt8bad_castD1Ev
_ZNSt8ios_base4InitC1Ev
_ZNSt8ios_base4InitD1Ev
_ZNSt9basic_iosIcSt11char_traitsIcEE5clearESt12_Ios_Iostate
_ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_i
_ZSt17__throw_bad_allocv
_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPKSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base
_ZSt20__throw_length_errorPKc
_ZSt20__throw_out_of_rangePKc
_ZSt24__throw_out_of_range_fmtPKcz
_ZSt28_Rb_tree_rebalance_for_erasePSt18_Rb_tree_node_baseRS_
_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVSt8bad_cast
_ZdlPv
_Znwj
__cxa_allocate_exception
__cxa_bad_cast
__cxa_begin_catch
__cxa_end_catch
__cxa_free_exception
__cxa_guard_acquire
__cxa_guard_release
__cxa_pure_virtual
__cxa_rethrow
__cxa_throw
__dynamic_cast
__gxx_personality_v0

Exports

Exports

_ZN3nbt10tag_string12read_payloadERNS_2io13stream_readerE
_ZN3nbt12tag_compound12read_payloadERNS_2io13stream_readerE
_ZN3nbt12tag_compound2atERKSs
_ZN3nbt12tag_compound3putERKSsONS_17value_initializerE
_ZN3nbt12tag_compound5eraseERKSs
_ZN3nbt12tag_compound6insertERKSsONS_17value_initializerE
_ZN3nbt12tag_compoundC1ESt16initializer_listISt4pairISsNS_17value_initializerEEE
_ZN3nbt12tag_compoundC2ESt16initializer_listISt4pairISsNS_17value_initializerEEE
_ZN3nbt13is_valid_typeEib
_ZN3nbt13tag_primitiveIaE12read_payloadERNS_2io13stream_readerE
_ZN3nbt13tag_primitiveIdE12read_payloadERNS_2io13stream_readerE
_ZN3nbt13tag_primitiveIfE12read_payloadERNS_2io13stream_readerE
_ZN3nbt13tag_primitiveIiE12read_payloadERNS_2io13stream_readerE
_ZN3nbt13tag_primitiveIsE12read_payloadERNS_2io13stream_readerE
_ZN3nbt13tag_primitiveIxE12read_payloadERNS_2io13stream_readerE
_ZN3nbt17value_initializerC1EOSs
_ZN3nbt17value_initializerC1EPKc
_ZN3nbt17value_initializerC1ERKSs
_ZN3nbt17value_initializerC1Ea
_ZN3nbt17value_initializerC1Ed
_ZN3nbt17value_initializerC1Ef
_ZN3nbt17value_initializerC1Ei
_ZN3nbt17value_initializerC1Es
_ZN3nbt17value_initializerC1Ex
_ZN3nbt17value_initializerC2EOSs
_ZN3nbt17value_initializerC2EPKc
_ZN3nbt17value_initializerC2ERKSs
_ZN3nbt17value_initializerC2Ea
_ZN3nbt17value_initializerC2Ed
_ZN3nbt17value_initializerC2Ef
_ZN3nbt17value_initializerC2Ei
_ZN3nbt17value_initializerC2Es
_ZN3nbt17value_initializerC2Ex
_ZN3nbt2io13read_compoundERSiN6endian6endianE
_ZN3nbt2io13stream_reader11read_stringEv
_ZN3nbt2io13stream_reader12read_payloadENS_8tag_typeE
_ZN3nbt2io13stream_reader13read_compoundEv
_ZN3nbt2io13stream_reader8read_tagEv
_ZN3nbt2io13stream_reader9read_typeEb
_ZN3nbt2io13stream_readerC1ERSiN6endian6endianE
_ZN3nbt2io13stream_readerC2ERSiN6endian6endianE
_ZN3nbt2io13stream_writer12write_stringERKSs
_ZN3nbt2io13stream_writer9write_tagERKSsRKNS_3tagE
_ZN3nbt2io8read_tagERSiN6endian6endianE
_ZN3nbt2io9write_tagERKSsRKNS_3tagERSoN6endian6endianE
_ZN3nbt3tag6createENS_8tag_typeE
_ZN3nbt5value2atERKSs
_ZN3nbt5value2atEj
_ZN3nbt5value3setEONS_3tagE
_ZN3nbt5valueC1EONS_3tagE
_ZN3nbt5valueC1ERKS0_
_ZN3nbt5valueC2EONS_3tagE
_ZN3nbt5valueC2ERKS0_
_ZN3nbt5valueaSEONS_3tagE
_ZN3nbt5valueaSEOSs
_ZN3nbt5valueaSERKS0_
_ZN3nbt5valueaSEa
_ZN3nbt5valueaSEd
_ZN3nbt5valueaSEf
_ZN3nbt5valueaSEi
_ZN3nbt5valueaSEs
_ZN3nbt5valueaSEx
_ZN3nbt5valueixEPKc
_ZN3nbt5valueixERKSs
_ZN3nbt5valueixEj
_ZN3nbt8tag_list12read_payloadERNS_2io13stream_readerE
_ZN3nbt8tag_list2atEj
_ZN3nbt8tag_list3setEjONS_5valueE
_ZN3nbt8tag_list5resetENS_8tag_typeE
_ZN3nbt8tag_list9push_backEONS_17value_initializerE
_ZN3nbt8tag_listC1ESt16initializer_listINS_12tag_compoundEE
_ZN3nbt8tag_listC1ESt16initializer_listINS_5valueEE
_ZN3nbt8tag_listC1ESt16initializer_listINS_9tag_arrayIaEEE
_ZN3nbt8tag_listC1ESt16initializer_listINS_9tag_arrayIiEEE
_ZN3nbt8tag_listC1ESt16initializer_listINS_9tag_arrayIxEEE
_ZN3nbt8tag_listC1ESt16initializer_listIS0_E
_ZN3nbt8tag_listC1ESt16initializer_listISsE
_ZN3nbt8tag_listC1ESt16initializer_listIaE
_ZN3nbt8tag_listC1ESt16initializer_listIdE
_ZN3nbt8tag_listC1ESt16initializer_listIfE
_ZN3nbt8tag_listC1ESt16initializer_listIiE
_ZN3nbt8tag_listC1ESt16initializer_listIsE
_ZN3nbt8tag_listC1ESt16initializer_listIxE
_ZN3nbt8tag_listC2ESt16initializer_listINS_12tag_compoundEE
_ZN3nbt8tag_listC2ESt16initializer_listINS_5valueEE
_ZN3nbt8tag_listC2ESt16initializer_listINS_9tag_arrayIaEEE
_ZN3nbt8tag_listC2ESt16initializer_listINS_9tag_arrayIiEEE
_ZN3nbt8tag_listC2ESt16initializer_listINS_9tag_arrayIxEEE
_ZN3nbt8tag_listC2ESt16initializer_listIS0_E
_ZN3nbt8tag_listC2ESt16initializer_listISsE
_ZN3nbt8tag_listC2ESt16initializer_listIaE
_ZN3nbt8tag_listC2ESt16initializer_listIdE
_ZN3nbt8tag_listC2ESt16initializer_listIfE
_ZN3nbt8tag_listC2ESt16initializer_listIiE
_ZN3nbt8tag_listC2ESt16initializer_listIsE
_ZN3nbt8tag_listC2ESt16initializer_listIxE
_ZN3nbt9tag_arrayIaE12read_payloadERNS_2io13stream_readerE
_ZN3nbt9tag_arrayIiE12read_payloadERNS_2io13stream_readerE
_ZN3nbt9tag_arrayIxE12read_payloadERNS_2io13stream_readerE
_ZN3nbteqERKNS_3tagES2_
_ZN3nbteqERKNS_5valueES2_
_ZN3nbteqERKNS_8tag_listES2_
_ZN3nbtlsERSoNS_8tag_typeE
_ZN3nbtlsERSoRKNS_3tagE
_ZN3nbtneERKNS_3tagES2_
_ZN3nbtneERKNS_5valueES2_
_ZN3nbtneERKNS_8tag_listES2_
_ZN6endian11read_littleERSiRa
_ZN6endian11read_littleERSiRd
_ZN6endian11read_littleERSiRf
_ZN6endian11read_littleERSiRh
_ZN6endian11read_littleERSiRi
_ZN6endian11read_littleERSiRj
_ZN6endian11read_littleERSiRs
_ZN6endian11read_littleERSiRt
_ZN6endian11read_littleERSiRx
_ZN6endian11read_littleERSiRy
_ZN6endian12write_littleERSoa
_ZN6endian12write_littleERSod
_ZN6endian12write_littleERSof
_ZN6endian12write_littleERSoh
_ZN6endian12write_littleERSoi
_ZN6endian12write_littleERSoj
_ZN6endian12write_littleERSos
_ZN6endian12write_littleERSot
_ZN6endian12write_littleERSox
_ZN6endian12write_littleERSoy
_ZN6endian8read_bigERSiRa
_ZN6endian8read_bigERSiRd
_ZN6endian8read_bigERSiRf
_ZN6endian8read_bigERSiRh
_ZN6endian8read_bigERSiRi
_ZN6endian8read_bigERSiRj
_ZN6endian8read_bigERSiRs
_ZN6endian8read_bigERSiRt
_ZN6endian8read_bigERSiRx
_ZN6endian8read_bigERSiRy
_ZN6endian9write_bigERSoa
_ZN6endian9write_bigERSod
_ZN6endian9write_bigERSof
_ZN6endian9write_bigERSoh
_ZN6endian9write_bigERSoi
_ZN6endian9write_bigERSoj
_ZN6endian9write_bigERSos
_ZN6endian9write_bigERSot
_ZN6endian9write_bigERSox
_ZN6endian9write_bigERSoy
_ZNK3nbt10tag_string13write_payloadERNS_2io13stream_writerE
_ZNK3nbt12tag_compound13write_payloadERNS_2io13stream_writerE
_ZNK3nbt12tag_compound2atERKSs
_ZNK3nbt12tag_compound7has_keyERKSs
_ZNK3nbt12tag_compound7has_keyERKSsNS_8tag_typeE
_ZNK3nbt13tag_primitiveIaE13write_payloadERNS_2io13stream_writerE
_ZNK3nbt13tag_primitiveIdE13write_payloadERNS_2io13stream_writerE
_ZNK3nbt13tag_primitiveIfE13write_payloadERNS_2io13stream_writerE
_ZNK3nbt13tag_primitiveIiE13write_payloadERNS_2io13stream_writerE
_ZNK3nbt13tag_primitiveIsE13write_payloadERNS_2io13stream_writerE
_ZNK3nbt13tag_primitiveIxE13write_payloadERNS_2io13stream_writerE
_ZNK3nbt2io13stream_reader10get_endianEv
_ZNK3nbt2io13stream_reader8get_istrEv
_ZNK3nbt4text14json_formatter5printERSoRKNS_3tagE
_ZNK3nbt5value2atERKSs
_ZNK3nbt5value2atEj
_ZNK3nbt5value8get_typeEv
_ZNK3nbt5valuecvRKSsEv
_ZNK3nbt5valuecvaEv
_ZNK3nbt5valuecvdEv
_ZNK3nbt5valuecvfEv
_ZNK3nbt5valuecviEv
_ZNK3nbt5valuecvsEv
_ZNK3nbt5valuecvxEv
_ZNK3nbt5valueixEj
_ZNK3nbt8tag_list13write_payloadERNS_2io13stream_writerE
_ZNK3nbt8tag_list2atEj
_ZNK3nbt9tag_arrayIaE13write_payloadERNS_2io13stream_writerE
_ZNK3nbt9tag_arrayIiE13write_payloadERNS_2io13stream_writerE
_ZNK3nbt9tag_arrayIxE13write_payloadERNS_2io13stream_writerE
_ZNO3nbt3tag5cloneEv
_ZTIN3nbt10tag_stringE
_ZTIN3nbt12tag_compoundE
_ZTIN3nbt13tag_primitiveIaEE
_ZTIN3nbt13tag_primitiveIdEE
_ZTIN3nbt13tag_primitiveIfEE
_ZTIN3nbt13tag_primitiveIiEE
_ZTIN3nbt13tag_primitiveIsEE
_ZTIN3nbt13tag_primitiveIxEE
_ZTIN3nbt2io11input_errorE
_ZTIN3nbt3tagE
_ZTIN3nbt8tag_listE
_ZTIN3nbt9tag_arrayIaEE
_ZTIN3nbt9tag_arrayIiEE
_ZTIN3nbt9tag_arrayIxEE
_ZTVN3nbt10tag_stringE
_ZTVN3nbt12tag_compoundE
_ZTVN3nbt13tag_primitiveIaEE
_ZTVN3nbt13tag_primitiveIdEE
_ZTVN3nbt13tag_primitiveIfEE
_ZTVN3nbt13tag_primitiveIiEE
_ZTVN3nbt13tag_primitiveIsEE
_ZTVN3nbt13tag_primitiveIxEE
_ZTVN3nbt2io11input_errorE
_ZTVN3nbt3tagE
_ZTVN3nbt8tag_listE
_ZTVN3nbt9tag_arrayIaEE
_ZTVN3nbt9tag_arrayIiEE
_ZTVN3nbt9tag_arrayIxEE

