crack[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

crack.zip
Size

8.2MB
MD5

5965355cfed99696151d974274a35b93
SHA1

af6698591e120261bbfdc41b841a3ba0c023579e
SHA256

ad0ec5537864f9972ea862bd37ad643aa99f7608f581350c8b1e56350b8b1de3
SHA512

e68575b0121db1946729fc21f40c7a9746d90ec18e3918f0298c832259f664b7aa33e7815188156b2e10bf7d30b7e7ba214ab94791bc3aabd7a07cb0ee1d9e91
SSDEEP

196608:JRCm7uP1SP+pNM90b/vRkRRQeM/rGeHIrk3/IRH/DFwrnHOxi:Lx0NM+e/zaCkvIRH7qrnuxi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Patch.exe

Files

crack.zip
.zip
Patch.exe
.exe windows:6 windows x64

3346971ceb7b366aff6035fae5c1febd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WriteConsoleW
GetFileType
QueryPerformanceFrequency
HeapQueryInformation
FreeLibraryAndExitThread
ExitThread
GetCommandLineW
GetCommandLineA
HeapValidate
VirtualAlloc
GetSystemInfo
SetConsoleCtrlHandler
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
RtlPcToFileHeader
GetCPInfo
CompareStringEx
GetStringTypeW
GetLocaleInfoEx
LCMapStringEx
FormatMessageA
OutputDebugStringW
SetStdHandle
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetThreadTimes
InitializeSRWLock
ReleaseSRWLockExclusive
LCMapStringW
AcquireSRWLockExclusive
TryEnterCriticalSection
SetFileInformationByHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
RtlUnwind
InitOnceBeginInitialize
InitOnceComplete
SetCurrentDirectoryW
CreateDirectoryW
GetDriveTypeW
GetFileInformationByHandle
VirtualQuery
GetStartupInfoW
GetSystemTimeAsFileTime
QueryPerformanceCounter
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
LocalUnlock
LocalLock
CreateSemaphoreW
WaitForMultipleObjects
CreateMutexW
ReleaseMutex
ReleaseSemaphore
PulseEvent
ResetEvent
Sleep
SearchPathW
GetTickCount
GetWindowsDirectoryW
FindResourceExW
GetUserDefaultLCID
ReplaceFileW
GetTempFileNameW
GetDiskFreeSpaceW
SystemTimeToTzSpecificLocalTime
SetFileTime
SetFileAttributesW
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
SystemTimeToFileTime
FileTimeToSystemTime
GetFileAttributesW
GetTempPathW
GetThreadLocale
GetStringTypeExW
MoveFileW
lstrcmpiW
GetCurrentProcess
GetHandleInformation
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
VirtualProtect
GetProfileIntW
GetAtomNameW
SetErrorMode
DeleteFileW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalSize
InitializeCriticalSectionAndSpinCount
CompareStringW
GlobalGetAtomNameW
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
ResumeThread
GetThreadPriority
SetThreadPriority
VerifyVersionInfoW
lstrcpyW
VerSetConditionMask
GetCurrentProcessId
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetProcAddress
GetModuleHandleW
SuspendThread
CreateEventW
SetEvent
GlobalFree
GlobalUnlock
FreeResource
CompareStringA
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetModuleHandleExW
FreeLibrary
GetVersionExW
GetCurrentThreadId
GetCurrentThread
GetModuleFileNameA
OutputDebugStringA
WideCharToMultiByte
SetConsoleTitleA
SetConsoleTextAttribute
AllocConsole
GetStdHandle
GetModuleFileNameW
DebugBreak
IsDebuggerPresent
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
CreateProcessA
TerminateProcess
CloseHandle
GetFileAttributesA
GetCurrentDirectoryA
MultiByteToWideChar
CreateDirectoryA
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetLastError
RaiseException
DecodePointer
CreateThread
WaitForSingleObject
GetLastError
ExitProcess
PeekNamedPipe

user32

CreateWindowExW
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
GetMessagePos
IsDialogMessageW
SetWindowLongW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
ScrollWindowEx
SetFocus
GetDlgCtrlID
SendDlgItemMessageW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
SetWindowPos
MoveWindow
ShowWindow
NotifyWinEvent
ArrangeIconicWindows
DlgDirSelectComboBoxExW
DlgDirListComboBoxW
DlgDirSelectExW
DlgDirListW
GetWindow
GetTopWindow
FindWindowExW
FindWindowW
SetParent
ChildWindowFromPointEx
ChildWindowFromPoint
WindowFromPoint
MapWindowPoints
ScreenToClient
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
CreateCaret
GetWindowContextHelpId
SetWindowContextHelpId
GetWindowRect
GetClientRect
EnableScrollBar
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
LockWindowUpdate
RedrawWindow
ValidateRgn
InvalidateRgn
InvalidateRect
GetWindowRgn
SetWindowRgn
GetUpdateRgn
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetWindowPlacement
GetDC
SetForegroundWindow
GetForegroundWindow
UpdateWindow
DragDetect
GetSystemMenu
DrawMenuBar
HiliteMenuItem
KillTimer
SetTimer
SetCapture
GetCapture
GetOpenClipboardWindow
ChangeClipboardChain
GetClipboardViewer
SetClipboardViewer
GetClipboardOwner
OpenClipboard
GetNextDlgTabItem
GetNextDlgGroupItem
IsZoomed
BringWindowToTop
IsIconic
IsWindowVisible
CloseWindow
OpenIcon
ShowOwnedPopups
FlashWindow
IsChild
GetComboBoxInfo
DestroyCursor
EnumChildWindows
WaitMessage
MsgWaitForMultipleObjectsEx
MessageBoxA
SendMessageW
LoadIconW
LoadImageW
PostThreadMessageW
SendNotifyMessageW
DrawAnimatedRects
DrawCaption
SendDlgItemMessageA
CheckMenuRadioItem
InvertRect
FrameRect
DrawFocusRect
GetMenuContextHelpId
SetMenuContextHelpId
ScrollDC
ExcludeUpdateRgn
WindowFromDC
GetTabbedTextExtentW
SetPropW
GetPropW
RemovePropW
AdjustWindowRectEx
EqualRect
PtInRect
GetWindowLongPtrW
SetWindowLongPtrW
GetClassLongW
GetClassLongPtrW
UnhookWindowsHookEx
SetScrollInfo
GetScrollInfo
WinHelpW
MonitorFromWindow
SetWindowPlacement
DrawStateW
GrayStringW
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetMenu
SetMenu
TrackPopupMenu
TrackPopupMenuEx
GetDCEx
ScrollWindow
UnregisterClassW
UnregisterClassA
GetSystemMetrics
GetWindowTextA
EnumWindows
PeekMessageW
PostQuitMessage
PostMessageW
IsWindow
TabbedTextOutW
MapDialogRect
GetFocus
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
DestroyWindow
CreateDialogIndirectParamW
EndDialog
GetDlgItem
GetActiveWindow
EnableWindow
ReleaseCapture
IsWindowEnabled
SetActiveWindow
GetWindowLongW
GetDesktopWindow
GetMessageW
TranslateMessage
DispatchMessageW
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
SetCursor
MessageBoxW
CopyImage
RealChildWindowFromPoint
LoadAcceleratorsW
GetParent
GetWindowThreadProcessId
GetLastActivePopup
DefWindowProcW
GetClassInfoW
SetLayeredWindowAttributes
GetSysColor
GetSysColorBrush
SetRectEmpty
CopyRect
IsRectEmpty
LoadCursorW
SystemParametersInfoW
GetMonitorInfoW
EnumDisplayMonitors
RegisterWindowMessageW
FillRect
InflateRect
OffsetRect
DrawIconEx
GetClassNameW
DrawEdge
DrawFrameControl
IsMenu
LoadMenuW
LoadMenuIndirectW
GetMenuStringW
GetMenuState
CreateMenu
CreatePopupMenu
CheckMenuItem
EnableMenuItem
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
DeleteMenu
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
GetMenuDefaultItem
SetMenuDefaultItem
DrawIcon
DrawTextW
DrawTextExW
DestroyMenu
SetRect
GetAsyncKeyState
GetDialogBaseUnits
GetKeyNameTextW
GetClipboardFormatNameA
GetClipboardFormatNameW
UnpackDDElParam
DestroyIcon
CharUpperW
TranslateAcceleratorW
IntersectRect
GetMenuBarInfo
ReuseDDElParam
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
TrackMouseEvent
MessageBeep
SetCursorPos
SetClassLongPtrW
CloseClipboard
SetClipboardData
EmptyClipboard
MonitorFromPoint
UnionRect
GetDoubleClickTime
GetIconInfo
CopyIcon
UpdateLayeredWindow
IsCharLowerW
MapVirtualKeyExW
RegisterClipboardFormatW
CharUpperBuffW
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
SubtractRect
MonitorFromRect
MapVirtualKeyW
InSendMessage

gdi32

BitBlt
Arc
AnimatePalette
GetObjectW
GetTextCharsetInfo
GetStockObject
EnumFontFamiliesW
DeleteObject
CreateDIBitmap
CreateBitmap
ExtTextOutW
CreateEnhMetaFileW
CloseEnhMetaFile
CreateMetaFileW
CloseMetaFile
DeleteDC
CreatePenIndirect
CreatePolyPolygonRgn
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
DrawEscape
Ellipse
EnumObjects
EqualRgn
Escape
ExtEscape
ExtCreateRegion
ExtFloodFill
FillRgn
FloodFill
FrameRgn
GetROP2
GetAspectRatioFilterEx
GetBkColor
GetBkMode
GetBitmapBits
GetBitmapDimensionEx
GetBoundsRect
GetBrushOrgEx
GetCharWidthW
GetCharWidthFloatW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetCurrentObject
GetCurrentPositionEx
GetDeviceCaps
GetFontData
GetGlyphOutlineW
GetGraphicsMode
GetMapMode
GetNearestColor
GetNearestPaletteIndex
GetObjectType
GetOutlineTextMetricsW
GetPaletteEntries
GetPixel
GetPolyFillMode
GetRegionData
GetRgnBox
GetStretchBltMode
GetTextCharacterExtra
GetTextAlign
GetTextColor
GetTextExtentPoint32W
GetFontLanguageInfo
GetCharacterPlacementW
GetViewportExtEx
GetViewportOrgEx
GetWindowExtEx
GetWindowOrgEx
InvertRgn
MaskBlt
PlgBlt
OffsetRgn
PatBlt
Pie
PaintRgn
PolyPolygon
PtInRegion
PtVisible
RectInRegion
RectVisible
Rectangle
ResetDCW
RealizePalette
RoundRect
ResizePalette
SelectObject
SetBitmapBits
SetBoundsRect
SetPaletteEntries
SetPixel
SetPixelV
StretchBlt
Chord
UpdateColors
PlayEnhMetaFile
GdiComment
GetTextMetricsW
AngleArc
PolyPolyline
GetWorldTransform
GetColorAdjustment
CreateHalftonePalette
StartDocW
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
AbortPath
BeginPath
CloseFigure
EndPath
FillPath
FlattenPath
GetPath
PathToRegion
SetMiterLimit
StrokeAndFillPath
StrokePath
WidenPath
ExtCreatePen
GetMiterLimit
GetArcDirection
TextOutW
CreatePolygonRgn
DPtoLP
LPtoDP
Polygon
Polyline
PolyBezier
SetBitmapDimensionEx
SetBrushOrgEx
GetTextFaceW
GetKerningPairsW
UnrealizeObject
SetBkColor
SetTextColor
CopyMetaFileW
ExcludeClipRect
GetClipBox
GetClipRgn
IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
MoveToEx
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
StretchDIBits
CreateDIBSection
GetDIBits
SetDIBColorTable
EnumFontFamiliesExW
GetSystemPaletteEntries
DeleteMetaFile
GetTextExtentPointW
CombineRgn
CreateBitmapIndirect
CreateBrushIndirect
CreateCompatibleBitmap
CreateDiscardableBitmap
CreateCompatibleDC
CreateDCW
CreateDIBPatternBrushPt
CreateEllipticRgn
CreateEllipticRgnIndirect
CreateFontIndirectW
CreateFontW
CreateHatchBrush
CreateICW
CreatePalette
SetRectRgn
CreateSolidBrush
CreatePen

msimg32

GradientFill
TransparentBlt
AlphaBlend

winspool.drv

GetJobW
ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegEnumKeyW
RegOpenKeyExW
RegEnumKeyExW
SetFileSecurityW
GetFileSecurityW
RegEnumValueW
RegSetValueW
RegQueryValueW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW

shell32

ShellExecuteExW
ShellExecuteW
SHAppBarMessage
DragFinish
DragQueryFileW
SHGetFileInfoW
ExtractIconW
SHAddToRecentDocs
DragAcceptFiles
SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHFileOperationA

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFindFileNameW
PathFindExtensionW
PathFileExistsA
StrFormatKBSizeW

uxtheme

DrawThemeBackground
GetCurrentThemeName
IsAppThemed
DrawThemeText
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetWindowTheme
GetThemeColor
DrawThemeParentBackground
OpenThemeData
CloseThemeData

ole32

RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
OleRegEnumVerbs
OleRegGetMiscStatus
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLoad
CreateFileMoniker
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
OleRun
OleSetMenuDescriptor
OleGetIconOfClass
OleLockRunning
OleQueryLinkFromData
StringFromCLSID
OleSaveToStream
OleSave
OleCreateFromFile
OleCreateLinkToFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleCreate
CreateItemMoniker
CreateGenericComposite
CreateILockBytesOnHGlobal
GetHGlobalFromILockBytes
WriteClassStm
StgIsStorageILockBytes
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
PropVariantCopy
CLSIDFromString
OleQueryCreateFromData
CreateDataAdviseHolder
CreateOleAdviseHolder
GetRunningObjectTable
CoDisconnectObject
CreateStreamOnHGlobal
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CLSIDFromProgID
OleIsRunning
CoGetClassObject
CoRegisterMessageFilter
GetClassFile
CoGetMalloc
OleSetContainedObject

oleaut32

SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayPutElement
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
SafeArrayGetElemsize
SafeArrayGetDim
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
SysStringLen
SysAllocStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString
VarBstrFromDate
VarBstrFromDec
VarDecFromStr
SafeArrayCopy
SafeArrayPtrOfIndex
VariantCopy
SysReAllocStringLen
GetErrorInfo
SetErrorInfo
CreateErrorInfo
VarCyFromStr
VarBstrFromCy
VarDateFromStr

oledlg

OleUIUpdateLinksW
OleUIConvertW
OleUIChangeIconW
OleUIEditLinksW
OleUIPasteSpecialW
OleUIInsertObjectW
OleUIBusyW

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateFromHDC
GdipCreateBitmapFromStreamICM
GdipDrawImageRectI
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipCreateBitmapFromFileICM
GdipDeleteGraphics
GdiplusShutdown
GdipFree
GdipAlloc
GdipCreateBitmapFromFile

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider

Exports

Exports

dummy

Sections

.textbss
Size: - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 13.4MB - Virtual size: 13.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 142KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 768KB - Virtual size: 768KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 987B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 546B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 233KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
evbda.sys
.sys windows:10 windows x64

752e719aa44f97eb2df9211e258bb0c4

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:4b:02:4d:00:31:6d:8f:c0:98:64:64:88:82:86:61:7c:a9:b2:99:41:c3:d2:be:48:15:6c:b1:36:bc:d7:48
Signer

Actual PE Digest

c6:4b:02:4d:00:31:6d:8f:c0:98:64:64:88:82:86:61:7c:a9:b2:99:41:c3:d2:be:48:15:6c:b1:36:bc:d7:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlAppendUnicodeToString
KeInitializeEvent
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
MmUnmapIoSpace
MmMapIoSpaceEx
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoGetDeviceProperty
IoInvalidateDeviceState
ZwClose
ZwOpenKey
ZwEnumerateKey
ZwQueryValueKey
ZwSetValueKey
strrchr
RtlQueryRegistryValues
MmGetSystemRoutineAddress
RtlWriteRegistryValue
KeLowerIrql
KfRaiseIrql
KeInitializeDpc
KeInsertQueueDpc
KeSetImportanceDpc
KeResetEvent
KeSetPriorityThread
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeInitializeTimer
KeCancelTimer
KeSetTimer
KeInitializeSpinLock
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
ExAcquireFastMutexUnsafe
RtlCheckRegistryKey
PsCreateSystemThread
IoBuildDeviceIoControlRequest
IoConnectInterrupt
IoGetDmaAdapter
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateKey
_vsnwprintf
PsThreadType
PsTerminateSystemThread
RtlIsNtDdiVersionAvailable
PsGetVersion
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
IoAllocateWorkItem
IoFreeWorkItem
IoRaiseInformationalHardError
IoSetThreadHardErrorMode
KeNumberProcessors
RtlCompareMemory
KeDelayExecutionThread
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoDisconnectInterrupt
IoFreeMdl
MmGetPhysicalMemoryRanges
memcpy_s
DbgPrint
RtlUnicodeStringToInteger
RtlInitUnicodeString
RtlIntegerToUnicodeString
wcsstr
RtlCopyUnicodeString
_vsnprintf
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwQuerySystemInformation
KeSetEvent
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
ExReleaseFastMutexUnsafe
wcsrchr

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3346971ceb7b366aff6035fae5c1febd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

oleacc

imm32

winmm

bcrypt

Exports

Exports

Sections

.textbss Size: - Virtual size: 6.4MB

.text Size: 13.4MB - Virtual size: 13.4MB

.rdata Size: 4.2MB - Virtual size: 4.2MB

.data Size: 142KB - Virtual size: 212KB

.pdata Size: 768KB - Virtual size: 768KB

.idata Size: 41KB - Virtual size: 40KB

.msvcjmc Size: 2KB - Virtual size: 1KB

.tls Size: 1024B - Virtual size: 987B

.00cfg Size: 512B - Virtual size: 337B

_RDATA Size: 1024B - Virtual size: 546B

.rsrc Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 233KB - Virtual size: 232KB

752e719aa44f97eb2df9211e258bb0c4

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

c6:4b:02:4d:00:31:6d:8f:c0:98:64:64:88:82:86:61:7c:a9:b2:99:41:c3:d2:be:48:15:6c:b1:36:bc:d7:48Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

wdfldr.sys

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.data Size: 49KB - Virtual size: 208KB

.pdata Size: 23KB - Virtual size: 22KB

.gfids Size: 512B - Virtual size: 4B

PAGE Size: 512B - Virtual size: 396B

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 11KB - Virtual size: 11KB

.reloc Size: 1KB - Virtual size: 1KB

.textbss
Size: - Virtual size: 6.4MB

.text
Size: 13.4MB - Virtual size: 13.4MB

.rdata
Size: 4.2MB - Virtual size: 4.2MB

.data
Size: 142KB - Virtual size: 212KB

.pdata
Size: 768KB - Virtual size: 768KB

.idata
Size: 41KB - Virtual size: 40KB

.msvcjmc
Size: 2KB - Virtual size: 1KB

.tls
Size: 1024B - Virtual size: 987B

.00cfg
Size: 512B - Virtual size: 337B

_RDATA
Size: 1024B - Virtual size: 546B

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 233KB - Virtual size: 232KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

c6:4b:02:4d:00:31:6d:8f:c0:98:64:64:88:82:86:61:7c:a9:b2:99:41:c3:d2:be:48:15:6c:b1:36:bc:d7:48
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 49KB - Virtual size: 208KB

.pdata
Size: 23KB - Virtual size: 22KB

.gfids
Size: 512B - Virtual size: 4B

PAGE
Size: 512B - Virtual size: 396B

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 1KB - Virtual size: 1KB