c:\Projects\My\Lib\IconExtractor\IconExtractor\obj\Release\IconExtractor.pdb
Overview
overview
7Static
static
3Poenix Key...or.dll
windows7-x64
1Poenix Key...or.dll
windows10-2004-x64
1Poenix Key...gn.dll
windows7-x64
1Poenix Key...gn.dll
windows10-2004-x64
1Poenix Key...ts.dll
windows7-x64
1Poenix Key...ts.dll
windows10-2004-x64
1Poenix Key...rk.dll
windows7-x64
1Poenix Key...rk.dll
windows10-2004-x64
1Poenix Key...UI.dll
windows7-x64
1Poenix Key...UI.dll
windows10-2004-x64
1Poenix Key...re.dll
windows7-x64
1Poenix Key...re.dll
windows10-2004-x64
1Poenix Key...ct.dll
windows7-x64
1Poenix Key...ct.dll
windows10-2004-x64
1Poenix Key...ib.dll
windows7-x64
1Poenix Key...ib.dll
windows10-2004-x64
1Poenix Key..._p.exe
windows7-x64
5Poenix Key..._p.exe
windows10-2004-x64
7Static task
static1
Behavioral task
behavioral1
Sample
Poenix Keylogger AIO/IconExtractor.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Poenix Keylogger AIO/IconExtractor.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
Poenix Keylogger AIO/MetroFramework.Design.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Poenix Keylogger AIO/MetroFramework.Design.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
Poenix Keylogger AIO/MetroFramework.Fonts.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Poenix Keylogger AIO/MetroFramework.Fonts.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
Poenix Keylogger AIO/MetroFramework.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Poenix Keylogger AIO/MetroFramework.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
Poenix Keylogger AIO/MetroSet UI.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
Poenix Keylogger AIO/MetroSet UI.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Poenix Keylogger AIO/PeebCore.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Poenix Keylogger AIO/PeebCore.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Poenix Keylogger AIO/PeebInject.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
Poenix Keylogger AIO/PeebInject.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
Poenix Keylogger AIO/dnlib.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
Poenix Keylogger AIO/dnlib.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
Poenix Keylogger AIO/px__p.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
Poenix Keylogger AIO/px__p.exe
Resource
win10v2004-20231215-en
General
-
Target
8a661305bc62c4ee76eaef71c9965bdc
-
Size
12.6MB
-
MD5
8a661305bc62c4ee76eaef71c9965bdc
-
SHA1
9f01a1da2af1002b0930a664d0043e5c79e501ac
-
SHA256
df9ecd91b0d24a1d0ad7f75a48d32dfeb9dd2453005c7a42bdf9b49c81a33dd5
-
SHA512
e640034bc615d45c98673460adfadd9ded0f331301364206ac8e66e308da0c4e9ba8ed5f8bf72a7bb0977c158102a04a11d99e08d6c7ef5130ef1496d6c8863c
-
SSDEEP
196608:XyP8g/e62p1vo+zBYcOHx52yF0ev9+9rGdUlufPV4ZCK46qYfgFbaqJH4YafJ27r:ie68hVdXwUiUlunuh46IaqLATEP
