Overview
overview
10Static
static
10malware-sa...04.exe
windows7-x64
10malware-sa...04.exe
windows10-2004-x64
10malware-sa...nt.doc
windows7-x64
4malware-sa...nt.doc
windows10-2004-x64
1malware-sa...oc.xls
windows7-x64
10malware-sa...oc.xls
windows10-2004-x64
10malware-sa...l.docm
windows7-x64
10malware-sa...l.docm
windows10-2004-x64
10malware-sa...nt.exe
windows7-x64
3malware-sa...nt.exe
windows10-2004-x64
3malware-sa...on.exe
windows7-x64
1malware-sa...on.exe
windows10-2004-x64
3malware-sa...el.exe
windows7-x64
1malware-sa...el.exe
windows10-2004-x64
1malware-sa...ab.exe
windows7-x64
1malware-sa...ab.exe
windows10-2004-x64
1malware-sa...nt.exe
windows7-x64
1malware-sa...nt.exe
windows10-2004-x64
1malware-sa...nt.exe
windows7-x64
1malware-sa...nt.exe
windows10-2004-x64
1malware-sa...FI.exe
windows7-x64
8malware-sa...FI.exe
windows10-2004-x64
8malware-sa...nt.exe
windows7-x64
7malware-sa...nt.exe
windows10-2004-x64
7malware-sa...LL.dll
windows7-x64
1malware-sa...LL.dll
windows10-2004-x64
1malware-sa...ar.bin
macos-10.15-amd64
1malware-sa...an.exe
windows7-x64
1malware-sa...an.exe
windows10-2004-x64
1malware-sa...64.dll
windows7-x64
8malware-sa...64.dll
windows10-2004-x64
8malware-sa...28.exe
windows7-x64
7Static task
static1
Behavioral task
behavioral1
Sample
malware-sample-library-master/APT28 FancyBear/APT28,NATOPAPER,SOFACY2004.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
malware-sample-library-master/APT28 FancyBear/APT28,NATOPAPER,SOFACY2004.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
malware-sample-library-master/APT28 FancyBear/APT28DecoyDocument.doc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
malware-sample-library-master/APT28 FancyBear/APT28DecoyDocument.doc
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
malware-sample-library-master/APT28 FancyBear/APT28DropperExcelDoc.xls
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
malware-sample-library-master/APT28 FancyBear/APT28DropperExcelDoc.xls
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
malware-sample-library-master/APT28 FancyBear/APT28Hospital.docm
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
malware-sample-library-master/APT28 FancyBear/APT28Hospital.docm
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
malware-sample-library-master/APT28 FancyBear/APT28Implant.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
malware-sample-library-master/APT28 FancyBear/APT28Implant.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
malware-sample-library-master/APT28 FancyBear/APT28wmsApplication.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
malware-sample-library-master/APT28 FancyBear/APT28wmsApplication.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
malware-sample-library-master/APT28 FancyBear/Backdoor.XTunnel.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
malware-sample-library-master/APT28 FancyBear/Backdoor.XTunnel.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
malware-sample-library-master/APT28 FancyBear/FancyBearZekapab.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
malware-sample-library-master/APT28 FancyBear/FancyBearZekapab.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
malware-sample-library-master/APT28 FancyBear/FancyBearZekapabImplant.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
malware-sample-library-master/APT28 FancyBear/FancyBearZekapabImplant.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
malware-sample-library-master/APT28 FancyBear/FancyImplant.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
malware-sample-library-master/APT28 FancyBear/FancyImplant.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxInfo_EFI.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxInfo_EFI.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxSmallAgent.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxSmallAgent.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxSmall_AgentDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxSmall_AgentDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
malware-sample-library-master/APT28 FancyBear/MacOSKomplexFancyBear.bin
Resource
macos-20240214-en
Behavioral task
behavioral28
Sample
malware-sample-library-master/APT28 FancyBear/X-AgentTrojan.exe
Resource
win7-20231129-en
Behavioral task
behavioral29
Sample
malware-sample-library-master/APT28 FancyBear/X-AgentTrojan.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
malware-sample-library-master/APT28 FancyBear/Xagent64.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
malware-sample-library-master/APT28 FancyBear/Xagent64.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
malware-sample-library-master/APT28 FancyBear/ZekaAPT28.exe
Resource
win7-20240221-en
General
-
Target
b4fc5b365d6ccb4dc726a82c8b3f1c39ce16bf848c779706569c938d1a6855a8
-
Size
137.8MB
-
MD5
0ea49cf67d7f137a795d6754c94ed083
-
SHA1
0be02b9e47a31775cc8b3a2d18363346ef0fd053
-
SHA256
b4fc5b365d6ccb4dc726a82c8b3f1c39ce16bf848c779706569c938d1a6855a8
-
SHA512
4034a6c9b2cc682e222eff296109e47d0e6f5b35a3b492b07fdf80fccfaf6a1cebd3b7f21b293947866d5b69c7716e09b595fb4ab086e56f868c5dd28524e50a
-
SSDEEP
3145728:8mi9r/A/MrzSxOsokx8IyfMvNxA0RZmhPcnZW0RlXtdfmhoiT40+6toJlZ4r:8mW/A/uz8dxYq7qJc1zH+2566+
Malware Config
Signatures
-
DiamondFox stealer 3 IoCs
resource yara_rule static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant diamondfox_stealer static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant?id=fm&fchmod=$dir$file diamondfox_stealer static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant?page=filemanager&id=fm&fchmod=$dir$file diamondfox_stealer -
Diamondfox family
-
Nanocore family
-
XMRig Miner payload 1 IoCs
resource yara_rule static1/unpack001/malware-sample-library-master/Coinminers/msxml.exe xmrig -
Xmrig family
-
Office macro that triggers on suspicious action 3 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule static1/unpack001/malware-sample-library-master/APT28 FancyBear/APT28DecoyDocument.doc office_macro_on_action static1/unpack001/malware-sample-library-master/APT28 FancyBear/APT28DropperExcelDoc.xls office_macro_on_action static1/unpack001/malware-sample-library-master/APT34 Iranian/MagicHoundAPT34.doc office_macro_on_action -
Patched UPX-packed file 3 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant patched_upx static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant?id=fm&fchmod=$dir$file patched_upx static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant?page=filemanager&id=fm&fchmod=$dir$file patched_upx -
resource static1/unpack001/malware-sample-library-master/APT28 FancyBear/APT28DropperExcelDoc.xls -
resource yara_rule static1/unpack001/malware-sample-library-master/APT28 FancyBear/ZekaAPT28.bin upx static1/unpack001/malware-sample-library-master/APT29 CozyBear/CozyBearImplant.bin upx static1/unpack001/malware-sample-library-master/APT29 CozyBear/ImplantCozy.bin upx static1/unpack001/malware-sample-library-master/APT29 CozyBear/SeaDaddyImplant (2).bin upx static1/unpack001/malware-sample-library-master/APT29 CozyBear/SeaDaddyImplant.bin upx static1/unpack001/malware-sample-library-master/DarkTequila/DarkTequila.exe upx static1/unpack001/malware-sample-library-master/Ransomeware/DistrictRansomware.bin upx -
resource yara_rule static1/unpack001/malware-sample-library-master/Coinminers/msxml.exe vmprotect -
Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN -
Declares services with permission to bind to the system 1 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE -
Requests dangerous framework permissions 5 IoCs
description ioc Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant autoit_exe static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant?id=fm&fchmod=$dir$file autoit_exe static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant?page=filemanager&id=fm&fchmod=$dir$file autoit_exe static1/unpack001/malware-sample-library-master/Trojans/NanocoreRAT.bin autoit_exe -
Detects Pyinstaller 3 IoCs
resource yara_rule static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant pyinstaller static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant?id=fm&fchmod=$dir$file pyinstaller static1/unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant?page=filemanager&id=fm&fchmod=$dir$file pyinstaller -
Unsigned PE 98 IoCs
Checks for missing Authenticode signature.
resource unpack001/malware-sample-library-master/APT28 FancyBear/APT28,NATOPAPER,SOFACY2004.bin unpack001/malware-sample-library-master/APT28 FancyBear/APT28Implant.bin unpack001/malware-sample-library-master/APT28 FancyBear/APT28wmsApplication.exe unpack001/malware-sample-library-master/APT28 FancyBear/Backdoor.XTunnel.exe unpack001/malware-sample-library-master/APT28 FancyBear/FancyBearZekapab.bin unpack001/malware-sample-library-master/APT28 FancyBear/FancyBearZekapabImplant.bin unpack001/malware-sample-library-master/APT28 FancyBear/FancyImplant.bin unpack001/malware-sample-library-master/APT28 FancyBear/LoJaxInfo_EFI.exe unpack001/malware-sample-library-master/APT28 FancyBear/LoJaxSmallAgent.exe unpack001/malware-sample-library-master/APT28 FancyBear/LoJaxSmall_AgentDLL.exe unpack001/malware-sample-library-master/APT28 FancyBear/X-AgentTrojan.bin unpack001/malware-sample-library-master/APT28 FancyBear/Xagent64.bin unpack001/malware-sample-library-master/APT28 FancyBear/ZekaAPT28.bin unpack001/malware-sample-library-master/APT28 FancyBear/ZekapabImplant.bin unpack001/malware-sample-library-master/APT28 FancyBear/twain_64DLL.dll unpack001/malware-sample-library-master/APT29 CozyBear/CozyBearImplant.bin unpack003/out.upx unpack001/malware-sample-library-master/APT29 CozyBear/ImplantCozy.bin unpack004/out.upx unpack001/malware-sample-library-master/APT29 CozyBear/SeaDaddyImplant (2).bin unpack005/out.upx unpack001/malware-sample-library-master/APT29 CozyBear/SeaDaddyImplant.bin unpack006/out.upx unpack001/malware-sample-library-master/APT37 NK Reaper/Final1stspy,Dropper.bin unpack001/malware-sample-library-master/APTC23/MicropsiaRAT2018.bin unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/CmdManager.exe unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/Player.dll unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/PlayerExe.exe unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/Server.exe unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/VncSharp.dll unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/_plugins/hvnc.plug unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/_plugins/hvnc64.plug unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/_plugins/rdpwrap.dll unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/_plugins/vnc.plug unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/_plugins/vnc64.plug unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/bot.dll unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/bot.exe unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/bot_x64.dll unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/bot_x64.exe unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/botcmd.exe unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/builder.exe unpack001/malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/builder_gui.exe unpack001/malware-sample-library-master/Coinminers/msxml.exe unpack001/malware-sample-library-master/DPRK/BackdoorDLLworm.bin unpack001/malware-sample-library-master/DPRK/BackdoorHiddenCobra.bin unpack001/malware-sample-library-master/DPRK/BackdoorWormSMB2.0.exe unpack001/malware-sample-library-master/DPRK/HiddenCobra.exe unpack001/malware-sample-library-master/DPRK/HiddenCobraJoanap.bin unpack001/malware-sample-library-master/DPRK/MoneroNorthKoreaPyongynag.bin unpack001/malware-sample-library-master/DarkTequila/DarkTequila.exe unpack001/malware-sample-library-master/DragonflyAPT/GreyEnergyImplant2018.bin unpack001/malware-sample-library-master/DustSquad/OctopusDelphi.exe unpack001/malware-sample-library-master/EnergeticBear/BerserkBear Downloader.bin unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant?id=fm&fchmod=$dir$file unpack001/malware-sample-library-master/EnergeticBear/Energetic Bear Implant?page=filemanager&id=fm&fchmod=$dir$file unpack001/malware-sample-library-master/EquationGroup/DoubleFantasyEquation.bin unpack001/malware-sample-library-master/GamaredonGroup/928aa3d3e26e9e285ccaf0b0132b92d2711de3a9f5d58244934854d02a529f70 unpack001/malware-sample-library-master/GamaredonGroup/9fc5081ba3c1a4473ac1ffa3d653096afa16684a3e819ce6745bc22d38bb97f9 unpack001/malware-sample-library-master/GamaredonGroup/GamaredonImplant.bin unpack001/malware-sample-library-master/GamaredonGroup/ff5ce90c78eb4d6c2714bd659fb6fbbb9afc50d03a16d32015ff350d79f6fec4 unpack001/malware-sample-library-master/GandCrab/GandCrabv4.exe unpack001/malware-sample-library-master/GandCrab/GandCrabv5RandomExtension.bin unpack001/malware-sample-library-master/GandCrab/Gandcrab5.0.2.bin unpack001/malware-sample-library-master/GandCrab/Gandcrab5.0.3.exe unpack001/malware-sample-library-master/GandCrab/Gandcrabv5.0.2exe.bin unpack001/malware-sample-library-master/GoziGroup/GoziBankerISFB.exe unpack001/malware-sample-library-master/OlympicDestroyer/OlympicDestroyer.bin unpack001/malware-sample-library-master/OlympicDestroyer/OlympicDestroyerAtos.bin unpack001/malware-sample-library-master/OlympicDestroyer/OlympicSystemStealer.bin unpack001/malware-sample-library-master/OlympicDestroyer/OlympicsSouthKorea.bin unpack001/malware-sample-library-master/Ransomeware/DistrictRansomware.bin unpack001/malware-sample-library-master/Ransomeware/KatyushaRansomware.bin unpack001/malware-sample-library-master/Ransomeware/KeypassRansomware.bin unpack001/malware-sample-library-master/Ransomeware/KrakenCryptor2.0.bin unpack001/malware-sample-library-master/Ransomeware/KryptikRansomware.false unpack001/malware-sample-library-master/Ransomeware/LockCrypt2.0.bin unpack001/malware-sample-library-master/Ransomeware/MatrixRansomware.bin unpack001/malware-sample-library-master/Ransomeware/WannaCry.exe unpack001/malware-sample-library-master/Ransomeware/WannaCry2.exe unpack001/malware-sample-library-master/Ransomeware/WannaCryDLL.bin unpack001/malware-sample-library-master/SLINGSHOT/SlingShot.bin unpack001/malware-sample-library-master/Stuxnet Malware/malware.ex_ unpack001/malware-sample-library-master/Stuxnet Malware/~WTR4132.tmp unpack001/malware-sample-library-master/Trojans/Azorult/AzorultPasswordStealer.bin unpack001/malware-sample-library-master/Trojans/NanocoreRAT.bin unpack001/malware-sample-library-master/Trojans/PasswordStealer.NET.bin unpack001/malware-sample-library-master/Trojans/Trickbotpwgrab.bin unpack001/malware-sample-library-master/Turla/CarbonImplant.bin unpack001/malware-sample-library-master/Turla/KazuarRAT.bin unpack001/malware-sample-library-master/Turla/NCSC.bin unpack001/malware-sample-library-master/Turla/Nautilus Implant.bin unpack001/malware-sample-library-master/Turla/NeuronImplant2018.bin unpack001/malware-sample-library-master/Turla/OutlookBackdoor.bin unpack001/malware-sample-library-master/Turla/OutlookBackdoor2.bin unpack001/malware-sample-library-master/Turla/TurlaAgent.exe unpack001/malware-sample-library-master/Turla/TurlaDropper.bin unpack001/malware-sample-library-master/Turla/TurlaKeylogger.bin
Files
-
b4fc5b365d6ccb4dc726a82c8b3f1c39ce16bf848c779706569c938d1a6855a8.zip
-
malware-sample-library-master/APT28 FancyBear/APT28,NATOPAPER,SOFACY2004.bin.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/APT28DecoyDocument.doc.doc windows office2003
-
malware-sample-library-master/APT28 FancyBear/APT28DropperExcelDoc.xls.xls windows office2003
ThisWorkbook
Hoja1
LinesOfBusiness
-
malware-sample-library-master/APT28 FancyBear/APT28Hospital.doc.docm .doc office2007
ThisDocument
-
malware-sample-library-master/APT28 FancyBear/APT28Implant.bin.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Sections
.text Size: 124KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.CAPE Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
malware-sample-library-master/APT28 FancyBear/APT28wmsApplication.exe.exe windows:5 windows x86 arch:x86
287595010a7d7f2e14aec2068098ad43
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetVolumeInformationW
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
LoadLibraryW
CreateDirectoryW
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
GetComputerNameA
FreeEnvironmentStringsW
GetModuleFileNameA
GetModuleFileNameW
CloseHandle
GetLocaleInfoW
HeapSize
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
GetCPInfo
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
GetProcessHeap
user32
UpdateWindow
CreateWindowExW
ShowWindow
DefWindowProcW
LoadIconW
RegisterClassExW
TranslateMessage
BeginPaint
DispatchMessageW
GetDesktopWindow
EndPaint
SetTimer
GetWindowRect
GetMessageW
PostQuitMessage
KillTimer
LoadCursorW
gdi32
TextOutW
shell32
ShellExecuteW
ws2_32
send
closesocket
socket
recv
WSACleanup
shutdown
htons
inet_addr
WSAStartup
connect
Sections
.text Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/Backdoor.XTunnel.exe.exe windows:5 windows x64 arch:x64
5b6222ff6b0354200f1a2d5ee56097b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetDriveTypeW
FindFirstFileExW
FileTimeToLocalFileTime
SetFilePointer
ReadConsoleW
SetConsoleMode
ReadConsoleInputA
ReadFile
GetTimeZoneInformation
FileTimeToSystemTime
SetEnvironmentVariableA
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
GetLastError
CloseHandle
TerminateThread
GetExitCodeThread
GetSystemTimeAsFileTime
HeapFree
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
HeapAlloc
CreateThread
GetCurrentThreadId
ExitThread
LoadLibraryExW
GetCommandLineA
SetLastError
GetProcessHeap
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetStdHandle
WriteFile
GetModuleFileNameW
FreeLibrary
SetConsoleCtrlHandler
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlPcToFileHeader
RaiseException
HeapSize
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
OutputDebugStringW
LoadLibraryW
HeapReAlloc
CompareStringW
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
SetStdHandle
WriteConsoleW
CreateFileW
GetVersion
FindClose
GlobalMemoryStatus
GetTickCount
GetVersionExW
FlushConsoleInputBuffer
LoadLibraryA
Sleep
ws2_32
shutdown
WSASetLastError
recvfrom
accept
listen
getsockname
bind
WSAStartup
ioctlsocket
connect
ntohs
htons
inet_addr
socket
closesocket
gethostbyname
send
recv
__WSAFDIsSet
WSAGetLastError
select
sendto
wininet
HttpSendRequestW
HttpAddRequestHeadersW
InternetSetOptionW
InternetQueryOptionW
HttpOpenRequestW
InternetOpenW
InternetCloseHandle
InternetConnectA
winhttp
WinHttpGetIEProxyConfigForCurrentUser
user32
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
GetDesktopWindow
advapi32
ReportEventW
DeregisterEventSource
RegisterEventSourceW
Exports
Exports
start
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 203KB - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 267KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/FancyBearZekapab.bin.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 643KB - Virtual size: 642KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 17KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/FancyBearZekapabImplant.bin.exe windows:4 windows x86 arch:x86
7ef9f53480e73a2c0e99aed4090a471b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegFlushKey
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
user32
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
ToUnicodeEx
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongA
SetCapture
SetActiveWindow
SendMessageW
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageW
PeekMessageA
OffsetRect
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
MapWindowPoints
MapVirtualKeyExA
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageW
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessagePos
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassLongA
GetClassInfoA
GetCapture
GetAsyncKeyState
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
SetCurrentDirectoryA
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCurrentDirectoryA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringA
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrlenA
lstrcpyA
WriteFile
WaitForSingleObject
VirtualQuery
VirtualAlloc
VerLanguageNameA
Sleep
SizeofResource
SetThreadLocale
SetFilePointer
SetFileAttributesA
SetEvent
SetErrorMode
SetEndOfFile
SetCurrentDirectoryA
ResumeThread
ResetEvent
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalFindAtomA
GlobalDeleteAtom
GlobalAddAtomA
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadLocale
GetTempPathA
GetSystemTime
GetSystemDirectoryA
GetSystemDefaultLangID
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetComputerNameA
GetCPInfo
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
Sleep
gdi32
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RectVisible
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
mpr
WNetOpenEnumA
WNetEnumResourceA
comctl32
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
wininet
InternetGetConnectedState
shell32
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderPathA
iphlpapi
GetAdaptersInfo
Sections
.text Size: 654KB - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 17KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/FancyImplant.bin.exe windows:4 windows x86 arch:x86
c53ee116b6a5d8c9e2535cea136ac0bf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
user32
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongA
SetCapture
SetActiveWindow
SendMessageW
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageW
PeekMessageA
OffsetRect
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageW
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessagePos
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassLongA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
SetCurrentDirectoryA
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCurrentDirectoryA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringA
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcpyA
WriteFile
WaitForSingleObject
VirtualQuery
VirtualAlloc
Sleep
SizeofResource
SetThreadLocale
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
SetCurrentDirectoryA
ResumeThread
ResetEvent
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalFindAtomA
GlobalDeleteAtom
GlobalAddAtomA
GetVolumeInformationA
GetVersionExA
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadLocale
GetTempPathA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetComputerNameA
GetCPInfo
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindFirstFileA
FindClose
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateProcessA
CreatePipe
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
Sleep
gdi32
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RectVisible
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
comctl32
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
shell32
ShellExecuteA
Sections
.text Size: 582KB - Virtual size: 581KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 17KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/LoJaxInfo_EFI.exe.exe windows:5 windows x86 arch:x86
5dfe98175c81190c8a176e1ce4524726
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
CloseHandle
DeleteFileW
GetFirmwareEnvironmentVariableW
GetTickCount
Sleep
GetProcAddress
GetCurrentDirectoryW
GetLastError
CreateFileW
GetVersionExW
GetSystemWow64DirectoryW
WideCharToMultiByte
GetSystemDirectoryW
WriteFile
GetCurrentProcess
DeviceIoControl
InterlockedDecrement
WriteConsoleW
GetStringTypeW
LCMapStringW
ReadFile
SetEndOfFile
SetFilePointer
MultiByteToWideChar
lstrlenA
LocalFree
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RtlUnwind
EncodePointer
DecodePointer
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
HeapSize
IsProcessorFeaturePresent
FreeLibrary
CreateFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetProcessHeap
VirtualQuery
HeapReAlloc
advapi32
QueryServiceStatusEx
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CloseServiceHandle
ControlService
ole32
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
SysFreeString
VariantClear
SysAllocString
Sections
.text Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 242KB - Virtual size: 249KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/LoJaxKernelDriver.bin.sys windows:6 windows x64 arch:x64
955e7b12a8fa06444c68e54026c45de1
Code Sign
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before21-12-2012 00:00Not After30-12-2020 23:59SubjectCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
04:00:00:00:00:01:2f:4e:e1:35:5cCertificate
IssuerCN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BENot Before13-04-2011 10:00Not After13-04-2019 10:00SubjectCN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
11:21:8f:56:da:fd:75:42:d5:f3:d7:0b:21:3e:2a:54:6c:ffCertificate
IssuerCN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BENot Before31-07-2012 20:41Not After01-08-2013 20:41SubjectCN=ChongKim Chan,C=TWExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate
IssuerCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USNot Before18-10-2012 00:00Not After29-12-2020 23:59SubjectCN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
61:29:15:27:00:00:00:00:00:2aCertificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before15-04-2011 19:55Not After15-04-2021 20:05SubjectCN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BEKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
39:25:7f:b8:6d:f8:88:20:7e:4f:3a:77:68:56:1b:4a:b1:55:78:48Signer
Actual PE Digest39:25:7f:b8:6d:f8:88:20:7e:4f:3a:77:68:56:1b:4a:b1:55:78:48Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
d:\src\rw\rwxe3\rw\driver\objfre_win7_amd64\amd64\RwDrv.pdb
Imports
ntoskrnl.exe
IoDeleteSymbolicLink
ExFreePoolWithTag
IoRegisterPlugPlayNotification
MmFreeContiguousMemorySpecifyCache
RtlInitUnicodeString
IoDeleteDevice
IoFreeWorkItem
KeInitializeEvent
RtlQueryRegistryValues
KeReleaseSpinLock
MmUnmapIoSpace
IoFreeMdl
MmGetPhysicalAddress
IoGetDeviceObjectPointer
IoBuildAsynchronousFsdRequest
ExInterlockedInsertTailList
IoBuildDeviceIoControlRequest
MmMapIoSpace
IoUnregisterPlugPlayNotification
IofCompleteRequest
KeWaitForSingleObject
IoFreeIrp
RtlCompareMemory
MmUnlockPages
IoCreateSymbolicLink
RtlCopyUnicodeString
ObfDereferenceObject
IoCreateDevice
IoQueueWorkItem
MmAllocateContiguousMemorySpecifyCache
IofCallDriver
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
IoAllocateWorkItem
ExAllocatePoolWithTag
hal
KeStallExecutionProcessor
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 764B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/LoJaxSmallAgent.exe.exe windows:4 windows x86 arch:x86
5ca3fccf907dd5d90b504f5066ae19f3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
inet_addr
WSAStartup
WSACleanup
user32
DefWindowProcA
wsprintfA
PostQuitMessage
RegisterClassA
TranslateMessage
GetMessageA
PeekMessageA
PostMessageA
DispatchMessageA
CreateWindowExA
SetTimer
PostThreadMessageA
KillTimer
kernel32
VirtualFreeEx
DeleteCriticalSection
OpenProcess
WriteFile
CloseHandle
RtlUnwind
GetVersion
LocalAlloc
SetFilePointer
CreateProcessA
GetModuleHandleA
GetLastError
LocalFree
ExitThread
SetEvent
ReadFile
TerminateProcess
WaitForSingleObject
WriteProcessMemory
ReadProcessMemory
ResetEvent
LeaveCriticalSection
GetStdHandle
TerminateThread
ExitProcess
InitializeCriticalSection
GetModuleFileNameA
GetProcAddress
WaitForMultipleObjects
CreateRemoteThread
lstrlenA
CreateEventA
GetExitCodeThread
CreateThread
lstrcmpiA
EnterCriticalSection
GetCurrentProcessId
CreateFileA
SetThreadPriority
ResumeThread
lstrcpyA
GetOverlappedResult
FreeLibrary
RaiseException
GetCurrentThreadId
lstrcatA
GetEnvironmentVariableA
SetStdHandle
VirtualAllocEx
Sleep
CopyFileA
LoadLibraryA
advapi32
RegQueryValueExA
RegEnumValueA
RegOpenKeyA
RegDeleteValueA
SetServiceStatus
OpenProcessToken
RegOpenKeyExA
StartServiceCtrlDispatcherA
SetTokenInformation
RegCloseKey
RegisterServiceCtrlHandlerA
DuplicateTokenEx
CreateProcessAsUserA
Exports
Exports
rpcnetp
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 356B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cdata Size: 1024B - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/LoJaxSmall_AgentDLL.exe.dll windows:4 windows x86 arch:x86
5ca3fccf907dd5d90b504f5066ae19f3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wsock32
inet_addr
WSAStartup
WSACleanup
user32
DefWindowProcA
wsprintfA
PostQuitMessage
RegisterClassA
TranslateMessage
GetMessageA
PeekMessageA
PostMessageA
DispatchMessageA
CreateWindowExA
SetTimer
PostThreadMessageA
KillTimer
kernel32
VirtualFreeEx
DeleteCriticalSection
OpenProcess
WriteFile
CloseHandle
RtlUnwind
GetVersion
LocalAlloc
SetFilePointer
CreateProcessA
GetModuleHandleA
GetLastError
LocalFree
ExitThread
SetEvent
ReadFile
TerminateProcess
WaitForSingleObject
WriteProcessMemory
ReadProcessMemory
ResetEvent
LeaveCriticalSection
GetStdHandle
TerminateThread
ExitProcess
InitializeCriticalSection
GetModuleFileNameA
GetProcAddress
WaitForMultipleObjects
CreateRemoteThread
lstrlenA
CreateEventA
GetExitCodeThread
CreateThread
lstrcmpiA
EnterCriticalSection
GetCurrentProcessId
CreateFileA
SetThreadPriority
ResumeThread
lstrcpyA
GetOverlappedResult
FreeLibrary
RaiseException
GetCurrentThreadId
lstrcatA
GetEnvironmentVariableA
SetStdHandle
VirtualAllocEx
Sleep
CopyFileA
LoadLibraryA
advapi32
RegQueryValueExA
RegEnumValueA
RegOpenKeyA
RegDeleteValueA
SetServiceStatus
OpenProcessToken
RegOpenKeyExA
StartServiceCtrlDispatcherA
SetTokenInformation
RegCloseKey
RegisterServiceCtrlHandlerA
DuplicateTokenEx
CreateProcessAsUserA
Exports
Exports
rpcnetp
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 356B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cdata Size: 1024B - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/MacOSKomplexFancyBear.bin.macho macos arch:x64
-
malware-sample-library-master/APT28 FancyBear/X-AgentTrojan.bin.exe windows:5 windows x64 arch:x64
78c667b78f868dad50baa7626307cf74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetTickCount
HeapReAlloc
ReadFile
GetFileSize
CreateFileW
WriteFile
VirtualProtect
CreateProcessW
GetModuleFileNameW
GetProcAddress
LoadLibraryA
HeapFree
GetFileAttributesW
GetModuleHandleA
ExpandEnvironmentStringsW
UnmapViewOfFile
MapViewOfFile
SetFilePointer
CreateFileMappingW
GetLastError
IsBadReadPtr
FreeLibrary
GetProcessHeap
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
GetExitCodeThread
CreateThread
TerminateThread
CloseHandle
WriteConsoleW
SetStdHandle
DeleteFileW
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
DecodePointer
EncodePointer
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
LoadLibraryW
ExitThread
GetCurrentThreadId
GetCommandLineA
GetStartupInfoW
GetStdHandle
HeapSetInformation
GetVersion
HeapCreate
FlsGetValue
FlsSetValue
FlsFree
SetLastError
FlsAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapSize
GetModuleHandleW
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
LCMapStringW
FlushFileBuffers
advapi32
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
ws2_32
WSAStartup
WSACleanup
iphlpapi
GetAdaptersAddresses
Sections
.text Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 80KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/Xagent64.bin.dll windows:5 windows x64 arch:x64
e11ff4cef00d69de4a2397f269573ce4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
VirtualFree
VirtualAlloc
TerminateProcess
GetExitCodeProcess
ExitThread
PeekNamedPipe
CreateProcessW
DuplicateHandle
GetCurrentProcess
DisconnectNamedPipe
WaitForMultipleObjects
CreatePipe
GetSystemDirectoryW
GetFileSize
FindClose
FindNextFileW
DeleteFileW
SystemTimeToTzSpecificLocalTime
FindFirstFileW
CreateFileW
GetComputerNameW
GetVolumeInformationW
OpenMutexW
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
MultiByteToWideChar
HeapReAlloc
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThreadId
WriteFile
OpenProcess
GetLastError
GetTickCount
GetMailslotInfo
CreateMailslotW
ReadFile
CreateMutexW
GetEnvironmentVariableW
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
ReleaseMutex
WaitForSingleObject
GetExitCodeThread
CreateThread
TerminateThread
CloseHandle
SetFilePointer
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
ExitProcess
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlsAlloc
SetLastError
FlsFree
FlsGetValue
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
GetModuleFileNameW
GetStdHandle
GetCommandLineA
FlsSetValue
LoadLibraryW
FreeLibrary
HeapAlloc
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RaiseException
HeapFree
EncodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
DecodePointer
user32
SendMessageTimeoutW
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowThreadProcessId
wsprintfW
ReleaseDC
AttachThreadInput
GetKeyboardState
EnumDisplayMonitors
GetDC
GetWindowDC
GetWindowRect
GetForegroundWindow
WindowFromPoint
GetCursorPos
MapVirtualKeyExW
gdi32
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
advapi32
RegCreateKeyExW
RegEnumKeyExW
GetUserNameW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
shell32
ShellExecuteW
ole32
StringFromCLSID
CreateStreamOnHGlobal
ws2_32
WSAGetLastError
WSAStartup
WSACleanup
shlwapi
PathFindFileNameW
PathFileExistsW
SHDeleteKeyW
gdiplus
GdiplusStartup
GdipFree
GdipAlloc
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCloneImage
GdiplusShutdown
psapi
GetProcessImageFileNameW
urlmon
ObtainUserAgentString
wininet
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetReadFile
InternetQueryDataAvailable
HttpAddRequestHeadersW
HttpSendRequestExW
InternetSetOptionW
InternetQueryOptionW
HttpOpenRequestA
HttpSendRequestW
HttpQueryInfoW
Exports
Exports
init
Sections
.text Size: 183KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/ZekaAPT28.bin.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 436KB - Virtual size: 436KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 375KB - Virtual size: 376KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
malware-sample-library-master/APT28 FancyBear/ZekapabImplant.bin.exe windows:4 windows x86 arch:x86
6623f8333a95beb5e936b6b1545b95e7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
user32
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WaitMessage
ValidateRect
UpdateWindow
UnregisterClassA
UnionRect
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetKeyboardState
SetForegroundWindow
SetFocus
SetCursor
SetClipboardData
SetClassLongA
SetCaretPos
SetCapture
SetActiveWindow
SendMessageW
SendMessageA
ScrollWindowEx
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageW
PeekMessageA
OpenClipboard
OffsetRect
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
MessageBeep
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageW
IsDialogMessageA
IsChild
IsCharAlphaNumericA
IsCharAlphaA
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessageTime
GetMessagePos
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDoubleClickTime
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassLongA
GetClassInfoA
GetCaretPos
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumClipboardFormats
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DestroyCaret
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
CreateCaret
CloseClipboard
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
SetCurrentDirectoryA
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCurrentDirectoryA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringA
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcpyA
WriteFile
WaitForSingleObject
VirtualQuery
VirtualAlloc
Sleep
SizeofResource
SetThreadLocale
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
SetCurrentDirectoryA
ResumeThread
ResetEvent
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalFindAtomA
GlobalDeleteAtom
GlobalAddAtomA
GetVolumeInformationA
GetVersionExA
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadLocale
GetTempPathA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetComputerNameA
GetCPInfo
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindFirstFileA
FindClose
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateProcessA
CreatePipe
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
Sleep
MulDiv
gdi32
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWindowExtEx
SetWinMetaFileBits
SetViewportOrgEx
SetViewportExtEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetMapMode
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
PolyPolyline
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
ExtCreatePen
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
comctl32
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls
shell32
Shell_NotifyIconA
ShellExecuteA
Sections
.text Size: 657KB - Virtual size: 656KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 17KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT28 FancyBear/twain_64DLL.dll.dll windows:5 windows x64 arch:x64
e11ff4cef00d69de4a2397f269573ce4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
VirtualFree
VirtualAlloc
TerminateProcess
GetExitCodeProcess
ExitThread
PeekNamedPipe
CreateProcessW
DuplicateHandle
GetCurrentProcess
DisconnectNamedPipe
WaitForMultipleObjects
CreatePipe
GetSystemDirectoryW
GetFileSize
FindClose
FindNextFileW
DeleteFileW
SystemTimeToTzSpecificLocalTime
FindFirstFileW
CreateFileW
GetComputerNameW
GetVolumeInformationW
OpenMutexW
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
MultiByteToWideChar
HeapReAlloc
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThreadId
WriteFile
OpenProcess
GetLastError
GetTickCount
GetMailslotInfo
CreateMailslotW
ReadFile
CreateMutexW
GetEnvironmentVariableW
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
ReleaseMutex
WaitForSingleObject
GetExitCodeThread
CreateThread
TerminateThread
CloseHandle
SetFilePointer
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
ExitProcess
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlsAlloc
SetLastError
FlsFree
FlsGetValue
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
GetModuleFileNameW
GetStdHandle
GetCommandLineA
FlsSetValue
LoadLibraryW
FreeLibrary
HeapAlloc
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RaiseException
HeapFree
EncodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
DecodePointer
user32
SendMessageTimeoutW
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowThreadProcessId
wsprintfW
ReleaseDC
AttachThreadInput
GetKeyboardState
EnumDisplayMonitors
GetDC
GetWindowDC
GetWindowRect
GetForegroundWindow
WindowFromPoint
GetCursorPos
MapVirtualKeyExW
gdi32
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
advapi32
RegCreateKeyExW
RegEnumKeyExW
GetUserNameW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
shell32
ShellExecuteW
ole32
StringFromCLSID
CreateStreamOnHGlobal
ws2_32
WSAGetLastError
WSAStartup
WSACleanup
shlwapi
PathFindFileNameW
PathFileExistsW
SHDeleteKeyW
gdiplus
GdiplusStartup
GdipFree
GdipAlloc
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCloneImage
GdiplusShutdown
psapi
GetProcessImageFileNameW
urlmon
ObtainUserAgentString
wininet
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetReadFile
InternetQueryDataAvailable
HttpAddRequestHeadersW
HttpSendRequestExW
InternetSetOptionW
InternetQueryOptionW
HttpOpenRequestA
HttpSendRequestW
HttpQueryInfoW
Exports
Exports
init
Sections
.text Size: 183KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT29 CozyBear/CozyBearImplant.bin.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT29 CozyBear/ImplantCozy.bin.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT29 CozyBear/SeaDaddyImplant (2).bin.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT29 CozyBear/SeaDaddyImplant.bin.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT29 CozyBear/TrojanCozyBear.bin.exe windows:5 windows x86 arch:x86
2695b09a1edda655e0df4b2ef196f37a
Code Sign
74:65:f7:35:98:f3:ec:9d:44:ae:2b:54:17:4c:be:4fCertificate
IssuerCN=Advanced Micro Devices\, Inc.Not Before02-07-2014 21:13Not After31-12-2039 23:59SubjectCN=Advanced Micro Devices\, Inc.1b:14:7f:b0:a2:17:d8:5d:dc:2c:c7:2c:d4:7e:9c:0b:83:0a:1c:58Signer
Actual PE Digest1b:14:7f:b0:a2:17:d8:5d:dc:2c:c7:2c:d4:7e:9c:0b:83:0a:1c:58Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetProcessHeap
GetModuleFileNameW
GetSystemDirectoryW
CopyFileW
GetCurrentProcessId
FindResourceW
LoadResource
GetModuleHandleW
SizeofResource
LockResource
VirtualProtect
CloseHandle
CreateFileA
SetFilePointer
CreateDirectoryW
WriteFile
GetFileAttributesW
CreateFileW
MultiByteToWideChar
GetProcAddress
LoadLibraryA
lstrlenA
WideCharToMultiByte
LocalFree
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
LoadLibraryW
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetStringTypeW
LCMapStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
HeapAlloc
ExpandEnvironmentStringsW
CreatePipe
GetLastError
ReadFile
GetVersionExW
WaitForSingleObject
SetHandleInformation
InterlockedDecrement
CreateProcessW
SetUnhandledExceptionFilter
SetErrorMode
Sleep
IsDebuggerPresent
ExitProcess
user32
wsprintfW
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
CryptReleaseContext
CryptAcquireContextW
ole32
CoInitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
oleaut32
SysAllocString
VariantClear
SysFreeString
SysStringLen
VariantInit
shlwapi
PathQuoteSpacesW
PathFileExistsW
PathAddBackslashW
StrStrIW
Sections
.text Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT29 CozyBear/atiagentCozyBear.bin.dll regsvr32 windows:5 windows x86 arch:x86
4fcca208e21237d4a38b26f2461938ce
Code Sign
45:f2:55:cd:72:90:ff:8f:47:3b:79:43:fd:ef:72:23Certificate
IssuerCN=Advanced Micro Devices\, Inc.Not Before20-08-2014 19:43Not After31-12-2039 23:59SubjectCN=Advanced Micro Devices\, Inc.67:3d:aa:9c:92:9e:31:ef:c0:40:91:b8:38:92:8f:04:37:1c:4c:60Signer
Actual PE Digest67:3d:aa:9c:92:9e:31:ef:c0:40:91:b8:38:92:8f:04:37:1c:4c:60Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
HeapAlloc
GetLastError
HeapFree
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
ExpandEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetModuleFileNameW
RtlUnwind
HeapSize
HeapReAlloc
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
CreateFileW
FlushFileBuffers
CreateThread
CloseHandle
GetProcAddress
Sleep
LoadLibraryW
CreateProcessW
GetEnvironmentStringsW
GetFullPathNameW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APT34 Iranian/Abu Dhabi Statistics Center scad.ae.zip.zip
-
Abu Dhabi Statistics Center scad.ae/scad.ae users passwords.txt
-
malware-sample-library-master/APT34 Iranian/Abu Dhabi airports.zip.zip
-
Abu Dhabi airports/pass-list.txt
-
Abu Dhabi airports/webshell.txt
-
malware-sample-library-master/APT34 Iranian/Dubai Media Inc.zip.zip
-
Dubai Media Inc/dmi_out2.txt
-
Dubai Media Inc/out_dmi.txt
-
malware-sample-library-master/APT34 Iranian/Emirates Federal Competitiveness and Statistics Authority.zip.zip
-
malware-sample-library-master/APT34 Iranian/Emirates Ministry of Presidental Affairs.zip.zip
-
malware-sample-library-master/APT34 Iranian/Emirates NMC National Media Company.zip.zip
-
malware-sample-library-master/APT34 Iranian/Emirates National Oil Co (2).zip.zip
-
malware-sample-library-master/APT34 Iranian/Emirates National Oil Co.zip.zip
-
malware-sample-library-master/APT34 Iranian/Emirates Policy Center.zip.zip
-
malware-sample-library-master/APT34 Iranian/Emirates Prime Minister Office.zip.zip
-
malware-sample-library-master/APT34 Iranian/Etithad Airways.zip.zip
-
malware-sample-library-master/APT34 Iranian/Glimpse.zip.zip
-
malware-sample-library-master/APT34 Iranian/Jordan NITC - National Information Technology Center.zip.zip
-
malware-sample-library-master/APT34 Iranian/Jordan Software solutions company primus.com.jo.zip.zip
-
malware-sample-library-master/APT34 Iranian/Kuwait Amiri Diwan da.gov.kw.zip.zip
-
malware-sample-library-master/APT34 Iranian/Lamprell Energy Ltd.zip.zip
-
malware-sample-library-master/APT34 Iranian/MagicHoundAPT34.doc.doc windows office2003
ThisDocument
-
malware-sample-library-master/APT34 Iranian/National Securtiy Agency of Bahrain.zip.zip
-
malware-sample-library-master/APT34 Iranian/Nigerian building and road research institute.zip.zip
-
malware-sample-library-master/APT34 Iranian/Oman Administrative court admincourt.gov.om.zip.zip
-
malware-sample-library-master/APT34 Iranian/Omid_Palvayeh.pdf.pdf
-
malware-sample-library-master/APT34 Iranian/Qatar padiwan.gov.qa.7z.7z
-
malware-sample-library-master/APT34 Iranian/Qatar padiwan.gov.qa.zip.zip
-
malware-sample-library-master/APT34 Iranian/Rahacrop.pdf.pdf
-
malware-sample-library-master/APT34 Iranian/Webshells_and_Panel.zip.zip
-
malware-sample-library-master/APT34 Iranian/alireza_ebrahimi.pdf.pdf
-
malware-sample-library-master/APT34 Iranian/base.aspx.txt.asp .ps1 polyglot
-
malware-sample-library-master/APT34 Iranian/cdhq.gov.ae.zip.zip
-
malware-sample-library-master/APT34 Iranian/mohamad masoomi.pdf.pdf
-
malware-sample-library-master/APT34 Iranian/photo_2019-04-18_12-01-17.jpg.jpg
-
malware-sample-library-master/APT34 Iranian/photo_2019-04-18_12-01-28.jpg.jpg
-
malware-sample-library-master/APT34 Iranian/photo_2019-04-18_12-01-32.jpg.jpg
-
malware-sample-library-master/APT34 Iranian/photo_2019-04-18_12-01-36.jpg.jpg
-
malware-sample-library-master/APT34 Iranian/photo_2019-04-18_12-01-39.jpg.jpg
-
malware-sample-library-master/APT34 Iranian/photo_2019-04-18_12-01-43.jpg.jpg
-
malware-sample-library-master/APT34 Iranian/photo_2019-04-18_12-01-51.jpg.jpg
-
malware-sample-library-master/APT34 Iranian/photo_2019-04-18_12-01-55.jpg.jpg
-
malware-sample-library-master/APT34 Iranian/photo_2019-04-18_12-03-11.jpg.jpg
-
malware-sample-library-master/APT34 Iranian/photo_2019-04-18_12-03-15.jpg.jpg
-
malware-sample-library-master/APT34 Iranian/posion frog.zip.zip
-
malware-sample-library-master/APT34 Iranian/saeid shahrab.pdf.pdf
-
malware-sample-library-master/APT34 Iranian/sstc.com.sa.zip.zip
-
malware-sample-library-master/APT34 Iranian/taha mahdi tavakoli.pdf.pdf
-
malware-sample-library-master/APT34 Iranian/webmask_dnspionage.zip.zip
-
malware-sample-library-master/APT34 Iranian/webshells.csv
-
malware-sample-library-master/APT37 NK Reaper/Final1stspy,Dropper.bin.dll windows:5 windows x86 arch:x86
024051f8572903e7e7eec5fb7841998d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
E:\Final Project(20180108)\Final1stspy\hadowexecute - Copy\Release\hadowexecute.pdb
Imports
kernel32
GetModuleFileNameA
GetCurrentProcess
GetPrivateProfileIntW
TerminateProcess
GetTempPathW
WaitForSingleObject
GetVersionExW
GetSystemDirectoryW
MultiByteToWideChar
GetPrivateProfileStringW
Sleep
DeleteFileW
CloseHandle
LoadLibraryW
GetProcAddress
GetModuleHandleW
WideCharToMultiByte
GetTickCount
DeviceIoControl
InterlockedDecrement
CreateFileW
SetEndOfFile
HeapSize
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetLastError
LocalFree
FreeLibrary
LoadLibraryExW
RaiseException
InterlockedFlushSList
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ReadFile
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
GetACP
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleCP
SetFilePointerEx
FindClose
FindFirstFileExA
FindNextFileA
ole32
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
VariantCopy
VariantChangeType
psapi
GetModuleBaseNameA
Exports
Exports
main_func
Sections
.text Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 836B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/APTC23/APT-C-23Info.txt
-
malware-sample-library-master/APTC23/MicropsiaRAT2018.bin.exe windows:5 windows x86 arch:x86
f9bbe755584020dc98cd5884808355f5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
winspool.drv
DocumentPropertiesW
ClosePrinter
OpenPrinterW
GetDefaultPrinterW
EnumPrintersW
comctl32
ImageList_GetImageInfo
FlatSB_SetScrollInfo
ImageList_DragMove
ImageList_Destroy
_TrackMouseEvent
ImageList_DragShowNolock
ImageList_Add
FlatSB_SetScrollProp
ImageList_GetDragImage
ImageList_Create
ImageList_EndDrag
ImageList_DrawEx
ImageList_SetImageCount
FlatSB_GetScrollPos
FlatSB_SetScrollPos
InitializeFlatSB
ImageList_Copy
FlatSB_GetScrollInfo
ImageList_Write
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Replace
ImageList_GetImageCount
ImageList_DragEnter
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_Read
ImageList_DragLeave
ImageList_LoadImageW
ImageList_Draw
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetOverlayImage
shell32
Shell_NotifyIconW
ShellExecuteW
user32
CopyImage
CreateWindowExW
GetMenuItemInfoW
SetMenuItemInfoW
DefFrameProcW
GetDCEx
PeekMessageW
MonitorFromWindow
GetDlgCtrlID
SetTimer
WindowFromPoint
BeginPaint
RegisterClipboardFormatW
FrameRect
MapVirtualKeyW
IsWindowUnicode
RegisterWindowMessageW
FillRect
GetMenuStringW
DispatchMessageW
CreateAcceleratorTableW
SendMessageA
DefMDIChildProcW
EnumWindows
GetClassInfoW
GetClassInfoExW
ShowOwnedPopups
GetSystemMenu
GetScrollRange
SetScrollPos
GetScrollPos
GetActiveWindow
SetActiveWindow
DrawEdge
GetKeyboardLayoutList
LoadBitmapW
DrawFocusRect
EnumChildWindows
GetScrollBarInfo
ReleaseCapture
UnhookWindowsHookEx
LoadCursorW
GetCapture
SetCapture
CreatePopupMenu
ScrollWindow
ShowCaret
GetMenuItemID
GetLastActivePopup
CharLowerBuffW
GetSystemMetrics
SetWindowLongW
PostMessageW
DrawMenuBar
SetParent
IsZoomed
CharUpperBuffW
GetClientRect
IsChild
ClientToScreen
GetClipboardData
SetClipboardData
SetWindowPlacement
IsIconic
CallNextHookEx
GetMonitorInfoW
ShowWindow
CheckMenuItem
CharUpperW
DefWindowProcW
GetForegroundWindow
SetForegroundWindow
GetWindowTextW
EnableWindow
DestroyWindow
IsDialogMessageW
EndMenu
RegisterClassW
CharNextW
GetWindowThreadProcessId
RedrawWindow
GetDC
GetFocus
SetFocus
EndPaint
ReleaseDC
MsgWaitForMultipleObjectsEx
LoadKeyboardLayoutW
GetClassLongW
ActivateKeyboardLayout
GetParent
DrawTextW
SetScrollRange
MonitorFromRect
InsertMenuItemW
PeekMessageA
GetPropW
SetClassLongW
MessageBoxW
MessageBeep
SetPropW
RemovePropW
UpdateWindow
GetSubMenu
MsgWaitForMultipleObjects
DestroyMenu
DestroyIcon
SetWindowsHookExW
EmptyClipboard
IsWindowVisible
DispatchMessageA
UnregisterClassW
GetTopWindow
SendMessageW
AdjustWindowRectEx
DrawIcon
IsWindow
EnumThreadWindows
InvalidateRect
GetKeyboardState
DrawFrameControl
ScreenToClient
SetCursor
CreateIcon
CreateMenu
LoadStringW
CharLowerW
SetWindowRgn
SetWindowPos
GetMenuItemCount
RemoveMenu
GetSysColorBrush
GetKeyboardLayoutNameW
GetWindowDC
TranslateMessage
OpenClipboard
DrawTextExW
MapWindowPoints
EnumDisplayMonitors
CallWindowProcW
CloseClipboard
DestroyCursor
GetScrollInfo
SetWindowTextW
GetMessageExtraInfo
EnableScrollBar
GetSysColor
TrackPopupMenu
CopyIcon
DrawIconEx
PostQuitMessage
GetClassNameW
ShowScrollBar
EnableMenuItem
GetIconInfo
GetMessagePos
SetScrollInfo
GetKeyNameTextW
GetDesktopWindow
GetCursorPos
SetCursorPos
HideCaret
GetMenu
GetMenuState
SetMenu
SetRect
GetKeyState
FindWindowExW
MonitorFromPoint
SystemParametersInfoW
LoadIconW
GetCursor
GetWindow
GetWindowLongW
GetWindowRect
InsertMenuW
KillTimer
WaitMessage
IsWindowEnabled
IsDialogMessageA
TranslateMDISysAccel
GetWindowPlacement
FindWindowW
DeleteMenu
GetKeyboardLayout
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
oleaut32
GetErrorInfo
SysFreeString
VariantClear
VariantInit
SysReAllocStringLen
SafeArrayCreate
SafeArrayGetElement
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantChangeType
advapi32
RegSetValueExW
RegConnectRegistryW
RegEnumKeyExW
RegLoadKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegUnLoadKeyW
RegSaveKeyW
RegDeleteValueW
RegReplaceKeyW
RegFlushKey
RegQueryValueExW
RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegRestoreKeyW
netapi32
NetWkstaGetInfo
NetApiBufferFree
msvcrt
memcpy
memset
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetTimeouts
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpWriteData
WinHttpSetCredentials
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSendRequest
WinHttpQueryOption
kernel32
GetACP
LocalFree
CloseHandle
GetCurrentProcessId
SizeofResource
VirtualProtect
TerminateThread
QueryPerformanceFrequency
IsDebuggerPresent
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
EnumSystemLocalesW
GetStdHandle
GetTimeZoneInformation
GetModuleHandleW
FreeLibrary
TryEnterCriticalSection
HeapDestroy
ReadFile
CreateProcessW
HeapSize
GetLastError
GetModuleFileNameW
SetLastError
GlobalAlloc
GlobalUnlock
FindResourceW
CreateThread
CompareStringW
CopyFileW
CreateMutexW
LoadLibraryA
ResetEvent
MulDiv
FreeResource
GetVersion
RaiseException
GlobalAddAtomW
FormatMessageW
SwitchToThread
GetExitCodeThread
OutputDebugStringW
GetCurrentThread
LoadLibraryExW
LockResource
FileTimeToSystemTime
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
GlobalFindAtomW
VirtualQueryEx
GlobalFree
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetStartupInfoW
GlobalDeleteAtom
GetFileAttributesW
InitializeCriticalSection
GetThreadPriority
GetCurrentProcess
SetThreadPriority
GlobalLock
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
LCMapStringW
GetDiskFreeSpaceW
VerSetConditionMask
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
EnumResourceNamesW
DeleteFileW
GetEnvironmentVariableW
GetLocalTime
WaitForSingleObject
WriteFile
ExitThread
CreatePipe
DeleteCriticalSection
GetDateFormatW
TlsGetValue
SetErrorMode
IsValidLocale
TlsSetValue
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
RemoveDirectoryW
CreateEventW
WaitForMultipleObjectsEx
SetThreadLocale
GetThreadLocale
ole32
IsEqualGUID
OleInitialize
CreateBindCtx
OleUninitialize
MkParseDisplayName
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
gdi32
Pie
SetBkMode
CreateCompatibleBitmap
GetEnhMetaFileHeader
RectVisible
AngleArc
SetAbortProc
SetTextColor
StretchBlt
RoundRect
RestoreDC
SetRectRgn
GetTextMetricsW
GetWindowOrgEx
CreatePalette
PolyBezierTo
CreateICW
CreateDCW
GetStockObject
CreateSolidBrush
Polygon
MoveToEx
PlayEnhMetaFile
Ellipse
StartPage
GetBitmapBits
StartDocW
GetSystemPaletteEntries
GetEnhMetaFileBits
AbortDoc
GetEnhMetaFilePaletteEntries
CreatePenIndirect
CreateFontIndirectW
PolyBezier
EndDoc
GetObjectW
GetWinMetaFileBits
SetROP2
GetEnhMetaFileDescriptionW
ArcTo
Arc
SelectPalette
ExcludeClipRect
MaskBlt
SetWindowOrgEx
EndPage
DeleteEnhMetaFile
Chord
SetDIBits
SetViewportOrgEx
CreateRectRgn
RealizePalette
SetDIBColorTable
GetDIBColorTable
CreateBrushIndirect
PatBlt
SetEnhMetaFileBits
Rectangle
SaveDC
DeleteDC
FrameRgn
BitBlt
GetDeviceCaps
GetTextExtentPoint32W
GetClipBox
IntersectClipRect
Polyline
CreateBitmap
SetWinMetaFileBits
GetStretchBltMode
CreateDIBitmap
SetStretchBltMode
GetDIBits
CreateDIBSection
LineTo
GetRgnBox
EnumFontsW
CreateHalftonePalette
SelectObject
DeleteObject
ExtFloodFill
UnrealizeObject
CopyEnhMetaFileW
SetBkColor
CreateCompatibleDC
GetBrushOrgEx
GetCurrentPositionEx
GetTextExtentPointW
ExtTextOutW
SetBrushOrgEx
GetPixel
GdiFlush
SetPixel
EnumFontFamiliesExW
StretchDIBits
GetPaletteEntries
Exports
Exports
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 24KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 154B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Babuk Loader/82e560a078cd7bb4472d5af832a04c4bc8f1001bac97b1574efe9863d3f66550.zip
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/.gitignore
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/TestElevation/TestElevation.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/TestElevation/TestElevation.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/TestElevation/main.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/TestInject/TestInject.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/TestInject/TestInject.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/TestInject/main.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/ReadMe.txt
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/WndRec.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/WndRec.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/WndRec.vcxproj.user
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/FileTransfer.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/WndRec.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/cmdexec.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/file.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/lzw.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/manager.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/portforward.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/sender.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/socks.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/stream.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/tunnel.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/WndRec/video.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/include/https.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/FileTransfer.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/SendLog.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/WndRec.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/cmdexec.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/crypt.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/file.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/https.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/lzw.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/manager.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/portforward.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/sender.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/socks.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/stream.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/tunnel.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/WndRec/source/video.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot.psess
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/bot.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/bot.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/bot.vcxproj.user
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/config/builder.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/config/debug/config.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/config/full/config.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/AV.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/AdminPanel.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/Manager.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/MonitoringProcesses.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/VideoServer.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/errors.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/info.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/keylogger.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/main.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/other.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/plugins.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/sandbox.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/service.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/system.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/task.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/include/tools.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/AV.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/AdminPanel.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/Manager.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/MonitoringProcesses.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/ReflectiveLoader.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/VideoServer.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/abstract.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/config.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/explorer_loop.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/info.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/keylogger.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/main.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/other/FindFiles.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/other/GetProxy.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/other/ListProcess.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/other/mimikatz.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/other/rdp_patch.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/other/secure_lsa.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/other/vnc.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/plugin.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/plugins/FindOutlookFiles.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/plugins/MonitoringFile.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/plugins/TrustedHosts.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/plugins/plugins.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/rootkit.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/sandbox.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/service.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/system/FormGrabber.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/system/FormGrabber.err
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/system/ifobs.cpp.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/system/system.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/task.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/tools.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/bot/source/wincmd.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botcmd/botcmd.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botcmd/botcmd.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botcmd/source/DecodeString.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botcmd/source/UAC.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botcmd/source/main.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botcmd_dll/botcmd_dll.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botcmd_dll/botcmd_dll.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botcmd_dll/source/DecodeString.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botcmd_dll/source/botcmd_dll.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botcmd_dll/source/dllmain.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/botep.sln
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/builder.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/builder.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/builder.vcxproj.user
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/include/main.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/source/ConfigFile.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/source/EncodeString.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/source/RSAKey.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/source/main.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/stdafx.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/stdafx.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder/targetver.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/ReadMe.txt
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/builder_gui.aps
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/builder_gui.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/builder_gui.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/builder_gui.rc
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/builder_gui.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/builder_gui.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/builder_guiDlg.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/builder_guiDlg.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/misc.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/misc.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/res/builder_gui.ico
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/res/builder_gui.rc2
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/resource.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/stdafx.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/stdafx.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/builder_gui/targetver.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/core.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/core.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/core.vcxproj.user
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/File.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/FileTools.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/HttpProxy.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/PipeSocket.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/ThroughTunnel.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/abstract.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/api_funcs_hash.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/api_funcs_type.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/cab.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/core.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/crypt.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/debug.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/elevation.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/hook.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/http.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/injects.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/keylogger.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/memory.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/misc.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/ntdll.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/path.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/pe.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/pipe.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/process.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/proxy.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/rand.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/reestr.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/runinmem.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/service.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/sniffer.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/socket.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/string.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/string_crypt.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/type.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/util.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/vector.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/version.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/winapi.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/include/core/winapi_simple.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/FileTools.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/HttpProxy.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/PipeSocket.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/Service.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/ThroughTunnel.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/abstract/GetUid1.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/abstract/abstract.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/cab.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/core.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/crypt.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/debug.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/elevation/BlackEnergy2.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/elevation/COM.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/elevation/CVE2014-4113.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/elevation/EUDC.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/elevation/PathRec.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/elevation/UACBypass.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/elevation/ndproxy.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/elevation/sdrop.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/file.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/hook/DestroyWindow.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/hook/DispatchMessage.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/hook/GetMessage.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/hook/PeekMessage.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/hook/ZwResumeThread.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/hook/hook.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/hook/x86/zdisasm.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/hook/x86/zdisasm.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/http.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/InjectCode.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/InjectCode2.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/InjectIntoProcess1.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/InjectIntoProcess2.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/InjectIntoProcess3.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/RunInjectCode.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/RunInjectCode2.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/RunInjectCode3.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/explorer.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/explorer2.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/injects/svchost.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/keylogger.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/memory.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/misc.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/misc/DeleteFileHard.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/misc/FileMonitoring.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/misc/GetCommandLineProcess.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/misc/KillBlockingProcess.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/misc/KillLoadedModule.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/path.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/pe.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/pipe.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/process/exec.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/process/kill.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/process/misc_process.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/process/sendmsg.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/proxy.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/rand.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/reestr.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/runinmem.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/sniffer.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/socket.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/string.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/util/mutex.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/util/screenshot.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/util/users.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/util/window.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/vector.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/version.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/core/source/winapi.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/config/builder.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/config/debug/config.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/config/full/config.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/downloader.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/downloader.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/include/adminka.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/include/main.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/include/service.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/include/task.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/source/adminka.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/source/config.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/source/main.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/source/service.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/downloader/source/task.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/lib/x64/ntdll.lib
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/lib/x86/ntdll.lib
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/DbgHelp.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/DsGetDC.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LM.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMAPIbuf.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMConfig.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMCons.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMDFS.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMErr.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMErrlog.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMJoin.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMMsg.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMRemUtl.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMRepl.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMSName.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMServer.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMShare.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMStats.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMSvc.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMUse.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMUseFlg.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMWksta.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMaccess.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMalert.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMat.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/LMaudit.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/NTSecPKG.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/PshPack8.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/globals.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/inc/wincred.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/kerberos/kuhl_m_kerberos.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/kerberos/kuhl_m_kerberos_pac.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/kerberos/kuhl_m_kerberos_ticket.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/kuhl_m.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/kuhl_m_ts.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/mimidrv/globals.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/mimidrv/ioctl.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/mimidrv/kkll_m_filters.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/mimidrv/kkll_m_memory.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/mimidrv/kkll_m_modules.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/mimidrv/kkll_m_notify.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/mimidrv/kkll_m_process.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/mimidrv/kkll_m_ssdt.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/mimidrv/mimidrv.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/mimikatz.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_asn1.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_crypto_system.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_file.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_handle.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_kernel.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_memory.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_minidump.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_net.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_output.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_patch.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_process.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_registry.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_registry_structures.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_rpce.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_service.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_string.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/modules/kull_m_token.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/crypto/kuhl_m_sekurlsa_nt5.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/crypto/kuhl_m_sekurlsa_nt6.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/crypto/kuhl_m_sekurlsa_nt63.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/globals_sekurlsa.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/kuhl_m_sekurlsa.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/kuhl_m_sekurlsa_utils.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/packages/kuhl_m_sekurlsa_dpapi.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/packages/kuhl_m_sekurlsa_kerberos.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/packages/kuhl_m_sekurlsa_livessp.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/packages/kuhl_m_sekurlsa_msv1_0.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/packages/kuhl_m_sekurlsa_ssp.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/packages/kuhl_m_sekurlsa_tspkg.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/sekurlsa/packages/kuhl_m_sekurlsa_wdigest.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/include/mimikatz/winapi.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/mimikatz.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/mimikatz.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/mimikatz.vcxproj.user
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/kuhl_m_ts.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/mimikatz.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_asn1.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_file.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_handle.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_kernel.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_memory.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_minidump.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_net.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_output.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_patch.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_process.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_registry.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_service.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_string.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/modules/kull_m_token.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/crypto/kuhl_m_sekurlsa_nt5.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/crypto/kuhl_m_sekurlsa_nt6.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/crypto/kuhl_m_sekurlsa_nt63.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/kuhl_m_sekurlsa.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/kuhl_m_sekurlsa_utils.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/packages/kuhl_m_sekurlsa_dpapi.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/packages/kuhl_m_sekurlsa_kerberos.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/packages/kuhl_m_sekurlsa_livessp.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/packages/kuhl_m_sekurlsa_msv1_0.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/packages/kuhl_m_sekurlsa_ssp.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/packages/kuhl_m_sekurlsa_tspkg.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/mimikatz/source/sekurlsa/packages/kuhl_m_sekurlsa_wdigest.c
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_AutorunSidebar/export_funcs.def
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_AutorunSidebar/plugin_AutorunSidebar.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_AutorunSidebar/plugin_AutorunSidebar.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_AutorunSidebar/source/SetAutorun.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_AutorunSidebar/source/dllmain.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_cve2014-4113/cve2014-4113.def
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_cve2014-4113/main.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_cve2014-4113/plugin_cve2014-4113.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_cve2014-4113/plugin_cve2014-4113.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_rdpwrap/export_funcs.def
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_rdpwrap/plugin_rdpwrap.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_rdpwrap/plugin_rdpwrap.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_rdpwrap/source/dllmain.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_rdpwrap/source/hidden_cmd.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_rdpwrap/source/install.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_rdpwrap/source/rdpwrap32.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/plugin_rdpwrap/source/rdpwrap64.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/test/source/test.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/test/test.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/test/test.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/tool/ReadMe.txt
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/tool/collect_api.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/tool/request_url.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/tool/stdafx.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/tool/stdafx.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/tool/targetver.h
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/tool/tool.cpp
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/tool/tool.vcxproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/botep/tool/tool.vcxproj.filters
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/.gitignore
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/CmdManager.csproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Config.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlBotPages.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlBotPages.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlBotPages.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlCmd.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlCmd.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlCmd.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlFileTransfer.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlFileTransfer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlFileTransfer.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlVideo.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlVideo.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/ControlVideo.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormConfig.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormConfig.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormConfig.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormEnterPassword.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormEnterPassword.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormEnterPassword.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormEnterText.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormEnterText.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormEnterText.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormMain.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormMain.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FormMain.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FullScreenView.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FullScreenView.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/FullScreenView.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/IControlPage.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Misc.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Output.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Program.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Prompt.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Prompt.designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Prompt.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Prompt1.Designer.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Properties/AssemblyInfo.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Properties/Resources.Designer.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Properties/Resources.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Properties/Settings.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Properties/Settings.settings
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/RemoteControl.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/RemoteControl.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/RemoteControl.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/192.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/222.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/adept_update_4772.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/binary_7655.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/close_16.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/compress_5381.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/document_delete3.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/folder_add_4851.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/hdd_unmount_3445.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/image_1971.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/left_arrow_3191.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/refresh_32.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/right_arrow_3040.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/start_32.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/stop_32.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/stop_6497.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Resources/wordprocessing_9956.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/CmdManager/Server.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/Config.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FTP.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/Filter.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormAnchor.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormAnchor.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormAnchor.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormBots.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormBots.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormBots.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormBotsRecord.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormBotsRecord.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormBotsRecord.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormDateDelete.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormDateDelete.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormDateDelete.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormPlayer.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormPlayer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/FormPlayer.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/Player.csproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/Program.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/Properties/AssemblyInfo.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/Properties/Resources.Designer.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/Properties/Resources.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/Properties/Settings.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/Properties/Settings.settings
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/RecordFromBot.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/Video.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/VideoXml.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/icons/filter.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/icons/forward.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/icons/fullscreen.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/icons/pause.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/icons/play.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Player/icons/stop.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/PlayerExe/App.config
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/PlayerExe/PlayerExe.csproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/PlayerExe/Program.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/PlayerExe/Properties/AssemblyInfo.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/PlayerExe/Properties/Resources.Designer.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/PlayerExe/Properties/Resources.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/PlayerExe/Properties/Settings.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/PlayerExe/Properties/Settings.settings
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/Config.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/ControlRDP.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/ControlRDP.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/ControlRDP.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/ControlVNC.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/ControlVNC.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/ControlVNC.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/FormConnectRDP.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/FormConnectRDP.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/FormConnectRDP.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/FormConnectVNC.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/FormConnectVNC.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/FormConnectVNC.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/FormRDP.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/FormRDP.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/FormRDP.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/Misc.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/Output.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/Program.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/Properties/AssemblyInfo.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/Properties/Resources.Designer.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/Properties/Resources.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/Properties/Settings.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/Properties/Settings.settings
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/RDP.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/RDPPlayer/RDPPlayer.csproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server.sln
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/CmdManager.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Config.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/DB.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/DataConvert.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/FormConfig.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/FormConfig.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/FormConfig.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/FormMain.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/FormMain.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/FormMain.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Log.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Misc.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Program.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Properties/AssemblyInfo.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Properties/Resources.Designer.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Properties/Resources.resx.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Properties/Settings.Designer.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Properties/Settings.settings
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/RecordFromBot.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Resources/cog-icon-2-48x48_3789.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Resources/connect_creating_48.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Resources/connect_no_48.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Resources/exit48.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Resources/rdp48.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Resources/socks48.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Resources/vnc_48.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Sender.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Server.csproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/Stream.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/key/private.key
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/Server/lzw.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/ConnectEventArgs.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/EncodedRectangleFactory.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/CPixelReader.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/CoRreRectangle.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/CopyRectRectangle.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/EncodedRectangle.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/HextileRectangle.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/PixelReader.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/PixelReader16.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/PixelReader32.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/PixelReader8.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/RawRectangle.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/RreRectangle.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Encodings/ZrleRectangle.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Framebuffer.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/IDesktopUpdater.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/IVncInputPolicy.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/PasswordDialog.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/PasswordDialog.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Properties/AssemblyInfo.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/RemoteDesktop.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/RemoteDesktop.resx.xml .vbs polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Resources/screenshot.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Resources/vnccursor.cur
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/Resources/vncviewer.ico
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/RfbProtocol.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncClient.cs.js
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncClippedDesktopPolicy.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncDefaultInputPolicy.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncDesignModeDesktopPolicy.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncDesktopTransformPolicy.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncEventArgs.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncProtocolException.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncScaledDesktopPolicy.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncSharp.csproj
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncSharpKey.snk
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/VncViewInputPolicy.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/vncviewer.ico
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/Adler32.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/Deflate.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/InfBlocks.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/InfCodes.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/InfTree.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/Inflate.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/StaticTree.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/SupportClass.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/Tree.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/ZInputStream.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/ZOutputStream.cs.vbs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/ZStream.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/ZStreamException.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/Zlib.cs
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/history.txt
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/license.txt
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/VncSharp/zlib.NET/readme.txt
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/dll/x64/System.Data.SQLite.dll.config.xml
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/dll/x64/System.Data.SQLite.xml.xml .js polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/dll/x86/System.Data.SQLite.dll.config.xml
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/dll/x86/System.Data.SQLite.xml.xml .js polyglot
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/images/close_16.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/images/close_32.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/images/refresh_32.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/images/start_32.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/images/stop_32.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 1/server/images/vnc_48.png.png
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/CmdManager.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
o:\server\CmdManager\obj\Debug\CmdManager.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/CmdManager.xml.xml
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/Player.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
o:\server\Player\obj\Debug\Player.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 832B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/PlayerExe.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
o:\server\PlayerExe\obj\Debug\PlayerExe.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/Server.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
o:\server\Server\obj\Debug\Server.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/VncSharp.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
o:\server\VncSharp\obj\Debug\VncSharp.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/_plugins/hvnc.plug.dll windows:5 windows x86 arch:x86
26c4f65857697dd4c36aa779456309af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
psapi
GetMappedFileNameA
GetModuleFileNameExA
EnumProcessModules
shlwapi
StrRChrW
PathStripPathA
StrDupA
StrChrA
StrRChrA
PathRemoveArgsW
StrChrW
PathRemoveBlanksW
StrTrimW
StrCmpNIW
PathRemoveBlanksA
PathRemoveArgsA
ntdll
RtlEqualUnicodeString
NtQueryObject
NtQueryInformationFile
NtQuerySystemInformation
RtlUnwind
RtlCompareUnicodeString
RtlInitUnicodeString
NtResumeProcess
NtSuspendProcess
NtSetContextThread
NtGetContextThread
ZwQueryInformationProcess
RtlNtStatusToDosError
ZwClose
NtUnmapViewOfSection
NtMapViewOfSection
NtCreateSection
ZwQueryKey
ws2_32
closesocket
connect
ioctlsocket
recv
WSACleanup
WSAStartup
select
send
shutdown
socket
htonl
htons
crypt32
CryptMsgGetParam
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgClose
CryptDecodeObject
kernel32
FreeLibrary
GetProcAddress
GetVersion
LoadLibraryA
CreateEventA
GetModuleHandleA
VirtualProtect
GetCurrentProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
lstrcmpA
lstrcpyA
lstrlenA
SetLastError
lstrcmpiW
lstrcpyW
lstrcatA
lstrcatW
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
LocalFree
lstrcmpiA
VirtualAlloc
VirtualFree
VirtualAllocEx
WaitForSingleObject
GetFileSize
ReadFile
SetFilePointer
GetModuleFileNameA
CreateFileA
GetCurrentThread
TerminateThread
GetTickCount
SleepEx
ReleaseMutex
SetUnhandledExceptionFilter
SetErrorMode
WaitForMultipleObjects
CreateMutexA
IsBadStringPtrA
IsProcessorFeaturePresent
VirtualQuery
IsDebuggerPresent
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
ExpandEnvironmentStringsW
GetVersionExA
SetEvent
GetCurrentThreadId
HeapFree
HeapReAlloc
HeapAlloc
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
OutputDebugStringW
LoadLibraryExW
LCMapStringW
GetStringTypeW
GetModuleFileNameW
GetStdHandle
GetModuleHandleExW
ExitProcess
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
DecodePointer
EncodePointer
VerLanguageNameW
GetLocaleInfoW
GetSystemTimeAsFileTime
GetProcessTimes
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
DeleteFileW
RemoveDirectoryW
HeapDestroy
HeapCreate
GetModuleHandleW
CloseHandle
Sleep
ResumeThread
SuspendThread
GetThreadContext
WriteProcessMemory
ReadProcessMemory
GetLastError
CreateThread
SwitchToThread
GetCurrentProcessId
OpenProcess
VirtualProtectEx
CreateDirectoryW
DuplicateHandle
InterlockedDecrement
SetFilePointerEx
SetEndOfFile
WriteFile
GetFileInformationByHandle
InterlockedIncrement
GetProcessId
MulDiv
LoadLibraryW
MapViewOfFile
TerminateProcess
GetSystemWindowsDirectoryA
SystemTimeToFileTime
GetSystemTime
GetTempPathW
GetLongPathNameW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
OpenFileMappingA
CreateFileMappingA
OpenThread
FindClose
lstrcmpW
OpenEventA
CreateFileW
FindFirstFileW
FindNextFileW
lstrcpynW
GetEnvironmentVariableW
UnmapViewOfFile
user32
WindowFromDC
IsWindow
GetWindowThreadProcessId
GetThreadDesktop
UnhookWindowsHookEx
SetWindowsHookExA
GetAncestor
GetWindowInfo
CallNextHookEx
GetClassNameA
FindWindowA
GetParent
SetClassLongA
GetClassLongA
SetWindowLongA
GetWindowLongA
FillRect
ScreenToClient
ClientToScreen
GetClientRect
RedrawWindow
MenuItemFromPoint
GetMenuItemRect
EndMenu
TrackPopupMenuEx
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetSystemMenu
GetMenuState
HiliteMenuItem
GetMenu
SetKeyboardState
SetLayeredWindowAttributes
PrintWindow
CallWindowProcA
DefWindowProcA
PostMessageA
SendMessageTimeoutA
SendMessageA
ActivateKeyboardLayout
GetDC
ReleaseDC
wsprintfA
wsprintfW
GetUserObjectInformationA
GetDoubleClickTime
SetWindowPos
GetSystemMetrics
GetMenuItemInfoA
GetMenuDefaultItem
GetWindowRect
MapWindowPoints
IsRectEmpty
GetWindow
SetThreadDesktop
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
DestroyWindow
ShowWindow
CreateDialogIndirectParamW
EndDialog
ExitWindowsEx
GetKeyState
CreatePopupMenu
DestroyMenu
AppendMenuA
AttachThreadInput
IsWindowVisible
IsIconic
BringWindowToTop
SetFocus
SetActiveWindow
SetForegroundWindow
WindowFromPoint
PtInRect
EnumChildWindows
GetLastActivePopup
GetGUIThreadInfo
RealChildWindowFromPoint
DrawEdge
GetWindowTextA
GetScrollBarInfo
CreateDesktopA
EnumDesktopWindows
CloseDesktop
RegisterWindowMessageA
GetDesktopWindow
IntersectRect
ToUnicodeEx
GetKeyboardLayoutList
GetKeyboardLayout
ToAscii
VkKeyScanA
VkKeyScanExA
VkKeyScanExW
MapVirtualKeyA
MapVirtualKeyExA
ChildWindowFromPointEx
SetWinEventHook
UnhookWinEvent
RegisterClassA
CreateWindowExA
MoveWindow
CharUpperBuffW
SetTimer
KillTimer
DrawTextW
BeginPaint
EndPaint
GetSysColor
SendNotifyMessageA
OpenClipboard
CloseClipboard
GetClipboardOwner
SetClipboardViewer
ChangeClipboardChain
SetClipboardData
GetClipboardData
EmptyClipboard
FindWindowExA
gdi32
CombineRgn
CreateBitmap
CreatePatternBrush
SetWindowOrgEx
SetDIBColorTable
CreateDIBSection
GetStockObject
GetDIBits
GetDeviceCaps
CreateFontA
ExtTextOutA
SetTextColor
SetBkMode
GetClipBox
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SetViewportOrgEx
SelectClipRgn
GetViewportOrgEx
GetClipRgn
DeleteObject
CreateRectRgn
GetSystemPaletteEntries
GetRegionData
GdiFlush
DeleteDC
SetBkColor
advapi32
RegOpenKeyExW
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
OpenProcessToken
OpenThreadToken
RegCloseKey
shell32
ShellExecuteA
ole32
CoUninitialize
CoInitialize
Exports
Exports
VncStartServer
VncStopServer
Sections
.text Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/_plugins/hvnc64.plug.dll windows:5 windows x64 arch:x64
53c3747c698f79b2430bf1104db11cb8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
psapi
GetMappedFileNameA
GetModuleFileNameExA
EnumProcessModules
shlwapi
PathRemoveArgsW
PathRemoveBlanksW
PathRemoveArgsA
PathRemoveBlanksA
StrChrW
StrCmpNIW
StrTrimW
StrDupA
StrRChrA
StrChrA
StrRChrW
PathStripPathA
ntdll
NtQuerySystemInformation
RtlUnwindEx
RtlCompareUnicodeString
RtlInitUnicodeString
NtResumeProcess
NtSuspendProcess
NtSetContextThread
NtGetContextThread
ZwQueryInformationProcess
RtlNtStatusToDosError
ZwClose
NtUnmapViewOfSection
NtMapViewOfSection
NtCreateSection
NtQueryInformationFile
NtQueryObject
RtlEqualUnicodeString
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ZwQueryKey
ws2_32
WSAStartup
closesocket
connect
ioctlsocket
recv
select
send
shutdown
socket
htonl
htons
WSACleanup
crypt32
CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
kernel32
GetVersion
LoadLibraryA
GetCurrentProcessId
CreateEventA
GetModuleHandleA
VirtualProtect
GetCurrentProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
lstrcmpA
lstrcpyA
lstrlenA
SetLastError
lstrcmpiW
lstrcpyW
lstrcatA
lstrcatW
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
LocalFree
lstrcmpiA
VirtualAlloc
VirtualFree
VirtualAllocEx
GetProcAddress
WaitForSingleObject
GetFileSize
ReadFile
SetFilePointer
GetModuleFileNameA
CreateFileA
GetCurrentThread
TerminateThread
GetTickCount
SleepEx
ReleaseMutex
TerminateProcess
SetUnhandledExceptionFilter
SetErrorMode
WaitForMultipleObjects
CreateMutexA
IsBadStringPtrA
ExpandEnvironmentStringsW
GetVersionExA
OpenEventA
FreeLibrary
SetEvent
GetCurrentThreadId
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
HeapCreate
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
OutputDebugStringW
LoadLibraryExW
LCMapStringW
GetStringTypeW
GetModuleFileNameW
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
GetCPInfo
GetModuleHandleW
CloseHandle
Sleep
ResumeThread
SuspendThread
GetThreadContext
WriteProcessMemory
ReadProcessMemory
GetLastError
CreateThread
SwitchToThread
VirtualProtectEx
GlobalUnlock
GlobalFree
GetLongPathNameW
OpenProcess
GetOEMCP
GetACP
GlobalLock
IsValidCodePage
IsProcessorFeaturePresent
DecodePointer
EncodePointer
IsDebuggerPresent
VerLanguageNameW
GetLocaleInfoW
GetSystemTimeAsFileTime
GetProcessTimes
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
DuplicateHandle
SetFilePointerEx
SetEndOfFile
WriteFile
GetFileInformationByHandle
GetProcessId
MulDiv
GetSystemWindowsDirectoryA
SystemTimeToFileTime
GetSystemTime
OpenThread
FindClose
lstrcmpW
GlobalAlloc
CreateFileW
FindFirstFileW
FindNextFileW
lstrcpynW
GetEnvironmentVariableW
LoadLibraryW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetTempPathW
user32
EmptyClipboard
DefWindowProcA
GetClipboardData
PostMessageA
SendMessageTimeoutA
SendMessageA
ActivateKeyboardLayout
FindWindowExA
GetThreadDesktop
GetWindowThreadProcessId
WindowFromDC
IsIconic
UnhookWindowsHookEx
SetWindowsHookExA
GetAncestor
GetWindowInfo
CallNextHookEx
GetClassNameA
FindWindowA
GetParent
SetClassLongPtrA
GetClassLongPtrA
SetWindowLongPtrA
GetWindowLongPtrA
FillRect
ScreenToClient
ClientToScreen
GetClientRect
RedrawWindow
MenuItemFromPoint
GetMenuItemRect
EndMenu
TrackPopupMenuEx
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetSystemMenu
GetMenuState
HiliteMenuItem
GetMenu
SetKeyboardState
SetLayeredWindowAttributes
PrintWindow
CallWindowProcA
GetDC
ReleaseDC
wsprintfA
wsprintfW
GetUserObjectInformationA
GetDoubleClickTime
SetWindowPos
GetSystemMetrics
GetMenuItemInfoA
GetMenuDefaultItem
GetWindowRect
MapWindowPoints
IsRectEmpty
GetWindow
SetThreadDesktop
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
DestroyWindow
ShowWindow
CreateDialogIndirectParamW
EndDialog
ExitWindowsEx
GetKeyState
CreatePopupMenu
DestroyMenu
AppendMenuA
AttachThreadInput
IsWindowVisible
SetClipboardData
BringWindowToTop
SetFocus
SetActiveWindow
SetForegroundWindow
WindowFromPoint
PtInRect
EnumChildWindows
GetLastActivePopup
GetGUIThreadInfo
RealChildWindowFromPoint
DrawEdge
GetWindowTextA
GetScrollBarInfo
CreateDesktopA
EnumDesktopWindows
CloseDesktop
RegisterWindowMessageA
GetDesktopWindow
GetWindowLongA
SetWindowLongA
IntersectRect
ToUnicodeEx
GetKeyboardLayoutList
GetKeyboardLayout
ToAscii
VkKeyScanA
VkKeyScanExA
VkKeyScanExW
MapVirtualKeyA
MapVirtualKeyExA
ChildWindowFromPointEx
SetWinEventHook
UnhookWinEvent
RegisterClassA
CreateWindowExA
MoveWindow
CharUpperBuffW
SetTimer
KillTimer
DrawTextW
BeginPaint
EndPaint
GetSysColor
SendNotifyMessageA
OpenClipboard
CloseClipboard
GetClipboardOwner
SetClipboardViewer
ChangeClipboardChain
IsWindow
gdi32
GetStockObject
CreateDIBSection
SetDIBColorTable
CreateFontA
GetClipBox
SetBkColor
SetBkMode
SetTextColor
SetWindowOrgEx
ExtTextOutA
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SetViewportOrgEx
SelectClipRgn
GetViewportOrgEx
GetClipRgn
DeleteObject
CreateRectRgn
GetSystemPaletteEntries
GetRegionData
GdiFlush
DeleteDC
GetDeviceCaps
CombineRgn
CreateBitmap
CreatePatternBrush
GetDIBits
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegQueryValueExW
RegOpenKeyExW
OpenThreadToken
OpenProcessToken
RegCloseKey
shell32
ShellExecuteA
ole32
CoUninitialize
CoInitialize
Exports
Exports
VncStartServer
VncStopServer
Sections
.text Size: 189KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/_plugins/rdpwrap.dll.dll windows:5 windows x86 arch:x86
c94b75338d87dc2ca071fab086a3766a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapReAlloc
HeapFree
MultiByteToWideChar
GetTickCount
CloseHandle
Sleep
WaitForSingleObject
HeapCreate
CreateProcessA
OpenProcess
GetTempPathA
CreateFileA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
HeapAlloc
GetFileSize
ReadFile
SetFileAttributesA
WriteFile
GetTempFileNameA
GetLastError
CreateToolhelp32Snapshot
Process32First
Process32Next
ExitProcess
TerminateProcess
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
VirtualAllocEx
WriteProcessMemory
Thread32First
Thread32Next
HeapDestroy
IsWow64Process
MoveFileExA
GetExitCodeProcess
GetCurrentProcess
ntdll
RtlAdjustPrivilege
shlwapi
PathFindFileNameA
PathFindExtensionA
psapi
EnumProcessModules
GetModuleFileNameExA
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationA
WTSEnumerateSessionsA
WTSQueryUserToken
user32
GetWindowThreadProcessId
FindWindowA
wvsprintfA
advapi32
CreateProcessAsUserA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
LookupAccountSidA
GetTokenInformation
StartServiceA
QueryServiceStatusEx
OpenServiceA
OpenSCManagerA
ControlService
CloseServiceHandle
ChangeServiceConfigA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
DuplicateTokenEx
shell32
SHCreateDirectoryExA
SHGetFolderPathA
ShellExecuteExA
Exports
Exports
install
uninstall
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 220KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/_plugins/vnc.plug.dll windows:5 windows x86 arch:x86
5c2ce08f08a5087e6c543acd43b55a8a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
ws2_32
connect
shutdown
send
WSADuplicateSocketA
WSAStartup
htonl
WSAGetLastError
WSAEventSelect
WSACleanup
bind
socket
WSACreateEvent
closesocket
listen
accept
htons
user32
WaitForInputIdle
kernel32
FlushFileBuffers
LCMapStringW
HeapSize
GetStringTypeW
WriteConsoleW
SetStdHandle
HeapReAlloc
RtlUnwind
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
CreateRemoteThread
VirtualAllocEx
WriteProcessMemory
PeekNamedPipe
ConnectNamedPipe
GetTickCount
Sleep
ReadFile
DisconnectNamedPipe
GetLastError
CreateNamedPipeA
CloseHandle
FindResourceA
LoadResource
GetCurrentProcess
WaitForSingleObject
TerminateThread
SizeofResource
SetLastError
LockResource
WaitForMultipleObjects
CreateMutexA
DuplicateHandle
ReleaseMutex
GetCurrentProcessId
CreateThread
FreeLibrary
OpenProcess
Thread32First
Thread32Next
GetProcAddress
VirtualAlloc
LoadLibraryA
OpenThread
CreateToolhelp32Snapshot
SuspendThread
ResumeThread
ExitProcess
HeapFree
HeapAlloc
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetProcessHeap
InterlockedDecrement
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
InterlockedIncrement
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
CreateFileW
Exports
Exports
Init
VncStartServer
VncStopServer
_ReflectiveLoader@0
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 308KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/_plugins/vnc64.plug.dll windows:5 windows x64 arch:x64
b9dbac19a93eb64836de38e45990b88c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ntdll
RtlEqualUnicodeString
NtQueryInformationFile
NtQuerySystemInformation
_wcsnicmp
_strnicmp
NtGetContextThread
ZwQueryInformationProcess
NtResumeProcess
NtSetContextThread
NtSuspendProcess
ZwQueryInformationToken
ZwOpenProcess
ZwOpenProcessToken
NtCreateSection
ZwClose
RtlNtStatusToDosError
NtUnmapViewOfSection
NtMapViewOfSection
memcpy
RtlCompareUnicodeString
RtlInitUnicodeString
memcmp
memset
_strupr
NtQueryObject
ZwQueryKey
__C_specific_handler
__chkstk
kernel32
VirtualFree
GetLocaleInfoW
GetProcessTimes
GetSystemTimeAsFileTime
GetFileInformationByHandle
DeleteFileW
DuplicateHandle
CreateToolhelp32Snapshot
HeapReAlloc
HeapAlloc
HeapFree
SetEvent
HeapDestroy
HeapCreate
GetCurrentThreadId
lstrlenA
lstrcpyA
lstrcatA
GetLastError
CreateMutexA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
SetLastError
lstrcmpiW
lstrcatW
lstrcpyW
LocalFree
GetCurrentProcess
GetTickCount
GetCurrentThread
TerminateThread
LoadLibraryA
WaitForSingleObject
lstrcmpiA
ReleaseMutex
SetErrorMode
SetUnhandledExceptionFilter
OpenProcess
Sleep
TerminateProcess
GetProcAddress
WaitForMultipleObjects
GetModuleHandleA
CloseHandle
GetCurrentProcessId
CreateThread
InitializeCriticalSection
LeaveCriticalSection
IsBadStringPtrA
EnterCriticalSection
DeleteCriticalSection
GetVersion
RaiseException
FreeLibrary
LoadLibraryExA
GetThreadContext
ReadProcessMemory
VirtualProtectEx
WriteProcessMemory
SuspendThread
ResumeThread
SwitchToThread
LocalAlloc
lstrcpynA
CreateEventA
lstrcmpA
VirtualProtect
CreateFileA
GetFileSize
SetFilePointer
Process32NextW
ReadFile
VirtualAlloc
VirtualAllocEx
GetModuleFileNameA
ExpandEnvironmentStringsW
GetVersionExA
RemoveDirectoryW
GetProcessId
Process32FirstW
WriteFile
CreateDirectoryW
SetFilePointerEx
SetEndOfFile
MulDiv
GetSystemTime
SystemTimeToFileTime
GetSystemWindowsDirectoryA
GlobalFree
GetLongPathNameW
GetTempPathW
GlobalUnlock
GlobalAlloc
GlobalLock
OpenFileMappingA
CreateFileMappingA
OpenThread
lstrcmpW
OpenEventA
FindFirstFileW
CreateFileW
FindClose
FindNextFileW
GetEnvironmentVariableW
lstrcpynW
GetModuleHandleW
LoadLibraryW
MapViewOfFile
UnmapViewOfFile
VerLanguageNameW
Exports
Exports
PluginRegisterCallbacks
VncStartServer
VncStopServer
Sections
.text Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/bot.dll.dll windows:5 windows x86 arch:x86
5be76b875f0b372970034f8b7ff1499d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
Exports
Exports
?ReflectiveLoader@@YGKPAX@Z
Sections
.text Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/bot.exe.exe windows:5 windows x86 arch:x86
b3659771bb5ac9f6ed1ee9aa25a3f19d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OutputDebugStringA
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
Sections
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/bot_cmd.txt
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/bot_x64.dll.dll windows:5 windows x64 arch:x64
5be76b875f0b372970034f8b7ff1499d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
Exports
Exports
?ReflectiveLoader@@YA_KPEAX@Z
Sections
.text Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/bot_x64.exe.exe windows:5 windows x64 arch:x64
b3659771bb5ac9f6ed1ee9aa25a3f19d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
OutputDebugStringA
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
Sections
.text Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/botcmd.exe.exe windows:5 windows x86 arch:x86
2f7c362cde465254a58ac91a58626c85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
CommandLineToArgvW
ntdll
memset
kernel32
FreeEnvironmentStringsW
ReadConsoleW
ReadFile
CreateFileW
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
HeapFree
Sleep
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
FlushFileBuffers
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
SetLastError
InterlockedIncrement
GetCurrentThreadId
GetStdHandle
GetModuleFileNameW
GetProcessHeap
GetFileType
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
HeapAlloc
HeapReAlloc
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetStdHandle
SetFilePointerEx
WriteConsoleW
RtlUnwind
GetStringTypeW
OutputDebugStringW
LoadLibraryW
CloseHandle
HeapSize
LCMapStringW
Sections
.text Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/builder.exe.exe windows:5 windows x86 arch:x86
1c6f9d43f4ea4c4ef44026a73bc26f9f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
ReadConsoleW
ReadFile
SetEndOfFile
GetCommandLineA
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetLastError
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
HeapFree
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
WriteFile
GetModuleFileNameW
GetProcessHeap
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapAlloc
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
HeapReAlloc
GetStringTypeW
SetFilePointerEx
CreateFileW
WriteConsoleW
HeapSize
LCMapStringW
advapi32
CryptReleaseContext
CryptExportKey
CryptAcquireContextA
CryptGenKey
CryptDestroyKey
ntdll
strcat
sqrt
Sections
.text Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/builder_gui.config
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/builder_gui.exe.exe windows:5 windows x86 arch:x86
494da06fa5dd6c1972ae28fbe09ec613
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
O:\botep\bin\Release\builder_gui.pdb
Imports
kernel32
FreeEnvironmentStringsW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
OutputDebugStringW
IsValidCodePage
LCMapStringW
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
GetStdHandle
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileType
SetStdHandle
GetSystemTimeAsFileTime
HeapQueryInformation
HeapSize
ExitThread
CreateThread
HeapReAlloc
RaiseException
WideCharToMultiByte
VirtualQuery
VirtualAlloc
GetSystemInfo
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetEnvironmentStringsW
HeapAlloc
HeapFree
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
FindResourceExW
GetWindowsDirectoryA
SearchPathA
GetProfileIntA
GetTickCount
Sleep
VirtualProtect
GetTempFileNameA
GetTempPathA
SetErrorMode
GetFileTime
GetFileSizeEx
GetFileAttributesExA
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
FileTimeToSystemTime
GetACP
GetFileAttributesA
VerifyVersionInfoA
lstrcpyA
VerSetConditionMask
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
QueryPerformanceCounter
GetProcessHeap
RtlUnwind
GetStringTypeW
CompareStringW
GetCurrentDirectoryA
InterlockedIncrement
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GetVolumeInformationA
lstrcmpiA
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetFullPathNameA
GetFileSize
FlushFileBuffers
FindFirstFileA
FindClose
DeleteFileA
CreateFileA
InterlockedDecrement
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetSystemDirectoryW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GlobalAddAtomA
ResumeThread
SetThreadPriority
CopyFileA
FormatMessageA
MulDiv
LocalFree
GlobalSize
GetCurrentProcessId
FindResourceA
GlobalFree
GlobalUnlock
FreeResource
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
LoadLibraryW
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetVersion
SetLastError
GetLastError
OutputDebugStringA
GetFileAttributesW
CompareStringA
MultiByteToWideChar
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
LoadLibraryExW
FreeLibrary
GetVersionExA
GetCurrentThreadId
GetCurrentThread
InterlockedExchange
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
ReadFile
CloseHandle
CreateProcessA
SetHandleInformation
CreatePipe
GetModuleFileNameA
FindResourceW
LoadResource
LockResource
SizeofResource
user32
CopyAcceleratorTableA
CreateAcceleratorTableA
LoadAcceleratorsW
ToAsciiEx
GetKeyboardState
GetKeyboardLayout
ReuseDDElParam
UnpackDDElParam
InsertMenuItemA
LoadMenuA
TranslateAcceleratorA
LoadAcceleratorsA
UnregisterClassA
UpdateLayeredWindow
GetUpdateRect
SetClassLongA
DestroyAcceleratorTable
ModifyMenuA
IsMenu
SetMenuDefaultItem
GetMenuDefaultItem
GetMenuItemInfoA
CopyIcon
GetIconInfo
GetDoubleClickTime
EnableScrollBar
DestroyMenu
LockWindowUpdate
CreatePopupMenu
BringWindowToTop
UnionRect
SetRect
SetCursorPos
NotifyWinEvent
MessageBeep
GetSystemMenu
LoadMenuW
GetAsyncKeyState
IsZoomed
TrackMouseEvent
LoadImageW
LoadImageA
DestroyIcon
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
MonitorFromPoint
SetParent
EnumDisplayMonitors
SetRectEmpty
SetLayeredWindowAttributes
IntersectRect
KillTimer
SetTimer
RealChildWindowFromPoint
DeleteMenu
SystemParametersInfoA
CopyImage
LoadCursorW
LoadCursorA
WindowFromPoint
ReleaseCapture
WaitMessage
CharUpperA
IsDialogMessageA
SetWindowTextA
SendDlgItemMessageA
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoA
MonitorFromWindow
GetScrollInfo
SetScrollInfo
LoadIconA
GetWindow
GetTopWindow
GetClassLongA
SetWindowLongA
EqualRect
AdjustWindowRectEx
GetWindowTextLengthA
GetWindowTextA
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
IsChild
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
GetClassNameA
InvalidateRect
UpdateWindow
SetCursor
ShowOwnedPopups
ValidateRect
GetKeyState
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
LoadBitmapW
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
PtInRect
GetCursorPos
ScreenToClient
ClientToScreen
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutA
GrayStringA
DrawTextExA
DrawTextA
RemoveMenu
AppendMenuA
InsertMenuA
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringA
GetLastActivePopup
GetWindowRgn
DestroyCursor
CreateMenu
InvertRect
HideCaret
GetComboBoxInfo
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
MapVirtualKeyExA
GetWindowThreadProcessId
CopyRect
ReleaseDC
IsCharLowerA
GetNextDlgGroupItem
PostThreadMessageA
IsClipboardFormatAvailable
FrameRect
CharUpperBuffA
RegisterClipboardFormatA
MapDialogRect
WinHelpA
SubtractRect
GetDC
MapVirtualKeyA
GetKeyNameTextA
GetDesktopWindow
GetWindowLongA
SetActiveWindow
IsWindowEnabled
GetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
IsWindow
DrawIconEx
GetParent
IsRectEmpty
OffsetRect
InflateRect
FillRect
DrawFocusRect
GetSysColorBrush
GetSysColor
MapWindowPoints
GetWindowRect
RedrawWindow
SetWindowRgn
DrawStateA
GetFocus
IsWindowVisible
DrawFrameControl
DrawEdge
RegisterWindowMessageA
PostQuitMessage
PostMessageA
MessageBoxA
wvsprintfA
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
SendMessageA
LoadIconW
EnableWindow
SetCapture
gdi32
GetObjectA
MoveToEx
TextOutA
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectA
SetRectRgn
DPtoLP
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
RealizePalette
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateRoundRectRgn
Rectangle
GetRgnBox
OffsetRgn
RoundRect
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExA
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
SetPixelV
GetTextFaceA
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
SelectPalette
SetTextAlign
SetTextColor
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
CreatePalette
CreateSolidBrush
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreatePatternBrush
CreatePen
CreateCompatibleDC
CreateBitmap
BitBlt
GetDeviceCaps
CreateDCA
CopyMetaFileA
GetTextMetricsA
Polyline
Polygon
CreatePolygonRgn
ExtTextOutA
PatBlt
GetTextExtentPoint32A
GetTextColor
GetBkColor
Ellipse
CreateRectRgnIndirect
CreateRectRgn
CreateHatchBrush
CreateEllipticRgn
CombineRgn
DeleteObject
SetBkColor
msimg32
AlphaBlend
TransparentBlt
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
RegEnumKeyA
RegOpenKeyExA
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
RegCloseKey
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA
shell32
ShellExecuteA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetDesktopFolder
SHGetFileInfoA
SHAppBarMessage
SHGetMalloc
DragFinish
DragQueryFileA
comctl32
ord17
InitCommonControlsEx
shlwapi
PathFindExtensionA
PathFindFileNameA
PathRenameExtensionA
PathFileExistsA
PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
StrFormatKBSizeA
uxtheme
GetThemeColor
GetWindowTheme
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemePartSize
DrawThemeParentBackground
GetCurrentThemeName
IsAppThemed
DrawThemeText
ole32
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CoInitializeEx
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
oleaut32
SysAllocStringLen
VarBstrFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocString
SysStringLen
VariantChangeType
VariantClear
VariantInit
SysFreeString
gdiplus
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipDrawImageRectI
oleacc
CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
winmm
PlaySoundA
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 294KB - Virtual size: 294KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 384KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/config_server.xml.xml
-
malware-sample-library-master/Carbanak/Carbanak - part 2/Malware/example.config
-
malware-sample-library-master/Coinminers/msxml.exe.dll windows:6 windows x64 arch:x64
e80b1ef709e071173651c6bb53a95da0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ws2_32
htons
WSASetLastError
WSAStartup
select
WSARecvFrom
bind
WSAIoctl
WSASend
shutdown
WSASocketW
socket
WSARecv
ioctlsocket
FreeAddrInfoW
GetAddrInfoW
closesocket
getsockopt
setsockopt
htonl
WSAGetLastError
kernel32
GetACP
HeapReAlloc
CompareStringW
GetModuleFileNameA
ExitProcess
CreateMutexA
GetLastError
GetStdHandle
SetConsoleMode
GetConsoleMode
CloseHandle
FreeConsole
GetConsoleWindow
SetThreadAffinityMask
GetCurrentProcess
SetProcessAffinityMask
GetCurrentThread
VirtualFree
VirtualAlloc
LocalAlloc
LocalFree
SetPriorityClass
SetThreadPriority
GetProcAddress
GetModuleHandleW
TlsSetValue
EnterCriticalSection
ReleaseSemaphore
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
ResumeThread
SetEvent
TlsAlloc
ResetEvent
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
CreateEventA
GetModuleFileNameW
MultiByteToWideChar
QueryPerformanceFrequency
GetSystemInfo
GetCurrentProcessId
WideCharToMultiByte
QueryPerformanceCounter
GetTimeZoneInformation
SetConsoleCtrlHandler
PostQueuedCompletionStatus
Sleep
SetErrorMode
GetQueuedCompletionStatus
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
QueueUserWorkItem
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
SetConsoleCursorPosition
GetFileType
CreateDirectoryW
ReadFile
SetLastError
WriteFile
DeviceIoControl
RemoveDirectoryW
SetFileTime
CreateHardLinkW
GetFileAttributesW
GetFileInformationByHandle
SetFilePointerEx
MoveFileExW
CopyFileW
FlushFileBuffers
CancelIo
GetModuleHandleA
LoadLibraryA
FormatMessageA
DebugBreak
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
GetNamedPipeHandleStateA
SwitchToThread
ConnectNamedPipe
GetLongPathNameW
ReadDirectoryChangesW
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetStartupInfoW
HeapFree
HeapAlloc
SetFileAttributesW
GetFileAttributesExW
GetConsoleCP
SetStdHandle
GetModuleHandleExW
GetStringTypeW
HeapSize
GetProcessHeap
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
DecodePointer
SetHandleInformation
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
CreateEventW
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateThread
EncodePointer
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
InterlockedFlushSList
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetCommandLineA
GetCommandLineW
ExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
TranslateMessage
ShowWindow
DispatchMessageA
MapVirtualKeyW
GetMessageA
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
Exports
Exports
VoidFunc
Sections
.text Size: - Virtual size: 337KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 768B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/DPRK/BackdoorDLLworm.bin.dll windows:4 windows x86 arch:x86
f6f7b2e00921129d18061822197111cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetFileAttributesA
FindClose
FindNextFileA
RemoveDirectoryA
FindFirstFileA
Sleep
LocalAlloc
GetLocalTime
WaitForSingleObject
CreateThread
CloseHandle
GlobalFree
GlobalAlloc
GetProcAddress
LoadLibraryA
GetModuleHandleA
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
InitializeCriticalSection
GetLocaleInfoA
GetVersionExA
GetModuleFileNameA
GetSystemDirectoryA
GetTickCount
user32
ShowWindow
DialogBoxParamA
advapi32
SetServiceStatus
oleaut32
SystemTimeToVariantTime
msvcrt
_stricmp
_adjust_fdiv
strncpy
strstr
sprintf
rand
srand
__CxxFrameHandler
strncmp
??2@YAPAXI@Z
_endthreadex
fclose
fread
fopen
fwrite
_strupr
free
malloc
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_CxxThrowException
_except_handler3
_EH_prolog
memset
memcpy
??1type_info@@UAE@XZ
_initterm
Exports
Exports
??0CMssvcdll@@QAE@XZ
??4CMssvcdll@@QAEAAV0@ABV0@@Z
?fnMssvcdll@@YAHXZ
?nMssvcdll@@3HA
ServiceMain
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/DPRK/BackdoorHiddenCobra.bin.dll windows:4 windows x86 arch:x86
d437a11253a2bfcac7ef0334e82980d4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LocalFree
LocalAlloc
GetLastError
QueryDosDeviceA
GetLogicalDriveStringsA
OpenProcess
WideCharToMultiByte
FlushFileBuffers
GetFileSizeEx
GetCurrentProcessId
Sleep
GetLocaleInfoW
MultiByteToWideChar
GetComputerNameW
CloseHandle
GetVersionExW
GetExitCodeThread
GetTickCount
SetErrorMode
GetProcAddress
LoadLibraryA
ReadFile
CreateFileW
GetFileAttributesW
GetFileSize
WriteFile
DeleteFileW
MoveFileW
ProcessIdToSessionId
CompareStringW
CompareStringA
GetSystemInfo
GetModuleHandleA
TerminateThread
GetCurrentProcess
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
SetStdHandle
HeapReAlloc
VirtualAlloc
GetOEMCP
GetACP
GetCPInfo
HeapAlloc
SetFilePointer
SetEnvironmentVariableA
HeapFree
VirtualFree
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
user32
GetSystemMetrics
advapi32
GetTokenInformation
LookupAccountSidA
OpenProcessToken
ws2_32
setsockopt
shutdown
recv
send
WSAGetLastError
ioctlsocket
select
__WSAFDIsSet
closesocket
WSAStartup
socket
htons
bind
listen
inet_addr
connect
iphlpapi
GetTcpTable
version
VerQueryValueW
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
Exports
Exports
ServiceMain
_ServiceHandler@4
Sections
.text Size: 84KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/DPRK/BackdoorWormSMB2.0.exe.exe windows:4 windows x86 arch:x86
e8cd12071a8e823ebc434c8ee3e23203
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
FindResourceA
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetEndOfFile
LoadResource
LockResource
SizeofResource
DeleteFileA
CreateFileA
SetFileTime
CloseHandle
WriteFile
GetTickCount
GetLocalTime
SystemTimeToFileTime
GetFileAttributesA
CreateDirectoryA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
GetLastError
ReadFile
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
GetStringTypeW
user32
ShowWindow
EndDialog
PostQuitMessage
DialogBoxParamA
advapi32
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
ControlService
DeleteService
RegOpenKeyExA
RegSetValueExA
RegCloseKey
CreateServiceA
ChangeServiceConfig2A
RegCreateKeyA
StartServiceA
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/DPRK/HiddenCobra.exe.dll windows:4 windows x86 arch:x86
5e9c8819379d7bcee6003e9bdf4e6701
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteFileW
WriteFile
SetFilePointer
GetLastError
CreateFileW
GetSystemInfo
GetComputerNameW
InitializeCriticalSection
ReadFile
WaitForSingleObject
CreateProcessW
GetProcAddress
GetModuleHandleW
InterlockedDecrement
GetTickCount
GetFileAttributesW
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetSystemTime
FileTimeToSystemTime
GetFileSize
MoveFileW
FlushFileBuffers
GetFileSizeEx
CompareStringW
CompareStringA
LocalAlloc
LocalFree
Sleep
CloseHandle
GetVersionExW
CreateThread
LCMapStringW
LCMapStringA
SetStdHandle
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
SetEnvironmentVariableA
VirtualAlloc
VirtualFree
HeapCreate
GetTimeZoneInformation
GetLocalTime
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
GetVersion
HeapFree
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapAlloc
HeapSize
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
user32
GetSystemMetrics
advapi32
RegQueryValueExW
RegCloseKey
RegisterServiceCtrlHandlerW
SetServiceStatus
RegOpenKeyExW
oleaut32
SystemTimeToVariantTime
ws2_32
recv
send
WSAGetLastError
ioctlsocket
connect
socket
setsockopt
shutdown
closesocket
listen
WSAStartup
WSACleanup
select
__WSAFDIsSet
accept
htons
bind
iphlpapi
GetAdaptersInfo
Exports
Exports
ServiceMain
Sections
.text Size: 68KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/DPRK/HiddenCobraJoanap.bin.dll windows:4 windows x86 arch:x86
8eb98df155a15c10cb2536524122de9b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
QueryDosDeviceA
GetLogicalDriveStringsA
WideCharToMultiByte
LocalFree
LocalAlloc
GetLocaleInfoW
MultiByteToWideChar
GetComputerNameW
GetLastError
GetProcAddress
LoadLibraryA
GetTickCount
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetFileAttributesW
MoveFileW
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetModuleHandleA
CloseHandle
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
SetFilePointer
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
SetStdHandle
FlushFileBuffers
SetEnvironmentVariableA
ws2_32
htons
bind
listen
inet_addr
socket
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
VerQueryValueW
Exports
Exports
ServiceMain
Sections
.text Size: 92KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/DPRK/MoneroNorthKoreaPyongynag.bin.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\Jawhar\documents\visual studio 2017\Projects\ConsoleApp5\ConsoleApp5\obj\Release\ConsoleApp5.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/DPRK/RedDawnSunTeamAndroid.apk.apk android
com.security01.android.fastapplock
com.security01.android.fastapplock.MainActivity0
Activities
com.security01.android.fastapplock.MainActivity0
android.intent.action.MAIN
Permissions
android.permission.INTERNET
android.permission.BIND_ACCESSIBILITY_SERVICE
android.permission.CALL_PHONE
android.permission.CHANGE_WIFI_STATE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.PROCESS_OUTGOING_CALLS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.ACCESS_WIFI_STATE
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.GET_ACCOUNTS
android.permission.ACCESS_NETWORK_STATE
android.permission.WAKE_LOCK
com.google.android.c2dm.permission.RECEIVE
com.security01.android.fastapplock.permission.C2D_MESSAGE
Receivers
com.security01.android.fastapplock.WidgetProvider
android.appwidget.action.APPWIDGET_UPDATE
com.security01.android.fastapplock.IncomingCall
android.intent.action.PHONE_STATE
com.security01.android.fastapplock.OutgoingCallDetectReceiver
android.intent.action.NEW_OUTGOING_CALL
com.security01.android.fastapplock.StartupReceiver
android.intent.action.BOOT_COMPLETED
com.security01.android.fastapplock.UpdateBroadcastReceiver
android.intent.action.ACTION_MY_PACKAGE_REPLACED
com.security01.android.fastapplock.WifiOnOffReceiver
android.net.wifi.WIFI_STATE_CHANGED
com.security01.android.fastapplock.BluetoothOnOffReceiver
android.bluetooth.adapter.action.STATE_CHANGED
com.security01.android.fastapplock.AdminReceiver
android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.DEVICE_ADMIN_DISABLED
com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver
com.android.vending.INSTALL_REFERRER
com.google.firebase.iid.FirebaseInstanceIdReceiver
com.google.android.c2dm.intent.RECEIVE
com.google.android.c2dm.intent.REGISTRATION
Services
com.security01.android.fastapplock.WidgetService
com.security01.android.fastapplock.intent.ACTION_WIDGET_TOUCH
com.security01.android.fastapplock.Access
android.accessibilityservice.AccessibilityService
com.google.firebase.iid.FirebaseInstanceIdService
com.google.firebase.INSTANCE_ID_EVENT
-
malware-sample-library-master/DPRK/SunTeamAndroid.apk.apk android
com.easylock.applockfree
com.studioapplock.applock.freeapplock.activities.activityonejava
Activities
com.studioapplock.applock.freeapplock.activities.activityonejava
android.intent.action.MAIN
Permissions
android.permission.INTERNET
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.READ_PHONE_STATE
com.android.browser.permission.READ_HISTORY_BOOKMARKS
android.permission.KILL_BACKGROUND_PROCESSES
com.android.browser.permission.WRITE_HISTORY_BOOKMARKS
android.permission.CLEAR_APP_CACHE
android.permission.GET_PACKAGE_SIZE
android.permission.VIBRATE
android.permission.CAMERA
android.permission.SYSTEM_ALERT_WINDOW
android.permission.PACKAGE_USAGE_STATS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.WAKE_LOCK
android.permission.GET_TASKS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.WAKE_LOCK
com.google.android.c2dm.permission.RECEIVE
com.studioapplock.free.android.permission.C2D_MESSAGE
Receivers
com.studioapplock.applock.freeapplock.receiver.BootCompletedReceiver
android.intent.action.QUICKBOOT_POWERON
android.intent.action.BOOT_COMPLETED
android.intent.action.USER_PRESENT
android.net.wifi.WIFI_STATE_CHANGED
android.intent.action.SCREEN_ON
Services
com.studioapplock.applock.freeapplock.service.MyAccessibilityService
android.accessibilityservice.AccessibilityService
-
malware-sample-library-master/DPRK/SunTeamRedDawn.apk.apk android
com.umsikgonghap.health.gonghap
com.umsikgonghap.health.gonghap.MainActivity
Activities
com.umsikgonghap.health.gonghap.MainActivity
android.intent.action.MAIN
Permissions
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
Receivers
com.umsikgonghap.health.gonghap.BroadcastReciver
android.intent.action.BOOT_COMPLETED
Services
-
malware-sample-library-master/DarkTequila/DarkTequila.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 854KB - Virtual size: 856KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
malware-sample-library-master/DragonflyAPT/GreyEnergyImplant2018.bin.exe windows:4 windows x86 arch:x86
f73d098ba05eba6e3d639538e7faa89f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
UnhandledExceptionFilter
IsDebuggerPresent
GetLastError
lstrlenA
user32
MessageBoxA
advapi32
RevertToSelf
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
malware-sample-library-master/Duqu/VirusShare_03bb47f461c51203d6799919dbb37012.zip.zip
-
malware-sample-library-master/Duqu/VirusShare_15972bdf667c595e9cba11842a6d905e.zip.zip
-
malware-sample-library-master/Duqu/VirusShare_1c35a13a0da0ea687100a7b273f9a5af.zip.zip
-
malware-sample-library-master/Duqu/VirusShare_745f96875b4ab8fb73c14b094e9c74f0.zip.zip
-
malware-sample-library-master/Duqu/VirusShare_e64d31ef596e86997ca0fffcfb3d1ce8.zip.zip
-
malware-sample-library-master/Duqu/VirusShare_f15b86eaf846fc7e9a074caf0ee78b63.zip.zip
-
malware-sample-library-master/DustSquad/DustSquadInformation.txt
-
malware-sample-library-master/DustSquad/OctopusDelphi.exe.exe windows:5 windows x86 arch:x86
7131fce8e12ee40d975b8d017bd6e30c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
user32
MessageBoxA
CharNextW
LoadStringW
PeekMessageW
OemToCharBuffW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
CharUpperBuffW
CharUpperW
CharLowerBuffW
kernel32
Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsDBCSLeadByteEx
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetConsoleOutputCP
GetConsoleCP
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
WriteFile
SetFilePointer
SetEndOfFile
ReadFile
GetFileType
GetFileSize
CreateFileW
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VerSetConditionMask
VerifyVersionInfoW
UnmapViewOfFile
TryEnterCriticalSection
SwitchToThread
SuspendThread
Sleep
SetVolumeLabelW
SetThreadPriority
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesW
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryW
ReadFile
RaiseException
QueryDosDeviceW
IsDebuggerPresent
MoveFileW
MapViewOfFile
LocalFree
LocalFileTimeToFileTime
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVolumeInformationW
GetVersionExW
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathW
GetTempFileNameW
GetSystemTimes
GetStdHandle
GetProcAddress
GetOEMCP
GetModuleHandleW
GetModuleFileNameW
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileTime
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetComputerNameW
GetCPInfoExW
GetCPInfo
GetACP
FreeLibrary
FormatMessageW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DosDateTimeToFileTime
DeleteFileW
DeleteCriticalSection
CreateProcessW
CreateFileMappingW
CreateFileW
CreateEventW
CompareStringW
CloseHandle
Sleep
shell32
ShellExecuteW
SHGetSpecialFolderPathW
msvcrt
sprintf
_ftol
strncmp
_stricmp
Exports
Exports
TMethodImplementationIntercept
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 22KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: 1024B - Virtual size: 556B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 94B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 167KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 55KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/DustSquad/OctopusTelegramMessengerDropper.bin.zip
-
malware-sample-library-master/EnergeticBear/BerserkBear Downloader.bin.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 159KB - Virtual size: 249KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 978B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/EnergeticBear/Energetic Bear Implant.exe windows:6 windows x64 arch:x64
6dfd283212216123373d6f57e66e4ef4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ExpandEnvironmentStringsW
CreateFileW
WriteFile
CloseHandle
LoadResource
LockResource
SizeofResource
FindResourceA
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetACP
GetCurrentThread
OutputDebugStringA
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetFileType
GetStringTypeW
SetConsoleCtrlHandler
HeapSize
HeapReAlloc
WriteConsoleW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Sections
.text Size: 366KB - Virtual size: 366KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 1024B - Virtual size: 977B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 283B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/EnergeticBear/Energetic Bear Implant?id=fm&fchmod=$dir$file.exe windows:6 windows x64 arch:x64
6dfd283212216123373d6f57e66e4ef4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ExpandEnvironmentStringsW
CreateFileW
WriteFile
CloseHandle
LoadResource
LockResource
SizeofResource
FindResourceA
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetACP
GetCurrentThread
OutputDebugStringA
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetFileType
GetStringTypeW
SetConsoleCtrlHandler
HeapSize
HeapReAlloc
WriteConsoleW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Sections
.text Size: 366KB - Virtual size: 366KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 1024B - Virtual size: 977B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 283B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/EnergeticBear/Energetic Bear Implant?page=filemanager&id=fm&fchmod=$dir$file.exe windows:6 windows x64 arch:x64
6dfd283212216123373d6f57e66e4ef4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ExpandEnvironmentStringsW
CreateFileW
WriteFile
CloseHandle
LoadResource
LockResource
SizeofResource
FindResourceA
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetACP
GetCurrentThread
OutputDebugStringA
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetFileType
GetStringTypeW
SetConsoleCtrlHandler
HeapSize
HeapReAlloc
WriteConsoleW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Sections
.text Size: 366KB - Virtual size: 366KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 1024B - Virtual size: 977B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 283B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/EquationGroup/DoubleFantasyEquation.bin.exe windows:4 windows x86 arch:x86
06077528a493591043dbfe56888ce29f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegCloseKey
RegSetValueExA
RegOpenKeyExA
StartServiceW
OpenServiceW
CloseServiceHandle
OpenSCManagerA
RegCreateKeyExA
FreeSid
LookupAccountSidW
AllocateAndInitializeSid
GetUserNameW
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
DuplicateTokenEx
OpenThreadToken
AccessCheck
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
RegEnumKeyExA
RegQueryValueExA
msvcrt
??2@YAPAXI@Z
_strlwr
wcsncpy
strchr
memset
_controlfp
free
calloc
malloc
_strnicmp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strcmp
_snwprintf
_wcsicmp
wcslen
wcscpy
memcmp
_local_unwind2
strncat
tolower
??3@YAXPAX@Z
time
gmtime
strrchr
strncmp
_snprintf
memcpy
memmove
difftime
strstr
strncpy
_stricmp
_splitpath
strlen
strcpy
user32
DestroyWindow
CharNextA
CreateAcceleratorTableW
CreateWindowExW
kernel32
TlsGetValue
TlsAlloc
WaitForSingleObjectEx
GetExitCodeThread
GetVersionExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
OpenProcess
TerminateProcess
LoadLibraryW
VirtualLock
VirtualUnlock
VirtualFree
ReleaseMutex
GetTempPathW
GetTempFileNameW
CreateFileW
DeleteFileW
LoadLibraryExA
OpenMutexW
CreateMutexW
UnmapViewOfFile
SetLastError
GetModuleHandleA
GetCurrentThread
GetCurrentProcess
GetCurrentProcessId
SetFileAttributesA
SetFileTime
GetFileAttributesA
FindNextFileA
FindFirstFileA
FindClose
FindResourceA
SizeofResource
LoadResource
LockResource
MoveFileExA
GetWindowsDirectoryA
CreateFileA
GetFileSize
ReadFile
CloseHandle
WriteFile
LocalAlloc
GetSystemDirectoryA
GetVersionExA
CreateDirectoryA
GetModuleFileNameA
GetTempPathA
IsBadReadPtr
MultiByteToWideChar
LocalFree
GetSystemTime
GetStartupInfoA
CreateProcessA
LoadLibraryA
GetLastError
FreeLibrary
WaitForSingleObject
DeleteFileA
Sleep
ExitProcess
GetVersion
GetProcAddress
VirtualAlloc
ReadProcessMemory
Sections
.text Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Flame/VirusShare_089d45e4c3bb60388211aa669deab26a.zip.zip
-
malware-sample-library-master/Flame/VirusShare_56e4fb972828fafbbdc11158a1b5fa72.zip.zip
-
malware-sample-library-master/Flame/VirusShare_695056ffacef1fdaa326d7c8bb0f88ba.zip.zip
-
malware-sample-library-master/Flame/VirusShare_8d90e3c68030fbb91ad5b920d5e17b32.zip.zip
-
malware-sample-library-master/Flame/VirusShare_af34546979079042a99b99b5613ad26b.zip.zip
-
malware-sample-library-master/Flame/VirusShare_e5f19ea43397103470b60a750149b753.zip.zip
-
malware-sample-library-master/Flame/VirusShare_f923ae31c3bb49f3b4b04d48f564a1ec.zip.zip
-
malware-sample-library-master/GamaredonGroup/928aa3d3e26e9e285ccaf0b0132b92d2711de3a9f5d58244934854d02a529f70.dll windows:6 windows x86 arch:x86
9537c3497fb9a0d0a3b25848caf81f84
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
LoadLibraryA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
CloseHandle
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetStdHandle
GetFileType
WriteFile
GetConsoleCP
HeapAlloc
HeapReAlloc
GetStringTypeW
GetACP
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
FlushFileBuffers
CreateFileW
WriteConsoleW
HeapSize
SetEndOfFile
DecodePointer
Exports
Exports
8f348c99e04186bea89
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GamaredonGroup/9fc5081ba3c1a4473ac1ffa3d653096afa16684a3e819ce6745bc22d38bb97f9.exe windows:4 windows x86 arch:x86
1d1577d864d2da06952f7affd8635371
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
shell32
SHGetSpecialFolderPathW
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteExW
gdi32
CreateCompatibleDC
CreateFontIndirectW
DeleteObject
DeleteDC
GetCurrentObject
StretchBlt
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
GetObjectW
advapi32
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
user32
GetMenu
SetWindowPos
GetWindowDC
ReleaseDC
CopyImage
GetKeyState
GetWindowRect
ScreenToClient
GetWindowLongW
SetTimer
GetMessageW
DispatchMessageW
KillTimer
DestroyWindow
EndDialog
SendMessageW
wsprintfW
GetClassNameA
GetWindowTextW
GetWindowTextLengthW
GetSysColor
wsprintfA
SetWindowTextW
CreateWindowExW
GetDlgItem
GetClientRect
SetWindowLongW
UnhookWindowsHookEx
SetFocus
GetSystemMetrics
SystemParametersInfoW
ShowWindow
DrawTextW
GetDC
ClientToScreen
GetWindow
DialogBoxIndirectParamW
DrawIconEx
CallWindowProcW
DefWindowProcW
CallNextHookEx
PtInRect
SetWindowsHookExW
LoadImageW
LoadIconW
MessageBeep
EnableWindow
IsWindow
EnableMenuItem
GetSystemMenu
wvsprintfW
CharUpperW
MessageBoxA
GetParent
ole32
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize
oleaut32
SysAllocString
VariantClear
OleLoadPicture
kernel32
SetFileTime
SetEndOfFile
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleA
LeaveCriticalSection
WaitForMultipleObjects
ReadFile
SetFilePointer
GetFileSize
FormatMessageW
lstrcpyW
LocalFree
IsBadReadPtr
GetSystemDirectoryW
GetCurrentThreadId
SuspendThread
TerminateThread
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
GetVersionExW
GetModuleFileNameW
GetCurrentProcess
SetProcessWorkingSetSize
SetCurrentDirectoryW
GetDriveTypeW
CreateFileW
GetCommandLineW
GetStartupInfoW
CreateProcessW
CreateJobObjectW
ResumeThread
AssignProcessToJobObject
CreateIoCompletionPort
SetInformationJobObject
GetQueuedCompletionStatus
GetExitCodeProcess
CloseHandle
SetEnvironmentVariableW
GetTempPathW
GetSystemTimeAsFileTime
lstrlenW
CompareFileTime
SetThreadLocale
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
ExpandEnvironmentStringsW
WideCharToMultiByte
VirtualAlloc
GlobalMemoryStatusEx
lstrcmpW
GetEnvironmentVariableW
lstrcmpiW
lstrlenA
GetLocaleInfoW
MultiByteToWideChar
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetSystemDefaultLCID
lstrcmpiA
GlobalAlloc
GlobalFree
MulDiv
FindResourceExA
SizeofResource
LoadResource
LockResource
LoadLibraryA
ExitProcess
lstrcatW
GetDiskFreeSpaceExW
SetFileAttributesW
SetLastError
Sleep
GetExitCodeThread
WaitForSingleObject
CreateThread
GetLastError
SystemTimeToFileTime
GetLocalTime
GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetModuleHandleW
GetProcAddress
GetStartupInfoA
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
free
memcpy
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
memset
_wcsnicmp
strncmp
wcsncmp
malloc
memmove
_wtol
_purecall
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GamaredonGroup/GamaredonImplant.bin.exe windows:4 windows x86 arch:x86
1d1577d864d2da06952f7affd8635371
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
shell32
SHGetSpecialFolderPathW
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteExW
gdi32
CreateCompatibleDC
CreateFontIndirectW
DeleteObject
DeleteDC
GetCurrentObject
StretchBlt
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
GetObjectW
advapi32
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
user32
GetMenu
SetWindowPos
GetWindowDC
ReleaseDC
CopyImage
GetKeyState
GetWindowRect
ScreenToClient
GetWindowLongW
SetTimer
GetMessageW
DispatchMessageW
KillTimer
DestroyWindow
EndDialog
SendMessageW
wsprintfW
GetClassNameA
GetWindowTextW
GetWindowTextLengthW
GetSysColor
wsprintfA
SetWindowTextW
CreateWindowExW
GetDlgItem
GetClientRect
SetWindowLongW
UnhookWindowsHookEx
SetFocus
GetSystemMetrics
SystemParametersInfoW
ShowWindow
DrawTextW
GetDC
ClientToScreen
GetWindow
DialogBoxIndirectParamW
DrawIconEx
CallWindowProcW
DefWindowProcW
CallNextHookEx
PtInRect
SetWindowsHookExW
LoadImageW
LoadIconW
MessageBeep
EnableWindow
IsWindow
EnableMenuItem
GetSystemMenu
wvsprintfW
CharUpperW
MessageBoxA
GetParent
ole32
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize
oleaut32
SysAllocString
VariantClear
OleLoadPicture
kernel32
SetFileTime
SetEndOfFile
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleA
LeaveCriticalSection
WaitForMultipleObjects
ReadFile
SetFilePointer
GetFileSize
FormatMessageW
lstrcpyW
LocalFree
IsBadReadPtr
GetSystemDirectoryW
GetCurrentThreadId
SuspendThread
TerminateThread
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
GetVersionExW
GetModuleFileNameW
GetCurrentProcess
SetProcessWorkingSetSize
SetCurrentDirectoryW
GetDriveTypeW
CreateFileW
GetCommandLineW
GetStartupInfoW
CreateProcessW
CreateJobObjectW
ResumeThread
AssignProcessToJobObject
CreateIoCompletionPort
SetInformationJobObject
GetQueuedCompletionStatus
GetExitCodeProcess
CloseHandle
SetEnvironmentVariableW
GetTempPathW
GetSystemTimeAsFileTime
lstrlenW
CompareFileTime
SetThreadLocale
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
ExpandEnvironmentStringsW
WideCharToMultiByte
VirtualAlloc
GlobalMemoryStatusEx
lstrcmpW
GetEnvironmentVariableW
lstrcmpiW
lstrlenA
GetLocaleInfoW
MultiByteToWideChar
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetSystemDefaultLCID
lstrcmpiA
GlobalAlloc
GlobalFree
MulDiv
FindResourceExA
SizeofResource
LoadResource
LockResource
LoadLibraryA
ExitProcess
lstrcatW
GetDiskFreeSpaceExW
SetFileAttributesW
SetLastError
Sleep
GetExitCodeThread
WaitForSingleObject
CreateThread
GetLastError
SystemTimeToFileTime
GetLocalTime
GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetModuleHandleW
GetProcAddress
GetStartupInfoA
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
free
memcpy
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
memset
_wcsnicmp
strncmp
wcsncmp
malloc
memmove
_wtol
_purecall
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GamaredonGroup/ff5ce90c78eb4d6c2714bd659fb6fbbb9afc50d03a16d32015ff350d79f6fec4.dll windows:6 windows x86 arch:x86
9537c3497fb9a0d0a3b25848caf81f84
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
LoadLibraryA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
CloseHandle
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetStdHandle
GetFileType
WriteFile
GetConsoleCP
HeapAlloc
HeapReAlloc
GetStringTypeW
GetACP
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
FlushFileBuffers
CreateFileW
WriteConsoleW
HeapSize
SetEndOfFile
DecodePointer
Exports
Exports
a03b074a6b086d1854b
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GandCrab/GandCrabv4.exe.exe windows:5 windows x86 arch:x86
1aa1bb71f8b759604ff63ee95cbaebec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryW
TerminateProcess
GetModuleFileNameW
ExitThread
MultiByteToWideChar
lstrlenW
VirtualUnlock
GetSystemInfo
WaitForMultipleObjects
lstrcmpiW
lstrcatW
GetUserDefaultUILanguage
DeleteCriticalSection
GetShortPathNameW
GetWindowsDirectoryW
lstrcpyW
GetVolumeInformationW
CreateThread
lstrcpyA
ExpandEnvironmentStringsW
lstrlenA
GetTickCount
lstrcmpiA
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
EnterCriticalSection
VirtualLock
FindFirstFileW
lstrcmpW
MoveFileW
FindClose
FindNextFileW
GetSystemTime
GetNativeSystemInfo
GetDriveTypeW
GetModuleHandleW
GetProcAddress
GetDiskFreeSpaceW
VerSetConditionMask
GetCurrentProcess
VerifyVersionInfoW
LoadLibraryA
LocalAlloc
GetModuleHandleA
LocalFree
SetStdHandle
GetConsoleMode
GetConsoleCP
InitializeCriticalSection
GetDriveTypeA
GetCommandLineA
GetProcessHeap
VirtualFree
GetComputerNameW
WaitForSingleObject
VirtualAlloc
SetErrorMode
GetSystemDefaultUILanguage
ExitProcess
CloseHandle
GetLastError
CreateFileW
ReadFile
Sleep
WriteFile
SetFilePointerEx
LeaveCriticalSection
FlushFileBuffers
OutputDebugStringW
HeapAlloc
RtlUnwind
LoadLibraryExW
GetStdHandle
LCMapStringW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
GetModuleHandleExW
WideCharToMultiByte
HeapFree
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
IsDebuggerPresent
WriteConsoleW
user32
wsprintfW
GetForegroundWindow
advapi32
CryptGetKeyParam
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetUserNameW
CryptDestroyKey
CryptGenKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptAcquireContextW
CryptExportKey
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
shell32
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
mpr
WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW
wininet
HttpQueryInfoA
HttpSendRequestW
InternetConnectW
InternetOpenW
InternetCloseHandle
HttpOpenRequestW
Sections
.text Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 41KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GandCrab/GandCrabv5RandomExtension.bin.exe windows:5 windows x86 arch:x86
b351a11d42d2d65c00cf0d66b1e1575a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualUnlock
OpenMutexW
GetSystemInfo
WaitForMultipleObjects
lstrcmpiW
GetUserDefaultUILanguage
DeleteCriticalSection
GetShortPathNameW
GetWindowsDirectoryW
GetVolumeInformationW
CreateThread
lstrcpyA
ExpandEnvironmentStringsW
GetTickCount
lstrcmpiA
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
VirtualLock
FindFirstFileExW
WideCharToMultiByte
lstrcmpW
MoveFileW
FindClose
FindNextFileW
GetSystemTime
GetNativeSystemInfo
GetDriveTypeW
GetDiskFreeSpaceW
ExitThread
VerSetConditionMask
VerifyVersionInfoW
SetLastError
LoadLibraryA
LocalAlloc
GetModuleHandleA
LocalFree
GlobalAlloc
MulDiv
GetTempPathW
GlobalFree
FindFirstFileW
ConnectNamedPipe
CreateNamedPipeW
CreateEventW
GetCurrentProcessId
GetFullPathNameW
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
OutputDebugStringW
HeapAlloc
RtlUnwind
GetModuleFileNameW
TerminateProcess
VirtualAlloc
OpenProcess
InitializeCriticalSection
GetDriveTypeA
GetCommandLineA
GetProcessHeap
GetComputerNameW
WaitForSingleObject
SetErrorMode
GetSystemDefaultUILanguage
CreateMutexW
ExitProcess
lstrcpyW
lstrcatW
GetProcAddress
GetLastError
LoadLibraryW
GetSystemDirectoryW
GetModuleHandleW
GetCurrentProcess
LoadLibraryExW
VirtualQuery
MultiByteToWideChar
VirtualFree
lstrlenA
CloseHandle
lstrlenW
CreateFileW
ReadFile
Sleep
WriteFile
LockFile
UnlockFile
SetFilePointerEx
GetStdHandle
LCMapStringW
IsDebuggerPresent
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
HeapFree
GetModuleHandleExW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
EncodePointer
DecodePointer
WriteConsoleW
user32
SystemParametersInfoW
ReleaseDC
GetDC
wsprintfA
wsprintfW
CreateWindowStationW
SetProcessWindowStation
DrawTextA
DrawTextW
FillRect
GetForegroundWindow
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetPixel
GetStockObject
SetBitmapBits
CreateBitmap
GetBitmapBits
advapi32
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetUserNameW
CryptDestroyKey
CryptGenKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CryptExportKey
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
shell32
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
ole32
CoInitialize
CoCreateInstance
CoUninitialize
mpr
WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW
wininet
InternetOpenW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoA
InternetCloseHandle
InternetConnectW
rpcrt4
NdrClientCall2
Sections
.text Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 55KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GandCrab/Gandcrab5.0.2.bin.exe windows:5 windows x86 arch:x86
736a6a11a44089aba4b68375d4e88177
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualUnlock
OpenMutexW
GetSystemInfo
WaitForMultipleObjects
lstrcmpiW
GetUserDefaultUILanguage
DeleteCriticalSection
GetShortPathNameW
GetWindowsDirectoryW
GetVolumeInformationW
CreateThread
lstrcpyA
ExpandEnvironmentStringsW
GetTickCount
lstrcmpiA
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
VirtualLock
FindFirstFileW
FindFirstFileExW
WideCharToMultiByte
lstrcmpW
MoveFileW
FindClose
FindNextFileW
GetSystemTime
GetNativeSystemInfo
GetDriveTypeW
GetDiskFreeSpaceW
ExitThread
VerSetConditionMask
VerifyVersionInfoW
SetLastError
LoadLibraryA
LocalAlloc
GetModuleHandleA
LocalFree
GlobalAlloc
MulDiv
GetTempPathW
GlobalFree
ConnectNamedPipe
CreateNamedPipeW
CreateEventW
GetCurrentProcessId
GetFullPathNameW
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
OutputDebugStringW
HeapAlloc
RtlUnwind
GetModuleFileNameW
TerminateProcess
VirtualAlloc
OpenProcess
InitializeCriticalSection
GetDriveTypeA
GetCommandLineA
GetProcessHeap
GetComputerNameW
WaitForSingleObject
SetErrorMode
GetSystemDefaultUILanguage
CreateMutexW
ExitProcess
lstrcpyW
lstrcatW
GetProcAddress
GetLastError
LoadLibraryW
GetSystemDirectoryW
GetModuleHandleW
GetCurrentProcess
LoadLibraryExW
VirtualQuery
MultiByteToWideChar
VirtualFree
lstrlenA
CloseHandle
lstrlenW
CreateFileW
ReadFile
Sleep
WriteFile
LockFile
UnlockFile
SetFilePointerEx
GetStdHandle
LCMapStringW
IsDebuggerPresent
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
HeapFree
GetModuleHandleExW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
EncodePointer
DecodePointer
WriteConsoleW
user32
SystemParametersInfoW
ReleaseDC
GetDC
wsprintfA
wsprintfW
CreateWindowStationW
SetProcessWindowStation
DrawTextA
DrawTextW
FillRect
GetForegroundWindow
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetPixel
GetStockObject
SetBitmapBits
CreateBitmap
GetBitmapBits
advapi32
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetUserNameW
CryptDestroyKey
CryptGenKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CryptExportKey
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
shell32
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
ole32
CoInitialize
CoCreateInstance
CoUninitialize
mpr
WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW
wininet
InternetOpenW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoA
InternetCloseHandle
InternetConnectW
rpcrt4
NdrClientCall2
Sections
.text Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 55KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GandCrab/Gandcrab5.0.3.exe.exe windows:4 windows x86 arch:x86
754f05425de4ad06169098be9bbe56cb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord641
ord324
ord825
ord2302
ord1768
ord537
ord4710
ord800
ord535
ord860
ord540
ord4275
ord5290
ord3402
ord3619
ord6055
ord1776
ord4424
ord3721
ord809
ord795
ord2614
ord556
ord567
ord3626
ord3663
ord2414
ord5875
ord1088
ord2122
ord1641
ord2860
ord6199
ord3874
ord3797
ord6358
ord858
ord6197
ord2859
ord6880
ord2864
ord941
ord5572
ord2915
ord5065
ord1771
ord6366
ord2413
ord4401
ord3639
ord692
ord823
ord3803
ord4277
ord939
ord940
ord5856
ord2784
ord4160
ord2379
ord4220
ord2584
ord3654
ord2438
ord6270
ord2863
ord1644
ord1146
ord6877
ord2763
ord6930
ord6928
ord5861
ord6883
ord6283
ord6282
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord1168
ord2358
ord2301
ord2370
ord755
ord470
ord6334
ord801
ord541
ord3092
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord6453
ord4234
ord1576
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
_setmbcp
__CxxFrameHandler
_mbsstr
_mbsspn
free
_mbstok
_strdup
__dllonexit
kernel32
GetModuleHandleA
LoadLibraryA
VirtualProtect
lstrcatA
lstrcpyA
GetWindowsDirectoryA
FreeLibrary
GetStartupInfoA
GlobalAlloc
GlobalUnlock
GlobalLock
user32
InflateRect
ReleaseDC
GetDC
GetParent
GetWindowRect
IsWindow
LoadCursorA
RedrawWindow
PtInRect
GetCursorPos
KillTimer
GetSystemMetrics
DrawFocusRect
GetSubMenu
LoadMenuA
EnumWindows
LoadIconA
GetSysColor
GetSystemMenu
LoadAcceleratorsA
DrawIcon
IsIconic
UpdateWindow
TranslateAcceleratorA
SetWindowLongA
GetClientRect
SetTimer
SetCursor
SendMessageA
DestroyCursor
EmptyClipboard
SetClipboardData
OpenClipboard
CloseClipboard
AppendMenuA
InvalidateRect
EnableWindow
CopyIcon
gdi32
CreateFontIndirectA
GetTextMetricsA
GetCharWidthA
GetTextExtentPoint32A
GetObjectA
GetStockObject
advapi32
RegQueryValueA
RegCloseKey
RegOpenKeyExA
shell32
ShellExecuteA
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 84KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xml Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
malware-sample-library-master/GandCrab/Gandcrabv5.0.2exe.bin.exe windows:5 windows x86 arch:x86
736a6a11a44089aba4b68375d4e88177
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualUnlock
OpenMutexW
GetSystemInfo
WaitForMultipleObjects
lstrcmpiW
GetUserDefaultUILanguage
DeleteCriticalSection
GetShortPathNameW
GetWindowsDirectoryW
GetVolumeInformationW
CreateThread
lstrcpyA
ExpandEnvironmentStringsW
GetTickCount
lstrcmpiA
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
VirtualLock
FindFirstFileW
FindFirstFileExW
WideCharToMultiByte
lstrcmpW
MoveFileW
FindClose
FindNextFileW
GetSystemTime
GetNativeSystemInfo
GetDriveTypeW
GetDiskFreeSpaceW
ExitThread
VerSetConditionMask
VerifyVersionInfoW
SetLastError
LoadLibraryA
LocalAlloc
GetModuleHandleA
LocalFree
GlobalAlloc
MulDiv
GetTempPathW
GlobalFree
ConnectNamedPipe
CreateNamedPipeW
CreateEventW
GetCurrentProcessId
GetFullPathNameW
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
OutputDebugStringW
HeapAlloc
RtlUnwind
GetModuleFileNameW
TerminateProcess
VirtualAlloc
OpenProcess
InitializeCriticalSection
GetDriveTypeA
GetCommandLineA
GetProcessHeap
GetComputerNameW
WaitForSingleObject
SetErrorMode
GetSystemDefaultUILanguage
CreateMutexW
ExitProcess
lstrcpyW
lstrcatW
GetProcAddress
GetLastError
LoadLibraryW
GetSystemDirectoryW
GetModuleHandleW
GetCurrentProcess
LoadLibraryExW
VirtualQuery
MultiByteToWideChar
VirtualFree
lstrlenA
CloseHandle
lstrlenW
CreateFileW
ReadFile
Sleep
WriteFile
LockFile
UnlockFile
SetFilePointerEx
GetStdHandle
LCMapStringW
IsDebuggerPresent
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
HeapFree
GetModuleHandleExW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
EncodePointer
DecodePointer
WriteConsoleW
user32
SystemParametersInfoW
ReleaseDC
GetDC
wsprintfA
wsprintfW
CreateWindowStationW
SetProcessWindowStation
DrawTextA
DrawTextW
FillRect
GetForegroundWindow
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetPixel
GetStockObject
SetBitmapBits
CreateBitmap
GetBitmapBits
advapi32
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetUserNameW
CryptDestroyKey
CryptGenKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CryptExportKey
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
shell32
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
ole32
CoInitialize
CoCreateInstance
CoUninitialize
mpr
WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW
wininet
InternetOpenW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoA
InternetCloseHandle
InternetConnectW
rpcrt4
NdrClientCall2
Sections
.text Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 55KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GoziGroup/GoziBankerISFB.exe.exe windows:4 windows x86 arch:x86
91dd9e8484082865d27a3f4ddc672144
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
HeapAlloc
HeapDestroy
HeapCreate
HeapFree
GetModuleHandleA
ExitProcess
CreateEventA
CloseHandle
GetTickCount
VirtualFree
VirtualAlloc
VirtualProtect
GetProcAddress
LoadLibraryA
WaitForSingleObject
SetEvent
ntdll
memcpy
memset
RtlUnwind
NtQueryVirtualMemory
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 30KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GoziGroup/HeVRmuUO.exe_.exe.exe windows:5 windows x86 arch:x86
748191526761b4423deb53fba9b95d54
Code Sign
04:00:00:00:00:01:2f:4e:e1:52:d7Certificate
IssuerCN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BENot Before13-04-2011 10:00Not After28-01-2028 12:00SubjectCN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BEKey Usages
KeyUsageCertSign
KeyUsageCRLSign
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate
IssuerCN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BENot Before24-05-2016 00:00Not After24-06-2027 00:00SubjectCN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SGExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
52:fa:ba:84:ef:2a:42:d9:8d:3c:2b:8c:46:db:57:a5Certificate
IssuerCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before15-06-2018 00:00Not After15-06-2019 23:59SubjectCN=SARI SEFWI LIMITED,O=SARI SEFWI LIMITED,POSTALCODE=SW9 7HX,STREET=147 St. James's Crescent,L=London,ST=London,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate
IssuerCN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before09-05-2013 00:00Not After08-05-2028 23:59SubjectCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
00:df:4c:82:e4:e1:25:61:44:41:83:22:6a:18:33:d7:fb:1b:a5:4eSigner
Actual PE Digest00:df:4c:82:e4:e1:25:61:44:41:83:22:6a:18:33:d7:fb:1b:a5:4eDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
##################RRRRRRRRRRRRRRRRRR.pdb
Imports
msvcrt
memcpy
userenv
ProcessGroupPolicyCompleted
kernel32
GetVersion
GetNativeSystemInfo
GetUserDefaultLCID
user32
RegisterShellHookWindow
mprapi
MprConfigInterfaceCreate
advapi32
RegRestoreKeyA
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt1 Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 284KB - Virtual size: 283KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 788B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GoziGroup/KRKeMaIts.exe_.exe.exe windows:5 windows x86 arch:x86
8c958c88156ebb6ca95a073dd1e6f0d5
Code Sign
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before31-12-2015 00:00Not After09-07-2019 18:40SubjectCN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
b5:2f:c0:0f:f7:d3:3b:4e:c4:11:3f:b9:ca:a4:e3:95Certificate
IssuerCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before12-07-2018 00:00Not After12-07-2019 23:59SubjectCN=LOKALIX LIMITED,O=LOKALIX LIMITED,POSTALCODE=W5 3TA,STREET=52-53 The Mall,L=London,ST=London,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate
IssuerCN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before09-05-2013 00:00Not After08-05-2028 23:59SubjectCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
d7:07:b8:da:7b:9e:27:16:e8:59:1a:69:50:bf:29:4a:03:e8:ff:d1Signer
Actual PE Digestd7:07:b8:da:7b:9e:27:16:e8:59:1a:69:50:bf:29:4a:03:e8:ff:d1Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
lejjwppqbncvm,xfkjhjasockzlefp.pdb
Imports
msvcrt
memcpy
kernel32
LocaleNameToLCID
IsSystemResumeAutomatic
CreateTimerQueue
GetFileSize
GetProcessShutdownParameters
FreeLibrary
GetProcAddress
LocalFree
GetPrivateProfileStructW
RaiseException
LocalAlloc
LoadLibraryA
InterlockedExchange
GetLastError
shlwapi
PathUnExpandEnvStringsA
setupapi
SetupGetBackupInformationW
crypt32
CertGetCRLContextProperty
ws2_32
WSAIsBlocking
clusapi
ClusterRegCloseKey
user32
LoadCursorA
mprapi
MprAdminPortDisconnect
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 284KB - Virtual size: 283KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 972B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GoziGroup/lsPEcswsco.exe_.exe.exe windows:5 windows x86 arch:x86
eafc215d8ba93e941a1de3868dbfd953
Code Sign
07Certificate
IssuerCN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=USNot Before03-05-2011 07:00Not After03-05-2031 07:00SubjectCN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=USKey Usages
KeyUsageCertSign
KeyUsageCRLSign
b5:2f:c0:0f:f7:d3:3b:4e:c4:11:3f:b9:ca:a4:e3:95Certificate
IssuerCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before12-07-2018 00:00Not After12-07-2019 23:59SubjectCN=LOKALIX LIMITED,O=LOKALIX LIMITED,POSTALCODE=W5 3TA,STREET=52-53 The Mall,L=London,ST=London,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
ef:95:c2:f4:80:e3:1b:93Certificate
IssuerCN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=USNot Before14-11-2017 07:00Not After14-11-2022 07:00SubjectCN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate
IssuerCN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before09-05-2013 00:00Not After08-05-2028 23:59SubjectCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
bf:2d:20:f3:c1:eb:62:2e:65:1e:76:56:fd:4f:77:ad:3a:b4:06:e1Signer
Actual PE Digestbf:2d:20:f3:c1:eb:62:2e:65:1e:76:56:fd:4f:77:ad:3a:b4:06:e1Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
lejRLContextm,xupGetBackupInformatifp.pdb
Imports
clusapi
ClusterRegCloseKey
kernel32
GetProcessShutdownParameters
CreateTimerQueue
GetFileSize
GetPrivateProfileStructW
IsSystemResumeAutomatic
LocaleNameToLCID
LoadLibraryA
GetLastError
InterlockedExchange
FreeLibrary
RaiseException
GetProcAddress
LocalFree
LocalAlloc
crypt32
CertGetCRLContextProperty
ws2_32
WSAIsBlocking
user32
LoadCursorA
mprapi
MprAdminPortDisconnect
setupapi
SetupGetBackupInformationW
msvcrt
memcpy
shlwapi
PathUnExpandEnvStringsA
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/GoziGroup/vCfjTmdR.exe_.exe.exe windows:5 windows x86 arch:x86
ebe507123723800973958e5f7d66d026
Code Sign
fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate
IssuerCN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PLNot Before08-03-2016 13:10Not After30-05-2027 13:10SubjectCN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PLExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
a0:45:1a:93:00:14:d2:bf:9c:fe:33:5f:db:f3:ee:8cCertificate
IssuerCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before20-07-2018 00:00Not After20-07-2019 23:59SubjectCN=AGF RESOURCING LTD,O=AGF RESOURCING LTD,POSTALCODE=W3 9JN,STREET=50c Hereford Road,L=London,ST=Greater London,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate
IssuerCN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before09-05-2013 00:00Not After08-05-2028 23:59SubjectCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
d4:16:c7:7b:fb:6d:e0:87:9d:53:0d:bb:74:60:bb:d3:d5:15:0c:0eSigner
Actual PE Digestd4:16:c7:7b:fb:6d:e0:87:9d:53:0d:bb:74:60:bb:d3:d5:15:0c:0eDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
sdtez%^565hfdgtftrjiytjgfn.pdb
Imports
msvcrt
memcpy
kernel32
LocaleNameToLCID
GetFileSize
AssignProcessToJobObject
TerminateJobObject
ClearCommBreak
GetModuleHandleA
GetProcessShutdownParameters
CreateTimerQueue
IsSystemResumeAutomatic
pdh
PdhCollectQueryData
Sections
.text Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt1 Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 284KB - Virtual size: 283KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/OlympicDestroyer/OlympicDestroyer.bin.exe windows:5 windows x86 arch:x86
975087e9286238a80895b195efb3968d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetModuleHandleA
CreateEventW
MultiByteToWideChar
Sleep
GetTempPathA
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
SetEvent
TerminateThread
DeleteFileW
CloseHandle
LoadLibraryW
CreateThread
GetOverlappedResult
VirtualProtectEx
GetWindowsDirectoryW
GetProcAddress
VirtualAllocEx
LocalFree
GetFileSize
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
CreateRemoteThread
CreateProcessA
CreateEventA
ConnectNamedPipe
GetComputerNameA
GetFileAttributesW
HeapFree
HeapAlloc
GetProcessHeap
GetTempPathW
GetTickCount
SizeofResource
LockResource
LoadResource
FindResourceW
FindFirstFileExW
CreateFileW
LocalAlloc
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
CreateNamedPipeW
GetModuleFileNameW
TerminateProcess
InterlockedDecrement
WriteFile
ReadFile
GetCurrentProcess
GetCommandLineW
EnterCriticalSection
WriteProcessMemory
CancelIo
FindClose
DecodePointer
SetEndOfFile
HeapSize
WriteConsoleW
FlushFileBuffers
GetStringTypeW
SetStdHandle
ReadConsoleW
SetFilePointerEx
GetModuleFileNameA
FreeLibrary
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WideCharToMultiByte
EncodePointer
RaiseException
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetModuleHandleExW
GetACP
HeapReAlloc
GetConsoleCP
GetConsoleMode
GetFileType
FindNextFileW
user32
wsprintfW
advapi32
CryptAcquireContextW
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptGenRandom
LookupPrivilegeNameW
CopySid
IsValidSid
LogonUserA
OpenProcessToken
ConvertSidToStringSidW
GetLengthSid
LookupAccountSidW
GetTokenInformation
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
ole32
CoCreateGuid
CoTaskMemFree
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SafeArrayCreate
iphlpapi
GetIpNetTable
ws2_32
FreeAddrInfoW
GetAddrInfoW
WSACleanup
WSAStartup
ntohl
credui
CredUIParseUserNameW
netapi32
NetApiBufferFree
NetGetDCName
Sections
.text Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/OlympicDestroyer/OlympicDestroyerAtos.bin.exe windows:5 windows x86 arch:x86
fd7200dcd5c0d9d4d277a26d951210aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetFileAttributesW
GetVersionExW
ResumeThread
GetModuleHandleA
CreateEventW
MultiByteToWideChar
Sleep
GetTempPathA
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
SetEvent
TerminateThread
DeleteFileW
CloseHandle
LoadLibraryW
CreateThread
GetOverlappedResult
VirtualProtectEx
GetWindowsDirectoryW
GetProcAddress
VirtualAllocEx
LocalFree
GetFileSize
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
CreateRemoteThread
CreateProcessA
CreateEventA
ConnectNamedPipe
GetComputerNameA
LocalAlloc
FreeLibrary
HeapFree
HeapAlloc
GetProcessHeap
GetTempPathW
GetTickCount
SizeofResource
LockResource
LoadResource
FindResourceW
FindClose
WaitForSingleObject
InitializeCriticalSection
CreatePipe
LeaveCriticalSection
WaitForMultipleObjects
CreateNamedPipeW
GetModuleFileNameW
TerminateProcess
InterlockedDecrement
ReadFile
WriteFile
GetCurrentProcess
GetCommandLineW
EnterCriticalSection
SetHandleInformation
WriteProcessMemory
CancelIo
DecodePointer
SetEndOfFile
HeapSize
WriteConsoleW
FlushFileBuffers
GetStringTypeW
SetStdHandle
ReadConsoleW
SetFilePointerEx
LCMapStringW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WideCharToMultiByte
EncodePointer
RaiseException
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetModuleHandleExW
GetACP
HeapReAlloc
GetConsoleCP
GetConsoleMode
FindFirstFileExW
user32
wsprintfW
advapi32
LookupPrivilegeNameW
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptGenRandom
CopySid
IsValidSid
LogonUserA
OpenProcessToken
ConvertSidToStringSidW
GetLengthSid
LookupAccountSidW
GetTokenInformation
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
ole32
CoCreateGuid
CoTaskMemFree
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SafeArrayCreate
iphlpapi
GetIpNetTable
ws2_32
ntohl
WSAStartup
FreeAddrInfoW
htonl
getnameinfo
WSACleanup
GetAddrInfoW
credui
CredUIParseUserNameW
netapi32
NetApiBufferFree
NetGetDCName
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/OlympicDestroyer/OlympicSystemStealer.bin.exe windows:5 windows x64 arch:x64
58e5112654a5cba84cb5b52c05309ff0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
CreateFileW
CloseHandle
ReadFile
WriteFile
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
GetCommandLineW
HeapReAlloc
LoadLibraryA
VirtualAlloc
VirtualFree
GetCurrentProcess
VirtualProtect
HeapSize
GetConsoleCP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetACP
SetFilePointerEx
GetFileType
GetConsoleMode
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetStringTypeW
FlushFileBuffers
WriteConsoleW
advapi32
LookupPrivilegeNameW
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
shell32
CommandLineToArgvW
Sections
.text Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 149KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/OlympicDestroyer/OlympicsSouthKorea.bin.exe windows:5 windows x86 arch:x86
fd7200dcd5c0d9d4d277a26d951210aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetFileAttributesW
GetVersionExW
ResumeThread
GetModuleHandleA
CreateEventW
MultiByteToWideChar
Sleep
GetTempPathA
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
SetEvent
TerminateThread
DeleteFileW
CloseHandle
LoadLibraryW
CreateThread
GetOverlappedResult
VirtualProtectEx
GetWindowsDirectoryW
GetProcAddress
VirtualAllocEx
LocalFree
GetFileSize
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
CreateRemoteThread
CreateProcessA
CreateEventA
ConnectNamedPipe
GetComputerNameA
LocalAlloc
FreeLibrary
HeapFree
HeapAlloc
GetProcessHeap
GetTempPathW
GetTickCount
SizeofResource
LockResource
LoadResource
FindResourceW
FindClose
WaitForSingleObject
InitializeCriticalSection
CreatePipe
LeaveCriticalSection
WaitForMultipleObjects
CreateNamedPipeW
GetModuleFileNameW
TerminateProcess
InterlockedDecrement
ReadFile
WriteFile
GetCurrentProcess
GetCommandLineW
EnterCriticalSection
SetHandleInformation
WriteProcessMemory
CancelIo
DecodePointer
SetEndOfFile
HeapSize
WriteConsoleW
FlushFileBuffers
GetStringTypeW
SetStdHandle
ReadConsoleW
SetFilePointerEx
LCMapStringW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WideCharToMultiByte
EncodePointer
RaiseException
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetModuleHandleExW
GetACP
HeapReAlloc
GetConsoleCP
GetConsoleMode
FindFirstFileExW
user32
wsprintfW
advapi32
LookupPrivilegeNameW
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptGenRandom
CopySid
IsValidSid
LogonUserA
OpenProcessToken
ConvertSidToStringSidW
GetLengthSid
LookupAccountSidW
GetTokenInformation
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
ole32
CoCreateGuid
CoTaskMemFree
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SafeArrayCreate
iphlpapi
GetIpNetTable
ws2_32
ntohl
WSAStartup
FreeAddrInfoW
htonl
getnameinfo
WSACleanup
GetAddrInfoW
credui
CredUIParseUserNameW
netapi32
NetApiBufferFree
NetGetDCName
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/README.md
-
malware-sample-library-master/Ransomeware/DistrictRansomware.bin.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 588KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 399KB - Virtual size: 400KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
malware-sample-library-master/Ransomeware/FoxRansomware.zip.zip
-
malware-sample-library-master/Ransomeware/KatyushaRansomware.bin.exe windows:5 windows x86 arch:x86
9586355d3c001552543f5fa27b1cb240
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
ws2_32
listen
user32
wsprintfA
advapi32
CryptEncrypt
shell32
ShellExecuteA
iphlpapi
GetIpAddrTable
wldap32
ord32
Sections
.MPRESS1 Size: 2.4MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
malware-sample-library-master/Ransomeware/KeypassRansomware.bin.exe windows:5 windows x86 arch:x86
e66550df92091dc80539d65f5d9ec0a6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
G:\Doc\My work (C++)\_New 2018\Encryption\Release\encrypt.pdb
Imports
kernel32
VirtualQuery
SetStdHandle
GetFileType
GetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateSemaphoreW
IsValidCodePage
GetACP
GetOEMCP
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetTimeZoneInformation
ReadConsoleW
OutputDebugStringW
GetDateFormatW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
WriteConsoleW
SetEnvironmentVariableA
OpenProcess
GetSystemInfo
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
CreateTimerQueue
FormatMessageA
GetThreadTimes
HeapQueryInformation
IsProcessorFeaturePresent
CloseHandle
IsDebuggerPresent
GetModuleFileNameW
GetModuleHandleW
Sleep
SizeofResource
LockResource
LoadResource
FindResourceW
GlobalFree
GetCurrentProcess
GlobalAlloc
GetLastError
GetTickCount
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
GetFileSize
MoveFileW
VirtualAlloc
SetFilePointer
ReadFile
WriteFile
VirtualFree
FindFirstFileW
FindNextFileW
GetLogicalDrives
SetErrorMode
GetDriveTypeA
GetTimeFormatW
TerminateProcess
GetModuleFileNameA
GetEnvironmentVariableA
DeleteFileA
CreateFileA
FlushFileBuffers
SetLastError
CreateProcessA
WideCharToMultiByte
MultiByteToWideChar
FormatMessageW
LocalAlloc
lstrlenW
LocalSize
lstrcpynW
LocalFree
GetTempPathW
DeleteFileW
CopyFileW
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
CreateThread
GetComputerNameW
SetEvent
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
RaiseException
HeapSize
EnterCriticalSection
DecodePointer
DeleteCriticalSection
TlsAlloc
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
InterlockedExchangeAdd
WaitForMultipleObjects
TerminateThread
QueueUserAPC
CreateEventW
SleepEx
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
InterlockedCompareExchange
VerSetConditionMask
VerifyVersionInfoW
CreateWaitableTimerW
GetSystemTimeAsFileTime
TlsGetValue
TlsSetValue
TlsFree
GlobalSize
GlobalLock
GlobalUnlock
MulDiv
OutputDebugStringA
EncodePointer
GetCurrentThreadId
GetSystemDirectoryW
FreeLibrary
FreeResource
GetModuleHandleA
GetProcAddress
LoadLibraryExW
GlobalDeleteAtom
lstrcmpW
LoadLibraryA
LoadLibraryW
GlobalAddAtomW
GlobalFindAtomW
GetCurrentProcessId
GetCurrentThread
GetVersionExW
lstrcmpA
lstrcpyW
SetThreadPriority
ResumeThread
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GlobalGetAtomNameW
FileTimeToSystemTime
GetThreadLocale
InitializeCriticalSection
GlobalReAlloc
GlobalHandle
LocalReAlloc
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
GetCurrentDirectoryW
GetFileAttributesW
FindClose
GetFullPathNameW
GetVolumeInformationW
LockFile
SetEndOfFile
UnlockFile
DuplicateHandle
lstrcmpiW
GetStringTypeExW
GetTempFileNameW
GetWindowsDirectoryW
SearchPathW
GetProfileIntW
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileSizeEx
GetFileTime
VirtualProtect
FindResourceExW
GetUserDefaultLCID
GetCPInfo
ExitThread
RtlUnwind
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetCommandLineW
user32
SetRectEmpty
SetLayeredWindowAttributes
LoadCursorW
SetCursor
ShowOwnedPopups
TranslateMessage
GetMessageW
MapVirtualKeyW
GetKeyNameTextW
DrawIconEx
IsRectEmpty
OffsetRect
InflateRect
DrawFocusRect
GetSysColorBrush
SetWindowRgn
GetSystemMetrics
DrawFrameControl
DrawEdge
MapDialogRect
SetWindowContextHelpId
PostQuitMessage
SendDlgItemMessageA
GetCursorPos
ClientToScreen
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
GetWindowThreadProcessId
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
LoadMenuW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
IsDialogMessageW
SetWindowTextW
IsWindowEnabled
CheckDlgButton
MoveWindow
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetScrollInfo
SetScrollInfo
LoadIconW
GetWindow
GetLastActivePopup
GetTopWindow
GetParent
GetClassLongW
SetWindowLongW
GetWindowLongW
PtInRect
EqualRect
CopyRect
GetSysColor
MapWindowPoints
InvalidateRgn
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
MonitorFromPoint
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetRect
GetNextDlgGroupItem
SetParent
SendMessageW
PeekMessageW
LoadStringW
DispatchMessageW
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
GetFocus
SetFocus
GetDlgCtrlID
GetDlgItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
CreateWindowExW
GetClassInfoExW
EnumDisplayMonitors
DestroyMenu
GetMenuItemInfoW
CopyImage
RealChildWindowFromPoint
IntersectRect
TrackMouseEvent
IsIconic
IsZoomed
CharUpperW
GetAsyncKeyState
SetCapture
ReleaseCapture
KillTimer
GetSystemMenu
GetClassInfoW
RegisterClassW
DeleteMenu
MessageBeep
WindowFromPoint
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
SetMenuDefaultItem
IsMenu
UpdateLayeredWindow
EnableScrollBar
WinHelpW
UnionRect
LoadAcceleratorsW
MessageBoxW
EnableWindow
SetWindowsHookExW
UnhookWindowsHookEx
PostThreadMessageW
IsWindowVisible
ShowWindow
SetForegroundWindow
CallNextHookEx
GetWindowRect
GetClientRect
UpdateWindow
SetTimer
IsWindow
UnregisterClassW
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
DrawStateW
InvalidateRect
FillRect
GetClassNameW
LoadBitmapW
RegisterWindowMessageW
GetMessagePos
GetMessageTime
PostMessageW
DefWindowProcW
CallWindowProcW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
WaitMessage
CharNextW
RemovePropW
CopyAcceleratorTableW
DestroyIcon
LoadImageW
SetCursorPos
BringWindowToTop
LockWindowUpdate
GetDoubleClickTime
GetIconInfo
CopyIcon
ModifyMenuW
DestroyAcceleratorTable
SetClassLongW
GetUpdateRect
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
DrawIcon
GetWindowRgn
DestroyCursor
CreateMenu
GetComboBoxInfo
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
MapVirtualKeyExW
IsCharLowerW
IsClipboardFormatAvailable
SubtractRect
InvertRect
HideCaret
FrameRect
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
CharUpperBuffW
RegisterClipboardFormatW
CreateAcceleratorTableW
ScreenToClient
gdi32
GetTextFaceW
SetPixelV
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
EnumFontFamiliesExW
SetPaletteEntries
ExtFloodFill
GetSystemPaletteEntries
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
RoundRect
OffsetRgn
Rectangle
SetDIBColorTable
StretchBlt
SetPixel
RealizePalette
GetRgnBox
CreateDIBSection
CreateRoundRectRgn
DPtoLP
SetRectRgn
GetMapMode
GetTextCharsetInfo
EnumFontFamiliesW
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleBitmap
GetTextMetricsW
Polyline
Polygon
CreatePolygonRgn
PatBlt
GetTextExtentPoint32W
GetTextColor
GetBkColor
Ellipse
CreateRectRgnIndirect
CreateEllipticRgn
CombineRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
CreateBitmap
SetTextColor
SetBkColor
GetObjectW
GetStockObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
CreateDCW
CopyMetaFileW
DeleteDC
msimg32
TransparentBlt
AlphaBlend
winspool.drv
ClosePrinter
DocumentPropertiesW
OpenPrinterW
advapi32
RegQueryValueExA
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
DeleteService
QueryServiceStatusEx
CloseServiceHandle
QueryServiceStatus
ControlService
OpenServiceW
OpenSCManagerW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
shell32
DragQueryFileW
SHGetFolderPathW
ShellExecuteExW
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetDesktopFolder
SHAppBarMessage
DragFinish
CommandLineToArgvW
SHGetFileInfoW
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameW
PathAppendW
PathFileExistsW
PathFindExtensionW
PathFileExistsA
StrTrimW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
uxtheme
IsAppThemed
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
DrawThemeParentBackground
DrawThemeText
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetWindowTheme
ole32
OleGetClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
DoDragDrop
OleIsCurrentClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
CoInitializeEx
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoRevokeClassObject
CoRegisterMessageFilter
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitialize
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
OleFlushClipboard
oleaut32
SafeArrayDestroy
SysAllocString
VariantTimeToSystemTime
VariantCopy
VarBstrFromDate
LoadTypeLi
OleCreateFontIndirect
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SystemTimeToVariantTime
SysStringLen
SysFreeString
oledlg
OleUIBusyW
gdiplus
GdipBitmapLockBits
GdipDrawImageRectI
GdiplusShutdown
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
winmm
PlaySoundW
timeGetTime
mpr
WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW
psapi
EnumProcesses
GetModuleBaseNameW
EnumProcessModules
ws2_32
WSASetLastError
getsockname
getsockopt
connect
bind
accept
htonl
freeaddrinfo
getaddrinfo
WSAGetLastError
setsockopt
WSASocketW
WSASend
WSARecv
listen
select
ioctlsocket
closesocket
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
oleacc
AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject
imm32
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 477KB - Virtual size: 477KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 49KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 173KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Ransomeware/KrakenCryptor2.0.bin.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 195KB - Virtual size: 195KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Ransomeware/KryptikRansomware.false.exe windows:4 windows x86 arch:x86
d6969de59adb01f944b057038b81adf0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
InterlockedIncrement
GetCPInfo
GetOEMCP
FileTimeToSystemTime
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
FindResourceExA
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
RtlUnwind
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GlobalHandle
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GlobalReAlloc
TlsGetValue
LocalAlloc
VirtualProtect
GlobalUnlock
MulDiv
InterlockedDecrement
GlobalFree
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetThreadLocale
GetCurrentProcessId
SuspendThread
SetEvent
ResumeThread
CloseHandle
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
VirtualUnlock
VirtualQuery
VirtualAlloc
CreateEventA
GetConsoleWindow
WaitForSingleObject
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileSize
GlobalAlloc
GlobalLock
GetModuleFileNameW
lstrcpyW
GetPrivateProfileSectionW
GetPrivateProfileIntW
FindResourceW
WaitNamedPipeA
CreateFileA
WriteFile
CreateNamedPipeA
ConnectNamedPipe
ReadFile
FormatMessageA
LocalFree
GetTempPathA
SetLastError
GetCurrentThread
SetThreadPriority
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
GetModuleHandleA
GetProcAddress
GetWindowsDirectoryA
LoadLibraryA
FreeLibrary
lstrcatA
WinExec
lstrcpyA
GetVersionExA
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
CreateThread
ExitThread
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
lstrlenA
lstrcmpiA
CompareStringW
CompareStringA
GetVersion
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetStartupInfoA
InterlockedExchange
user32
RegisterClipboardFormatA
PostThreadMessageA
DestroyMenu
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetWindowContextHelpId
MapDialogRect
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsWindowEnabled
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMessageA
GetActiveWindow
ValidateRect
PostQuitMessage
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
GetForegroundWindow
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
CharNextA
GetKeyState
IsWindowVisible
GetMenu
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
ScreenToClient
EqualRect
CopyRect
GetDlgCtrlID
CallWindowProcA
GetWindowLongA
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
SetMenuDefaultItem
TrackPopupMenu
LoadMenuA
GetSubMenu
GetMenuItemID
DefWindowProcA
RemovePropA
GetDlgItem
GetFocus
CreateIconIndirect
GetIconInfo
GetWindowTextA
UpdateWindow
SetWindowPos
GetWindowTextLengthA
GetWindowThreadProcessId
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyExA
ToUnicodeEx
SetRect
SetSysColors
EnumWindows
GetCursorPos
SetCursorPos
BeginPaint
EndPaint
MessageBoxA
TranslateMessage
DispatchMessageA
PeekMessageA
wsprintfA
UnregisterClassA
GetNextDlgGroupItem
InvalidateRgn
IsRectEmpty
MapWindowPoints
CopyAcceleratorTableA
GetSysColorBrush
GetDesktopWindow
WindowFromPoint
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
GetMessagePos
GetAsyncKeyState
SetFocus
SetActiveWindow
SetWindowLongA
MessageBeep
LoadCursorA
CopyIcon
DestroyCursor
IsWindow
SetCursor
ReleaseCapture
GetParent
SetCapture
InvalidateRect
ReleaseDC
GetDC
InflateRect
PtInRect
LoadBitmapA
GetSysColor
KillTimer
SetTimer
RedrawWindow
FillRect
OffsetRect
LoadImageA
GetSystemMetrics
EnableWindow
LoadIconA
GetClientRect
GetWindowRect
GetSystemMenu
AppendMenuA
DrawIcon
CharUpperA
SetForegroundWindow
GetLastActivePopup
FindWindowA
IsIconic
PostMessageA
SendMessageA
gdi32
ExtSelectClipRgn
DeleteDC
CreateSolidBrush
ScaleWindowExtEx
GetBkColor
GetTextColor
GetRgnBox
GetMapMode
EnumFontFamiliesExA
CreateRectRgnIndirect
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
GetViewportExtEx
ExtTextOutA
TextOutA
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
SetTextColor
GetClipBox
CreatePen
CreatePatternBrush
SelectObject
Rectangle
DeleteObject
CreateBitmap
GetDeviceCaps
StartPage
SetWindowOrgEx
SetBkColor
SetBkMode
GetRegionData
GetTextExtentPoint32A
GetStockObject
CreateFontIndirectA
BitBlt
CreateCompatibleDC
GetObjectA
GetWindowExtEx
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegQueryValueA
RegConnectRegistryA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
Shell_NotifyIconA
ShellExecuteA
shlwapi
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathFindExtensionW
PathIsUNCA
oledlg
ord8
ole32
CoTaskMemAlloc
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoGetClassObject
GetHGlobalFromStream
CreateStreamOnHGlobal
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
oleaut32
SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
OleSavePictureFile
OleLoadPicture
VarXor
VarDecFromBool
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantCopy
urlmon
HlinkGoBack
opengl32
glMultMatrixd
glFlush
glDrawBuffer
glMatrixMode
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
winmm
mciSendStringA
sndPlaySoundA
rasapi32
RasGetConnectStatusA
RasGetProjectionInfoA
RasGetErrorStringA
RasEnumEntriesA
RasHangUpA
RasCreatePhonebookEntryA
RasEditPhonebookEntryA
RasDialA
RasEnumConnectionsA
wininet
CreateUrlCacheGroup
netapi32
NetWkstaUserGetInfo
NetShareGetInfo
avifil32
AVIMakeCompressedStream
gdiplus
GdipDeleteMatrix
GdipCreateMatrix
winhttp
WinHttpReceiveResponse
Sections
.text Size: 308KB - Virtual size: 304KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.0MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Ransomeware/LockCrypt2.0.bin.exe windows:4 windows x86 arch:x86
930ddd1c5a61dbaa873661edbf374853
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlZeroMemory
SetFileAttributesW
SetFilePointerEx
SetThreadPriority
Sleep
UnmapViewOfFile
WriteFile
RtlMoveMemory
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyW
lstrlenA
lstrlenW
MultiByteToWideChar
MoveFileW
MapViewOfFile
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetModuleFileNameA
GetFileAttributesW
GetEnvironmentVariableA
CreateThread
CreateFileW
CreateFileMappingA
CreateFileA
CopyFileA
lstrcatW
CloseHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
CryptReleaseContext
CryptImportKey
CryptGenKey
CryptExportKey
CryptEncrypt
CryptDestroyKey
CryptDecrypt
CryptAcquireContextA
AdjustTokenPrivileges
RegSetValueExA
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
malware-sample-library-master/Ransomeware/MatrixRansomware.bin.exe windows:5 windows x86 arch:x86
ca3b1af31abe1beced65a635aa0c47a3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
GetErrorInfo
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenThreadToken
OpenProcessToken
GetUserNameA
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
FreeSid
EqualSid
AllocateAndInitializeSid
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
user32
MessageBoxA
CharNextW
LoadStringW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
GetSystemMetrics
CharUpperBuffW
CharUpperW
CharLowerBuffW
kernel32
Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsDBCSLeadByteEx
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetConsoleOutputCP
GetConsoleCP
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
SetFilePointer
SetEndOfFile
ReadFile
GetFileType
GetFileSize
CreateFileW
GetStdHandle
CloseHandle
LoadLibraryA
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
WaitForSingleObject
WaitForMultipleObjects
VirtualQueryEx
VirtualProtect
VerSetConditionMask
VerifyVersionInfoW
SuspendThread
SizeofResource
SetThreadPriority
SetLastError
SetFileAttributesW
SetEvent
SetErrorMode
ResumeThread
ResetEvent
ReleaseMutex
QueryPerformanceFrequency
QueryPerformanceCounter
OpenMutexW
MoveFileExW
LockResource
LoadResource
LoadLibraryW
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVolumeInformationW
GetVersionExW
GetUserDefaultLangID
GetUserDefaultLCID
GetThreadTimes
GetThreadPriority
GetThreadLocale
GetSystemTimes
GetSystemDefaultLangID
GetSystemDefaultLCID
GetProcessTimes
GetLocalTime
GetFullPathNameW
GetFileAttributesW
GetExitCodeThread
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetCPInfoExW
GetCPInfo
FreeResource
InterlockedCompareExchange
FormatMessageW
FindResourceW
FindNextFileW
ExpandEnvironmentStringsW
EnumSystemLocalesW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateMutexW
CreateEventW
ole32
CoUninitialize
CoInitialize
shell32
SHGetSpecialFolderPathW
wsock32
WSACleanup
WSAStartup
gethostname
gethostbyname
inet_ntoa
netapi32
NetShareEnum
NetApiBufferFree
Exports
Exports
TMethodImplementationIntercept
Sections
.text Size: 878KB - Virtual size: 878KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 25KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: 512B - Virtual size: 250B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 295KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Ransomeware/NotPetya.bin.dll windows:5 windows x86 arch:x86
52dd60b5f3c9e2f17c2e303e8c8d4eab
Code Sign
2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before22-08-2007 22:31Not After25-08-2012 07:00SubjectCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:01:cf:3e:00:00:00:00:00:0fCertificate
IssuerCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before07-12-2009 22:40Not After07-03-2011 22:40SubjectCN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before16-09-2006 01:04Not After15-09-2019 07:00SubjectCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:05:a2:30:00:00:00:00:00:08Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before25-07-2008 19:01Not After25-07-2013 19:11SubjectCN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
3b:65:0e:49:c6:e9:34:29:f5:80:58:4e:cc:af:af:dd:dd:e9:ce:e5Signer
Actual PE Digest3b:65:0e:49:c6:e9:34:29:f5:80:58:4e:cc:af:af:dd:dd:e9:ce:e5Digest Algorithmsha1PE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ConnectNamedPipe
GetModuleHandleW
CreateNamedPipeW
TerminateThread
DisconnectNamedPipe
FlushFileBuffers
GetTempPathW
GetProcAddress
DeleteFileW
FreeLibrary
GlobalAlloc
LoadLibraryW
GetComputerNameExW
GlobalFree
ExitProcess
GetVersionExW
GetModuleFileNameW
DisableThreadLibraryCalls
ResumeThread
GetEnvironmentVariableW
GetFileSize
SetFilePointer
SetLastError
LoadResource
GetCurrentThread
OpenProcess
GetSystemDirectoryW
SizeofResource
GetLocalTime
Process32FirstW
LockResource
Process32NextW
GetModuleHandleA
lstrcatW
CreateToolhelp32Snapshot
GetCurrentProcess
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WideCharToMultiByte
GetExitCodeProcess
WaitForMultipleObjects
CreateProcessW
PeekNamedPipe
GetTempFileNameW
InterlockedExchange
LeaveCriticalSection
MultiByteToWideChar
CreateFileA
GetTickCount
CreateThread
LocalFree
FindNextFileW
CreateFileMappingW
LocalAlloc
FindClose
GetFileSizeEx
CreateFileW
Sleep
FlushViewOfFile
GetLogicalDrives
WaitForSingleObject
GetDriveTypeW
UnmapViewOfFile
MapViewOfFile
FindFirstFileW
CloseHandle
DeviceIoControl
GetLastError
GetSystemDirectoryA
ReadFile
WriteFile
GetProcessHeap
InitializeCriticalSection
HeapReAlloc
GetWindowsDirectoryW
EnterCriticalSection
HeapFree
SetFilePointerEx
HeapAlloc
FindResourceW
user32
ExitWindowsEx
wsprintfA
wsprintfW
advapi32
CryptGenRandom
CryptAcquireContextA
CryptExportKey
CryptAcquireContextW
CreateProcessAsUserW
InitiateSystemShutdownExW
DuplicateTokenEx
SetTokenInformation
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
GetSidSubAuthority
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetThreadToken
CredEnumerateW
CredFree
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptDestroyKey
CryptGenKey
CryptEncrypt
CryptImportKey
CryptSetKeyParam
CryptReleaseContext
shell32
CommandLineToArgvW
SHGetFolderPathW
ole32
CoCreateGuid
CoTaskMemFree
StringFromCLSID
crypt32
CryptStringToBinaryW
CryptBinaryToStringW
CryptDecodeObjectEx
shlwapi
PathAppendW
StrToIntW
PathFindFileNameW
PathFileExistsW
StrCmpW
StrCmpIW
StrChrW
StrCatW
StrStrW
PathFindExtensionW
PathCombineW
StrStrIW
iphlpapi
GetIpNetTable
GetAdaptersInfo
ws2_32
inet_ntoa
gethostbyname
__WSAFDIsSet
ntohl
ioctlsocket
connect
inet_addr
select
recv
send
htons
closesocket
socket
WSAStartup
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCancelConnection2W
WNetAddConnection2W
WNetCloseEnum
netapi32
NetServerEnum
NetApiBufferFree
NetServerGetInfo
dhcpsapi
DhcpEnumSubnetClients
DhcpRpcFreeMemory
DhcpGetSubnetInfo
DhcpEnumSubnets
msvcrt
malloc
_itoa
free
memset
rand
memcpy
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 242KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Ransomeware/WannaCry.exe.exe windows:4 windows x86 arch:x86
68f013d7437aa653a8a98a05807afeb1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesW
GetFileSizeEx
CreateFileA
InitializeCriticalSection
DeleteCriticalSection
ReadFile
GetFileSize
WriteFile
LeaveCriticalSection
EnterCriticalSection
SetFileAttributesW
SetCurrentDirectoryW
CreateDirectoryW
GetTempPathW
GetWindowsDirectoryW
GetFileAttributesA
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
Sleep
OpenMutexA
GetFullPathNameA
CopyFileA
GetModuleFileNameA
VirtualAlloc
VirtualFree
FreeLibrary
HeapAlloc
GetProcessHeap
GetModuleHandleA
SetLastError
VirtualProtect
IsBadReadPtr
HeapFree
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryA
GetStartupInfoA
SetFilePointer
SetFileTime
GetComputerNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
GlobalAlloc
LoadLibraryA
GetProcAddress
GlobalFree
CreateProcessA
CloseHandle
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
FindResourceA
user32
wsprintfA
advapi32
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle
CryptReleaseContext
RegCreateKeyW
RegSetValueExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
msvcrt
realloc
fclose
fwrite
fread
fopen
sprintf
rand
srand
strcpy
memset
strlen
wcscat
wcslen
__CxxFrameHandler
??3@YAXPAX@Z
memcmp
_except_handler3
_local_unwind2
wcsrchr
swprintf
??2@YAPAXI@Z
memcpy
strcmp
strrchr
__p___argv
__p___argc
_stricmp
free
malloc
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_CxxThrowException
calloc
strcat
_mbsstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Ransomeware/WannaCry2.exe.dll windows:4 windows x86 arch:x86
2e5708ae5fed0403e8117c645fb23e5b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
WriteFile
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
CreateProcessA
msvcrt
free
_initterm
malloc
_adjust_fdiv
sprintf
Exports
Exports
PlayGame
Sections
.text Size: 4KB - Virtual size: 652B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 684B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Ransomeware/WannaCryDLL.bin.dll windows:4 windows x86 arch:x86
2e5708ae5fed0403e8117c645fb23e5b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
WriteFile
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
CreateProcessA
msvcrt
free
_initterm
malloc
_adjust_fdiv
sprintf
Exports
Exports
PlayGame
Sections
.text Size: 4KB - Virtual size: 652B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 684B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/SLINGSHOT/SlingShot.bin.dll windows:5 windows x86 arch:x86
2f3b3df466e24e0792e0e90d668856bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
??1type_info@@UAE@XZ
wcstoul
_vsnwprintf
_CxxThrowException
_except_handler3
_onexit
_lock
_unlock
_amsg_exit
_initterm
_XcptFilter
memcpy
memset
realloc
_vsnprintf
wcsstr
_snprintf
wcsncpy
malloc
_snwprintf
swscanf
sprintf
_wcsicmp
atoi
strchr
strstr
wcschr
strncpy
calloc
free
_strlwr
__dllonexit
memcmp
crypt32
CryptUnprotectData
ws2_32
listen
accept
WSAEventSelect
htons
inet_addr
WSASocketA
getsockopt
WSAIoctl
gethostbyname
WSAStartup
WSACreateEvent
recv
WSAConnect
socket
WSAGetLastError
select
bind
send
shutdown
WSACloseEvent
inet_ntoa
closesocket
kernel32
SetLastError
GetSystemDefaultUILanguage
CreateMutexW
GetModuleHandleW
VirtualAllocEx
VirtualProtectEx
VirtualFreeEx
TlsFree
GetLocaleInfoW
EnumUILanguagesW
GetUserDefaultUILanguage
GetNativeSystemInfo
GetSystemTime
TlsAlloc
TlsSetValue
TlsGetValue
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
RtlUnwind
HeapAlloc
HeapFree
GetProcessHeap
HeapSize
GetCurrentProcess
VirtualFree
RtlZeroMemory
Sleep
WaitForSingleObject
WideCharToMultiByte
MultiByteToWideChar
GetLastError
ExitProcess
FindResourceA
FreeLibrary
LoadResource
GetModuleFileNameW
GetExitCodeThread
GetModuleFileNameA
CloseHandle
DeleteFileW
CreateThread
lstrlenA
OpenProcess
GetProcAddress
LoadLibraryA
GetModuleHandleA
LocalFree
lstrcpyA
GetCurrentThread
user32
PeekMessageW
wsprintfW
wsprintfA
GetSystemMetrics
advapi32
OpenProcessToken
RegQueryValueExW
RegCreateKeyExA
RegOpenKeyExA
LookupAccountSidW
RegOpenKeyExW
ImpersonateLoggedOnUser
AllocateAndInitializeSid
RevertToSelf
FreeSid
RegOpenKeyA
RegEnumKeyExW
RegCloseKey
RegQueryValueExA
oleaut32
GetErrorInfo
shlwapi
StrStrIW
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA
Exports
Exports
Init
dll_u
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
LineRecs Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Stuxnet Malware/A0055521.sys.sys windows:6 windows x86 arch:x86
e479290b25b0e1240c9981c53a12abb9
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before16-07-2004 00:00Not After15-07-2014 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
61:0c:12:06:00:00:00:00:00:1bCertificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before23-05-2006 17:01Not After23-05-2016 17:11SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
5e:6d:dc:87:37:50:82:84:58:14:f4:42:d1:d8:2a:25Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USNot Before15-03-2007 00:00Not After11-06-2010 23:59SubjectCN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TWExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
64:1a:97:0f:49:95:f6:a3:3a:83:b4:9e:89:26:d3:7f:84:17:26:36Signer
Actual PE Digest64:1a:97:0f:49:95:f6:a3:3a:83:b4:9e:89:26:d3:7f:84:17:26:36Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwReadFile
ZwClose
ZwOpenFile
ZwQueryInformationFile
MmGetSystemRoutineAddress
PsGetVersion
PsSetLoadImageNotifyRoutine
KdDebuggerEnabled
InitSafeBootMode
ExAllocatePool
IoCreateDevice
RtlDeleteElementGenericTable
KeGetCurrentThread
RtlLookupElementGenericTable
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlUpcaseUnicodeChar
ZwAllocateVirtualMemory
RtlInitUnicodeString
IoRegisterDriverReinitialization
IofCompleteRequest
ExFreePoolWithTag
ZwQueryValueKey
ZwOpenKey
KeUnstackDetachProcess
KeStackAttachProcess
_stricmp
ZwQuerySystemInformation
ZwQueryInformationProcess
ObOpenObjectByPointer
PsLookupProcessByProcessId
ObfDereferenceObject
_except_handler3
memcpy
memset
hal
KfAcquireSpinLock
KeGetCurrentIrql
KfReleaseSpinLock
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 896B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 768B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Stuxnet Malware/Copy of Shortcut to.lnk.lnk
-
malware-sample-library-master/Stuxnet Malware/malware.ex_.dll regsvr32 windows:5 windows x86 arch:x86
0021f47781268b6caaf314d0b686997c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
FreeLibrary
GetModuleHandleW
GetVersionExW
lstrcmpiA
GetProcAddress
DeleteFileA
VirtualProtect
GetCurrentProcess
GetCurrentThreadId
GetTickCount
lstrcpyW
lstrlenW
user32
wsprintfW
Exports
Exports
CPlApplet
DllCanUnloadNow
DllGetClassObject
DllGetClassObjectEx
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
DllUnregisterServerEx
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 326B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.stub Size: 492KB - Virtual size: 492KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
malware-sample-library-master/Stuxnet Malware/~WTR4132.tmp.dll regsvr32 windows:5 windows x86 arch:x86
0021f47781268b6caaf314d0b686997c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
FreeLibrary
GetModuleHandleW
GetVersionExW
lstrcmpiA
GetProcAddress
DeleteFileA
VirtualProtect
GetCurrentProcess
GetCurrentThreadId
GetTickCount
lstrcpyW
lstrlenW
user32
wsprintfW
Exports
Exports
CPlApplet
DllCanUnloadNow
DllGetClassObject
DllGetClassObjectEx
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
DllUnregisterServerEx
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 326B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.stub Size: 496KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
malware-sample-library-master/Stuxnet Malware/~WTR4141.tmp.dll regsvr32 windows:5 windows x86 arch:x86
be2c3036d981fa5ac54d71ba4ce15c7d
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before16-07-2004 00:00Not After15-07-2014 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
61:0c:12:06:00:00:00:00:00:1bCertificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before23-05-2006 17:01Not After23-05-2016 17:11SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
5e:6d:dc:87:37:50:82:84:58:14:f4:42:d1:d8:2a:25Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USNot Before15-03-2007 00:00Not After11-06-2010 23:59SubjectCN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TWExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
82:fd:2e:dd:90:4f:d2:2c:bf:39:d1:ba:52:3d:05:74:38:22:04:95Signer
Actual PE Digest82:fd:2e:dd:90:4f:d2:2c:bf:39:d1:ba:52:3d:05:74:38:22:04:95Digest Algorithmsha1PE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
Imports
psapi
EnumProcessModules
GetModuleBaseNameW
kernel32
GetFileSize
GetFileAttributesExW
RtlUnwind
GetModuleHandleW
SetFileTime
WriteFile
GetFileAttributesW
CreateFileW
lstrlenW
GetProcAddress
CloseHandle
DeleteFileW
lstrcpyW
SetFileAttributesW
GetCurrentProcess
SetLastError
lstrcmpiW
GetCurrentThreadId
GetCurrentProcessId
lstrcmpA
IsBadReadPtr
GetModuleFileNameW
lstrcmpiA
GetModuleHandleA
VirtualProtect
lstrcatW
VirtualFree
lstrcpynW
ReadFile
VirtualAlloc
CreateMutexW
SetErrorMode
FreeLibrary
HeapAlloc
WaitForSingleObject
GetTickCount
GetProcessHeap
Sleep
GetLastError
DisableThreadLibraryCalls
ReleaseMutex
CreateThread
SetFilePointer
user32
GetWindowThreadProcessId
SendMessageW
IsWindowVisible
EnumChildWindows
GetClassNameW
EnumWindows
PostMessageW
wsprintfW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 400B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 902B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Triton/TRISIS-TRITON-HATMAN-master.zip.zip
-
malware-sample-library-master/Triton/TritonCRC.bin
-
malware-sample-library-master/Trojans/Azorult/AzorultDownloaderCVE-2017-11882.xml.xlsx .xml office2007
-
malware-sample-library-master/Trojans/Azorult/AzorultPasswordStealer.bin.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Trojans/FormbookStealer.false.exe windows:4 windows x86 arch:x86
1a3f93ff0fc528859cc20f3969cb5961
Code Sign
01Certificate
IssuerCN=InstallScript Setup Launcher,O=EffectMatrix Inc.\ ,C=FRNot Before06-10-2018 06:57Not After06-10-2019 06:57SubjectCN=InstallScript Setup Launcher,O=EffectMatrix Inc.\ ,C=FRb6:04:de:58:61:fd:84:33:a1:09:90:82:57:e2:47:19:ec:62:6b:9b:35:8f:91:ba:cc:24:1a:fc:e3:e0:77:44Signer
Actual PE Digestb6:04:de:58:61:fd:84:33:a1:09:90:82:57:e2:47:19:ec:62:6b:9b:35:8f:91:ba:cc:24:1a:fc:e3:e0:77:44Digest Algorithmsha256PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
ord693
__vbaFreeVar
__vbaCyMul
__vbaStrVarMove
__vbaLenBstr
__vbaEnd
__vbaVarIdiv
__vbaFreeVarList
_adj_fdiv_m64
ord698
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
ord660
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord669
__vbaCyErrVar
ord594
__vbaOnError
_adj_fdiv_m16i
ord702
__vbaObjSetAddref
_adj_fdivr_m16i
ord523
_CIsin
ord525
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
DllFunctionCall
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
ord712
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord609
__vbaFPException
__vbaVarCat
ord537
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
ord610
__vbaStrToAnsi
_CIatan
__vbaStrMove
__vbaI4Cy
_allmul
ord545
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
Sections
.text Size: 508KB - Virtual size: 505KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Trojans/NanocoreRAT.bin.exe windows:5 windows x86 arch:x86
7f2222d75bcebeb591b7d884c5b9299b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
__WSAFDIsSet
recv
send
setsockopt
ntohs
recvfrom
select
WSAStartup
htons
accept
listen
bind
closesocket
connect
WSACleanup
ioctlsocket
sendto
WSAGetLastError
inet_addr
gethostbyname
gethostname
socket
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetConnectW
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
userenv
UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetCurrentThread
FindNextFileW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
CloseHandle
GetLastError
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
RaiseException
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateThread
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
DrawMenuBar
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
CopyImage
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
UnregisterHotKey
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
DeleteMenu
PeekMessageW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
CharLowerBuffW
GetWindowTextW
gdi32
SetPixel
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
GetDeviceCaps
CloseFigure
LineTo
AngleArc
CreateCompatibleBitmap
CreateCompatibleDC
MoveToEx
Ellipse
PolyDraw
BeginPath
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
EndPath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAclInformation
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
InitiateSystemShutdownExW
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAce
GetAce
shell32
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
UnRegisterTypeLi
SafeArrayCreateVector
SysAllocString
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
VariantCopy
VariantClear
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
VariantChangeType
SafeArrayAllocDescriptorEx
VariantInit
Sections
.text Size: 557KB - Virtual size: 557KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 368KB - Virtual size: 367KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Trojans/PasswordStealer.NET.bin.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Trojans/Trickbotpwgrab.bin.dll windows:6 windows x86 arch:x86
2e7d1a4d4a2b95a6c239f0ae536c1af6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InitializeSListHead
GetCurrentThreadId
ReadConsoleW
GetTimeZoneInformation
FreeLibraryAndExitThread
IsDebuggerPresent
ExitThread
QueryPerformanceFrequency
GetCurrentProcessId
QueryPerformanceCounter
GetSystemTimeAsFileTime
lstrlenA
GetCurrentProcess
ReadFile
VirtualQuery
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapSize
SetLastError
GlobalAlloc
GlobalFree
CloseHandle
Sleep
lstrlenW
GetVersionExW
LoadLibraryW
GetProcAddress
GetCurrentDirectoryA
SetCurrentDirectoryA
FindFirstFileA
FindNextFileA
CopyFileA
GetFileAttributesA
CreateFileA
SystemTimeToFileTime
GetSystemTime
GetFileTime
WriteFile
SetFilePointer
SetEndOfFile
GetFileSize
lstrcatA
VirtualAlloc
lstrcpyA
EncodePointer
RaiseException
InterlockedFlushSList
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
GetACP
CompareStringW
LCMapStringW
FindClose
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetStdHandle
GetFileType
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringA
OutputDebugStringW
WaitForSingleObjectEx
WriteConsoleW
DecodePointer
CreateFileW
GetVersionExA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
GetTempPathW
CreateMutexW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
FlushViewOfFile
DeleteFileA
DeleteFileW
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
VirtualFree
HeapFree
GetLastError
WTSGetActiveConsoleSessionId
ExpandEnvironmentStringsA
DeleteCriticalSection
CreateThread
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
LocalFree
advapi32
CryptGenRandom
AdjustTokenPrivileges
RegDisablePredefinedCacheEx
LookupPrivilegeValueA
GetUserNameA
ImpersonateLoggedOnUser
OpenProcessToken
ConvertSidToStringSidW
GetTokenInformation
CryptReleaseContext
RegQueryValueExW
RegEnumValueW
CryptGetHashParam
RegOpenKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CredFree
CredEnumerateW
CryptAcquireContextW
CryptAcquireContextA
RegOpenKeyExA
DuplicateToken
RevertToSelf
RegEnumKeyA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
userenv
ExpandEnvironmentStringsForUserA
GetProfilesDirectoryA
shlwapi
StrCatW
wnsprintfW
StrChrW
StrCpyNW
StrChrA
wnsprintfA
StrStrA
StrCmpW
crypt32
CryptUnprotectData
ntdll
strncat
strncpy
_alldiv
_aulldiv
strrchr
memcmp
memcpy
strstr
memchr
memmove
strchr
_wcsicmp
memset
strncmp
_wcslwr
wtsapi32
WTSQueryUserToken
wininet
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
user32
wsprintfA
shell32
SHGetSpecialFolderPathA
ws2_32
send
closesocket
WSAGetLastError
recv
Exports
Exports
Control
FreeBuffer
Release
Start
Sections
.text Size: 689KB - Virtual size: 688KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 112KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Turla/CarbonImplant.bin.exe windows:5 windows x64 arch:x64
f9410b77f2ed92c5538775ecf2c381c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateFileW
WritePrivateProfileStringW
FindClose
LockResource
DeviceIoControl
GetFileAttributesW
GetFileTime
CloseHandle
GetVolumeInformationW
ExpandEnvironmentStringsW
__chkstk
GetVersionExW
SizeofResource
WriteFile
SetFileTime
GetPrivateProfileStringW
GetProcessHeap
LoadResource
HeapAlloc
FindResourceW
FindFirstFileW
GetEnvironmentVariableW
LocalFree
lstrcatW
GetLastError
VerifyVersionInfoW
HeapFree
VerSetConditionMask
FindNextFileW
user32
wsprintfW
advapi32
OpenServiceW
RegCloseKey
RegOpenKeyExW
ChangeServiceConfigW
StartServiceW
ChangeServiceConfig2W
RegOpenKeyExA
InitializeSecurityDescriptor
RegQueryValueExW
RegCreateKeyExW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorA
MakeAbsoluteSD
SetFileSecurityW
RegSetValueExW
msvcrt
_wcsicmp
memmove
free
malloc
wprintf
printf
rand
srand
wcsncmp
_time64
__C_specific_handler
_XcptFilter
sprintf
_exit
_cexit
exit
__winitenv
__wgetmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
_c_exit
memset
memcpy
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 600KB - Virtual size: 600KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Turla/KazuarRAT.bin.dll windows:4 windows x86 arch:x86
682156c4380c216ff8cb766a2f2e8817
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
GetModuleFileNameA
LoadLibraryA
lstrcmpiA
shlwapi
PathFindFileNameA
user32
CallNextHookEx
Exports
Exports
DllMain@12
HookProc@12
Sections
.text Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.wtf Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Turla/NCSC.bin.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
D:\Develop\sps\neuron2\neuron2\obj\Release\neuron2.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Turla/Nautilus Implant.bin.dll windows:6 windows x64 arch:x64
468451b8d57563f8791acd5aad32d23a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
SetFilePointer
ReadFile
GetLastError
CreateThread
GetCurrentProcessId
CreateEventA
GetTempPathA
CreateProcessA
TerminateProcess
Sleep
GetFileSize
DeleteFileA
CreateFileA
WaitForSingleObject
SetEndOfFile
CreateFileW
HeapSize
WriteConsoleW
GetFileAttributesA
MultiByteToWideChar
WideCharToMultiByte
ReleaseMutex
CreateMutexA
DuplicateHandle
SetEvent
GetCurrentProcess
OpenProcess
MapViewOfFile
LocalAlloc
WaitForMultipleObjects
CreateFileMappingA
SetLastError
GetProcAddress
UnmapViewOfFile
ResetEvent
WriteFile
HeapAlloc
HeapFree
GetProcessHeap
GetTempFileNameA
GetExitCodeThread
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetStdHandle
GetModuleFileNameW
GetFileType
DeleteCriticalSection
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadConsoleW
RaiseException
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetStringTypeW
CompareStringW
LCMapStringW
SetStdHandle
CreateDirectoryA
shell32
SHFileOperationA
ws2_32
connect
httpapi
HttpReceiveHttpRequest
HttpRemoveUrl
HttpAddUrl
HttpCreateHttpHandle
HttpInitialize
HttpSendResponseEntityBody
HttpSendHttpResponse
HttpReceiveRequestEntityBody
wininet
HttpQueryInfoW
InternetOpenA
HttpOpenRequestA
InternetReadFile
InternetCloseHandle
InternetConnectA
HttpSendRequestA
advapi32
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
OpenProcessToken
Exports
Exports
MyFunction
ReflectiveLoader
Sections
.text Size: 447KB - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Turla/NeuronImplant2018.bin.dll windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.rdata Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Turla/OutlookBackdoor.bin.dll regsvr32 windows:5 windows x86 arch:x86
ffdd7d29384f862df16f05b993adefd4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteFile
HeapReAlloc
HeapAlloc
WaitForSingleObject
GetFileAttributesW
MultiByteToWideChar
SetLastError
VirtualFree
LoadLibraryA
VirtualProtect
DeleteCriticalSection
WideCharToMultiByte
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
CreateDirectoryW
GetModuleFileNameW
GetFullPathNameW
ExpandEnvironmentStringsW
GetCurrentProcess
VirtualAlloc
GetSystemTime
SystemTimeToFileTime
GetModuleHandleA
CreateEventA
SetEvent
CreateFileA
FormatMessageA
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
SetFilePointer
GetCurrentProcessId
GetComputerNameA
lstrlenA
CreateSemaphoreA
CreateProcessA
TerminateProcess
lstrcatA
ReleaseSemaphore
CreateDirectoryA
FindFirstFileA
GetCurrentDirectoryA
GetTempPathA
DeleteFileA
FreeLibrary
GetTickCount
GetModuleHandleW
GetProcessId
FlushInstructionCache
LocalAlloc
CompareStringW
CompareStringA
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentThreadId
ReadFile
GetFileSize
CreateFileW
GetProcessHeap
HeapFree
GetLocalTime
DeleteFileW
GetEnvironmentVariableW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
LoadLibraryW
Sleep
CreateThread
Thread32Next
CloseHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualQuery
SetEnvironmentVariableW
SetEnvironmentVariableA
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
HeapSize
ExitProcess
HeapCreate
HeapDestroy
GetConsoleCP
GetConsoleMode
user32
wsprintfA
EnumThreadWindows
EnumChildWindows
GetActiveWindow
InvalidateRect
SendMessageA
PostMessageA
IsWindowVisible
CallWindowProcA
SetWindowLongA
GetWindowLongA
GetClassNameA
MessageBoxA
advapi32
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
shell32
SHFileOperationA
psapi
GetModuleInformation
mapi32
ord13
ord140
Exports
Exports
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Install
TBP_Finalize
TBP_GetName
TBP_GetStatus
TBP_Initialize
Uninstall
install
uninstall
Sections
.text Size: 295KB - Virtual size: 294KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Turla/OutlookBackdoor2.bin.dll regsvr32 windows:5 windows x86 arch:x86
76768716dc7a613d452ff4d177e13797
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteFile
HeapReAlloc
FindFirstChangeNotificationW
HeapAlloc
WaitForSingleObject
FindCloseChangeNotification
GetFileAttributesW
MultiByteToWideChar
GetLastError
SetLastError
FindNextChangeNotification
DeleteFileW
VirtualFree
DeleteCriticalSection
WideCharToMultiByte
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
CreateDirectoryW
GetModuleFileNameW
GetFullPathNameW
ExpandEnvironmentStringsW
GetCurrentProcess
VirtualAlloc
VirtualProtect
GetSystemTime
SystemTimeToFileTime
GetModuleHandleA
LoadLibraryA
GetVersionExA
CreateEventA
SetEvent
CreateFileA
FormatMessageA
GetProcAddress
CreateToolhelp32Snapshot
SetFilePointer
Thread32Next
GetCurrentProcessId
WaitForMultipleObjects
CreateWaitableTimerA
SetWaitableTimer
TerminateProcess
FreeLibrary
GetTickCount
LocalAlloc
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
VirtualQuery
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
ReadFile
GetFileSize
CreateFileW
GetProcessHeap
HeapFree
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
Sleep
CreateThread
Thread32First
CloseHandle
GetLocaleInfoA
GetUserDefaultLCID
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
ResumeThread
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStdHandle
GetModuleFileNameA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
HeapSize
ExitProcess
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapCreate
HeapDestroy
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
user32
EnumThreadWindows
EnumChildWindows
InvalidateRect
SendMessageA
DefWindowProcA
DestroyWindow
CreateWindowExA
RegisterClassA
PostMessageA
IsWindowVisible
CallWindowProcA
SetWindowLongA
GetWindowLongA
GetClassNameA
GetActiveWindow
advapi32
RegSetValueExA
RegCreateKeyExA
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegQueryValueExA
oleaut32
SysAllocStringLen
SysFreeString
psapi
GetModuleInformation
Exports
Exports
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Install
TBP_Finalize
TBP_GetName
TBP_GetStatus
TBP_Initialize
Uninstall
install
uninstall
Sections
.text Size: 213KB - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Turla/TurlaAgent.exe.dll windows:4 windows x86 arch:x86
9d0d6daa47d6e6f2d80eb05405944f87
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
LoadLibraryA
FindClose
FindFirstFileA
UnmapViewOfFile
GetLastError
MapViewOfFile
CreateFileMappingA
GetFileSize
lstrcmpA
GetTempFileNameA
GetTempPathA
lstrlenA
SetLastError
SetFileAttributesA
CopyFileA
WriteFile
GetPrivateProfileStringA
FindNextFileA
OpenEventA
GetVolumeInformationA
GetDriveTypeA
ExitProcess
GetModuleHandleA
GetModuleFileNameA
SetFilePointer
ReadFile
CreateProcessA
Sleep
lstrcatA
GetSystemDirectoryA
GetSystemTime
SetFileTime
GetTempPathW
FreeLibrary
GetEnvironmentVariableW
GetComputerNameW
GetTimeZoneInformation
GetLocalTime
MultiByteToWideChar
lstrcatW
lstrlenW
GetVersionExA
GetTickCount
GetComputerNameA
WaitForSingleObject
ResumeThread
TerminateProcess
FileTimeToSystemTime
GetWindowsDirectoryA
GetEnvironmentVariableA
CreateDirectoryA
CreateMutexA
ReleaseMutex
OutputDebugStringA
GetFileTime
InterlockedIncrement
InterlockedDecrement
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
DeleteFileA
lstrcpyA
CreateFileA
GetFileInformationByHandle
CloseHandle
GetFileAttributesA
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetWindowsDirectoryW
IsBadCodePtr
IsBadReadPtr
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
WideCharToMultiByte
UnhandledExceptionFilter
HeapSize
SetUnhandledExceptionFilter
FlushFileBuffers
GetCurrentProcess
GetStartupInfoA
GetStdHandle
HeapAlloc
HeapFree
GetFileType
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsFree
SetStdHandle
SetEndOfFile
SetHandleCount
user32
RegisterClassExA
CreateWindowExA
DefWindowProcA
CharLowerBuffA
wsprintfA
wsprintfW
GetMessageA
TranslateMessage
DispatchMessageA
advapi32
RegCreateKeyA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegEnumValueA
RegCloseKey
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
ws2_32
inet_ntoa
gethostbyname
WSAStartup
WSACleanup
Exports
Exports
Entry
InstallM
InstallS
Sections
.text Size: 128KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Turla/TurlaDropper.bin.exe windows:5 windows x86 arch:x86
05cb4e6d3d97087700002cadc74908c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
GetFileAttributesW
GetModuleFileNameW
GetLastError
SetLastError
GetModuleFileNameA
CreateFileA
SetFileTime
InitializeCriticalSection
LeaveCriticalSection
GetSystemDirectoryA
EnterCriticalSection
GetFileTime
DeleteCriticalSection
CloseHandle
HeapAlloc
WideCharToMultiByte
HeapFree
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
SetFilePointer
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
HeapSize
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
VirtualQuery
GetProcAddress
LoadLibraryW
GetCPInfo
GetModuleHandleA
RaiseException
user32
DefWindowProcA
EndDialog
CreateWindowExA
GetWindowLongA
MessageBoxA
TranslateMessage
SendMessageA
SetFocus
LoadIconA
LoadMenuA
KillTimer
PostQuitMessage
RegisterClassExA
SetTimer
GetMessageA
wsprintfW
wsprintfA
SetMenu
DispatchMessageA
SetWindowTextA
LoadCursorA
DialogBoxParamA
ShowWindow
gdi32
GetStockObject
advapi32
GetUserNameA
Sections
.text Size: 126KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 383KB - Virtual size: 390KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
malware-sample-library-master/Turla/TurlaKeylogger.bin.dll windows:5 windows x64 arch:x64
94e4cb53a59c210cf3bda6a0cd66f941
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
GetModuleHandleW
Sleep
RtlUnwindEx
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapFree
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