vmtools[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vmtools.dll
Size

827KB
MD5

14e2f65e92bea0cb1fcbcb20c49487b9
SHA1

b10024fece4067c4a6b2e22e98c3da3d8be0a3e9
SHA256

3e11d38eb322aedad2c663d7743cb78de546847c48c3ae9d82e78267d9817df5
SHA512

41ba0b796c73818e51407dddaaae00f2a9ada4468d10b1756a9ada7172ef9a264d8c156ed988582be8b715a7b84655ebcd042398f0de59d0f42dcc19a54f3717
SSDEEP

24576:HLWMGiyA6cUlVD3UW/EIpyRZsIEnKyENN/:HLbGiyAg3XnoRZsIEKyU1

Score

1^/10

Malware Config

Signatures

Files

vmtools.dll
.dll windows:6 windows x64

de0e9a1c5146d0ccdbd2c591204b3397

Code Sign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3d
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/12/2019, 00:00

Not After

07/12/2022, 12:00

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

13/08/2018, 00:00

Not After

11/09/2021, 23:59

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:9c:55:97:58:7c:19:11:17:30:35:6c:30:aa:8e:fe:23:98:7c:3d:20:a8:ed:26:19:82:07:b8:27:a2:cd:d0
Signer

Actual PE Digest

f9:9c:55:97:58:7c:19:11:17:30:35:6c:30:aa:8e:fe:23:98:7c:3d:20:a8:ed:26:19:82:07:b8:27:a2:cd:d0

Digest Algorithm

sha256

PE Digest Matches

false

b2:b4:25:9e:8b:1a:e2:bf:c9:66:7b:fa:bd:1a:f0:08:ce:18:f1:87
Signer

Actual PE Digest

b2:b4:25:9e:8b:1a:e2:bf:c9:66:7b:fa:bd:1a:f0:08:ce:18:f1:87

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

GetUserNameW
OpenProcessToken
GetLengthSid
GetTokenInformation
DeregisterEventSource
RegisterEventSourceW
ReportEventW
AllocateAndInitializeSid
CopySid
FreeSid
InitializeSecurityDescriptor
IsValidSid
SetKernelObjectSecurity
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetEntriesInAclW
OpenThreadToken
AccessCheck
DuplicateToken
GetNamedSecurityInfoW
GetFileSecurityW
ImpersonateSelf
MapGenericMask
RevertToSelf
LookupAccountSidW
LookupAccountNameW
OpenSCManagerW
OpenServiceW
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
AddAccessAllowedAceEx
CheckTokenMembership
EqualSid
GetSecurityDescriptorControl
InitializeAcl
LookupPrivilegeValueA
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegSetValueExW
GetExplicitEntriesFromAclW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegLoadKeyW
RegQueryInfoKeyW
RegUnLoadKeyW
AddAccessAllowedAce
SetSecurityDescriptorGroup
AddAce
GetAce
GetAclInformation
GetSecurityDescriptorDacl
RegOpenKeyExA
CloseServiceHandle
RegQueryValueExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenCurrentUser
InitiateSystemShutdownW
QueryServiceStatus
DeleteAce
CreateProcessAsUserW

kernel32

GetConsoleWindow
OutputDebugStringA
GetCurrentProcess
LocalFree
RtlCaptureContext
RaiseException
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemInfo
VirtualAlloc
VirtualFree
LoadLibraryW
VirtualQuery
IsBadReadPtr
GetCurrentThread
FindClose
FindNextFileW
FlushFileBuffers
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
DuplicateHandle
CreateDirectoryW
DeleteFileW
FindFirstFileExW
GetFileAttributesExW
GetFileTime
GetVolumeInformationW
RemoveDirectoryW
SetFileTime
MoveFileExW
GetDiskFreeSpaceExW
GetDriveTypeW
GetFileInformationByHandle
GetProcessTimes
OpenProcess
AllocConsole
TryEnterCriticalSection
DeleteCriticalSection
GetTickCount
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetDiskFreeSpaceW
GetLogicalDriveStringsW
GetShortPathNameW
GetTempFileNameW
QueryDosDeviceW
GetTempPathW
GetCompressedFileSizeW
WaitNamedPipeW
CreateProcessW
GetComputerNameExW
GetVersionExW
FreeLibrary
LoadLibraryA
GetFullPathNameW
SetFileAttributesW
GetModuleFileNameW
LoadLibraryExW
FormatMessageW
GetModuleHandleExW
GetFileAttributesA
OutputDebugStringW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetDriveTypeA
WideCharToMultiByte
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
GetFileAttributesW
GetOverlappedResult
CancelIo
WaitForSingleObject
CreateEventA
MultiByteToWideChar
GetExitCodeProcess
GetVersionExA
GetNativeSystemInfo
GetProductInfo
lstrcmpiA
CreateToolhelp32Snapshot
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount64
GetACP
ExpandEnvironmentStringsA
IsDebuggerPresent
InitializeCriticalSection
CreateFileA
TerminateProcess
GetSystemFirmwareTable
SetFileInformationByHandle
SetFilePointer
GetFileSizeEx
CreateDirectoryA
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetProcAddress
GetModuleHandleW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCommandLineW
GetExitCodeThread
ReadProcessMemory
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetLogicalDrives
GetVolumeInformationA
FreeConsole
GetFileType
GetStdHandle
Sleep
DeviceIoControl
CloseHandle
CreateFileW
SetLastError
GetLocaleInfoW
GetLastError
InitializeCriticalSectionAndSpinCount