Malware Config
Signatures
-
Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/Poenix Keylogger AIO/IconExtractor.dll unpack001/Poenix Keylogger AIO/MetroFramework.Design.dll unpack001/Poenix Keylogger AIO/MetroFramework.Fonts.dll unpack001/Poenix Keylogger AIO/MetroFramework.dll unpack001/Poenix Keylogger AIO/MetroSet UI.dll unpack001/Poenix Keylogger AIO/PeebCore.dll unpack001/Poenix Keylogger AIO/PeebInject.dll unpack001/Poenix Keylogger AIO/dnlib.dll unpack001/Poenix Keylogger AIO/px__p.exe
Files
-
8a661305bc62c4ee76eaef71c9965bdc.zip
-
Poenix Keylogger AIO/IconExtractor.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 832B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Poenix Keylogger AIO/MetroFramework.Design.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
e:\Development\Desktop\Github\winforms-modernui\MetroFramework.Design\obj\Release\MetroFramework.Design.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Poenix Keylogger AIO/MetroFramework.Fonts.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
e:\Development\Desktop\Github\winforms-modernui\MetroFramework.Fonts\obj\Release\MetroFramework.Fonts.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 654KB - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Poenix Keylogger AIO/MetroFramework.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 342KB - Virtual size: 342KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Poenix Keylogger AIO/MetroSet UI.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 438KB - Virtual size: 438KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Poenix Keylogger AIO/PeebCore.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
H:\Obf after md5\PeebPeeb\PeebCore\obj\Debug\PeebCore.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Poenix Keylogger AIO/PeebInject.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\Home\Documents\Visual Studio 2015\Dont Touch\Obf after md5\PeebPeeb\PeebInject\obj\Debug\PeebInject.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Poenix Keylogger AIO/dnlib.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Poenix Keylogger AIO/key.txt
-
Poenix Keylogger AIO/px__p.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
A����G#��1�}�1W������_ː~�N^a(X:�� +_"=t�!L�o�� P���ͷ�lc�NE�>����B�]Z ��F�U�ubܙ <AS�un��hoO���L��Bj�q%�"�ʚ��s �������'�����ꝅ�2+�ҡ��Q���,a:sg,\��e�e��63z��ȡqZ��{<q�Eʉ氶�k��O�5,��"eX��̦p�Fj���<W ��ŠuFC &Xҙh������{�!p�T��X2��&�m�N�af�"�d��-PS��/q[�"� ������'{���5�ݞ�����w��Ҭ��ن��7��v����$e�|����}�i|�ׁ|*��K��n�������������T��8��X+:�����7��Ǫ��\ւ�mq$=x%$�l�-� 3 �.�+�%"�C���GjV�O�O�t6\)�H�͐4 � :چ8[?CIi}گ��)�qNP������S"F���I��v[�l��$��kOG�;��E|l1o���qɄ��B���?�]g��� ���z�B�ߧ�� ~al,�N��|f>�E&�2,�0{����e�ݾ �o*�*SN�� /9����3����G���y�Y�v���}�"��,�Jp���)��q�S��/�$��I�����rʮ@�3 R���'Q�uN��@��DjR~�k9�@�}���H&0�4��}��"����\&o�B_e�8�T�]?