KeePass-2[.]55[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

KeePass-2.55.zip
Size

3.1MB
MD5

904f85446cb64116352e03b1814136d5
SHA1

5078af3f20bb6cbb006b40610fb60f3eead79bc8
SHA256

4f906f558297e67768b5b983fe94c86ecf628057135fdfb1f122df8b45d4d4db
SHA512

986d02129b4efd83c9c9117411519e79b3ada0c42e57aa2c176b444a770aebf4b469e75b023f451b0a9748312520ad9a2cd5dd265a324aad2216023e91beb1f2
SSDEEP

98304:xQBJtD5DrKX/7Is6nEq6bptdMzmTUz0GzaLTujfu:G5lrKX/F6Eq61jMyTO0G+PujG

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/KeePass.XmlSerializers.dll
unpack001/KeePass.exe
unpack001/KeePassLibC32.dll
unpack001/KeePassLibC64.dll
unpack001/ShInstUtil.exe

Files

KeePass-2.55.zip
.zip
KeePass.XmlSerializers.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 416KB - Virtual size: 414KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KeePass.chm
.chm
KeePass.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KeePass.exe.config
.xml
KeePassLibC32.dll
.dll windows:5 windows x86

9b3ae4777a424138943a8e4bf259162e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeGetTime

kernel32

GetModuleHandleW
GetCPInfo
GetOEMCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
ExitThread
GetCommandLineA
RtlUnwind
Sleep
ExitProcess
RaiseException
HeapReAlloc
HeapSize
GetACP
IsValidCodePage
SetHandleCount
GetStdHandle
GetFileType
LCMapStringW
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
HeapCreate
HeapDestroy
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
EnumSystemLocalesA
IsValidLocale
SetStdHandle
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
ReadFile
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
GlobalFree
GlobalUnlock
GlobalAddAtomA
GlobalDeleteAtom
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryExA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
GetModuleHandleA
SetFileTime
FileTimeToSystemTime
GetFileTime
SetFileAttributesA
FormatMessageA
MoveFileExA
CreateDirectoryA
GetTempPathA
GetVolumeInformationA
GetTickCount
MoveFileA
LocalFree
SetLastError
GetFullPathNameA
GetLastError
lstrlenA
MultiByteToWideChar
GetSystemTime
GetStartupInfoA
GetSystemInfo
GetProcessHeap
GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
GlobalMemoryStatus
GetLocalTime
QueryPerformanceCounter
GetCurrentProcess
GetFileAttributesA
GetVersionExA
FlushFileBuffers
WriteFile
SetFilePointer
DeleteFileA
CreateFileA
GetModuleFileNameA
LCMapStringA
LoadLibraryA
GetStringTypeExA
GetUserDefaultLCID
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
FreeLibrary
GetProcAddress
CloseHandle
WaitForSingleObject
CreateThread
VirtualAlloc
InterlockedCompareExchange

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
ShowWindow
RegisterWindowMessageA
LoadIconA
WinHelpA
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetDlgItem
GetTopWindow
DestroyWindow
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
GetWindowTextA
SetWindowTextA
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
IsWindowVisible
GetKeyState
PeekMessageA
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetParent
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageA
PostQuitMessage
SendMessageA
GetOpenClipboardWindow
GetMessageTime
GetMessagePos
GetInputState
GetForegroundWindow
GetFocus
GetClipboardViewer
GetClipboardOwner
GetCapture
GetActiveWindow
GetCaretPos
GetCursorPos
LoadStringA
GetDesktopWindow
MessageBoxA
SetWindowPos

gdi32

GetStockObject
TextOutA
RectVisible
PtVisible
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
CreateBitmap
DeleteObject
GetClipBox
SetMapMode
SetTextColor
ExtTextOutA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SetNamedSecurityInfoA
EncryptFileA
GetNamedSecurityInfoA
DecryptFileA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
OpenProcessToken
SetSecurityInfo
AddAccessAllowedAce
InitializeAcl
GetLengthSid
IsValidSid
GetTokenInformation

shlwapi

PathFindFileNameA
PathFindExtensionA

ole32

CoCreateGuid

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

AddEntry
AddGroup
AttachFileAsBinaryData
BackupEntry
CreateEntry
CreateGroup
DeleteEntry
DeleteGroupById
DeleteManager
Find
FixGroupTree
GetAlgorithm
GetEntry
GetEntryByGroup
GetEntryByGroupN
GetEntryByUuid
GetEntryByUuidN
GetEntryPosInGroup
GetEntryStruct
GetGroup
GetGroupById
GetGroupByIdN
GetGroupId
GetGroupIdByIndex
GetGroupStruct
GetGroupTree
GetKeePassVersion
GetKeePassVersionString
GetKeyEncRounds
GetLastChildGroup
GetLastEditedEntry
GetLibraryBuild
GetNeverExpireTime
GetNumberOfEntries
GetNumberOfGroups
GetNumberOfItemsInGroup
GetNumberOfItemsInGroupN
GetRawMasterKey
InitManager
IsAllowedStoreGroup
IsZeroUUID
LockEntryPassword
MemAllocCopyEntry
MemFreeEntry
MergeIn
MoveEntry
MoveGroup
NewDatabase
OpenDatabase
PE_GetBinaryData
PE_GetBinaryDataLength
PE_GetBinaryDesc
PE_GetCreationTime
PE_GetExpireTime
PE_GetGroupID
PE_GetImageID
PE_GetLastAccessTime
PE_GetLastModTime
PE_GetNotes
PE_GetPasswordPtr
PE_GetTitle
PE_GetURL
PE_GetUUID
PE_GetUserName
PE_SetBinaryData
PE_SetBinaryDesc
PE_SetCreationTime
PE_SetExpireTime
PE_SetGroupID
PE_SetImageID
PE_SetLastAccessTime
PE_SetLastModTime
PE_SetNotes
PE_SetPasswordAndLock
PE_SetTitle
PE_SetURL
PE_SetUUID
PE_SetUserName
PG_GetCreationTime
PG_GetExpireTime
PG_GetID
PG_GetImageID
PG_GetLastAccessTime
PG_GetLastModTime
PG_GetLevel
PG_GetName
PG_SetCreationTime
PG_SetExpireTime
PG_SetID
PG_SetImageID
PG_SetLastAccessTime
PG_SetLastModTime
PG_SetLevel
PG_SetName
ProtectProcessWithDacl
PwTimeToTime
RemoveBinaryData
SaveBinaryData
SaveDatabase
SetAlgorithm
SetEntry
SetGroup
SetKeyEncRounds
SetMasterKey
SetRawMasterKey
SortGroup
SortGroupList
SubstEntryGroupIds
TimeToPwTime
TransformKey256
TransformKeyBenchmark256
UnlockEntryPassword
argon2_ctx
argon2_encodedlen
argon2_error_message
argon2_hash
argon2_type2string
argon2_verify
argon2_verify_ctx
argon2d_ctx
argon2d_hash_encoded
argon2d_hash_raw
argon2d_verify
argon2d_verify_ctx
argon2i_ctx
argon2i_hash_encoded
argon2i_hash_raw
argon2i_verify
argon2i_verify_ctx
argon2id_ctx
argon2id_hash_encoded
argon2id_hash_raw
argon2id_verify
argon2id_verify_ctx

Sections

.text
Size: 420KB - Virtual size: 419KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KeePassLibC64.dll
.dll windows:5 windows x64

5c19870740512156556bc298057e8d07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

winmm

timeGetTime

kernel32

GetCPInfo
GetOEMCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapFree
HeapAlloc
ExitThread
FlsSetValue
GetCommandLineA
RtlUnwindEx
Sleep
ExitProcess
RaiseException
RtlPcToFileHeader
GetModuleHandleW
HeapSize
HeapQueryInformation
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
GetACP
IsValidCodePage
SetHandleCount
GetStdHandle
GetFileType
LCMapStringW
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
HeapSetInformation
HeapCreate
HeapDestroy
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
EnumSystemLocalesA
IsValidLocale
SetStdHandle
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
ReadFile
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetModuleFileNameW
GlobalFree
GlobalUnlock
GlobalAddAtomA
GlobalDeleteAtom
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryExA
CompareStringA
GlobalLock
lstrcmpA
GlobalAlloc
GetModuleHandleA
SetFileTime
FileTimeToSystemTime
GetFileTime
SetFileAttributesA
FormatMessageA
MoveFileExA
CreateDirectoryA
GetTempPathA
GetVolumeInformationA
GetTickCount
MoveFileA
LocalFree
SetLastError
GetFullPathNameA
GetLastError
lstrlenA
MultiByteToWideChar
GetSystemTime
GetStartupInfoA
GetSystemInfo
GetProcessHeap
GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
GlobalMemoryStatus
GetLocalTime
QueryPerformanceCounter
GetCurrentProcess
GetFileAttributesA
GetVersionExA
FlushFileBuffers
WriteFile
SetFilePointer
DeleteFileA
CreateFileA
GetModuleFileNameA
LCMapStringA
LoadLibraryA
GetStringTypeExA
GetUserDefaultLCID
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
FreeLibrary
GetProcAddress
CloseHandle
WaitForSingleObject
CreateThread
HeapReAlloc

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
ShowWindow
RegisterWindowMessageA
LoadIconA
WinHelpA
GetClassLongA
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
IsWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetWindowLongPtrA
SetWindowLongPtrA
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowPos
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
GetWindowTextA
SetWindowTextA
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
IsWindowVisible
GetKeyState
PeekMessageA
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetParent
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageA
PostQuitMessage
SendMessageA
GetOpenClipboardWindow
GetMessageTime
GetMessagePos
GetInputState
GetForegroundWindow
GetFocus
GetClipboardViewer
GetClipboardOwner
GetCapture
GetActiveWindow
GetCaretPos
GetCursorPos
LoadStringA
GetDesktopWindow
MessageBoxA
SystemParametersInfoA

gdi32

GetStockObject
RectVisible
DeleteDC
PtVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
CreateBitmap
DeleteObject
GetClipBox
SetMapMode
SetTextColor
TextOutA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SetNamedSecurityInfoA
EncryptFileA
GetNamedSecurityInfoA
DecryptFileA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
OpenProcessToken
SetSecurityInfo
AddAccessAllowedAce
InitializeAcl
GetLengthSid
IsValidSid
GetTokenInformation

shlwapi

PathFindFileNameA
PathFindExtensionA

ole32

CoCreateGuid

oleaut32

VariantInit
VariantClear
VariantChangeType

Exports

Exports

AddEntry
AddGroup
AttachFileAsBinaryData
BackupEntry
CreateEntry
CreateGroup
DeleteEntry
DeleteGroupById
DeleteManager
Find
FixGroupTree
GetAlgorithm
GetEntry
GetEntryByGroup
GetEntryByGroupN
GetEntryByUuid
GetEntryByUuidN
GetEntryPosInGroup
GetEntryStruct
GetGroup
GetGroupById
GetGroupByIdN
GetGroupId
GetGroupIdByIndex
GetGroupStruct
GetGroupTree
GetKeePassVersion
GetKeePassVersionString
GetKeyEncRounds
GetLastChildGroup
GetLastEditedEntry
GetLibraryBuild
GetNeverExpireTime
GetNumberOfEntries
GetNumberOfGroups
GetNumberOfItemsInGroup
GetNumberOfItemsInGroupN
GetRawMasterKey
InitManager
IsAllowedStoreGroup
IsZeroUUID
LockEntryPassword
MemAllocCopyEntry
MemFreeEntry
MergeIn
MoveEntry
MoveGroup
NewDatabase
OpenDatabase
PE_GetBinaryData
PE_GetBinaryDataLength
PE_GetBinaryDesc
PE_GetCreationTime
PE_GetExpireTime
PE_GetGroupID
PE_GetImageID
PE_GetLastAccessTime
PE_GetLastModTime
PE_GetNotes
PE_GetPasswordPtr
PE_GetTitle
PE_GetURL
PE_GetUUID
PE_GetUserName
PE_SetBinaryData
PE_SetBinaryDesc
PE_SetCreationTime
PE_SetExpireTime
PE_SetGroupID
PE_SetImageID
PE_SetLastAccessTime
PE_SetLastModTime
PE_SetNotes
PE_SetPasswordAndLock
PE_SetTitle
PE_SetURL
PE_SetUUID
PE_SetUserName
PG_GetCreationTime
PG_GetExpireTime
PG_GetID
PG_GetImageID
PG_GetLastAccessTime
PG_GetLastModTime
PG_GetLevel
PG_GetName
PG_SetCreationTime
PG_SetExpireTime
PG_SetID
PG_SetImageID
PG_SetLastAccessTime
PG_SetLastModTime
PG_SetLevel
PG_SetName
ProtectProcessWithDacl
PwTimeToTime
RemoveBinaryData
SaveBinaryData
SaveDatabase
SetAlgorithm
SetEntry
SetGroup
SetKeyEncRounds
SetMasterKey
SetRawMasterKey
SortGroup
SortGroupList
SubstEntryGroupIds
TimeToPwTime
TransformKey256
TransformKeyBenchmark256
UnlockEntryPassword
argon2_ctx
argon2_encodedlen
argon2_error_message
argon2_hash
argon2_type2string
argon2_verify
argon2_verify_ctx
argon2d_ctx
argon2d_hash_encoded
argon2d_hash_raw
argon2d_verify
argon2d_verify_ctx
argon2i_ctx
argon2i_hash_encoded
argon2i_hash_raw
argon2i_verify
argon2i_verify_ctx
argon2id_ctx
argon2id_hash_encoded
argon2id_hash_raw
argon2id_verify
argon2id_verify_ctx

