Selfishnet win 7[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Selfishnet win 7.zip
Size

380KB
MD5

b08da9c3e5f779f0ae510de613174b1e
SHA1

a7c95b0304455f3407a08cb54e09fe354c6ae0fb
SHA256

d59f4670e4ba66dde536a26a2f3541dab3c1e2a3b018c622d71cc80ee8660527
SHA512

2edf1631b7351fad898667eab8265daef5674c790935822d44aca77cbaadf72a6b01378f3407b2d34e5903ca463fc7e0a3634a9726a2b3e9651e01ce609f2020
SSDEEP

6144:enk1tLCbz3MUXidASm/3PXjsMtMsjH0hJqXgfuIdaNzLO42VhiCbCuS3F9FV9YsC:z/o4siCS+7ftPFQGIdf4mhiC+uqV7YW+

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Selfishnet win 7/DataGridViewNumericUpDownElements.dll
unpack001/Selfishnet win 7/ExpandableGridView.dll
unpack001/Selfishnet win 7/Packet.dll
unpack001/Selfishnet win 7/PcapNet.dll
unpack001/Selfishnet win 7/SelfishNetv0.2-beta_vista.exe
unpack001/Selfishnet win 7/WanPacket.dll
unpack001/Selfishnet win 7/npptools.dll

Files

Selfishnet win 7.zip
.zip
Selfishnet win 7/DataGridViewNumericUpDownElements.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\projects\DataGridViewNumericUpDown\DataGridViewNumericUpDownElements\obj\Release\DataGridViewNumericUpDownElements.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Selfishnet win 7/ExpandableGridView.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\projects\treev\TreeGridView\obj\Release\ExpandableGridView.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Selfishnet win 7/HlpIndex.html
.html
Selfishnet win 7/LicenseYouAccepted.txt
Selfishnet win 7/Packet.dll
.dll windows:4 windows x86 arch:x86

90fd35a7252a25453f6570ea94de755c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

g:\projects\winpcap\packetNtx\Dll\Project\Release_No_AirPcap\Packet.pdb

Imports

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegEnumKeyW
CloseServiceHandle
CreateServiceA
OpenSCManagerW
ControlService
OpenServiceA
StartServiceW
QueryServiceStatus
RegOpenKeyExA

ws2_32

inet_addr

wanpacket

WanPacketGetReadEvent
WanPacketGetStats
WanPacketOpenAdapter
WanPacketSetBufferSize
WanPacketSetReadTimeout
WanPacketSetBpfFilter
WanPacketSetMinToCopy
WanPacketReceivePacket
WanPacketCloseAdapter
WanPacketTestAdapter
WanPacketSetMode

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

FlushFileBuffers
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
ReleaseMutex
WaitForSingleObject
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetLastError
DeviceIoControl
CreateEventW
SetLastError
SetEvent
ReadFile
WriteFile
QueryPerformanceFrequency
QueryPerformanceCounter
GetFullPathNameW
CreateFileA
GetVersion
GetModuleFileNameW
CreateMutexW
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
InitializeCriticalSection
RtlUnwind
LoadLibraryA
SetStdHandle

Exports

Exports

PacketAllocatePacket
PacketCloseAdapter
PacketFreePacket
PacketGetAdapterNames
PacketGetAirPcapHandle
PacketGetDriverVersion
PacketGetNetInfoEx
PacketGetNetType
PacketGetReadEvent
PacketGetStats
PacketGetStatsEx
PacketGetVersion
PacketInitPacket
PacketIsDumpEnded
PacketLibraryVersion
PacketOpenAdapter
PacketReceivePacket
PacketRequest
PacketSendPacket
PacketSendPackets
PacketSetBpf
PacketSetBuff
PacketSetDumpLimits
PacketSetDumpName
PacketSetHwFilter
PacketSetLoopbackBehavior
PacketSetMinToCopy
PacketSetMode
PacketSetNumWrites
PacketSetReadTimeout
PacketSetSnapLen
PacketStopDriver

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Selfishnet win 7/PcapNet.dll
.dll windows:4 windows x86 arch:x86

7feb5cbd437eba7e204d887a3ca0c64a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr80

_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
atoi
_amsg_exit
isspace
getc
clearerr
realloc
exit
rewind
isxdigit
islower
fopen
fread
ferror
fwrite
sscanf
_setjmp3
strncpy
_vsnprintf
longjmp
strcat_s
sprintf_s
strtoul
strncpy_s
calloc
strcpy_s
memcpy
_errno
memset
malloc
_initterm_e
_initterm
_decode_pointer
free
_encoded_null
_malloc_crt
abort
_encode_pointer
??2@YAPAXI@Z
??3@YAXPAX@Z
_cexit
__FrameUnwindFilter
fprintf
__iob_func
_snprintf
strchr
strerror
isdigit

kernel32

CreateFileA
GetLastError
FormatMessageA
GetProcAddress
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
IsDebuggerPresent
InterlockedExchange
Sleep
InterlockedCompareExchange
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

advapi32

CreateServiceA
CloseServiceHandle
OpenServiceA
DeleteService
StartServiceA
ControlService
OpenSCManagerA

user32

wsprintfA

packet

PacketCloseAdapter
PacketAllocatePacket
PacketInitPacket
PacketSendPacket
PacketSetBpf
PacketReceivePacket
PacketGetStats
PacketGetAdapterNames
PacketGetNetInfoEx
PacketSetReadTimeout
PacketSetBuff
PacketSetMinToCopy
PacketSetHwFilter
PacketOpenAdapter
PacketGetNetType
PacketFreePacket

ws2_32

WSAStartup
ntohl
ntohs
getservbyport
gethostbyaddr
WSASetLastError
getservbyname
htonl
inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
getprotobyname
htons

msvcm80

?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z

mscoree

_CorDllMain

Sections

.text
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Selfishnet win 7/Readme.txt
Selfishnet win 7/SelfishNetv0.2-beta_vista.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\projects\SelfishNetPro\release\SelfishNet1.0.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 208KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Selfishnet win 7/WanPacket.dll
.dll windows:4 windows x86 arch:x86

341c687b15f95a4eabc71259b0cebfa3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\winpcap\packetNtx\Dll\WanPacket\Release\WanPacket.pdb

Imports

npptools

CreateNPPInterface
GetNPPBlobTable
SetBoolInBlob
CreateBlob
DestroyBlob

kernel32

InterlockedDecrement
LCMapStringW
LCMapStringA
GlobalAlloc
GlobalFree
GetSystemTimeAsFileTime
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
ResetEvent
SetEvent
LoadLibraryA
DeleteCriticalSection
CloseHandle
CreateEventA
InitializeCriticalSection
Sleep
OutputDebugStringA
WaitForSingleObject
GetStringTypeW
GetStringTypeA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
WriteFile
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA

ole32

CoInitializeEx
CoInitialize
CoUninitialize

Exports

Exports

WanPacketCloseAdapter
WanPacketGetReadEvent
WanPacketGetStats
WanPacketOpenAdapter
WanPacketReceivePacket
WanPacketSetBpfFilter
WanPacketSetBufferSize
WanPacketSetMinToCopy
WanPacketSetMode
WanPacketSetReadTimeout
WanPacketTestAdapter

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Selfishnet win 7/npf.sys
.sys windows:5 windows x86 arch:x86

723e743d2416e2507ad5c140e06135d5

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:7c:31:88:a9:65:10:fb:5c:59:d8:41:d5:5b:b3:ab
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

19/05/2006, 00:00

Not After

19/05/2007, 23:59

Subject

CN=CACE TECHNOLOGIES\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CACE TECHNOLOGIES\, LLC,L=Davis,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:d7:f4:ec:16:70:14:64:8b:9a:2c:18:22:46:7e:44:d5:40:f6:72
Signer

Actual PE Digest

41:d7:f4:ec:16:70:14:64:8b:9a:2c:18:22:46:7e:44:d5:40:f6:72

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\cvsroot\release_winpcap_4_0_0_755\winpcap\packetntx\driver\bin\2k\i386\npf.pdb

Imports

ntoskrnl.exe

InterlockedCompareExchange
ObReferenceObjectByHandle
ExEventObjectType
_allmul
PsGetVersion
KeQuerySystemTime
_allrem
_alldiv
KeWaitForSingleObject
KeInitializeEvent
_aullrem
_aulldiv
ZwSetInformationThread
InterlockedDecrement
KeSetEvent
InterlockedIncrement
KeInitializeSpinLock
InterlockedExchangeAdd
MmMapLockedPagesSpecifyCache
ObfDereferenceObject
KefReleaseSpinLockFromDpcLevel
IoFreeMdl
MmBuildMdlForNonPagedPool
IoAllocateMdl
KefAcquireSpinLockAtDpcLevel
KeTickCount
KeBugCheckEx
KeResetEvent
ExfInterlockedInsertTailList
IofCompleteRequest
ExfInterlockedRemoveHeadList
IoDeleteSymbolicLink
IoDeleteDevice
RtlCompareMemory
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
IoCreateDevice
IoCreateSymbolicLink
ZwOpenKey
ZwEnumerateKey
RtlInitUnicodeString
ZwQueryValueKey
ZwClose
ExAllocatePoolWithTag
RtlQueryRegistryValues
RtlWriteRegistryValue
KeClearEvent
ExFreePool

hal

KfReleaseSpinLock
KeQueryPerformanceCounter
KfLowerIrql
KfRaiseIrql
KfAcquireSpinLock

ndis.sys

NdisInitializeEvent
NdisCloseAdapter
NdisSystemProcessorCount
NdisFreePacketPool
NdisResetEvent
NdisWaitEvent
NdisSetEvent
NdisDeregisterProtocol
NdisOpenAdapter
NdisAllocatePacketPool
NdisFreePacket
NdisAllocatePacket
NdisRegisterProtocol
NdisUnchainBufferAtFront

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Selfishnet win 7/npptools.dll
.dll windows:5 windows x86 arch:x86

b2838cc8b03c449fc08d9ea6b5c9e096

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileMappingW
HeapReAlloc
GlobalSize
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
HeapSize
FreeLibrary
GetWindowsDirectoryW
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
MapViewOfFile
GetSystemDirectoryA
LoadLibraryA
FindClose
FindNextFileA
FindFirstFileA
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetFileSize
UnmapViewOfFile
CreateFileA
WriteFile
CloseHandle
GetLastError
WaitForSingleObject
ReleaseMutex
GetProcessHeap
HeapAlloc
Sleep
CreateMutexW
HeapFree
GetModuleFileNameA
GetCurrentProcessId

mfc42u

ord825
ord823

msvcrt

memmove
strncmp
strncpy
_strnicmp
strpbrk
_stricmp
strtol
wcslen
sprintf
_except_handler3
malloc
_adjust_fdiv
_initterm
free
strrchr
wcsncpy
wcschr
strtoul
wcscat
wcscpy
wcscmp
sscanf
__CxxFrameHandler
_ltoa

advapi32

RegSetValueExA
RegCreateKeyExA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegSetValueExW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegCloseKey

ole32

CoCreateInstance

user32

GetFocus
EndDialog
GetWindowLongW
GetDlgItem
GetWindowRect
SendMessageW
LoadStringW
wsprintfA
DialogBoxParamW
LoadStringA
wsprintfW
SetWindowLongW
UpdateWindow

Exports

Exports

ClearEventData
ConvertHexStringToWString
ConvertWStringToHexString
CreateBlob
CreateNPPInterface
DestroyBlob
DuplicateBlob
FilterNPPBlob
FindOneOf
FindUnknownBlobCategories
FindUnknownBlobTags
GetBoolFromBlob
GetClassIDFromBlob
GetDwordFromBlob
GetMacAddressFromBlob
GetNPPAddress2FilterFromBlob
GetNPPAddressFilterFromBlob
GetNPPBlobFromUI
GetNPPBlobTable
GetNPPEtypeSapFilter
GetNPPMacTypeAsNumber
GetNPPPatternFilterFromBlob
GetNPPTriggerFromBlob
GetNetworkInfoFromBlob
GetStringFromBlob
GetStringsFromBlob
GetWStringFromBlob
IsRemoteNPP
LockBlob
MarshalBlob
MergeBlob
NmAddUsedEntry
NmHeapAllocate
NmHeapFree
NmHeapReallocate
NmHeapSetMaxSize
NmHeapSize
NmRemoveUsedEntry
RaiseNMEvent
ReadBlobFromFile
RegCreateBlobKey
RegOpenBlobKey
ReleaseEventSystem
RemoveFromBlob
SelectNPPBlobFromTable
SendEvent
SetBoolInBlob
SetClassIDInBlob
SetDwordInBlob
SetMacAddressInBlob
SetNPPAddress2FilterInBlob
SetNPPAddressFilterInBlob
SetNPPEtypeSapFilter
SetNPPPatternFilterInBlob
SetNPPTriggerInBlob
SetNetworkInfoInBlob
SetStringInBlob
SetWStringInBlob
SubkeyExists
UnMarshalBlob
UnlockBlob
WriteBlobToFile
WriteCrackedBlobToFile
recursiveDeleteKey
setKeyAndValue

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

FINDSHAR
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Selfishnet win 7/release_notes.txt

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 20KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 28KB - Virtual size: 25KB

.rsrc Size: 4KB - Virtual size: 928B

.reloc Size: 4KB - Virtual size: 12B

90fd35a7252a25453f6570ea94de755c

Headers

File Characteristics

PDB Paths

Imports

advapi32

ws2_32

wanpacket

iphlpapi

version

kernel32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 50KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 4KB

7feb5cbd437eba7e204d887a3ca0c64a

Headers

File Characteristics

Imports

msvcr80

kernel32

advapi32

user32

packet

ws2_32

msvcm80

mscoree

Sections

.text Size: 68KB - Virtual size: 65KB

.rdata Size: 76KB - Virtual size: 73KB

.data Size: 4KB - Virtual size: 33KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 5KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 208KB - Virtual size: 204KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 12B

341c687b15f95a4eabc71259b0cebfa3

Headers

File Characteristics

PDB Paths

.text
Size: 20KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 28KB - Virtual size: 25KB

.rsrc
Size: 4KB - Virtual size: 928B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 52KB - Virtual size: 50KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 4KB

.text
Size: 68KB - Virtual size: 65KB

.rdata
Size: 76KB - Virtual size: 73KB

.data
Size: 4KB - Virtual size: 33KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 5KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 208KB - Virtual size: 204KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 40KB - Virtual size: 37KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

62:7c:31:88:a9:65:10:fb:5c:59:d8:41:d5:5b:b3:ab
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

41:d7:f4:ec:16:70:14:64:8b:9a:2c:18:22:46:7e:44:d5:40:f6:72
Signer

.text
Size: 26KB - Virtual size: 26KB

.rdata
Size: 1024B - Virtual size: 946B

.data
Size: 1KB - Virtual size: 1KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 40KB - Virtual size: 39KB

.data
Size: 512B - Virtual size: 480B

FINDSHAR
Size: 512B - Virtual size: 4B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB