Software_Demo_unpacked[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
Software_Demo_unpacked.rar
Size 6.9MB
Sample230824-3a76jaga88
SHA256 8a1965fc2b1cfa4f438a99efde8add14c41af708a1961d151fb75a9f8f2de61e
MD5 8f29433f92653e53293e2a0d8f18dfce
SHA1 10ab81f314111507081cd19f9a1ca43032d21ec9
SHA512 bce00a9dc451cdda50d490f450c84f13b92072bf643b86235608e2b37c63a67b81dec5aa0ae7d263f24e7bc2f8e3f52f53ecffa29c1285d8f664974c4766271e
SSDEEP 196608:eFNfXNXAGge7kblM88qI017KmEtdlyYDWEg/pKqZmFI9Mu7m:evXW7e7kblJHTElo4qZmW4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Software Demo_unpacked.exe
unpack001/runtimes/win/native/libzstd.dll
unpack001/runtimes/win/native/mongocrypt.dll
unpack001/runtimes/win/native/snappy32.dll
unpack001/runtimes/win/native/snappy64.dll

File Explorer

Software_Demo_unpacked.rar

.rar 6.9MB
Software Demo_unpacked.exe

.exe 7.3MB
runtimes/win/lib/netcoreapp3.1/System.Management.dll

.dll 284KB
runtimes/win/native/libzstd.dll

.dll 996KB
runtimes/win/native/mongocrypt.dll

.dll 399KB
runtimes/win/native/snappy32.dll

.dll 226KB
runtimes/win/native/snappy64.dll

.dll 264KB

Software_Demo_unpacked.rar

SHA256 8a1965fc2b1cfa4f438a99efde8add14c41af708a1961d151fb75a9f8f2de61e
MD5 8f29433f92653e53293e2a0d8f18dfce
SHA1 10ab81f314111507081cd19f9a1ca43032d21ec9
SHA512 bce00a9dc451cdda50d490f450c84f13b92072bf643b86235608e2b37c63a67b81dec5aa0ae7d263f24e7bc2f8e3f52f53ecffa29c1285d8f664974c4766271e
SSDEEP 196608:eFNfXNXAGge7kblM88qI017KmEtdlyYDWEg/pKqZmFI9Mu7m:evXW7e7kblJHTElo4qZmW4
MD5 SHA1 SHA512 SSDEEP

Software Demo_unpacked.exe

IMPHASH af5fae81436482962005affbb4919ffd
SHA256 5262da36f07dd72a709e15c9ce820f1225737fe2076b7ecd8306684eb54ee381
MD5 b2f9fc49c76c741f9da2dcbe3278fe9f
SHA1 a36eae58afbdf0b0b2185a95602c23e26c446b77
SHA512 8e91f012fba4922055eec6aaf64fce2cf4979f5c9bd243e016d920f25de4147f7b9b7fce11021fcb0b0c01ef2e4d73c9f717d253d81bfd61d8b1950f1cb397d3
SSDEEP 196608:EKD2/s4C0ZraDwsRKPlXjZI99ZYOaFJO:EKes4ZJasCWXj293YnJO
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8382954

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetLastError GetFileAttributesExW GetFullPathNameW GetProcAddress DeleteCriticalSection WideCharToMultiByte IsWow64Process LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EnterCriticalSection FindFirstFileExW OutputDebugStringW LoadLibraryA GetModuleHandleW InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _errno _register_onexit_function _initialize_onexit_table _exit abort __p___argc __p___wargv _c_exit terminate _register_thread_local_exe_atexit_callback exit

api-ms-win-crt-stdio-l1-1-0

fputwc __p__commode _set_fmode fflush __stdio_common_vfwprintf fputws __acrt_iob_func __stdio_common_vswprintf _wfopen __stdio_common_vsprintf_s setvbuf

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsdup strcspn strcpy_s wcsnlen

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-locale-l1-1-0

localeconv ___mb_cur_max_func _lock_locales ___lc_codepage_func ___lc_locale_name_func __pctype_func setlocale _configthreadlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 wcsftime

Name

.text

Size

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.H5l

Size

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.)J0

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.y<c

Size

7.2MB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

runtimes/win/lib/netcoreapp3.1/System.Management.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 eec7814814a0f280eff8c1f86779a77651311e0bc610e623b4192d6f43da4c65
MD5 924b5ad9af21499706e353dfadce3a0a
SHA1 b304786ece6262f5c19520bc0558485a2a4cb716
SHA512 f6092119b626bedc987671b0f7b16883d0ba421c081819b51ee440241667211090bb7fea76d3369bddbd07e3e3eb986c3048774ba9cb8020949f3d26731e4cab
SSDEEP 6144:LP3+VFebn3AXPBkd1ivZbkgGQgZE6kObqL2uouRPj0TWLMcX:LmVFeD3AXPm1ivZQFQN6kObqL2uouyT+
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

10:89:08:9e:44:70:a2:5d:c0:9e:b3:53:3b:d0:6f:70:00:ae:c1:66:f9:56:0d:4a:c0:45:4d:17:6b:ce:d8:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 23, 2023

Minor OS version

Major OS version

Entry point

287206

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

runtimes/win/native/libzstd.dll

IMPHASH 742bb7a8ff6d7a2efac0b2e4edb110fd
SHA256 b098b9c33b90926b1c490cb9d13274bd2586f57b2796466286784df0ed44eba9
MD5 36e008cb07d35f6a75a60df11c5bed71
SHA1 9ee18c0d634948199ae4f8091a57090edd26ac73
SHA512 11bc9410fa7609abc2805b33b651bb0cb21f25f2d196b51604da6a73e6eba8993b543146baf9edeedf9fcbf9a5fbedaca07820bb158f3a49b57c33fd37a71e23
SSDEEP 24576:pITKzogJyV2ogDrXZZVReuqc6TmkTrOVy/WTWy+rwkprgkJn7dAW:pYKUgC2FDtZVkuqctkTrOVyrwkpjn7dT
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ZBUFF_compressContinue ZBUFF_compressEnd ZBUFF_compressFlush ZBUFF_compressInit ZBUFF_compressInitDictionary ZBUFF_compressInit_advanced ZBUFF_createCCtx ZBUFF_createCCtx_advanced ZBUFF_createDCtx ZBUFF_createDCtx_advanced ZBUFF_decompressContinue ZBUFF_decompressInit ZBUFF_decompressInitDictionary ZBUFF_freeCCtx ZBUFF_freeDCtx ZBUFF_getErrorName ZBUFF_isError ZBUFF_recommendedCInSize ZBUFF_recommendedCOutSize ZBUFF_recommendedDInSize ZBUFF_recommendedDOutSize ZDICT_addEntropyTablesFromBuffer ZDICT_finalizeDictionary ZDICT_getDictID ZDICT_getErrorName ZDICT_isError ZDICT_optimizeTrainFromBuffer_cover ZDICT_optimizeTrainFromBuffer_fastCover ZDICT_trainFromBuffer ZDICT_trainFromBuffer_cover ZDICT_trainFromBuffer_fastCover ZDICT_trainFromBuffer_legacy ZSTD_CCtxParams_getParameter ZSTD_CCtxParams_init ZSTD_CCtxParams_init_advanced ZSTD_CCtxParams_reset ZSTD_CCtxParams_setParameter ZSTD_CCtx_getParameter ZSTD_CCtx_loadDictionary ZSTD_CCtx_loadDictionary_advanced ZSTD_CCtx_loadDictionary_byReference ZSTD_CCtx_refCDict ZSTD_CCtx_refPrefix ZSTD_CCtx_refPrefix_advanced ZSTD_CCtx_reset ZSTD_CCtx_setParameter ZSTD_CCtx_setParametersUsingCCtxParams ZSTD_CCtx_setPledgedSrcSize ZSTD_CStreamInSize ZSTD_CStreamOutSize ZSTD_DCtx_loadDictionary ZSTD_DCtx_loadDictionary_advanced ZSTD_DCtx_loadDictionary_byReference ZSTD_DCtx_refDDict ZSTD_DCtx_refPrefix ZSTD_DCtx_refPrefix_advanced ZSTD_DCtx_reset ZSTD_DCtx_setFormat ZSTD_DCtx_setMaxWindowSize ZSTD_DCtx_setParameter ZSTD_DStreamInSize ZSTD_DStreamOutSize ZSTD_adjustCParams ZSTD_cParam_getBounds ZSTD_checkCParams ZSTD_compress ZSTD_compress2 ZSTD_compressBegin ZSTD_compressBegin_advanced ZSTD_compressBegin_usingCDict ZSTD_compressBegin_usingCDict_advanced ZSTD_compressBegin_usingDict ZSTD_compressBlock ZSTD_compressBound ZSTD_compressCCtx ZSTD_compressContinue ZSTD_compressEnd ZSTD_compressStream ZSTD_compressStream2 ZSTD_compressStream2_simpleArgs ZSTD_compress_advanced ZSTD_compress_usingCDict ZSTD_compress_usingCDict_advanced ZSTD_compress_usingDict ZSTD_copyCCtx ZSTD_copyDCtx ZSTD_createCCtx ZSTD_createCCtxParams ZSTD_createCCtx_advanced ZSTD_createCDict ZSTD_createCDict_advanced ZSTD_createCDict_byReference ZSTD_createCStream ZSTD_createCStream_advanced ZSTD_createDCtx ZSTD_createDCtx_advanced ZSTD_createDDict ZSTD_createDDict_advanced ZSTD_createDDict_byReference ZSTD_createDStream ZSTD_createDStream_advanced ZSTD_dParam_getBounds ZSTD_decodingBufferSize_min ZSTD_decompress ZSTD_decompressBegin ZSTD_decompressBegin_usingDDict ZSTD_decompressBegin_usingDict ZSTD_decompressBlock ZSTD_decompressBound ZSTD_decompressContinue ZSTD_decompressDCtx ZSTD_decompressStream ZSTD_decompressStream_simpleArgs ZSTD_decompress_usingDDict ZSTD_decompress_usingDict ZSTD_endStream ZSTD_estimateCCtxSize ZSTD_estimateCCtxSize_usingCCtxParams ZSTD_estimateCCtxSize_usingCParams ZSTD_estimateCDictSize ZSTD_estimateCDictSize_advanced ZSTD_estimateCStreamSize ZSTD_estimateCStreamSize_usingCCtxParams ZSTD_estimateCStreamSize_usingCParams ZSTD_estimateDCtxSize ZSTD_estimateDDictSize ZSTD_estimateDStreamSize ZSTD_estimateDStreamSize_fromFrame ZSTD_findDecompressedSize ZSTD_findFrameCompressedSize ZSTD_flushStream ZSTD_frameHeaderSize ZSTD_freeCCtx ZSTD_freeCCtxParams ZSTD_freeCDict ZSTD_freeCStream ZSTD_freeDCtx ZSTD_freeDDict ZSTD_freeDStream ZSTD_getBlockSize ZSTD_getCParams ZSTD_getDecompressedSize ZSTD_getDictID_fromDDict ZSTD_getDictID_fromDict ZSTD_getDictID_fromFrame ZSTD_getErrorCode ZSTD_getErrorName ZSTD_getErrorString ZSTD_getFrameContentSize ZSTD_getFrameHeader ZSTD_getFrameHeader_advanced ZSTD_getFrameProgression ZSTD_getParams ZSTD_getSequences ZSTD_initCStream ZSTD_initCStream_advanced ZSTD_initCStream_srcSize ZSTD_initCStream_usingCDict ZSTD_initCStream_usingCDict_advanced ZSTD_initCStream_usingDict ZSTD_initDStream ZSTD_initDStream_usingDDict ZSTD_initDStream_usingDict ZSTD_initStaticCCtx ZSTD_initStaticCDict ZSTD_initStaticCStream ZSTD_initStaticDCtx ZSTD_initStaticDDict ZSTD_initStaticDStream ZSTD_insertBlock ZSTD_isError ZSTD_isFrame ZSTD_maxCLevel ZSTD_minCLevel ZSTD_nextInputType ZSTD_nextSrcSizeToDecompress ZSTD_resetCStream ZSTD_resetDStream ZSTD_sizeof_CCtx ZSTD_sizeof_CDict ZSTD_sizeof_CStream ZSTD_sizeof_DCtx ZSTD_sizeof_DDict ZSTD_sizeof_DStream ZSTD_toFlushNow ZSTD_versionNumber ZSTD_versionString

Name

.text

Size

852KB

Virtual Size

852KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

512B

Virtual Size

303B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

runtimes/win/native/mongocrypt.dll

IMPHASH e01fe10f050d8b79fbe457b2183c7d7a
SHA256 04ce755579183a0fdad4e5fd3d10cd160c90bde4029947414ea93fb74831eaba
MD5 78178f495dbfb61a77e11b4f27d653dd
SHA1 865abc124ce38c25530b90feca22f2a1a12b9329
SHA512 903ee89fbed4f9bfe7fd8c334e22723334cf5b103583610ff7c9460f984259bae552fac151382595c6904af3f1614f68c3b05cca05170127a0183004b079d5c0
SSDEEP 6144:b8ISMBsvTgbO0hIgWVPoElwDWxZz+f6t88icEzkA8VpPHCIoUi9kIhNrBNEDJtr3:bITg21URexHJadvBMJR
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7331

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

bcrypt

BCryptGetProperty BCryptSignHash BCryptImportKeyPair BCryptCloseAlgorithmProvider BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptDestroyKey BCryptImportKey BCryptDecrypt BCryptEncrypt BCryptSetProperty BCryptOpenAlgorithmProvider

ws2_32

gethostname

crypt32

CryptDecodeObjectEx

kernel32

IsDebuggerPresent InitializeSListHead DisableThreadLibraryCalls GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentProcessId GetTickCount64 GetSystemTimeAsFileTime GetCurrentProcess GetModuleHandleW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitOnceExecuteOnce

vcruntime140

__std_type_info_destroy_list __C_specific_handler memmove memcpy memcmp memset strstr strchr

api-ms-win-crt-stdio-l1-1-0

_sopen_s __stdio_common_vfprintf _read _close __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vsnprintf_s __acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _execute_onexit_table _initialize_narrow_environment _cexit _initialize_onexit_table _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _crt_at_quick_exit terminate _errno strerror_s abort

api-ms-win-crt-string-l1-1-0

strncpy_s isspace tolower isalnum isdigit isupper isalpha isxdigit strspn strncmp _stricmp _strdup _strnicmp strncpy strcmp

api-ms-win-crt-heap-l1-1-0

realloc calloc free malloc

api-ms-win-crt-time-l1-1-0

strftime _gmtime64_s _time64

api-ms-win-crt-convert-l1-1-0

strtoul strtol strtod

api-ms-win-crt-utility-l1-1-0

rand srand

mongocrypt_binary_data mongocrypt_binary_destroy mongocrypt_binary_len mongocrypt_binary_new mongocrypt_binary_new_from_data mongocrypt_ctx_datakey_init mongocrypt_ctx_decrypt_init mongocrypt_ctx_destroy mongocrypt_ctx_encrypt_init mongocrypt_ctx_explicit_decrypt_init mongocrypt_ctx_explicit_encrypt_init mongocrypt_ctx_finalize mongocrypt_ctx_kms_done mongocrypt_ctx_mongo_done mongocrypt_ctx_mongo_feed mongocrypt_ctx_mongo_op mongocrypt_ctx_new mongocrypt_ctx_next_kms_ctx mongocrypt_ctx_setopt_algorithm mongocrypt_ctx_setopt_key_alt_name mongocrypt_ctx_setopt_key_encryption_key mongocrypt_ctx_setopt_key_id mongocrypt_ctx_setopt_masterkey_aws mongocrypt_ctx_setopt_masterkey_aws_endpoint mongocrypt_ctx_setopt_masterkey_local mongocrypt_ctx_state mongocrypt_ctx_status mongocrypt_destroy mongocrypt_init mongocrypt_kms_ctx_bytes_needed mongocrypt_kms_ctx_endpoint mongocrypt_kms_ctx_feed mongocrypt_kms_ctx_get_kms_provider mongocrypt_kms_ctx_message mongocrypt_kms_ctx_status mongocrypt_new mongocrypt_setopt_crypto_hook_sign_rsaes_pkcs1_v1_5 mongocrypt_setopt_crypto_hooks mongocrypt_setopt_kms_provider_aws mongocrypt_setopt_kms_provider_local mongocrypt_setopt_kms_providers mongocrypt_setopt_log_handler mongocrypt_setopt_schema_map mongocrypt_status mongocrypt_status_code mongocrypt_status_destroy mongocrypt_status_message mongocrypt_status_new mongocrypt_status_ok mongocrypt_status_set mongocrypt_status_type mongocrypt_version

Name

.text

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

runtimes/win/native/snappy32.dll

IMPHASH a229ba0dee708573045b8ca09fceb082
SHA256 93c33d548ac34b8971b01e3fb98fb881a9530f9cf6eeb442da39f4e1de114022
MD5 235b668b12b01ea8df603e8baa7c9d03
SHA1 a4a2704b84c6333ba93c403a3b38c68ea1156b19
SHA512 13d22d274693b0a250261c26e70350d7de7c85c1bc21c8422970843a079b09e47b045c53801aa50af475058e3dd88f5239c335e1d280a1a0348bcb1ef0260904
SSDEEP 6144:g5y4uZgph/92UwfbfJ+DQ7fjBcRdsTGu9ANJz:g5y4uZgph/92GQ76u9GJz
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66808

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess QueryPerformanceCounter GetProcessTimes QueryPerformanceFrequency EncodePointer DecodePointer IsProcessorFeaturePresent GetLastError HeapFree EnterCriticalSection LeaveCriticalSection ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCommandLineA GetCurrentThreadId IsDebuggerPresent HeapSize RaiseException HeapAlloc SetStdHandle GetFileType WriteFile GetConsoleCP GetConsoleMode GetProcessHeap DeleteCriticalSection RtlUnwind ReadFile ReadConsoleW GetStdHandle GetStartupInfoW CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetModuleFileNameW LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetModuleFileNameA GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx WriteConsoleW FlushFileBuffers SetEnvironmentVariableA OutputDebugStringW GetStringTypeW CreateFileW SetEndOfFile

runtimes/win/native/snappy64.dll

IMPHASH 609ffef03dc49188439c4d766e677f9b
SHA256 a0bfd16e10abe379aa236d51b2242bec546164cce0d51b2883e62417f508015b
MD5 5f6b1906760afad625e139c2f8449d6a
SHA1 1df218c4f0afe01df097ea96ba11a7c3a304e912
SHA512 a555d217595bc5ebfac73474a951e1d73463863729887bc605086911dfa0461c0918d611d48c62acf8cc8cc08e2e401664c39815caba1538e2be91a3b0ca7b6a
SSDEEP 6144:XoTXMAxvaKc+YTVgTEZWoDsCRUz4qwTYgs5V:4DMqaKyVOqvpTB
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

76552

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess QueryPerformanceCounter GetProcessTimes QueryPerformanceFrequency EncodePointer DecodePointer IsProcessorFeaturePresent GetLastError HeapFree EnterCriticalSection LeaveCriticalSection ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCommandLineA GetCurrentThreadId IsDebuggerPresent HeapSize RtlUnwindEx HeapAlloc RtlPcToFileHeader RaiseException SetStdHandle GetFileType WriteFile GetConsoleCP GetConsoleMode GetProcessHeap DeleteCriticalSection ReadFile ReadConsoleW GetStdHandle GetStartupInfoW CloseHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetModuleFileNameW LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetModuleFileNameA GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx WriteConsoleW FlushFileBuffers SetEnvironmentVariableA OutputDebugStringW GetStringTypeW CreateFileW SetEndOfFile

Software_Demo_unpacked.rar

Software Demo_unpacked.exe

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

runtimes/win/lib/netcoreapp3.1/System.Management.dll

PE Signature issue

mscoree

runtimes/win/native/libzstd.dll

kernel32

msvcrt

user32

runtimes/win/native/mongocrypt.dll

bcrypt

ws2_32

crypt32

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

runtimes/win/native/snappy32.dll

kernel32

runtimes/win/native/snappy64.dll

kernel32