ole32

CoQueryProxyBlanket
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoTaskMemFree

oleaut32

VariantClear
VariantInit
SafeArrayPutElement
SafeArrayDestroy
SafeArrayCreate
SysFreeString
SysAllocString

shell32

SHGetFolderPathW
DragQueryFileW

user32

SystemParametersInfoW
GetWindowInfo
CallNextHookEx
OpenWindowStationW
CloseWindowStation
UnhookWindowsHookEx
SetWindowsHookExW
LoadStringW
GetClipboardFormatNameW
MessageBoxW
GetClassNameW
GetParent
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
TranslateMessage
GetUserObjectSecurity
SetUserObjectSecurity
GetProcessWindowStation
GetDesktopWindow
SetForegroundWindow
GetForegroundWindow
SendInput
IsWindowVisible
PostMessageW
SendMessageTimeoutW
ExitWindowsEx
CloseDesktop
EnumDesktopWindows
OpenInputDesktop
SetProcessWindowStation
OpenDesktopW

ws2_32

GetNameInfoW
WSASetLastError
setsockopt
select
ntohs
getsockopt
getsockname
ioctlsocket
accept
__WSAFDIsSet
WSACleanup
htonl
WSAGetLastError
WSAStartup
socket
send
recv
ntohl
connect
closesocket
bind

crypt32

CryptAcquireCertificatePrivateKey
CryptExportPKCS8
CertFindCertificateInStore
CertAddEncodedCertificateToStore
CertGetCertificateChain
CertFreeCertificateChain
CertCreateCertificateContext
CertFreeCertificateContext
CertCloseStore
CertOpenStore

glib-2.0

g_key_file_new
g_key_file_free
g_key_file_get_keys
g_key_file_has_key
g_key_file_set_string
g_io_channel_win32_new_socket
g_io_channel_win32_new_fd
g_io_channel_win32_new_messages
g_io_add_watch
g_timeout_add
g_malloc0
g_date_time_format
g_date_time_get_microsecond
g_source_remove
g_source_is_destroyed
g_date_time_new_now_utc
g_main_current_source
g_slist_find
g_slist_prepend
g_slist_free
g_direct_equal
g_direct_hash
g_hash_table_size
g_hash_table_foreach_remove
g_hash_table_find
g_hash_table_steal
g_hash_table_replace
g_hash_table_new_full
g_once_init_leave
g_once_init_enter
g_malloc
g_locale_from_utf8
g_date_time_unref
g_rec_mutex_unlock
g_rec_mutex_lock
g_rec_mutex_init
g_rename
g_io_channel_write_chars
g_io_channel_flush
g_io_channel_set_encoding
g_utf16_to_utf8
g_file_test
g_filename_from_utf8
g_usleep
g_timeout_source_new
g_idle_source_new
g_source_set_callback
g_source_set_priority
g_source_destroy
g_source_attach
g_source_unref
g_main_context_unref
g_main_context_ref
g_str_hash
g_str_equal
g_hash_table_lookup
g_hash_table_remove
g_hash_table_insert
g_hash_table_destroy
g_hash_table_new
g_fopen
g_stat
g_fprintf
g_key_file_to_data
g_key_file_load_from_file
g_build_filename
g_file_error_quark
g_set_error
g_vasprintf
g_strcmp0
g_strfreev
g_vsnprintf
g_strsplit
g_strjoin
g_snprintf
g_unlink
g_strchomp
g_str_has_suffix
g_return_if_fail_warning
g_log_set_default_handler
g_log_default_handler
g_log_remove_handler
g_log_set_handler
g_get_user_name
g_ptr_array_foreach
g_ptr_array_add
g_ptr_array_remove_index
g_ptr_array_free
g_ptr_array_sized_new
g_source_new
g_ptr_array_new
g_strdup_printf
g_strdup
g_log
g_io_channel_new_file
g_io_channel_read_line
g_io_channel_unref
g_utf8_to_utf16
g_malloc0_n
g_free
g_once_impl
g_mutex_unlock
g_mutex_lock
g_mutex_clear
g_mutex_init
g_key_file_get_boolean
g_clear_error
g_array_sized_new
g_key_file_get_integer
g_source_add_poll
g_key_file_get_string

vcruntime140

__C_specific_handler
wcsstr
memcmp
wcsrchr
wcschr
__std_type_info_destroy_list
strstr
memset
memmove
strrchr
strchr
memchr
memcpy

api-ms-win-crt-heap-l1-1-0

calloc
malloc
realloc
free

api-ms-win-crt-string-l1-1-0

strcmp
strncmp
isdigit
_wcsdup
strncat
isspace
strtok_s
_stricmp
islower
strtok
_strnicmp
_strupr
isprint
strncpy
wcsncmp
isalnum
_strlwr
tolower
_strdup
_wcslwr
wcsspn
strcspn
towupper
wcscspn

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
strerror
_initialize_narrow_environment
_beginthreadex
_getpid
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_cexit
_execute_onexit_table
_errno
exit
abort

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
_wopen
_wfopen
__stdio_common_vsprintf
fflush
fgetc
fgets
setvbuf
getc
__stdio_common_vfscanf
fputs
__acrt_iob_func
__stdio_common_vfprintf
_wfreopen
fclose
feof
fwrite

api-ms-win-crt-time-l1-1-0

_time64
_mktime64
_ftime64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

_wgetenv
getenv

api-ms-win-crt-filesystem-l1-1-0

_wunlink
_wmkdir
_wfullpath
_wrename
_wstat64

api-ms-win-crt-convert-l1-1-0

_strtoi64
_strtoui64
strtoul
strtol
strtod
wcrtomb
_ecvt_s
_fcvt_s
mbtowc

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

frexp

Exports

Exports

Backdoor
BackdoorChannel_New
Backdoor_HbIn
Backdoor_HbOut
Base64_Decode
Base64_DecodedLength
Base64_EasyEncode
Base64_Encode
Base64_EncodedLength
CodeSet_CurrentToUtf8
CodeSet_DontUseIcu
CodeSet_GenericToGeneric
CodeSet_GetAltPathName
CodeSet_GetCurrentCodeSet
CodeSet_Init
CodeSet_Utf16leToUtf8
CodeSet_Utf8ToCurrent
CodeSet_Utf8ToUtf16le
CodeSet_Validate
Config_GetLong
CryptoHash_Compute
CryptoHash_FromString
CryptoHash_GetOutputSize
Debug
DictLL_ReadLine
DictLL_WriteLine
DynArray_AllocCount
DynArray_Destroy
DynArray_Init
DynArray_SetCount
DynBuf_Append
DynBuf_Attach
DynBuf_Copy
DynBuf_Destroy
DynBuf_Detach
DynBuf_Enlarge
DynBuf_Init
DynBuf_SafeInternalAppend
DynBuf_Trim
DynXdr_AllocGet
DynXdr_AppendRaw
DynXdr_Create
DynXdr_Destroy
DynXdr_Get
Err_ErrString
Err_Errno2String
Escape_Do
Escape_DoString
Escape_Undo
FileIO_Access
FileIO_Close
FileIO_ErrorEnglish
FileIO_GetSize
FileIO_Invalidate
FileIO_Open
FileIO_Read
FileIO_Write
File_CreateDirectory
File_CreateDirectoryEx
File_CreateDirectoryHierarchy
File_CreateDirectoryHierarchyEx
File_DeleteDirectoryTree
File_DeleteEmptyDirectory
File_EnsureDirectory
File_EnsureDirectoryEx
File_Exists
File_GetFilePermissions
File_GetModTime
File_GetPathName
File_GetSafeRandomTmpDir
File_GetSafeTmpDir
File_GetSize
File_GetSizeEx
File_GetTimes
File_IsDirectory
File_IsEmptyDirectory
File_IsFile
File_IsSameFile
File_IsSymLink
File_ListDirectory
File_MakeSafeTemp
File_MakeTempEx
File_MakeTempEx2
File_Move
File_PathJoin
File_SetFilePermissions
File_SetTimes
File_SplitName
File_StripSlashes
File_Unlink
File_UnlinkDelayed
File_UnlinkIfExists
File_UnlinkNoFollow
GuestApp_GetConfPath
GuestApp_GetDefaultScript
GuestApp_GetInstallPath
GuestApp_GetInstallPathW
HashTable_Alloc
HashTable_AllocOnce
HashTable_Clear
HashTable_Delete
HashTable_ForEach
HashTable_Free
HashTable_GetNumElements
HashTable_Insert
HashTable_KeyArray
HashTable_Lookup
HashTable_LookupAndDelete
HashTable_ReplaceOrInsert
HashTable_ToArray
Hostinfo_GetLibraryPath
Hostinfo_GetModulePath
Hostinfo_GetOSDetailType
Hostinfo_GetOSDetailedData
Hostinfo_GetOSGuestString
Hostinfo_GetOSName
Hostinfo_GetOSType
Hostinfo_GetSystemBitness
Hostinfo_GetTimeOfDay
Hostinfo_OSVersion
Hostinfo_SystemTimerNS
Log
LogV
MXUser_AcquireExclLock
MXUser_AcquireForRead
MXUser_AcquireForWrite
MXUser_AcquireRecLock
MXUser_BroadcastCondVar
MXUser_CreateCondVarExclLock
MXUser_CreateExclLock
MXUser_CreateRWLock
MXUser_CreateRecLock
MXUser_CreateSingletonExclLockInt
MXUser_CreateSingletonRWLockInt
MXUser_CreateSingletonRecLockInt
MXUser_DestroyCondVar
MXUser_DestroyExclLock
MXUser_DestroyRWLock
MXUser_DestroyRecLock
MXUser_IsCurThreadHoldingExclLock
MXUser_IsCurThreadHoldingRWLock
MXUser_IsCurThreadHoldingRecLock
MXUser_ReleaseExclLock
MXUser_ReleaseRWLock
MXUser_ReleaseRecLock
MXUser_SetInPanic
MXUser_SignalCondVar
MXUser_TimedWaitCondVarExclLock
MXUser_TryAcquireExclLock
MXUser_TryAcquireRecLock
MXUser_WaitCondVarExclLock
Message_Close
Message_Open
Message_Receive
Message_Send
NetUtil_GetPrimaryNic
Panic
Posix_Fopen
Posix_Getenv
Posix_Open
Posix_Stat
Preference_GetBool
ProcMgr_ExecAsync
ProcMgr_ExecSync
ProcMgr_Free
ProcMgr_FreeProcList
ProcMgr_GetAsyncProcSelectable
ProcMgr_GetExitCode
ProcMgr_GetImpersonatedUserInfo
ProcMgr_GetPid
ProcMgr_IsAsyncProcRunning
ProcMgr_KillByPid
ProcMgr_ListProcesses
ProcMgr_ListProcessesEx
ProductState_GetName
Random_Crypto
Random_Quick
Random_QuickSeed
Registry_GetRootHKey
Registry_KeyExists
Registry_ReadInteger
Registry_ReadMultiString
Registry_ReadString
Registry_SubkeysExist
Registry_WriteInteger
Registry_WriteString
RpcChannel_BuildXdrCommand
RpcChannel_Create
RpcChannel_Destroy
RpcChannel_Dispatch
RpcChannel_Free
RpcChannel_GetType
RpcChannel_New
RpcChannel_RegisterCallback
RpcChannel_Send
RpcChannel_SendOne
RpcChannel_SendOnePriv
RpcChannel_SendOneRaw
RpcChannel_SendOneRawPriv
RpcChannel_SetBackdoorOnly
RpcChannel_SetRetVals
RpcChannel_SetRetValsF
RpcChannel_Setup
RpcChannel_Start
RpcChannel_Stop
RpcChannel_UnregisterCallback
RpcOut_Construct
RpcOut_Destruct
RpcOut_SendOneRaw
RpcOut_send
RpcOut_sendOne
RpcOut_start
RpcOut_stop
RpcVMX_ConfigGetBool
RpcVMX_ConfigGetString
RpcVMX_Log
StdIO_ReadNextLine
StrUtil_DynBufPrintf
StrUtil_EndsWith
StrUtil_GetNextIntToken
StrUtil_GetNextToken
StrUtil_GetNextUintToken
StrUtil_StartsWith
StrUtil_StrToInt
StrUtil_StrToInt64
StrUtil_StrToUint
Str_Asprintf
Str_Aswprintf
Str_SafeAsprintf
Str_SafeAswprintf
Str_SafeVasprintf
Str_SafeVaswprintf
Str_Snprintf
Str_Snwprintf
Str_Sprintf
Str_Strcat
Str_Strcpy
Str_Strlen
Str_Strncat
Str_Strncpy
Str_Swprintf
Str_Vasprintf
Str_Vaswprintf
Str_Vsnprintf
Str_Wcscat
Str_Wcscpy
SyncDriver_CloseHandle
SyncDriver_Freeze
SyncDriver_Init
SyncDriver_QueryStatus
SyncDriver_Thaw
System_DisableAndKillScreenSaver
System_EnableDesktopComposition
System_GetEnv
System_GetNodeName
System_GetServiceState
System_GetTimeMonotonic
System_IsSecureDesktopActive
System_IsUserAdmin
System_SetEnv
System_SetFocusedWindow
System_SetProcessPrivilege
System_Shutdown
System_Uptime
TimeUtil_DateLowerThan
TimeUtil_DaysAdd
TimeUtil_NtTimeToUnixTime
TimeUtil_PopulateWithCurrent
TimeUtil_UnixTimeToNtTime
UUID_CreateRandom
Unicode_AllocWithLength
Unicode_CompareRange
Unicode_CopyBytes
Unicode_Duplicate
Unicode_EscapeBuffer
Unicode_FindLastSubstrInRange
Unicode_FindSubstrInRange
Unicode_FoldCase
Unicode_Format
Unicode_GetAllocBytes
Unicode_InitW
Unicode_IsBufferValid
Unicode_Join
Unicode_LengthInBytes
Unicode_LengthInCodePoints
Unicode_LengthInCodeUnits
Unicode_ReplaceRange
Unicode_Substr
Unicode_Trim
Unicode_TrimLeft
Unicode_TrimRight
Unicode_UTF16Strdup
Unicode_UTF16Strlen
UtilSafeCalloc0
UtilSafeCalloc1
UtilSafeMalloc0
UtilSafeMalloc1
UtilSafeRealloc0
UtilSafeRealloc1
UtilSafeStrdup0
UtilSafeStrdup1
UtilSafeStrndup0
UtilSafeStrndup1
Util_GetCanonicalPath
Util_Memdup
Util_TokenHasAdminPriv
VMTools_AttachConsole
VMTools_BindTextDomain
VMTools_ChangeLogFilePath
VMTools_ConfigGetBoolean
VMTools_ConfigGetInteger
VMTools_ConfigGetString
VMTools_ConfigLogToStdio
VMTools_ConfigLogging
VMTools_CreateTimer
VMTools_GetString
VMTools_GetTimeAsString
VMTools_GetUtf16String
VMTools_LoadConfig
VMTools_Log
VMTools_NewHandleSource
VMTools_ResumeLogIO
VMTools_SetGuestSDKMode
VMTools_SetupVmxGuestLog
VMTools_SuspendLogIO
VMTools_TeardownVmxGuestLog
VMTools_UseVmxGuestLog
VMTools_WrapArray
VMTools_WriteConfig
VMW_SHA1Final
VMW_SHA1Init
VMW_SHA1Update
VSockChannel_New
VmCheck_GetVersion
VmCheck_IsVirtualWorld
W32Util_AsciiStrToWideStr
W32Util_CheckGroupMembership
W32Util_GetInstalledFilePath
W32Util_GetModuleByAddress
W32Util_GetVmwareCommonAppDataFilePath
W32Util_OpenProductRegKey
W32Util_ReadFileTimeout
W32Util_WriteFileTimeout
WMI_EnableDHCP
WMI_EnableStatic
WMI_GetWMINicConfiguration
Warning
WarningToGuest
WarningToHost
Win32U_AllocString
Win32U_DragQueryFile
Win32U_EnumKeyExpandBuffer
Win32U_EnumValueExpandBuffer
Win32U_ExpandEnvironmentStrings
Win32U_ExpandEnvironmentStringsEx
Win32U_FindFirstFileW
Win32U_FormatMessage
Win32U_GetClassName
Win32U_GetClipboardFormatName
Win32U_GetComputerName
Win32U_GetComputerNameEx
Win32U_GetDiskFreeSpaceEx
Win32U_GetDriveType
Win32U_GetEnvironmentVariable
Win32U_GetFileAttributes
Win32U_GetLogicalDriveStrings
Win32U_GetModuleFileName
Win32U_GetModuleHandle
Win32U_GetUserName
Win32U_GetVolumeInformation
Win32U_LoadLibrary
Win32U_LookupAccountSid
Win32U_LookupSidForAccount
Win32U_PathUnExpandEnvStrings
Win32U_RecurseDeleteKeyEx
Win32U_RegCreateKeyEx
Win32U_RegDeleteValue
Win32U_RegEnumKeyEx
Win32U_RegOpenKeyEx
Win32U_RegQueryValueEx
Win32U_RegSetValueEx
Win32U_SHCopyKey
Win32U_SHDeleteKey
Win32U_SHGetFolderPath
Win32U_SHSetFolderPath
Win32U_SetEnvironmentVariable
Win32U_SetFileAttributes
WinReg_DeleteValue
WinReg_EnumerateSubkeys
WinReg_EnumerateValues
WinReg_GetDWORD
WinReg_GetSZ
WinReg_GetSZEx
WinReg_LoadHiveU
WinReg_SetDWORD
WinReg_SetSZ
WinReg_SetSZEx
WinReg_UnloadHiveU
WiperPartition_Close
WiperPartition_Open
WiperSinglePartition_Close
WiperSinglePartition_GetSpace
Wiper_Cancel
Wiper_Init
Wiper_IsWipeSupported
Wiper_Next
Wiper_Start
XdrUtil_ArrayAppend
XdrUtil_Deserialize
_loglevel_offset_user
getopt
getopt_long
logLevelPtr
optarg
optind
uriComposeQueryCharsRequiredA
uriComposeQueryMallocA
uriDissectQueryMallocA
uriEscapeA
uriFreeQueryListA
uriFreeUriMembersA
uriParseUriA
uriUnescapeInPlaceA
uriUriStringToWindowsFilenameA
uriWindowsFilenameToUriStringA
vm_free
xdr_DnsConfigInfo
xdr_GHIDisplaysDPIInfo
xdr_GuestNic
xdr_GuestNicList
xdr_GuestNicProto
xdr_NicInfoV3
xdr_VMCFBrokerConfig
xdr_VMCFBrokerRegistration
xdr_array
xdr_bool
xdr_bytes
xdr_char
xdr_double
xdr_enum
xdr_float
xdr_free
xdr_int
xdr_int16_t
xdr_int32_t
xdr_int64_t
xdr_long
xdr_netobj
xdr_opaque
xdr_pointer
xdr_reference
xdr_short
xdr_string
xdr_u_char
xdr_u_int
xdr_u_int16_t
xdr_u_int32_t
xdr_u_int64_t
xdr_u_long
xdr_u_short
xdr_union
xdr_vector
xdr_void
xdr_wrapstring
xdrmem_create

Sections

.text
Size: 477KB - Virtual size: 476KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de0e9a1c5146d0ccdbd2c591204b3397

Code Sign

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3dCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

f9:9c:55:97:58:7c:19:11:17:30:35:6c:30:aa:8e:fe:23:98:7c:3d:20:a8:ed:26:19:82:07:b8:27:a2:cd:d0Signer

b2:b4:25:9e:8b:1a:e2:bf:c9:66:7b:fa:bd:1a:f0:08:ce:18:f1:87Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ole32

oleaut32

shell32

user32

ws2_32

crypt32

glib-2.0

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 477KB - Virtual size: 476KB

.rdata Size: 219KB - Virtual size: 218KB

.data Size: 70KB - Virtual size: 94KB

.pdata Size: 26KB - Virtual size: 25KB

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 6KB - Virtual size: 5KB

61:1c:b2:8a:00:00:00:00:00:26
Certificate

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3d
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

f9:9c:55:97:58:7c:19:11:17:30:35:6c:30:aa:8e:fe:23:98:7c:3d:20:a8:ed:26:19:82:07:b8:27:a2:cd:d0
Signer

b2:b4:25:9e:8b:1a:e2:bf:c9:66:7b:fa:bd:1a:f0:08:ce:18:f1:87
Signer

.text
Size: 477KB - Virtual size: 476KB

.rdata
Size: 219KB - Virtual size: 218KB

.data
Size: 70KB - Virtual size: 94KB

.pdata
Size: 26KB - Virtual size: 25KB

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 6KB - Virtual size: 5KB