pack[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

pack.rar
Size

19.1MB
MD5

98160c8c47493832eaa21c827f32be60
SHA1

81e0a18238007b9a8d4eac6db9cac23ca59621b2
SHA256

712f0de01cfd08cb8dedd7c36165d10271ff1ed8349e25adf77a2089084c34cb
SHA512

61f8376b4064a28aede2627a2b31bfed13ac79716b415c87b0cd494185bc554c6c9b0aac5213010f42dfd33914504767eb2dd92fe044d4d7c74c155e2194c0e0
SSDEEP

393216:R1bzV5trjHc87lTRBkkjFvKVFDAu5I+0dqfdL6g46a5Evp1tmGK:RxzBrj887/dKVF8+I+0dqdLOt6wGK

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0aaa43340703d7d27a6d4abdd9ae2cae.exe.vir
unpack001/16c98d0087a5860fb3186f488cf68136.exe.vir
unpack001/6502d93a18e586683fa4232ed4222a2c.exe.vir
unpack001/882cefbf5bfbc3b9361d08b21fc46bb9.exe.vir
unpack001/b413ec6de347bd8ac14b5d49100e0888.exe.vir
unpack001/b5745b3e162d83d2195edd6838ad5a4a.exe.vir
unpack001/e539f67371028fd1efdc9f31157e395a.exe.vir

Files

pack.rar
.rar
0aaa43340703d7d27a6d4abdd9ae2cae.exe.vir
.exe windows x64

f0ea7b7844bbc5bfa9bb32efdcea957c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 331KB - Virtual size: 745KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
16c98d0087a5860fb3186f488cf68136.exe.vir
.exe windows x86

5025745570b1681a685819ca7db0f879

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemInfo
VirtualAlloc
GetCurrentProcess
VirtualAllocExNuma
GetModuleFileNameA
WriteConsoleW
VirtualFree
GlobalMemoryStatusEx
CheckRemoteDebuggerPresent
GetCurrentThreadId
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetCurrentThread
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CloseHandle
ReadFile
ReadConsoleW
CreateFileW
DecodePointer

crypt32

CertEnumSystemStore

Sections

.textbss
Size: - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 362KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 512B - Virtual size: 282B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
6329f5b21aec8c3149fe2c6ec14aad8e.msi.vir
.msi
6502d93a18e586683fa4232ed4222a2c.exe.vir
.exe windows x64

f0ea7b7844bbc5bfa9bb32efdcea957c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 943KB - Virtual size: 943KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 952KB - Virtual size: 952KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 110KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
882cefbf5bfbc3b9361d08b21fc46bb9.exe.vir
.exe windows x64

f0ea7b7844bbc5bfa9bb32efdcea957c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 358KB - Virtual size: 737KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
b413ec6de347bd8ac14b5d49100e0888.exe.vir
.exe windows x86

2a07ef4617f7e234576d7bb1012dd610

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalMemoryStatusEx
GetSystemInfo
VirtualAlloc
GetCurrentProcess
VirtualAllocExNuma
GetModuleFileNameA
SetEndOfFile
CloseHandle
CheckRemoteDebuggerPresent
VirtualFree
CreateFileA
GetCurrentThreadId
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
TerminateProcess
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapValidate
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
ReadFile
GetConsoleMode
ReadConsoleW
SetStdHandle
GetConsoleCP
GetCurrentThread
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
HeapReAlloc
HeapSize
HeapQueryInformation
FlushFileBuffers
CreateFileW
SetFilePointerEx
GetFileSizeEx
DecodePointer

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

Sections

.textbss
Size: - Virtual size: 324KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 697KB - Virtual size: 696KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
b5745b3e162d83d2195edd6838ad5a4a.exe.vir
.exe windows x64

1805b5943a7871cc727ba16c80fa495b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

kernel32

RtlUnwindEx
GetACP
CloseHandle
LocalFree
VirtualProtect
QueryPerformanceFrequency
VirtualFree
GetFullPathNameW
GetProcessHeap
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
SetFilePointerEx
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
lstrcpynW
GetLastError
GetModuleFileNameW
SetLastError
GetNativeSystemInfo
lstrlenA
CreateThread
CompareStringW
GetFileSizeEx
lstrcpyA
LoadLibraryA
ResetEvent
GetVersion
RaiseException
OpenProcess
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
GlobalMemoryStatusEx
LoadLibraryExW
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
ReleaseMutex
SuspendThread
GetTickCount
lstrcmpiA
GetFileSize
GetStartupInfoW
InitializeCriticalSection
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetCommandLineW
GetSystemInfo
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
LCMapStringW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
SetEndOfFile
QueryPerformanceCounter
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
CreateMutexA
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetLocalTime
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
GetLogicalProcessorInformation
GetComputerNameW
IsValidLocale
TlsSetValue
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
CreateEventW
QueryFullProcessImageNameW
SetThreadLocale
GetThreadLocale

shlwapi

StrStrIW

ole32

CoInitialize
CoUninitialize

user32

UnregisterClassW
CreateWindowExW
GetMessageW
GetClassInfoW
TranslateMessage
CharLowerBuffW
CharUpperW
PeekMessageW
GetSystemMetrics
DefWindowProcW
wsprintfW
MessageBoxA
MessageBoxW
GetAsyncKeyState
SetWindowLongPtrW
CharUpperBuffW
RegisterClassW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
DispatchMessageW
GetCursorPos

oleaut32

SysFreeString
VariantClear
VariantInit
GetErrorInfo
SysReAllocStringLen
SafeArrayCreate
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantChangeType

msvcrt

_wcslwr
_strlwr
isupper
isalpha
isalnum
toupper
memchr
memcmp
memcpy
memset
isprint
isspace
iscntrl
isxdigit
ispunct
isgraph
islower
tolower

advapi32

RegQueryValueExW
GetUserNameW
RegCloseKey
RegOpenKeyExW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 882KB - Virtual size: 881KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 50KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 568B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 109B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
c7a462cd84f6c091bc3961b877913a56.exe.vir
.exe .ps1 windows x86
e539f67371028fd1efdc9f31157e395a.exe.vir
.exe windows x64

e9ecca98ea96b03248cc9a5779881681

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
CryptGenRandom
GetUserNameW
OpenProcessToken
CryptReleaseContext
CryptAcquireContextA
ConvertStringSidToSidW
RegOpenKeyExW
RegQueryInfoKeyA
RegQueryValueExA
RegQueryValueExW
SetThreadToken
OpenThreadToken
AccessCheck
AddAccessAllowedAceEx
AddAccessDeniedAceEx
AdjustTokenPrivileges
DuplicateTokenEx
GetAce
GetAclInformation
GetFileSecurityW
GetLengthSid
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
MapGenericMask
SetFileSecurityW
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
LookupAccountSidW
LookupAccountNameW
LookupPrivilegeValueW
ConvertSidToStringSidW

ws2_32

select
recvfrom
getsockname
ioctlsocket
connect
closesocket
ntohs
ntohl
WSAIoctl
bind
getsockopt
htonl
htons
gethostname
WSACloseEvent
setsockopt
WSAEventSelect
getaddrinfo
freeaddrinfo
getnameinfo
__WSAFDIsSet
accept
listen
send
shutdown
recv
WSARecv
WSASend
socket
WSAGetLastError
sendto
WSASetLastError
WSAStartup
WSACreateEvent
getpeername

userenv

GetUserProfileDirectoryW

mswsock

TransmitFile

kernel32

VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WriteFile
GetTimeZoneInformation
GetDynamicTimeZoneInformation
MultiByteToWideChar
SetHandleInformation
LocalFree
FormatMessageA
GetOverlappedResult
GlobalFree
VerSetConditionMask
VerifyVersionInfoW
SetFilePointerEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetDiskFreeSpaceW
GetFileSizeEx
LockFileEx
ReadFile
SetFileInformationByHandle
UnlockFileEx
ReOpenFile
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetDriveTypeW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
GetLogicalDrives
GetVolumeInformationW
GetVolumePathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFileTime
FindFirstStreamW
FindNextStreamW
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeviceIoControl
CancelIo
CreateEventW
LocalAlloc
FormatMessageW
CopyFileExW
MoveFileExW
CreateHardLinkW
ReadDirectoryChangesW
SwitchToThread
GetFileTime
SetLastError
GetModuleHandleExW
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WaitForMultipleObjects
GetProcessTimes
TerminateProcess
GetExitCodeProcess
OpenProcess
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32First
Process32Next
GetHandleInformation
CreatePipe
CreateProcessW
GetProcessId
WideCharToMultiByte
GetConsoleWindow
FindFirstFileA
IsDBCSLeadByte
GetFileType
SetFilePointer
PeekNamedPipe
GetNumberOfConsoleInputEvents
PeekConsoleInputA
CreateFileA
ReleaseSemaphore
GetSystemTimeAsFileTime
GetProcessAffinityMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
AddVectoredContinueHandler
CloseHandle
CreateEventA
DuplicateHandle
EnterCriticalSection
FlushFileBuffers
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStdHandle
SleepConditionVariableCS
Sleep
SetEvent
ResumeThread
GetSystemDirectoryW
ResetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryA
LeaveCriticalSection
GetSystemInfo
GetTempPathW
GetVersionExA
GetWindowsDirectoryW
GlobalMemoryStatusEx
InitializeConditionVariable
InitializeCriticalSection
CreateSymbolicLinkW

vcruntime140

strchr
_CxxThrowException
__C_specific_handler
wcsstr
wcschr
memcpy
memset
__current_exception
__current_exception_context
__std_exception_copy
wcsrchr
__std_exception_destroy
memcmp

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_initialize_onexit_table
_crt_atexit
terminate
strerror_s
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_register_onexit_function
__p___argc
_errno
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
__p___argv
_set_app_type
_seh_filter_exe
raise
signal
abort
_exit
strerror

api-ms-win-crt-environment-l1-1-0

_wgetcwd
_wgetdcwd
_wgetenv

api-ms-win-crt-heap-l1-1-0

malloc
calloc
_callnewh
realloc
_set_new_mode
free

api-ms-win-crt-string-l1-1-0

wcscat
wcscpy
wcsncmp
wcscmp
isalpha
toupper
isupper
islower
strcmp
strncpy_s
_wcsdup
strcpy
wcstok_s
strcat
isdigit
_strdup
wcsncat
wcslen
_wcsupr
strncpy
towupper
strlen
iswctype

api-ms-win-crt-convert-l1-1-0

mbstowcs_s
wcstombs_s
wcstombs

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
__p__commode
fopen
__stdio_common_vswprintf
__stdio_common_vswscanf
__stdio_common_vfprintf
fgets
_get_osfhandle
fclose

api-ms-win-crt-filesystem-l1-1-0

_fullpath
_wrename
_wfullpath

api-ms-win-crt-utility-l1-1-0

labs

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpGetProxyForUrl

secur32

DeleteSecurityContext
CompleteAuthToken
InitializeSecurityContextA
FreeCredentialsHandle
AcquireCredentialsHandleA

iphlpapi

GetAdaptersInfo
NotifyAddrChange
GetAdaptersAddresses
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
IcmpSendEcho2Ex
Icmp6CreateFile
Icmp6SendEcho2
GetIfTable
GetIpAddrTable
GetFriendlyIfIndex

Exports

Exports

Canonicalize
GetStringPlatformChars
InitializeEncoding
IsolateEnterStub__CEntryPointNativeFunctions__attachThread__fe8e89788bae97cf98065b8b062da14102a906b7__2b64db5eac3e1a5e679637d48826f72a2be23a42
IsolateEnterStub__CEntryPointNativeFunctions__createIsolate__c5b5663bc8e51fac8eb7cc2a6c1952957d7e49f1__e3f95e216b9b0443e095f98421be4f9508afbc9d
IsolateEnterStub__CEntryPointNativeFunctions__detachAllThreadsAndTearDownIsolate__803a26f98b4febfb61e3b676ead8b433cc2f21b3__3cdc54b389bc5e287aebc9dca36a2fb081fc5b39
IsolateEnterStub__CEntryPointNativeFunctions__detachThread__573569b4c2b1f6ab146362c4435fcfe4abea4692__9d3359159eb3fd8426ba331efd872dbe28268132
IsolateEnterStub__CEntryPointNativeFunctions__getCurrentThread__669b6d90f89f02f4f21a6830554f612197337b86__1bf20bd8ee8d1284f6f76462b563914eae6bfc68
IsolateEnterStub__CEntryPointNativeFunctions__getIsolate__75d5a57aa8fca0d2471ea17ca517f44cfdf0f2fc__293fe173aeaef5a23ac83062148fca98f49d7f18
IsolateEnterStub__CEntryPointNativeFunctions__tearDownIsolate__fa8c10625da916d6c43ee2eea372e6d2349f2fa0__f2c185b4673374474a8deac159ef6df212b755b6
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__CreateJavaVM__8df18e9ea6eb1ed7b1c899a0bbc578da0e2cc0ad__3d26790b83b03d9c10db0419f30f48d545478b3d
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetCreatedJavaVMs__a8346bf814329333010f55369a80ae610088db0e__442c1b35ff12eecc1b833843d889f8d0e24ec2a4
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetDefaultJavaVMInitArgs__e85ea02793eeddf2ada6e1599b1df16bb01b9094__a58831a7d5f4ea86fd5300341ffa8d1f8f5e6e43
IsolateEnterStub__JavaMainWrapper__run__5087f5482cc9a6abc971913ece43acb471d2631b__a61fe6c26e84dd4037e4629852b5488bfcc16e7e
IsolateEnterStub__VmLocatorSymbol__vmLocatorSymbol__bec84cad1f8708102cd8814ef3e496531bf6ff5b__bbf2dbb2d6a07a8e1dae8a3072b01ad86ecc1a50
IsolateEnterStub__WindowsSubstrateSegfaultHandler__handler__e4ef6b716ca19d889d8c88199f44a529900bb37b__73b86451bd5061fd6755a740aa7b5098751a99a9
JNI_CreateJavaVM
JNI_GetCreatedJavaVMs
JNI_GetDefaultJavaVMInitArgs
JNI_OnLoad_java
JNI_OnLoad_net
JNI_OnLoad_nio
JNI_OnLoad_sunec
JNI_OnLoad_zip
JNU_CallMethodByName
JNU_CallMethodByNameV
JNU_CallStaticMethodByName
JNU_ClassClass
JNU_ClassObject
JNU_ClassString
JNU_ClassThrowable
JNU_CopyObjectArray
JNU_Equals
JNU_GetEnv
JNU_GetFieldByName
JNU_GetStaticFieldByName
JNU_GetStringPlatformChars
JNU_IsInstanceOfByName
JNU_MonitorWait
JNU_NewObjectByName
JNU_NewStringPlatform
JNU_Notify
JNU_NotifyAll
JNU_PrintClass
JNU_PrintString
JNU_ReleaseStringPlatformChars
JNU_SetFieldByName
JNU_SetStaticFieldByName
JNU_ThrowArrayIndexOutOfBoundsException
JNU_ThrowByName
JNU_ThrowByNameWithLastError
JNU_ThrowByNameWithMessageAndLastError
JNU_ThrowClassNotFoundException
JNU_ThrowIOException
JNU_ThrowIOExceptionWithLastError
JNU_ThrowIllegalAccessError
JNU_ThrowIllegalAccessException
JNU_ThrowIllegalArgumentException
JNU_ThrowInstantiationException
JNU_ThrowInternalError
JNU_ThrowNoSuchFieldError
JNU_ThrowNoSuchFieldException
JNU_ThrowNoSuchMethodError
JNU_ThrowNoSuchMethodException
JNU_ThrowNullPointerException
JNU_ThrowNumberFormatException
JNU_ThrowOutOfMemoryError
JNU_ThrowStringIndexOutOfBoundsException
JNU_ToString
JVM_ActiveProcessorCount
JVM_AddModuleExports
JVM_AddModuleExportsToAll
JVM_AddModuleExportsToAllUnnamed
JVM_AddReadsModule
JVM_AreNestMates
JVM_ArrayCopy
JVM_AssertionStatusDirectives
JVM_BeforeHalt
JVM_CallStackWalk
JVM_Clone
JVM_ConstantPoolGetClassAt
JVM_ConstantPoolGetClassAtIfLoaded
JVM_ConstantPoolGetClassRefIndexAt
JVM_ConstantPoolGetDoubleAt
JVM_ConstantPoolGetFieldAt
JVM_ConstantPoolGetFieldAtIfLoaded
JVM_ConstantPoolGetFloatAt
JVM_ConstantPoolGetIntAt
JVM_ConstantPoolGetLongAt
JVM_ConstantPoolGetMemberRefInfoAt
JVM_ConstantPoolGetMethodAt
JVM_ConstantPoolGetMethodAtIfLoaded
JVM_ConstantPoolGetNameAndTypeRefIndexAt
JVM_ConstantPoolGetNameAndTypeRefInfoAt
JVM_ConstantPoolGetSize
JVM_ConstantPoolGetStringAt
JVM_ConstantPoolGetTagAt
JVM_ConstantPoolGetUTF8At
JVM_CountStackFrames
JVM_CurrentThread
JVM_CurrentTimeMillis
JVM_DefineClassWithSource
JVM_DefineModule
JVM_DesiredAssertionStatus
JVM_DoPrivileged
JVM_DumpThreads
JVM_FillInStackTrace
JVM_FindClassFromBootLoader
JVM_FindClassFromCaller
JVM_FindClassFromClass
JVM_FindLibraryEntry
JVM_FindLoadedClass
JVM_FindPrimitiveClass
JVM_FindSignal
JVM_FreeMemory
JVM_GC
JVM_GetAllThreads
JVM_GetAndClearReferencePendingList
JVM_GetArrayElement
JVM_GetArrayLength
JVM_GetCPClassNameUTF
JVM_GetCPFieldClassNameUTF
JVM_GetCPFieldModifiers
JVM_GetCPFieldSignatureUTF
JVM_GetCPMethodClassNameUTF
JVM_GetCPMethodModifiers
JVM_GetCPMethodNameUTF
JVM_GetCPMethodSignatureUTF
JVM_GetCallerClass
JVM_GetClassAccessFlags
JVM_GetClassAnnotations
JVM_GetClassCPEntriesCount
JVM_GetClassCPTypes
JVM_GetClassConstantPool
JVM_GetClassContext
JVM_GetClassDeclaredConstructors
JVM_GetClassDeclaredFields
JVM_GetClassDeclaredMethods
JVM_GetClassFieldsCount
JVM_GetClassInterfaces
JVM_GetClassMethodsCount
JVM_GetClassModifiers
JVM_GetClassNameUTF
JVM_GetClassSignature
JVM_GetClassSigners
JVM_GetClassTypeAnnotations
JVM_GetDeclaredClasses
JVM_GetDeclaringClass
JVM_GetEnclosingMethodInfo
JVM_GetFieldIxModifiers
JVM_GetFieldTypeAnnotations
JVM_GetInheritedAccessControlContext
JVM_GetInterfaceVersion
JVM_GetLastErrorString
JVM_GetManagement
JVM_GetMethodIxArgsSize
JVM_GetMethodIxByteCode
JVM_GetMethodIxByteCodeLength
JVM_GetMethodIxExceptionIndexes
JVM_GetMethodIxExceptionTableEntry
JVM_GetMethodIxExceptionTableLength
JVM_GetMethodIxExceptionsCount
JVM_GetMethodIxLocalsCount
JVM_GetMethodIxMaxStack
JVM_GetMethodIxModifiers
JVM_GetMethodIxNameUTF
JVM_GetMethodIxSignatureUTF
JVM_GetMethodParameters
JVM_GetMethodTypeAnnotations
JVM_GetNanoTimeAdjustment
JVM_GetNestHost
JVM_GetNestMembers
JVM_GetPrimitiveArrayElement
JVM_GetProtectionDomain
JVM_GetSimpleBinaryName
JVM_GetStackAccessControlContext
JVM_GetSystemPackage
JVM_GetSystemPackages
JVM_GetTemporaryDirectory
JVM_GetThreadInterruptEvent
JVM_GetVmArguments
JVM_Halt
JVM_HasReferencePendingList
JVM_HoldsLock
JVM_IHashCode
JVM_InitAgentProperties
JVM_InitClassName
JVM_InitProperties
JVM_InitStackTraceElement
JVM_InitStackTraceElementArray
JVM_InitializeFromArchive
JVM_InitializeSocketLibrary
JVM_InternString
JVM_Interrupt
JVM_InvokeMethod
JVM_IsArrayClass
JVM_IsConstructorIx
JVM_IsInterface
JVM_IsInterrupted
JVM_IsPrimitiveClass
JVM_IsSameClassPackage
JVM_IsSupportedJNIVersion
JVM_IsThreadAlive
JVM_IsVMGeneratedMethodIx
JVM_LatestUserDefinedLoader
JVM_LoadLibrary
JVM_MaxMemory
JVM_MaxObjectInspectionAge
JVM_MonitorNotify
JVM_MonitorNotifyAll
JVM_MonitorWait
JVM_MoreStackWalk
JVM_NanoTime
JVM_NativePath
JVM_NewArray
JVM_NewInstanceFromConstructor
JVM_NewMultiArray
JVM_RaiseSignal
JVM_RawMonitorCreate
JVM_RawMonitorDestroy
JVM_RawMonitorEnter
JVM_RawMonitorExit
JVM_RegisterSignal
JVM_ReleaseUTF
JVM_ResumeThread
JVM_SetArrayElement
JVM_SetBootLoaderUnnamedModule
JVM_SetClassSigners
JVM_SetNativeThreadName
JVM_SetPrimitiveArrayElement
JVM_SetThreadPriority
JVM_Sleep
JVM_StartThread
JVM_StopThread
JVM_SupportsCX8
JVM_SuspendThread
JVM_TotalMemory
JVM_UnloadLibrary
JVM_WaitForReferencePendingList
JVM_Yield
Java_java_io_FileCleanable_cleanupClose0
Java_java_io_FileDescriptor_close0
Java_java_io_FileDescriptor_getAppend
Java_java_io_FileDescriptor_getHandle
Java_java_io_FileDescriptor_initIDs
Java_java_io_FileDescriptor_sync
Java_java_io_FileInputStream_available0
Java_java_io_FileInputStream_initIDs
Java_java_io_FileInputStream_open0
Java_java_io_FileInputStream_read0
Java_java_io_FileInputStream_readBytes
Java_java_io_FileInputStream_skip0
Java_java_io_FileOutputStream_initIDs
Java_java_io_FileOutputStream_open0
Java_java_io_FileOutputStream_write
Java_java_io_FileOutputStream_writeBytes
Java_java_io_ObjectInputStream_bytesToDoubles
Java_java_io_ObjectInputStream_bytesToFloats
Java_java_io_RandomAccessFile_getFilePointer
Java_java_io_RandomAccessFile_initIDs
Java_java_io_RandomAccessFile_length
Java_java_io_RandomAccessFile_open0
Java_java_io_RandomAccessFile_read0
Java_java_io_RandomAccessFile_readBytes
Java_java_io_RandomAccessFile_seek0
Java_java_io_RandomAccessFile_setLength
Java_java_io_RandomAccessFile_write0
Java_java_io_RandomAccessFile_writeBytes
Java_java_io_WinNTFileSystem_canonicalize0
Java_java_io_WinNTFileSystem_canonicalizeWithPrefix0
Java_java_io_WinNTFileSystem_checkAccess
Java_java_io_WinNTFileSystem_createDirectory
Java_java_io_WinNTFileSystem_createFileExclusively
Java_java_io_WinNTFileSystem_delete0
Java_java_io_WinNTFileSystem_getBooleanAttributes
Java_java_io_WinNTFileSystem_getDriveDirectory
Java_java_io_WinNTFileSystem_getLastModifiedTime
Java_java_io_WinNTFileSystem_getLength
Java_java_io_WinNTFileSystem_getNameMax0
Java_java_io_WinNTFileSystem_getSpace0
Java_java_io_WinNTFileSystem_initIDs
Java_java_io_WinNTFileSystem_list
Java_java_io_WinNTFileSystem_listRoots0
Java_java_io_WinNTFileSystem_rename0
Java_java_io_WinNTFileSystem_setLastModifiedTime
Java_java_io_WinNTFileSystem_setPermission
Java_java_io_WinNTFileSystem_setReadOnly
Java_java_lang_ProcessEnvironment_environmentBlock
Java_java_lang_ProcessHandleImpl_00024Info_info0
Java_java_lang_ProcessHandleImpl_00024Info_initIDs
Java_java_lang_ProcessHandleImpl_destroy0
Java_java_lang_ProcessHandleImpl_getCurrentPid0
Java_java_lang_ProcessHandleImpl_getProcessPids0
Java_java_lang_ProcessHandleImpl_initNative
Java_java_lang_ProcessHandleImpl_isAlive0
Java_java_lang_ProcessHandleImpl_parent0
Java_java_lang_ProcessHandleImpl_waitForProcessExit0
Java_java_lang_ProcessImpl_closeHandle
Java_java_lang_ProcessImpl_create
Java_java_lang_ProcessImpl_getExitCodeProcess
Java_java_lang_ProcessImpl_getProcessId0
Java_java_lang_ProcessImpl_getStillActive
Java_java_lang_ProcessImpl_isProcessAlive
Java_java_lang_ProcessImpl_openForAtomicAppend
Java_java_lang_ProcessImpl_terminateProcess
Java_java_lang_ProcessImpl_waitForInterruptibly
Java_java_lang_ProcessImpl_waitForTimeoutInterruptibly
Java_java_lang_Shutdown_beforeHalt
Java_java_lang_Shutdown_halt0
Java_java_lang_System_currentTimeMillis
Java_java_lang_System_nanoTime
Java_java_net_AbstractPlainDatagramSocketImpl_isReusePortAvailable0
Java_java_net_AbstractPlainSocketImpl_isReusePortAvailable0
Java_java_net_DatagramPacket_init
Java_java_net_DualStackPlainDatagramSocketImpl_dataAvailable
Java_java_net_DualStackPlainDatagramSocketImpl_initIDs
Java_java_net_DualStackPlainDatagramSocketImpl_socketBind
Java_java_net_DualStackPlainDatagramSocketImpl_socketClose
Java_java_net_DualStackPlainDatagramSocketImpl_socketConnect
Java_java_net_DualStackPlainDatagramSocketImpl_socketCreate
Java_java_net_DualStackPlainDatagramSocketImpl_socketDisconnect
Java_java_net_DualStackPlainDatagramSocketImpl_socketGetIntOption
Java_java_net_DualStackPlainDatagramSocketImpl_socketLocalAddress
Java_java_net_DualStackPlainDatagramSocketImpl_socketLocalPort
Java_java_net_DualStackPlainDatagramSocketImpl_socketReceiveOrPeekData
Java_java_net_DualStackPlainDatagramSocketImpl_socketSend
Java_java_net_DualStackPlainDatagramSocketImpl_socketSetIntOption
Java_java_net_Inet4AddressImpl_getHostByAddr
