Windows_Repair_Toolbox[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Windows_Repair_Toolbox.zip
Size

3.1MB
MD5

8297cc1fac3dfab6f0c8f4b65596583f
SHA1

02237e2ca5ccc32c01dedd76d384fcaab474bc43
SHA256

43fde8eeacb4b2c977025e1f55b1d2b753abc4cc67c80471fdb19b6bb40f6945
SHA512

9016cf4399fef1b578ae03017f872b1320a9202431fa4eb15fd74ed659b79721dd9c443b99b004497b01f3210ff290ff83c03c36ca1405953ab7b6738bba8072
SSDEEP

49152:MTfRG3cTavevVoemRXI4q6iLbXsMuk241vlL5dIU0lu29QOKTSqdjLH8MMM:MTpGMTaGvVv4I0ME4JXy994vnUM

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Windows_Repair_Toolbox.exe
unpack001/files/7zG.exe
unpack001/files/7za.exe
unpack001/files/ATPad/ATPad.exe
unpack001/files/CheckDisk.exe
unpack001/files/DISM_And_SFC.exe
unpack001/files/smartctl-nc.exe
unpack001/updater.exe

Files

Windows_Repair_Toolbox.zip
.zip
Downloads/_downloads_folder_WRT
Final Tests/EXCEL.xlsx
.xlsx office2007
Final Tests/PDF.pdf
.pdf
Final Tests/POWERPOINT.pptx
.pptx office2007
Final Tests/WORD.docx
.docx office2007
Final Tests/_final_tests_folder_WRT
Final Tests/clouds.mp4
Final Tests/test.zip
.zip
Final Tests/thunder.mp3
Windows_Repair_Toolbox.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows_Repair_Toolbox.exe.config
.xml
custom/custom.xml
.xml
custom/settings.xml
files/7zG.exe
.exe windows x86

22ea1ffd699e61d7e25f4ee69976acda

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

comdlg32

CommDlgExtendedError
GetOpenFileNameW

gdi32

CreateFontIndirectW
DeleteObject

oleaut32

SysStringByteLen
VariantCopy
VariantClear
SysAllocString
SysAllocStringLen
SysStringLen

ole32

OleInitialize
CoCreateInstance
CoInitialize
CoUninitialize

user32

SetCursor
SetDlgItemTextW
LoadIconW
SetTimer
CheckDlgButton
IsDlgButtonChecked
PostMessageW
GetKeyState
EndDialog
InvalidateRect
SetWindowTextW
MessageBoxW
DialogBoxParamW
SetWindowLongW
GetWindowLongW
GetParent
LoadCursorW
MoveWindow
ScreenToClient
GetDlgItem
GetWindowRect
MapDialogRect
MonitorFromWindow
GetMonitorInfoA
SystemParametersInfoW
GetWindowTextLengthW
GetWindowTextW
SendMessageW
LoadStringW
SetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
CharUpperW
IsWindowEnabled
SetDlgItemTextA
GetFocus
SetFocus
KillTimer
EnableWindow
ShowWindow

advapi32

RegQueryValueExW
LookupPrivilegeValueW
RegOpenKeyExA
RegQueryValueExA
GetFileSecurityW
SetFileSecurityW
OpenProcessToken
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
AdjustTokenPrivileges

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHGetMalloc

msvcrt

_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
wcscat
_ftol
_iob
memcmp
_purecall
strlen
memset
free
malloc
wcscmp
wcsstr
strcmp
memmove
memcpy
_CxxThrowException
__CxxFrameHandler
_isatty
exit
_fileno