Sections

.text
Size: 510KB - Virtual size: 509KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
License.txt
ShInstUtil.exe
.exe windows:5 windows x86

9ad0494984fc3ede58e229096270cf2e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

Sleep
GetVersionExW
GetModuleFileNameW
WaitForSingleObject
FindNextFileW
CloseHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
FindFirstFileW
GetCommandLineW
FindClose
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
LCMapStringW
HeapAlloc
HeapFree
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
VirtualAlloc
HeapReAlloc

user32

MessageBoxW

advapi32

RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW

shell32

ShellExecuteExW

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
XSL/KDBX_Common.xsl
.xml
XSL/KDBX_DetailsFull_HTML.xsl
.xml
XSL/KDBX_DetailsLight_HTML.xsl
.xml
XSL/KDBX_PasswordsOnly_TXT.xsl
.xml
XSL/KDBX_Tabular_HTML.xsl
.xml

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 416KB - Virtual size: 414KB

.rsrc Size: 4KB - Virtual size: 768B

.reloc Size: 4KB - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rsrc Size: 65KB - Virtual size: 65KB

.reloc Size: 512B - Virtual size: 12B

9b3ae4777a424138943a8e4bf259162e

Headers

DLL Characteristics

File Characteristics

Imports

winmm

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 420KB - Virtual size: 419KB

.rdata Size: 82KB - Virtual size: 82KB

.data Size: 12KB - Virtual size: 32KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 40KB - Virtual size: 39KB

5c19870740512156556bc298057e8d07

Headers

DLL Characteristics

File Characteristics

Imports

winmm

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 510KB - Virtual size: 509KB

.rdata Size: 154KB - Virtual size: 153KB

.data Size: 15KB - Virtual size: 44KB

.pdata Size: 35KB - Virtual size: 34KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 12KB - Virtual size: 11KB

9ad0494984fc3ede58e229096270cf2e

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

version

kernel32

user32

advapi32

.text
Size: 416KB - Virtual size: 414KB

.rsrc
Size: 4KB - Virtual size: 768B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 3.1MB - Virtual size: 3.1MB

.rsrc
Size: 65KB - Virtual size: 65KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 420KB - Virtual size: 419KB

.rdata
Size: 82KB - Virtual size: 82KB

.data
Size: 12KB - Virtual size: 32KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 40KB - Virtual size: 39KB

.text
Size: 510KB - Virtual size: 509KB

.rdata
Size: 154KB - Virtual size: 153KB

.data
Size: 15KB - Virtual size: 44KB

.pdata
Size: 35KB - Virtual size: 34KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB