Temp[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Temp.zip
Size

1.5MB
MD5

19f14235c12de51eb54191abd14d63d9
SHA1

f73243a892faa3e8dbb3c3b576f31642252f3fb1
SHA256

491720d030b298ed2b58dd0d74c20b13bc36dd3a816f5c8dc6437a1b7ade654f
SHA512

0136f598d950dd0137b4b451809f8e019bd214a0977abe19d7890118181e7502ca71b775b94cee2c3dba6d7bd5dcb6c0c10f747d0184cbb8da076e93c5eb0713
SSDEEP

24576:lq/0n0Ncicfsx+PIK8SZTVv6m1tDYSF92GErXkxK+BOXITAOxIrZJ362zxMT45z:lq/BciqEKTvP8S7aqK8OqxerHLm0R

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Temp/$
unpack001/Temp/$.$
unpack001/Temp/host.exe

Files

Temp.zip
.zip
Temp/$
.dll regsvr32 windows:4 windows x64 arch:x64

00a3ad8febd896e65e8ee1d066681090

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\source\dfcgorilla\src\expapply\x64\Release\expapply64.pdb

Imports

mpr

WNetGetConnectionA
WNetGetConnectionW
WNetAddConnection2A
WNetCancelConnection2A

kernel32

LoadLibraryA
IsBadReadPtr
GetFileSize
DeleteCriticalSection
GlobalMemoryStatus
GetLastError
GetDriveTypeA
lstrlenA
GetEnvironmentVariableA
GetTempPathA
SetErrorMode
MoveFileW
MoveFileA
GetFileAttributesW
GetFileAttributesA
GetFullPathNameW
GetFullPathNameA
CreateFileW
CreateFileA
ReleaseMutex
lstrcpyA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetLogicalDrives
lstrcmpiA
SetFileAttributesW
SetFileAttributesA
SetFileTime
SetEndOfFile
SetFilePointer
CreateDirectoryW
CreateDirectoryA
RemoveDirectoryW
RemoveDirectoryA
DeviceIoControl
GetProcAddress
DeleteFileW
DeleteFileA
GetCurrentProcessId
GetVolumeInformationW
GetDriveTypeW
GetModuleHandleA
GetComputerNameW
GetComputerNameA
CreateMutexA
CopyFileW
CopyFileA
GlobalAlloc
GlobalFree
GlobalSize
GlobalReAlloc
GetLocalTime
GetProfileStringW
GetPrivateProfileStringW
LocalFree
LocalAlloc
GetCurrentThread
MoveFileExW
GetFileInformationByHandle
GetSystemDirectoryW
GetWindowsDirectoryW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
ReadFile
WriteFile
GetLocaleInfoW
WriteConsoleW
SetConsoleCtrlHandler
GetConsoleOutputCP
WriteConsoleA
FreeLibrary
GetModuleFileNameA
Sleep
InitializeCriticalSection
FindResourceA
LoadResource
LockResource
EnterCriticalSection
LeaveCriticalSection
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetEnvironmentVariableW
GetStdHandle
CreateProcessW
CloseHandle
WaitForSingleObject
GetExitCodeProcess
GetVersion
WideCharToMultiByte
FindFirstFileA
MultiByteToWideChar
FindClose
FindFirstFileW
FindNextFileA
FindNextFileW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTimeZoneInformation
GetCurrentProcess
FlushFileBuffers
HeapAlloc
HeapFree
HeapReAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetVersionExA
GetProcessHeap
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
TlsAlloc
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
ExitProcess
HeapSetInformation
HeapCreate
HeapDestroy
HeapSize
LCMapStringA
LCMapStringW
RtlUnwindEx
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
FatalAppExitA
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetDateFormatA
GetTimeFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
SetStdHandle

user32

CharUpperA
LoadStringA
LoadStringW
CharUpperW

advapi32

GetAclInformation
GetEffectiveRightsFromAclA
GetAce
RegCloseKey
OpenThreadToken
DuplicateToken
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
AccessCheck
FreeSid
RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
GetSidSubAuthorityCount
GetSidLengthRequired
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetSecurityDescriptorOwner
IsValidSid
GetSecurityDescriptorGroup
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetFileSecurityW
SetFileSecurityW
GetSecurityInfo

Exports

Exports

ExaPatchApplyClose
ExaPatchApplyCloseStream
ExaPatchApplyDoEntireFile
ExaPatchApplyDoEntry
ExaPatchApplyDoEntryRaw
ExaPatchApplyFinishEntry
ExaPatchApplyFinishFile
��
��
DllRegisterServer
EllRegisterServer
EllRegisterServer
EllRegisterServer
EllRegisterServer
EllRegisterServer

Sections

.text
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 281KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 335KB - Virtual size: 334KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Temp/$.$
.dll regsvr32 windows:6 windows x64 arch:x64

fde5069783a744f97063c1afd7b8a158

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

RtlCaptureContext
RtlUnwindEx
NtWriteFile
NtReadFile
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

kernel32

HeapSize
WriteFile
GetConsoleOutputCP
GetStringTypeW
SetStdHandle
WaitForMultipleObjects
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
SetThreadPriority
Sleep
CloseHandle
FreeConsole
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
SetThreadStackGuarantee
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
QueryPerformanceCounter
AcquireSRWLockExclusive
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCurrentProcess
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
DuplicateHandle
SetFilePointerEx
GetStdHandle
SetHandleInformation
WriteFileEx
SleepEx
GetExitCodeProcess
TerminateProcess
TryAcquireSRWLockExclusive
HeapFree
HeapReAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
GetModuleHandleA
GetProcAddress
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
CreateEventW
ReadFile
GetOverlappedResult
CancelIo
GetConsoleMode
GetFileType
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
SetCurrentDirectoryW
ExitProcess
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetFullPathNameW
GetSystemTimeAsFileTime
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
EncodePointer
InterlockedFlushSList
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW

ws2_32

connect
getaddrinfo
WSASocketW
send
recv
WSAGetLastError
freeaddrinfo
WSACleanup
WSAStartup
closesocket

Exports

Exports

DllGetClassObject
DllRegisterServer
DllUnregisterServer
ebsbqoV

Sections

.text
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Temp/PsExec.exe
.exe windows:6 windows x86 arch:x86

1193bc223dad681f22f8248608cbb592

Code Sign

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cd
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:f4:a0:22:99:74:5d:2a:dd:26:8b:e6:eb:e6:8a:9d:bd:73:6f:54:ad:34:c8:ef:67:d3:83:f8:30:d2:f1:6f
Signer

Actual PE Digest

35:f4:a0:22:99:74:5d:2a:dd:26:8b:e6:eb:e6:8a:9d:bd:73:6f:54:ad:34:c8:ef:67:d3:83:f8:30:d2:f1:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\1\s\psexec\exe\Win32\Release\psexec.pdb

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

netapi32

NetServerEnum
NetApiBufferFree

ws2_32

gethostname
WSAStartup
inet_ntoa
gethostbyname

mpr

WNetCancelConnection2W
WNetAddConnection2W

kernel32

SetFileAttributesW
DuplicateHandle
DisconnectNamedPipe
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
CreateEventW
WaitForMultipleObjects
GetCurrentProcessId
GetFileTime
GetExitCodeProcess
ResumeThread
GetVersion
SetProcessAffinityMask
CopyFileW
ReadConsoleW
SetConsoleCtrlHandler
SetConsoleTitleW
HeapReAlloc
GetEnvironmentVariableW
GetFileAttributesW
ReadFile
GetConsoleScreenBufferInfo
MultiByteToWideChar
VerifyVersionInfoW
FormatMessageA
FindResourceW
SizeofResource
LockResource
LoadResource
FreeLibrary
GetSystemDirectoryW
GetTickCount
GetCurrentProcess
Sleep
WaitForSingleObject
SetEvent
CloseHandle
WriteFile
DeleteFileW
CreateFileW
VerSetConditionMask
SetThreadGroupAffinity
SetPriorityClass
GetModuleFileNameW
LocalFree
SetEndOfFile
LocalAlloc
GetProcAddress
GetModuleHandleW
GetFileType
GetCommandLineW
GetStdHandle
LoadLibraryExW
GetVersionExW
SetLastError
GetComputerNameW
GetLastError
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
WriteConsoleW
HeapSize
TerminateProcess
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetConsoleCP
SetStdHandle
CreateThread
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
GetFileSizeEx
SetFilePointerEx

comdlg32

PrintDlgW

advapi32

CreateProcessAsUserW
CryptHashData
CryptCreateHash
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptExportKey
CryptDestroyKey
CryptDeriveKey
CryptGenKey
CryptReleaseContext
CryptAcquireContextW
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
OpenProcessToken
LsaEnumerateAccountRights
LsaOpenPolicy
LsaClose
LsaFreeMemory
SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW
LookupPrivilegeValueW
SetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
GetLengthSid
GetAce
FreeSid
AllocateAndInitializeSid
AddAce
AddAccessAllowedAce
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegCreateKeyW
RegCloseKey

Sections

.text
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Temp/host.exe
.exe windows:6 windows x64 arch:x64

e5624907c8866cb389b142bdb0adf34f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtWriteFile
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtReadFile
RtlNtStatusToDosError
RtlPcToFileHeader

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

kernel32

FlushFileBuffers
HeapSize
GetConsoleOutputCP
SetThreadPriority
LCMapStringW
CompareStringW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetLastError
HeapFree
HeapReAlloc
GetModuleHandleA
GetProcAddress
GetCurrentThread
CloseHandle
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
CreateWaitableTimerExW
SetWaitableTimer
Sleep
GetModuleHandleW
FormatMessageW
GetCurrentDirectoryW
GetCurrentProcess
GetEnvironmentVariableW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
CreateDirectoryW
FindFirstFileW
FindClose
AcquireSRWLockExclusive
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
ReadFileEx
SleepEx
WriteFileEx
CreateEventW
CancelIo
GetOverlappedResult
ReadFile
ExitProcess
GetProcessHeap
HeapAlloc
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
AcquireSRWLockShared
ReleaseSRWLockShared
GetFinalPathNameByHandleW
FreeConsole
GetCurrentThreadId
WaitForMultipleObjects
GetExitCodeProcess
SetCurrentDirectoryW
SetHandleInformation
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
GetFileType
SetStdHandle
SetEnvironmentVariableW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
SetFilePointerEx

ws2_32

getaddrinfo
connect
WSASocketW
send
closesocket
recv
freeaddrinfo
WSACleanup
WSAStartup
WSAGetLastError

Sections

.text
Size: 250KB - Virtual size: 250KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 662KB - Virtual size: 661KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

00a3ad8febd896e65e8ee1d066681090

Headers

File Characteristics

PDB Paths

Imports

mpr

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 290KB - Virtual size: 289KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 6KB - Virtual size: 281KB

.pdata Size: 14KB - Virtual size: 14KB

.rsrc Size: 335KB - Virtual size: 334KB

.reloc Size: 2KB - Virtual size: 2KB

fde5069783a744f97063c1afd7b8a158

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

advapi32

bcrypt

kernel32

ws2_32

Exports

Exports

Sections

.text Size: 254KB - Virtual size: 254KB

.rdata Size: 89KB - Virtual size: 89KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 12KB - Virtual size: 12KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 3KB - Virtual size: 2KB

1193bc223dad681f22f8248608cbb592

Code Sign

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cdCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

35:f4:a0:22:99:74:5d:2a:dd:26:8b:e6:eb:e6:8a:9d:bd:73:6f:54:ad:34:c8:ef:67:d3:83:f8:30:d2:f1:6fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

netapi32

ws2_32

mpr

kernel32

comdlg32

advapi32

Sections

.text Size: 254KB - Virtual size: 254KB

.rdata Size: 224KB - Virtual size: 223KB

.data Size: 7KB - Virtual size: 155KB

.rsrc Size: 191KB - Virtual size: 191KB

.reloc Size: 11KB - Virtual size: 10KB

e5624907c8866cb389b142bdb0adf34f

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

advapi32

bcrypt

kernel32

ws2_32

Sections

.text Size: 250KB - Virtual size: 250KB

.text
Size: 290KB - Virtual size: 289KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 6KB - Virtual size: 281KB

.pdata
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 335KB - Virtual size: 334KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 254KB - Virtual size: 254KB

.rdata
Size: 89KB - Virtual size: 89KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 12KB - Virtual size: 12KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 3KB - Virtual size: 2KB

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cd
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

35:f4:a0:22:99:74:5d:2a:dd:26:8b:e6:eb:e6:8a:9d:bd:73:6f:54:ad:34:c8:ef:67:d3:83:f8:30:d2:f1:6f
Signer

.text
Size: 254KB - Virtual size: 254KB

.rdata
Size: 224KB - Virtual size: 223KB

.data
Size: 7KB - Virtual size: 155KB

.rsrc
Size: 191KB - Virtual size: 191KB

.reloc
Size: 11KB - Virtual size: 10KB

.text
Size: 250KB - Virtual size: 250KB

.rdata
Size: 87KB - Virtual size: 86KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 11KB - Virtual size: 10KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 662KB - Virtual size: 661KB

.reloc
Size: 3KB - Virtual size: 2KB