kernel32

GetVersionExW
lstrcatW
SetPriorityClass
WaitForMultipleObjects
Sleep
GetSystemDefaultLangID
GetUserDefaultLangID
AreFileApisANSI
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
lstrlenW
GetCommandLineW
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GlobalFree
GlobalAlloc
GetDiskFreeSpaceW
GetDriveTypeW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
WaitForSingleObject
ResumeThread
SetThreadAffinityMask
CreateEventW
SetEvent
InitializeCriticalSection
LoadLibraryA
VirtualAlloc
FileTimeToLocalFileTime
VirtualFree
GetStartupInfoA
GetTempPathW
GetFileInformationByHandle
GetFileAttributesW
GetModuleHandleA
FindNextFileW
FindFirstFileW
FindClose
GetCurrentThreadId
GetTickCount
GetCurrentDirectoryW
SetCurrentDirectoryW
SetLastError
DeleteFileW
CreateDirectoryW
GetModuleHandleW
GetProcAddress
MoveFileW
RemoveDirectoryW
SetFileAttributesW
CreateFileW
SetFileTime
CloseHandle
FormatMessageW
LocalFree
GetModuleFileNameW
LoadLibraryW
LoadLibraryExW
FreeLibrary
GlobalLock
GlobalUnlock
WideCharToMultiByte
MultiByteToWideChar
GetLastError
GetCurrentProcessId

Sections

.text
Size: 313KB - Virtual size: 313KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
files/7za.exe
.exe windows x86

abae283b9febd6b6c99aae6c6b3d9202

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear

user32

CharPrevExA
CharUpperW

advapi32

OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
exit
_ftol
realloc
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
malloc
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
_isatty
_fileno

kernel32

CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
ResumeThread
SetFileAttributesW
WaitForSingleObject
InterlockedIncrement
VirtualFree
VirtualAlloc
GetOEMCP
LocalFileTimeToFileTime
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
ReadFile
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
DeviceIoControl
SetThreadAffinityMask

Sections

.text
Size: 672KB - Virtual size: 672KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
files/ATPad/ATPad.exe
.exe windows x86

09a38fd288880c15ae6b1022084d3532

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GlobalAlloc
GlobalFree
GetPrivateProfileStringW
WritePrivateProfileSectionW
WritePrivateProfileStringW
HeapAlloc
HeapFree
GetLastError
MulDiv
CreateMutexW
GlobalAddAtomW
GetModuleFileNameW
LoadLibraryW
GetProcessHeap
MultiByteToWideChar
GlobalGetAtomNameW
DeleteAtom
WritePrivateProfileStructW
GetDriveTypeW
DeleteFileW
FindFirstFileW
FindClose
GetFileAttributesW
CreateFileW
WriteFile
CloseHandle
GetVersionExW
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineW
LocalFree
HeapReAlloc
GetPrivateProfileSectionW
GetPrivateProfileStructW
GetPrivateProfileIntW
FindNextFileW
ReadFile
SetFilePointer
GetTempPathW
GetTickCount
GetLocalTime
GetDateFormatW
GetTimeFormatW
WideCharToMultiByte
GetTempFileNameW
CopyFileW
CreateThread
GetPrivateProfileSectionNamesW
GetModuleHandleW
GetModuleHandleA
GetStartupInfoA
VirtualAlloc
VirtualQuery
HeapCreate
HeapDestroy
HeapSize
HeapValidate
RtlUnwind
ExitProcess
GetSystemTimeAsFileTime
GetFileType
GetStdHandle
GetCurrentProcess
DuplicateHandle
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetConsoleCtrlHandler
SetLastError

user32

wsprintfA
LoadStringA
DialogBoxParamA
GetDlgItem
GetWindowLongA
EndDialog
SendMessageW
SendMessageA
SetWindowTextA
GetClientRect
GetWindowRect
MapWindowPoints
SetWindowPos
BeginPaint
DrawIconEx
DrawTextA
EndPaint
GetDesktopWindow
MoveWindow
DestroyWindow
GetWindowTextW
SendDlgItemMessageW
IsDlgButtonChecked
MessageBoxW
GetWindowTextLengthW
EnableWindow
CheckDlgButton
SetWindowTextW
SetFocus
GetWindowPlacement
SetWindowPlacement
ShowWindow
GetWindowLongW
SetRect
AdjustWindowRectEx
IsWindowEnabled
IsWindowVisible
GetDlgItemInt
SetDlgItemInt
LoadCursorA
RegisterClassExA
RegisterClassExW
CreateWindowExA
CreateWindowExW
SetWindowLongA
GetDC
ReleaseDC
SetWindowLongW
DefWindowProcA
IsWindowUnicode
GetDlgCtrlID
GetParent
DrawTextW
EnumWindows
PostMessageW
LoadIconA
SetPropW
UpdateWindow
CreateAcceleratorTableW
RedrawWindow
IsWindow
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
TranslateMessage
DispatchMessageW
GetMessageW
DestroyAcceleratorTable
MessageBoxA
SetForegroundWindow
GetSubMenu
GetCursorPos
PtInRect
DefFrameProcW
GetSysColor
CheckMenuRadioItem
GetMenuState
GetPropW
LoadBitmapW
SetTimer
DialogBoxParamW
DrawMenuBar
InvalidateRect
CreateDialogParamW
KillTimer
PostQuitMessage
DestroyIcon
CallWindowProcW
HideCaret
ShowCaret
GetMenuItemCount
DeleteMenu
InsertMenuItemW
AppendMenuW
EnableMenuItem
GetMenuStringW
DestroyMenu
LoadMenuW
SetMenu
GetMenuItemInfoW
SetMenuItemInfoW
SystemParametersInfoW
RemovePropW
GetSystemMetrics
SetCursor
LockWindowUpdate
RemoveMenu
CheckMenuItem
GetSysColorBrush
FillRect
CopyRect
DrawFrameControl
GetMenuItemID
GetClassNameW
FrameRect
TrackPopupMenu
DefMDIChildProcW
GetDlgItemTextW
SetDlgItemTextW
OffsetRect
wsprintfW
BringWindowToTop
LoadBitmapA
LoadIconW
PostMessageA
GetKeyState
GetPropA
SetWindowRgn
RemovePropA
SetPropA
DefWindowProcW
DrawFocusRect
CallWindowProcA
DrawTextExW
DrawTextExA

gdi32

DeleteObject
SetBkMode
SelectObject
SaveDC
CreateFontIndirectA
GetTextExtentPoint32A
RestoreDC
CreateFontIndirectW
GetTextExtentPoint32W
GetDeviceCaps
SetTextColor
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
CreateSolidBrush
GetStockObject
MoveToEx
CreatePen
LineTo
StartDocW
StartPage
SetTextAlign
TextOutW
EndPage
EndDoc
BitBlt
GetObjectA
CreateRectRgnIndirect
SelectClipRgn
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
SetBkColor
CreateRoundRectRgn
RoundRect
CreateFontW
CreateFontA

comctl32

InitCommonControlsEx
ImageList_Destroy
ImageList_Create
ImageList_AddMasked
ImageList_Draw
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Replace
ImageList_GetIcon

comdlg32

PageSetupDlgW
GetOpenFileNameW
GetSaveFileNameW
PrintDlgW
ChooseFontW

advapi32

RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
RegEnumKeyExA

msimg32

GradientFill

shlwapi

PathRemoveFileSpecW
PathUnquoteSpacesW
ColorAdjustLuma
PathStripPathW
PathFindExtensionW
PathFileExistsW

shell32

ShellExecuteA
Shell_NotifyIconW
DragQueryFileW
ShellExecuteW
CommandLineToArgvW
SHGetFileInfoW

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ole32

CoInitialize
CoUninitialize

wininet

InternetOpenA
InternetGetLastResponseInfoA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetReadFile

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
files/CheckDisk.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
files/DISM_And_SFC.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
files/_files_folder_WRT
files/custom.xml
.xml
files/definitions.xml
.xml
files/drivedb.h
files/hash
files/repair_network.cmd
files/settings.xml
files/smartctl-nc.exe
.exe windows x86

d2d965741151507c9be5567dbcde10c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AddAccessAllowedAce
CreateProcessAsUserA
CreateRestrictedToken
CreateWellKnownSid
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
EqualSid
GetTokenInformation
InitializeAcl
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
SetTokenInformation

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
CreatePipe
CreateProcessA
CreateSemaphoreA
CreateSemaphoreW
DeleteCriticalSection
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDevicePowerState
GetExitCodeProcess
GetHandleInformation
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetStartupInfoA
GetSystemPowerStatus
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
GetVersionExA
GetVersionExW
GlobalFree
GlobalLock
GlobalSize
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEvent
SetHandleInformation
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadExecutionState
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte

msvcrt

__argv
__dllonexit
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_errno
_exit
_fmode
_initterm
_iob
_lock
_mbsinc
_onexit
_open_osfhandle
_setjmp3
_snwprintf
time
localtime
_ultoa
_unlock
calloc
exit
fclose
fflush
fopen
fprintf
fputc
fputs
fread
free
fwprintf
fwrite
getc
getenv
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
printf
putc
raise
realloc
setlocale
signal
sprintf
strchr
strcmp
strcspn
strerror
strftime
strlen
strncmp
strncpy
strspn
strstr
strtol
strtoul
abort
asctime
tolower
toupper
ungetc
vfprintf
wcscpy
wcslen
atoi
longjmp
_tzname
_write
_tzset
_strnicmp
_stricmp
_strdup
_putenv
_open
_fdopen
_close
_access

ole32

CoCreateInstance
CoInitialize
CoSetProxyBlanket

oleaut32

SysAllocStringLen
SysFreeString
VariantClear
VariantInit

user32

CloseClipboard
GetClipboardData
GetSystemMetrics
MessageBoxW
OpenClipboard

Sections

.text
Size: 658KB - Virtual size: 658KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 81KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
files/wrt.ico
updater.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 512B - Virtual size: 12B

22ea1ffd699e61d7e25f4ee69976acda

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

comdlg32

gdi32

oleaut32

ole32

user32

advapi32

shell32

msvcrt

kernel32

Sections

.text Size: 313KB - Virtual size: 313KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 1KB - Virtual size: 9KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 25KB - Virtual size: 24KB

.reloc Size: 19KB - Virtual size: 19KB

abae283b9febd6b6c99aae6c6b3d9202

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

user32

advapi32

msvcrt

kernel32

Sections

.text Size: 672KB - Virtual size: 672KB

.rdata Size: 88KB - Virtual size: 88KB

.data Size: 2KB - Virtual size: 28KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 29KB - Virtual size: 29KB

09a38fd288880c15ae6b1022084d3532

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comctl32

comdlg32

advapi32

msimg32

shlwapi

shell32

version

ole32

wininet

iphlpapi

Sections

.text Size: 148KB - Virtual size: 147KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 62KB - Virtual size: 81KB

.rsrc Size: 112KB - Virtual size: 111KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

.text
Size: 1.8MB - Virtual size: 1.8MB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 313KB - Virtual size: 313KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 1KB - Virtual size: 9KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 25KB - Virtual size: 24KB

.reloc
Size: 19KB - Virtual size: 19KB

.text
Size: 672KB - Virtual size: 672KB

.rdata
Size: 88KB - Virtual size: 88KB

.data
Size: 2KB - Virtual size: 28KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 29KB - Virtual size: 29KB

.text
Size: 148KB - Virtual size: 147KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 62KB - Virtual size: 81KB

.rsrc
Size: 112KB - Virtual size: 111KB

.text
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 658KB - Virtual size: 658KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 294KB - Virtual size: 294KB

.bss
Size: - Virtual size: 81KB

.edata
Size: 512B - Virtual size: 53B

.idata
Size: 6KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 56B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 43KB - Virtual size: 43KB

.text
Size: 294KB - Virtual size: 294KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 512B - Virtual size: 12B