RC7x64[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RC7x64.zip
Size

11.5MB
MD5

af9675691cbb1c54a8e2bf449897fb8d
SHA1

9f496d869121794d6a4332b0346e231c8082b850
SHA256

f293c46132b3535734ce9a239021790aaac3c91897939fa303819980aaf984bd
SHA512

19caa0dac6b2a925d1b843f81d37bf9f3b6041077b8adf9e16db0ed7cb2e2db13ed71c28d6106f62347594504b98b2acaef8ce0a0784decdda901326c0223b39
SSDEEP

196608:kbYuf4l4ZHSGxZzAdCRRXaAFCrKPMLBUu580kdm1WHTG3/RhzelacM95pw9:gslgH/AdC/XRubLBUvU0H63/LSscW3w9

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RC7x64/Executor/AlphaBlendTextBox.dll
unpack001/RC7x64/Executor/Bunifu_UI_v1.5.3.dll
unpack001/RC7x64/Executor/RC7_UI.exe
unpack001/RC7x64/Executor/Regret.dll

Files

RC7x64.zip
.zip
RC7x64/Executor/AlphaBlendTextBox.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RC7x64/Executor/Bunifu_UI_v1.5.3.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RC7x64/Executor/RC7_UI.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RC7x64/Executor/Regret.dll
.dll windows:6 windows x86 arch:x86

40966ecb63dcf036ca70947417becef0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\PCD\Desktop\2016L exploit - Copy\Release\2016L exploit.pdb

Imports

kernel32

GetModuleHandleA
GetModuleFileNameA
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
FormatMessageA
ReadFile
VirtualProtect
CreateNamedPipeA
DisconnectNamedPipe
OpenProcess
Sleep
CloseHandle
CreateThread
VirtualProtectEx
ExitProcess
GetCurrentProcessId
ConnectNamedPipe
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
OpenThread
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcess
GetThreadContext
SetThreadContext
FlushInstructionCache
GetModuleHandleW
VirtualAlloc
VirtualFree
VirtualQuery
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ

vcruntime140

memset
_except_handler4_common
__std_type_info_destroy_list
_CxxThrowException
memmove
memcpy
memchr
_setjmp3
longjmp
strchr
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
strrchr

api-ms-win-crt-stdio-l1-1-0

fseek
_pclose
tmpfile
__stdio_common_vfscanf
_popen
fputc
fflush
_get_stream_buffer_pointers
freopen
tmpnam
ferror
fopen
__acrt_iob_func
getc
__stdio_common_vfprintf
fclose
__stdio_common_vsprintf
fgetc
fwrite
fread
fgetpos
feof
fputs
setvbuf
ungetc
fgets
fsetpos
ftell
_fseeki64
clearerr

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file
remove
rename

api-ms-win-crt-runtime-l1-1-0

_initterm
_cexit
_crt_atexit
_execute_onexit_table
system
exit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
strerror
_errno
_initterm_e
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
realloc

api-ms-win-crt-convert-l1-1-0

strtod
strtoul

api-ms-win-crt-string-l1-1-0

isspace
iscntrl
strncpy
isalnum
isalpha
strcspn
isdigit
strncat
strpbrk
toupper
isupper
tolower
isxdigit
ispunct
islower
strcoll

api-ms-win-crt-locale-l1-1-0

setlocale
localeconv

api-ms-win-crt-math-l1-1-0

_libm_sse2_acos_precise
_libm_sse2_atan_precise
_CIsinh
_CIfmod
_CIcosh
_CIatan2
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
modf
_libm_sse2_asin_precise
_libm_sse2_pow_precise
ldexp
frexp
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
ceil
floor
_CItanh

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_time64
_localtime64
_gmtime64
_difftime64
clock
_mktime64
strftime

Sections

.text
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RC7x64/Executor/bin/Monaco.html
.js
RC7x64/Executor/bin/MonacoEditor.html
.js
RC7x64/Executor/bin/Themes/Asriel Theme.zip
.zip
Auto_In.bmp
Button_Clicked.bmp
Button_Hover.bmp
Button_Idle.bmp
Config.txt
Google_Drive_In.bmp
Hide_Side.bmp
Krystal_In.bmp
MainUi.bmp
S_Button_Clicked.bmp
S_Button_Hover.bmp
S_Button_Idle.bmp
Save_In.bmp
TextBox.bmp
Wofly_In.bmp
WordWrap_In.bmp
RC7x64/Executor/bin/Themes/Blue Chicago Theme.zip
.zip
Auto_In.bmp
Button_Clicked.bmp
Button_Hover.bmp
Button_Idle.bmp
Config.txt
Google_Drive_In.bmp
Hide_Side.bmp
Krystal_In.bmp
MainUi.bmp
S_Button_Clicked.bmp
S_Button_Hover.bmp
S_Button_Idle.bmp
Save_In.bmp
TextBox.bmp
Wofly_In.bmp
WordWrap_In.bmp
RC7x64/Executor/bin/Themes/Blue Stripes Theme.zip
.zip
Auto_In.bmp
Button_Clicked.bmp
Button_Hover.bmp
Button_Idle.bmp
Config.txt
Google_Drive_In.bmp
Hide_Side.bmp
Krystal_In.bmp
MainUi.bmp
S_Button_Clicked.bmp
S_Button_Hover.bmp
S_Button_Idle.bmp
Save_In.bmp
TextBox.bmp
Wofly_In.bmp
WordWrap_In.bmp
RC7x64/Executor/bin/Themes/Cow Theme.zip
.zip
Auto_In.bmp
Button_Clicked.bmp
Button_Hover.bmp
Button_Idle.bmp
Config.txt
Google_Drive_In.bmp
Hide_Side.bmp
Krystal_In.bmp
MainUi.bmp
S_Button_Clicked.bmp
S_Button_Hover.bmp
S_Button_Idle.bmp
Save_In.bmp
TextBox.bmp
Wofly_In.bmp
WordWrap_In.bmp
RC7x64/Executor/bin/Themes/Emilia Theme.zip
.zip
Auto_In.bmp
Button_Clicked.bmp
Button_Hover.bmp
Button_Idle.bmp
Config.txt
Google_Drive_In.bmp
Hide_Side.bmp
Krystal_In.bmp
MainUi.bmp
S_Button_Clicked.bmp
S_Button_Hover.bmp
S_Button_Idle.bmp
Save_In.bmp
TextBox.bmp
Wofly_In.bmp
WordWrap_In.bmp
RC7x64/Executor/bin/Themes/Frozen Winter Theme.zip
.zip
Auto_In.bmp
Button_Clicked.bmp
Button_Hover.bmp
Button_Idle.bmp
Config.txt
Google_Drive_In.bmp
Hide_Side.bmp
Krystal_In.bmp
MainUi.bmp
S_Button_Clicked.bmp
S_Button_Hover.bmp
S_Button_Idle.bmp
Save_In.bmp
TextBox.bmp
Wofly_In.bmp
WordWrap_In.bmp
RC7x64/Executor/bin/Themes/Gold Theme.zip
.zip
Auto_In.bmp
Button_Clicked.bmp
Button_Hover.bmp
Button_Idle.bmp
Config.txt
Google_Drive_In.bmp
Hide_Side.bmp
Krystal_In.bmp
MainUi.bmp
S_Button_Clicked.bmp
S_Button_Hover.bmp
S_Button_Idle.bmp
Save_In.bmp
TextBox.bmp
Wofly_In.bmp
WordWrap_In.bmp
RC7x64/Executor/bin/Themes/Green Wolf Theme.zip
.zip
Auto_In.bmp
Button_Clicked.bmp
Button_Hover.bmp
Button_Idle.bmp
Config.txt
Google_Drive_In.bmp
Hide_Side.bmp
Krystal_In.bmp
MainUi.bmp
S_Button_Clicked.bmp
S_Button_Hover.bmp
S_Button_Idle.bmp
Save_In.bmp
TextBox.bmp
Wofly_In.bmp
WordWrap_In.bmp
RC7x64/Executor/bin/Themes/Kakarot Theme.zip
.zip
RC7x64/Executor/bin/Themes/Original.zip
.zip
RC7x64/Executor/bin/Themes/Rc7 Classic Wolf Rework.zip
.zip
RC7x64/Executor/bin/Themes/Red Carbon Fiber.zip
.zip
RC7x64/Executor/bin/Themes/Tabs_back.bmp
RC7x64/Executor/bin/Themes/default.zip
.zip
RC7x64/Executor/bin/Themes/light.zip
.zip
RC7x64/Executor/bin/Themes/temp/Auto_In.bmp
RC7x64/Executor/bin/Themes/temp/Button_Clicked.bmp
RC7x64/Executor/bin/Themes/temp/Button_Hover.bmp
RC7x64/Executor/bin/Themes/temp/Button_Idle.bmp
RC7x64/Executor/bin/Themes/temp/Config.txt
RC7x64/Executor/bin/Themes/temp/Google_Drive_In.bmp
RC7x64/Executor/bin/Themes/temp/Hide_Side.bmp
RC7x64/Executor/bin/Themes/temp/Krystal_In.bmp
RC7x64/Executor/bin/Themes/temp/MainUi.bmp
RC7x64/Executor/bin/Themes/temp/S_Button_Clicked.bmp
RC7x64/Executor/bin/Themes/temp/S_Button_Hover.bmp
RC7x64/Executor/bin/Themes/temp/S_Button_Idle.bmp
RC7x64/Executor/bin/Themes/temp/Save_In.bmp
RC7x64/Executor/bin/Themes/temp/TextBox.bmp
RC7x64/Executor/bin/Themes/temp/Wofly_In.bmp
RC7x64/Executor/bin/Themes/temp/WordWrap_In.bmp
RC7x64/Executor/bin/def/base.txt
RC7x64/Executor/bin/def/classfunc.txt
RC7x64/Executor/bin/def/globalf.txt
RC7x64/Executor/bin/def/globalns.txt
RC7x64/Executor/bin/def/globalv.txt
RC7x64/Executor/bin/scripts/RoXploit v6.txt
RC7x64/Executor/bin/scripts/c00lgui reborn.txt
RC7x64/Executor/bin/scripts/c00lkidd decal spam.txt
RC7x64/Executor/bin/scripts/fe checker.txt
RC7x64/Executor/bin/scripts/hello world.lua
RC7x64/Executor/bin/scripts/rocky2u admin.txt
RC7x64/Executor/bin/scripts/skelly skybox.txt
RC7x64/Executor/bin/scripts/wingz.txt
RC7x64/Executor/bin/vs/base/worker/workerMain.js
.js
RC7x64/Executor/bin/vs/basic-languages/bat/bat.js
RC7x64/Executor/bin/vs/basic-languages/coffee/coffee.js
RC7x64/Executor/bin/vs/basic-languages/cpp/cpp.js
RC7x64/Executor/bin/vs/basic-languages/csharp/csharp.js
RC7x64/Executor/bin/vs/basic-languages/csp/csp.js
RC7x64/Executor/bin/vs/basic-languages/css/css.js
RC7x64/Executor/bin/vs/basic-languages/dockerfile/dockerfile.js
RC7x64/Executor/bin/vs/basic-languages/fsharp/fsharp.js
RC7x64/Executor/bin/vs/basic-languages/go/go.js
RC7x64/Executor/bin/vs/basic-languages/handlebars/handlebars.js
.js
RC7x64/Executor/bin/vs/basic-languages/html/html.js
.js
RC7x64/Executor/bin/vs/basic-languages/ini/ini.js
RC7x64/Executor/bin/vs/basic-languages/java/java.js
RC7x64/Executor/bin/vs/basic-languages/less/less.js
RC7x64/Executor/bin/vs/basic-languages/lua/lua.js
RC7x64/Executor/bin/vs/basic-languages/markdown/markdown.js
.js
RC7x64/Executor/bin/vs/basic-languages/msdax/msdax.js
RC7x64/Executor/bin/vs/basic-languages/mysql/mysql.js
RC7x64/Executor/bin/vs/basic-languages/objective-c/objective-c.js
RC7x64/Executor/bin/vs/basic-languages/pgsql/pgsql.js
RC7x64/Executor/bin/vs/basic-languages/php/php.js
RC7x64/Executor/bin/vs/basic-languages/postiats/postiats.js
RC7x64/Executor/bin/vs/basic-languages/powershell/powershell.js
RC7x64/Executor/bin/vs/basic-languages/pug/pug.js
RC7x64/Executor/bin/vs/basic-languages/python/python.js
RC7x64/Executor/bin/vs/basic-languages/r/r.js
RC7x64/Executor/bin/vs/basic-languages/razor/razor.js
.js
RC7x64/Executor/bin/vs/basic-languages/redis/redis.js
RC7x64/Executor/bin/vs/basic-languages/redshift/redshift.js
RC7x64/Executor/bin/vs/basic-languages/ruby/ruby.js
RC7x64/Executor/bin/vs/basic-languages/rust/rust.js
RC7x64/Executor/bin/vs/basic-languages/sb/sb.js
RC7x64/Executor/bin/vs/basic-languages/scss/scss.js
RC7x64/Executor/bin/vs/basic-languages/solidity/solidity.js
RC7x64/Executor/bin/vs/basic-languages/sql/sql.js
RC7x64/Executor/bin/vs/basic-languages/st/st.js
RC7x64/Executor/bin/vs/basic-languages/swift/swift.js
RC7x64/Executor/bin/vs/basic-languages/vb/vb.js
RC7x64/Executor/bin/vs/basic-languages/xml/xml.js
RC7x64/Executor/bin/vs/basic-languages/yaml/yaml.js
RC7x64/Executor/bin/vs/editor/contrib/suggest/media/String_16x.svg
RC7x64/Executor/bin/vs/editor/contrib/suggest/media/String_inverse_16x.svg
RC7x64/Executor/bin/vs/editor/editor.main.css
RC7x64/Executor/bin/vs/editor/editor.main.js
.js
RC7x64/Executor/bin/vs/editor/editor.main.nls.de.js
RC7x64/Executor/bin/vs/editor/editor.main.nls.es.js
RC7x64/Executor/bin/vs/editor/editor.main.nls.fr.js
RC7x64/Executor/bin/vs/editor/editor.main.nls.it.js
RC7x64/Executor/bin/vs/editor/editor.main.nls.ja.js
RC7x64/Executor/bin/vs/editor/editor.main.nls.js
RC7x64/Executor/bin/vs/editor/editor.main.nls.ko.js
RC7x64/Executor/bin/vs/editor/editor.main.nls.ru.js
RC7x64/Executor/bin/vs/editor/editor.main.nls.zh-cn.js
RC7x64/Executor/bin/vs/editor/editor.main.nls.zh-tw.js
RC7x64/Executor/bin/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
RC7x64/Executor/bin/vs/language/css/cssMode.js
.js
RC7x64/Executor/bin/vs/language/css/cssWorker.js
.js
RC7x64/Executor/bin/vs/language/html/htmlMode.js
.js
RC7x64/Executor/bin/vs/language/html/htmlWorker.js
.js
RC7x64/Executor/bin/vs/language/json/jsonMode.js
.js
RC7x64/Executor/bin/vs/language/json/jsonWorker.js
.js
RC7x64/Executor/bin/vs/language/typescript/lib/typescriptServices.js
.js
RC7x64/Executor/bin/vs/language/typescript/tsMode.js
.js
RC7x64/Executor/bin/vs/language/typescript/tsWorker.js
.js
RC7x64/Executor/bin/vs/loader.js
.js
RC7x64/Imporant.txt

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 12KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 234KB - Virtual size: 233KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

40966ecb63dcf036ca70947417becef0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

Sections

.text Size: 181KB - Virtual size: 181KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 12KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 234KB - Virtual size: 233KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 4.2MB - Virtual size: 4.2MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 181KB - Virtual size: 181KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 8KB - Virtual size: 8KB