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 512B - Virtual size: 135B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 512B - Virtual size: 277B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69befada6c154f29dced012d4f62e0f1

Headers

File Characteristics

Imports

libgcc_s_dw2-1

kernel32

msvcrt

libssp-0

libstdc++-6

Exports

Exports

Sections

.text Size: 85KB - Virtual size: 85KB

.data Size: 512B - Virtual size: 68B

.rdata Size: 12KB - Virtual size: 11KB

/4 Size: 30KB - Virtual size: 30KB

.bss Size: - Virtual size: 3KB

.edata Size: 9KB - Virtual size: 9KB

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 4KB - Virtual size: 3KB

/14 Size: 512B - Virtual size: 56B

/29 Size: 3KB - Virtual size: 3KB

/41 Size: 512B - Virtual size: 135B

/55 Size: 512B - Virtual size: 277B

/67 Size: 512B - Virtual size: 56B

.text
Size: 85KB - Virtual size: 85KB

.data
Size: 512B - Virtual size: 68B

.rdata
Size: 12KB - Virtual size: 11KB

/4
Size: 30KB - Virtual size: 30KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 9KB - Virtual size: 9KB

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 4KB - Virtual size: 3KB

/14
Size: 512B - Virtual size: 56B

/29
Size: 3KB - Virtual size: 3KB

/41
Size: 512B - Virtual size: 135B

/55
Size: 512B - Virtual size: 277B

/67
Size: 512B - Virtual size: 56B