Java_java_net_Inet4AddressImpl_getLocalHostName
Java_java_net_Inet4AddressImpl_isReachable0
Java_java_net_Inet4AddressImpl_lookupAllHostAddr
Java_java_net_Inet4Address_init
Java_java_net_Inet6AddressImpl_getHostByAddr
Java_java_net_Inet6AddressImpl_getLocalHostName
Java_java_net_Inet6AddressImpl_isReachable0
Java_java_net_Inet6AddressImpl_lookupAllHostAddr
Java_java_net_Inet6Address_init
Java_java_net_InetAddressImplFactory_isIPv6Supported
Java_java_net_InetAddress_init
Java_java_net_NetworkInterface_getAll
Java_java_net_NetworkInterface_getAll_XP
Java_java_net_NetworkInterface_getByIndex0
Java_java_net_NetworkInterface_getByIndex0_XP
Java_java_net_NetworkInterface_getByInetAddress0
Java_java_net_NetworkInterface_getByInetAddress0_XP
Java_java_net_NetworkInterface_getByName0
Java_java_net_NetworkInterface_getByName0_XP
Java_java_net_NetworkInterface_getMTU0
Java_java_net_NetworkInterface_getMTU0_XP
Java_java_net_NetworkInterface_getMacAddr0
Java_java_net_NetworkInterface_getMacAddr0_XP
Java_java_net_NetworkInterface_init
Java_java_net_NetworkInterface_isLoopback0
Java_java_net_NetworkInterface_isLoopback0_XP
Java_java_net_NetworkInterface_isP2P0
Java_java_net_NetworkInterface_isP2P0_XP
Java_java_net_NetworkInterface_isUp0
Java_java_net_NetworkInterface_isUp0_XP
Java_java_net_NetworkInterface_supportsMulticast0
Java_java_net_NetworkInterface_supportsMulticast0_XP
Java_java_net_PlainSocketImpl_accept0
Java_java_net_PlainSocketImpl_available0
Java_java_net_PlainSocketImpl_bind0
Java_java_net_PlainSocketImpl_close0
Java_java_net_PlainSocketImpl_configureBlocking
Java_java_net_PlainSocketImpl_connect0
Java_java_net_PlainSocketImpl_getIntOption
Java_java_net_PlainSocketImpl_initIDs
Java_java_net_PlainSocketImpl_listen0
Java_java_net_PlainSocketImpl_localAddress
Java_java_net_PlainSocketImpl_localPort0
Java_java_net_PlainSocketImpl_sendOOB
Java_java_net_PlainSocketImpl_setIntOption
Java_java_net_PlainSocketImpl_setSoTimeout0
Java_java_net_PlainSocketImpl_shutdown0
Java_java_net_PlainSocketImpl_socket0
Java_java_net_PlainSocketImpl_waitForConnect
Java_java_net_PlainSocketImpl_waitForNewConnection
Java_java_net_SocketCleanable_cleanupClose0
Java_java_net_SocketInputStream_init
Java_java_net_SocketInputStream_socketRead0
Java_java_net_SocketOutputStream_init
Java_java_net_SocketOutputStream_socketWrite0
Java_java_net_TwoStacksPlainDatagramSocketImpl_bind0
Java_java_net_TwoStacksPlainDatagramSocketImpl_connect0
Java_java_net_TwoStacksPlainDatagramSocketImpl_dataAvailable
Java_java_net_TwoStacksPlainDatagramSocketImpl_datagramSocketClose
Java_java_net_TwoStacksPlainDatagramSocketImpl_datagramSocketCreate
Java_java_net_TwoStacksPlainDatagramSocketImpl_disconnect0
Java_java_net_TwoStacksPlainDatagramSocketImpl_getTTL
Java_java_net_TwoStacksPlainDatagramSocketImpl_getTimeToLive
Java_java_net_TwoStacksPlainDatagramSocketImpl_init
Java_java_net_TwoStacksPlainDatagramSocketImpl_join
Java_java_net_TwoStacksPlainDatagramSocketImpl_leave
Java_java_net_TwoStacksPlainDatagramSocketImpl_peek
Java_java_net_TwoStacksPlainDatagramSocketImpl_peekData
Java_java_net_TwoStacksPlainDatagramSocketImpl_receive0
Java_java_net_TwoStacksPlainDatagramSocketImpl_send0
Java_java_net_TwoStacksPlainDatagramSocketImpl_setTTL
Java_java_net_TwoStacksPlainDatagramSocketImpl_setTimeToLive
Java_java_net_TwoStacksPlainDatagramSocketImpl_socketGetOption
Java_java_net_TwoStacksPlainDatagramSocketImpl_socketLocalAddress
Java_java_net_TwoStacksPlainDatagramSocketImpl_socketNativeSetOption
Java_java_util_TimeZone_getSystemGMTOffsetID
Java_java_util_TimeZone_getSystemTimeZoneID
Java_java_util_zip_CRC32_update
Java_java_util_zip_CRC32_updateByteBuffer0
Java_java_util_zip_CRC32_updateBytes0
Java_java_util_zip_Inflater_end
Java_java_util_zip_Inflater_getAdler
Java_java_util_zip_Inflater_inflateBufferBuffer
Java_java_util_zip_Inflater_inflateBufferBytes
Java_java_util_zip_Inflater_inflateBytesBuffer
Java_java_util_zip_Inflater_inflateBytesBytes
Java_java_util_zip_Inflater_init
Java_java_util_zip_Inflater_initIDs
Java_java_util_zip_Inflater_reset
Java_java_util_zip_Inflater_setDictionary
Java_java_util_zip_Inflater_setDictionaryBuffer
Java_jdk_internal_misc_VM_getNanoTimeAdjustment
Java_jdk_net_Sockets_isReusePortAvailable0
Java_sun_net_dns_ResolverConfigurationImpl_init0
Java_sun_net_dns_ResolverConfigurationImpl_loadDNSconfig0
Java_sun_net_dns_ResolverConfigurationImpl_notifyAddrChange0
Java_sun_net_spi_DefaultProxySelector_getSystemProxies
Java_sun_net_spi_DefaultProxySelector_init
Java_sun_net_www_protocol_http_ntlm_NTLMAuthSequence_getCredentialsHandle
Java_sun_net_www_protocol_http_ntlm_NTLMAuthSequence_getNextToken
Java_sun_net_www_protocol_http_ntlm_NTLMAuthSequence_initFirst
Java_sun_nio_ch_DatagramChannelImpl_disconnect0
Java_sun_nio_ch_DatagramChannelImpl_initIDs
Java_sun_nio_ch_DatagramChannelImpl_receive0
Java_sun_nio_ch_DatagramChannelImpl_send0
Java_sun_nio_ch_DatagramDispatcher_read0
Java_sun_nio_ch_DatagramDispatcher_readv0
Java_sun_nio_ch_DatagramDispatcher_write0
Java_sun_nio_ch_DatagramDispatcher_writev0
Java_sun_nio_ch_FileChannelImpl_initIDs
Java_sun_nio_ch_FileChannelImpl_map0
Java_sun_nio_ch_FileChannelImpl_transferTo0
Java_sun_nio_ch_FileChannelImpl_unmap0
Java_sun_nio_ch_FileDispatcherImpl_close0
Java_sun_nio_ch_FileDispatcherImpl_duplicateHandle
Java_sun_nio_ch_FileDispatcherImpl_force0
Java_sun_nio_ch_FileDispatcherImpl_lock0
Java_sun_nio_ch_FileDispatcherImpl_pread0
Java_sun_nio_ch_FileDispatcherImpl_pwrite0
Java_sun_nio_ch_FileDispatcherImpl_read0
Java_sun_nio_ch_FileDispatcherImpl_readv0
Java_sun_nio_ch_FileDispatcherImpl_release0
Java_sun_nio_ch_FileDispatcherImpl_seek0
Java_sun_nio_ch_FileDispatcherImpl_setDirect0
Java_sun_nio_ch_FileDispatcherImpl_size0
Java_sun_nio_ch_FileDispatcherImpl_truncate0
Java_sun_nio_ch_FileDispatcherImpl_write0
Java_sun_nio_ch_FileDispatcherImpl_writev0
Java_sun_nio_ch_IOUtil_configureBlocking
Java_sun_nio_ch_IOUtil_drain
Java_sun_nio_ch_IOUtil_fdVal
Java_sun_nio_ch_IOUtil_initIDs
Java_sun_nio_ch_IOUtil_iovMax
Java_sun_nio_ch_IOUtil_randomBytes
Java_sun_nio_ch_IOUtil_setfdVal
Java_sun_nio_ch_Net_bind0
Java_sun_nio_ch_Net_blockOrUnblock4
Java_sun_nio_ch_Net_blockOrUnblock6
Java_sun_nio_ch_Net_canIPv6SocketJoinIPv4Group0
Java_sun_nio_ch_Net_canJoin6WithIPv4Group0
Java_sun_nio_ch_Net_connect0
Java_sun_nio_ch_Net_getIntOption0
Java_sun_nio_ch_Net_getInterface4
Java_sun_nio_ch_Net_getInterface6
Java_sun_nio_ch_Net_initIDs
Java_sun_nio_ch_Net_isExclusiveBindAvailable
Java_sun_nio_ch_Net_isIPv6Available0
Java_sun_nio_ch_Net_isReusePortAvailable0
Java_sun_nio_ch_Net_joinOrDrop4
Java_sun_nio_ch_Net_joinOrDrop6
Java_sun_nio_ch_Net_listen
Java_sun_nio_ch_Net_localInetAddress
Java_sun_nio_ch_Net_localPort
Java_sun_nio_ch_Net_poll
Java_sun_nio_ch_Net_pollconnValue
Java_sun_nio_ch_Net_pollerrValue
Java_sun_nio_ch_Net_pollhupValue
Java_sun_nio_ch_Net_pollinValue
Java_sun_nio_ch_Net_pollnvalValue
Java_sun_nio_ch_Net_polloutValue
Java_sun_nio_ch_Net_remoteInetAddress
Java_sun_nio_ch_Net_remotePort
Java_sun_nio_ch_Net_setIntOption0
Java_sun_nio_ch_Net_setInterface4
Java_sun_nio_ch_Net_setInterface6
Java_sun_nio_ch_Net_shutdown
Java_sun_nio_ch_Net_socket0
Java_sun_nio_ch_SocketChannelImpl_checkConnect
Java_sun_nio_ch_SocketChannelImpl_initIDs
Java_sun_nio_ch_SocketChannelImpl_sendOutOfBandData
Java_sun_nio_ch_SocketDispatcher_close0
Java_sun_nio_ch_SocketDispatcher_preClose0

Sections

.text
Size: 15.6MB - Virtual size: 15.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.svm_hea
Size: 23.2MB - Virtual size: 23.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 159KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0ea7b7844bbc5bfa9bb32efdcea957c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 5.3MB - Virtual size: 5.3MB

.rdata Size: 7.5MB - Virtual size: 7.5MB

.data Size: 331KB - Virtual size: 745KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 101KB - Virtual size: 100KB

.symtab Size: 512B - Virtual size: 4B

5025745570b1681a685819ca7db0f879

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

crypt32

Sections

.textbss Size: - Virtual size: 161KB

.text Size: 362KB - Virtual size: 362KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 4KB - Virtual size: 9KB

.idata Size: 3KB - Virtual size: 3KB

.msvcjmc Size: 512B - Virtual size: 282B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 10KB

f0ea7b7844bbc5bfa9bb32efdcea957c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 943KB - Virtual size: 943KB

.rdata Size: 952KB - Virtual size: 952KB

.data Size: 110KB - Virtual size: 470KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 16KB

.symtab Size: 512B - Virtual size: 4B

.rsrc Size: 1.5MB - Virtual size: 1.5MB

f0ea7b7844bbc5bfa9bb32efdcea957c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 2.6MB - Virtual size: 2.6MB

.data Size: 358KB - Virtual size: 737KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 49KB - Virtual size: 48KB

.symtab Size: 420KB - Virtual size: 420KB

2a07ef4617f7e234576d7bb1012dd610

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Sections

.textbss Size: - Virtual size: 324KB

.text Size: 697KB - Virtual size: 696KB

.rdata Size: 150KB - Virtual size: 150KB

.data Size: 4KB - Virtual size: 9KB

.idata Size: 3KB - Virtual size: 3KB

.msvcjmc Size: 512B - Virtual size: 288B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 23KB - Virtual size: 23KB

1805b5943a7871cc727ba16c80fa495b

.text
Size: 5.3MB - Virtual size: 5.3MB

.rdata
Size: 7.5MB - Virtual size: 7.5MB

.data
Size: 331KB - Virtual size: 745KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 101KB - Virtual size: 100KB

.symtab
Size: 512B - Virtual size: 4B

.textbss
Size: - Virtual size: 161KB

.text
Size: 362KB - Virtual size: 362KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 4KB - Virtual size: 9KB

.idata
Size: 3KB - Virtual size: 3KB

.msvcjmc
Size: 512B - Virtual size: 282B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 10KB

.text
Size: 943KB - Virtual size: 943KB

.rdata
Size: 952KB - Virtual size: 952KB

.data
Size: 110KB - Virtual size: 470KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 16KB

.symtab
Size: 512B - Virtual size: 4B

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 358KB - Virtual size: 737KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 49KB - Virtual size: 48KB

.symtab
Size: 420KB - Virtual size: 420KB

.textbss
Size: - Virtual size: 324KB

.text
Size: 697KB - Virtual size: 696KB

.rdata
Size: 150KB - Virtual size: 150KB

.data
Size: 4KB - Virtual size: 9KB

.idata
Size: 3KB - Virtual size: 3KB

.msvcjmc
Size: 512B - Virtual size: 288B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 23KB - Virtual size: 23KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 882KB - Virtual size: 881KB

.bss
Size: - Virtual size: 50KB

.idata
Size: 6KB - Virtual size: 5KB

.tls
Size: - Virtual size: 568B

.rdata
Size: 512B - Virtual size: 109B

.reloc
Size: 64KB - Virtual size: 64KB

.pdata
Size: 52KB - Virtual size: 52KB

.rsrc
Size: 57KB - Virtual size: 56KB

.text
Size: 15.6MB - Virtual size: 15.6MB

.rdata
Size: 132KB - Virtual size: 132KB

.data
Size: 9KB - Virtual size: 11KB

.pdata
Size: 11KB - Virtual size: 10KB

.rodata
Size: 15KB - Virtual size: 14KB

.svm_hea
Size: 23.2MB - Virtual size: 23.2MB

.reloc
Size: 78KB - Virtual size: 78KB

.rsrc
Size: 159KB - Virtual size: 160KB