`0A�J��6��f˾�cS�BΟZ S���q�8�V-+o�p{(1ǀt�K�t�倫:FOjc��X���[^j`ݨ�JKS���5k�3��Z��?`���J���J�&W�}��:9R���3ٯ�*��;#���+5�>��0&A�e(���Ϣ9��S�8e T������v��o@���{�ښmz��]F{r��{���S[?�G�6�����oa�{Eɒ������xT�p�� ��K a5���!��'�z��c���*�.Ws��}d���b L�DUٜez�{w��Z&7���'�� ��&k�ի���d���$\�c3�W����̿��v�1�-���V�� �Z2�پO�e��TPMɫ��O�)�$��/8ڝ 1��,��r�� ���Ū�8��[?l���U��y�?������,���5��z���`p��BU��1�Ag�RC���N���R�f���&���4�RZ�ka"� %����Js�[Շ���%$�j�6���ȎyaL:�a����4TހZh���-��_���Ki\&*>�0�]c8�����|�9څ�5Ϻn�0�2�d���$U�9ä���� �1��v�٭�>d�H�@���R �i~����S3v�4Ő��L�=�O��<+�=���O8~���m� ��t&%�E��e��Oୖ��P���c � �#���F���xMt������PeQT_�w�j�W'�m�{��y�FK���A��Τ�/�C~��E��Bi]vlΖ��P�X{�%�%�3�Ù�� A��A�j�����2.uL6)�_���h���c���ٹ�Uo�iw&���ké�����M�u�U�� ��������a̋R9i��e�� aY�1�5ł~ ��(H��n���t��0�ں�S/!�9�PEˎ���s���Bx�#�-q���Y�pN_���ب����w��P!�c��^��p�t�E�OaѺN���"��|������F�{�&��Q=�{�2���`�ً�?=�����4�����ί�����[��T�,%,���������m�*�����e���\��%6e\����������@rqZ�e�=�z�!� �S����g�U��k[��V��rC��P�� q�3e�����`�u%_ �L7�G�^Sv���vL�����_�bR�͡�5��L��j3]\��8���^��<����z�ȑE���5���Z���`����8��NM�� $�[������3/Y.ȅ��<xj��G)����ȥ/���p�*սٌ��odZ����/��)CNV�('ǢÅ1 ���>��B��Y)5�ε4m���{c��PKis��r�W�3��Eȑ�����+ll���^�ՓQ�_=��8���)�C�, �gsDއ��h���ݑ�~�k�<�gv7�xb����ؿ�5!ϥs=�g�Z��2Nq���C>P4��'٤�.�ܗ?�7u� ��R-��p��6D{LU-XU�|�"��,���lcis�� m ��B�^�ѝ�M���Q�M�97HT7��T���ԕ������2iu�e������(Mo+K���gK���?#½���Ҡ� (4#�8���B�K�tڐr�����e�����"i<C�T��>P�&"L=ބ��g�9�n�1S&���DZ�~��QU��tި�D��%��� ��0SB%_�,�;�24�}'��H�7aw������>wi5������L�Ρ��o6���*#pb��Ǩ�;���Z��=/�q��8:�<gL�ট" �������� clj��c�rM}H�ޤ�k�'��ucM�ZsN��1eP^Ч�j����HR��I�=���T��+�@�.�<g�,&%]��t�=��'��QƄ�1Ԓh�'�i�|����z��R]˗�l��)J�̐,��K�l��A3I�&��(+�Z(���j;!��J�]bz7Q*96]���v�P�<]G'.A��mʑ��}+�R34����-��"�*�� Co:P�j=3��7[L<������{�G�X�%�bi�]s8-��dU� �W�_-�5P+ڙ�Sj���0_5������<���q�9�R�a���5G�D5J���aҎ�,�M���B��Ҥ�E�'p�c���/+m/�e�e]�����H��D�ޕ�/A܀,ȷ��Nw"m]��:ef�����d��;�'�U�ѮM�+]���ШiJS�(f]�@ھ���ǁ��I����t�w�G���J�oxya&$R�tL��9ѓs��s��qx����/)q�p^9+����s����.��ў����{@8�b��+�K���@�,RCƳ�����yy�UbS��� �1�bZ������L�%�ߧ��f���16>5�i!3�CI?>�M�����N,"@���$B9"����Or����ȢiǢ�>���x�>�/(,n&��,��r�� ��`/1Z!p/�b�P,Ґ��[�6�v�8b��z��V��J�l7��Яx �����涁��-K�.}�K��P �{�{LJ�;��{�Y-�a,��V �~�"y~��"�TJd��=������N0����O���E�!HS�%�K;$������fz�7楌N���h�|��P���h�Z7ʢV|FdқO�ALΫ�z!����"�W;��{���/m!Jr�ȓ.��n9�)�Eͪɛ2� OjG�_�_���xmۼ#�/�#�|�b{T�ś�Gݝ�c3��� �=�㩎���ei.�]������A��o}h�v^lH0�A m����W�eg��`Ӂ� Ƹ����RRm>d9����tmLL��Ў6�9r�؛�Io����q7��Fr�
Sections
.xcode Size: 6.2MB - Virtual size: 10.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.srdata Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata Size: 234KB - Virtual size: 408KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sdata Size: 42KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sbss Size: 1.8MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE