mpv[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

mpv.zip
Size

27.3MB
MD5

f8fd84f5e7967bb9c95ecc504625ab23
SHA1

d5b651464891021eb107697ef9b2c7ee1919aeb9
SHA256

7c1bf10dfabb31cb121ea16a0f880c465e1c7f465f3c1c7bb9e9434945a7a7cb
SHA512

6b687f0aebc9caade49e49f44957f612314a7b6259d155d094b4a39efeac8187541adfa12c48ef36856e3534e0a529e9cf4398f1e1ee71703b772b4d0872488b
SSDEEP

393216:QGlJz1axM6bxhWaUtUHU7bwJWCeyAUDcNh0Qd3pYNJQSnT0lZmmLG7AtlLHzu3dg:5zEhaiHUzCey5DcNh0Qd2gagSKdWB+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mpv.exe

Files

mpv.zip
.zip

Password: P@$$w0rd
mpv.exe
.exe windows:6 windows x64 arch:x64

Password: P@$$w0rd

ee76ed2f66ee560e90972651752a9767

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

ConvertSidToStringSidA
ConvertStringSecurityDescriptorToSecurityDescriptorA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
GetUserNameA
OpenProcessToken
RegCloseKey
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW

avrt

AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

cfgmgr32

CM_Get_Child
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Status
CM_Get_Device_IDW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_Sibling
CM_Locate_DevNodeW
CM_Open_DevNode_Key

dwmapi

DwmEnableMMCSS
DwmFlush
DwmGetCompositionTimingInfo
DwmGetWindowAttribute
DwmIsCompositionEnabled

gdi32

BitBlt
ChoosePixelFormat
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreateFontW
CreateICW
CreatePen
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
DescribePixelFormat
EnumFontFamiliesExW
EnumFontFamiliesW
ExtTextOutW
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetDeviceGammaRamp
GetICMProfileW
GetObjectA
GetPixelFormat
GetStockObject
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextFaceW
GetTextMetricsW
Rectangle
SelectObject
SetBkMode
SetDeviceGammaRamp
SetPixelFormat
SetTextColor
SwapBuffers

imm32

ImmAssociateContext
ImmGetCandidateListW
ImmGetCompositionStringW
ImmGetContext
ImmGetIMEFileNameA
ImmNotifyIME
ImmReleaseContext
ImmSetCompositionStringW
ImmSetCompositionWindow

kernel32

AcquireSRWLockExclusive
AddVectoredExceptionHandler
AttachConsole
CancelIo
CancelIoEx
CloseHandle
CompareStringA
ConnectNamedPipe
CreateDirectoryW
CreateEventA
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexA
CreateNamedPipeW
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DebugBreak
DeleteCriticalSection
DeleteProcThreadAttributeList
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
ExitThread
FileTimeToSystemTime
FillConsoleOutputCharacterW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FindResourceW
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameA
GetFullPathNameW
GetHandleInformation
GetLastError
GetLocaleInfoA
GetLogicalDrives
GetLongPathNameA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
GetNumberOfConsoleInputEvents
GetOEMCP
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemPowerStatus
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadGroupAffinity
GetThreadPriority
GetThreadTimes
GetTickCount
GetTickCount64
GetTimeZoneInformation
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSetInformation
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSRWLock
IsDBCSLeadByteEx
IsDebuggerPresent
IsValidCodePage
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
MoveFileExA
MoveFileExW
MulDiv
MultiByteToWideChar
OpenFileMappingA
OpenProcess
OpenThread
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleInputW
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
SetConsoleTitleW
SetDllDirectoryW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFilePointer
SetFilePointerEx
SetLastError
SetNamedPipeHandleState
SetPriorityClass
SetProcessAffinityMask
SetSystemTime
SetThreadAffinityMask
SetThreadContext
SetThreadExecutionState
SetThreadGroupAffinity
SetThreadPriority
SetUnhandledExceptionFilter
SignalObjectAndWait
SizeofResource
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
SuspendThread
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
lstrcmpiW
lstrcpyA
lstrcpynA

mfplat

MFCreateAlignedMemoryBuffer
MFCreateMediaType
MFCreateSample
MFShutdown
MFStartup

msvcrt

__DestructExceptionObject
___lc_codepage_func
___mb_cur_max_func
__argv
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_access
_acmdln
_aligned_free
_aligned_malloc
_aligned_realloc
_amsg_exit
_assert
_beginthread
_beginthreadex
_cexit
_chsize
_close
_commode
_difftime64
_endthread
_endthreadex
_environ
_errno
_exit
_filelengthi64
_fileno
_findclose
_findfirst64
_findnext64
_fmode
_fstat64
_ftime64
_fullpath
_get_osfhandle
_gmtime64
_hypot
_i64toa
_initterm
_isctype
_itoa_s
_localtime64
_lock
_locking
_lseeki64
_ltoa
_mbsrchr
_mkdir
_mkgmtime64
_mktime64
_onexit
_open
_open_osfhandle
_pclose
_popen
_read
_rmdir
_setjmp
_snprintf
_sopen
_stat64
_strdup
_stricmp
_strlwr
_strnicmp
fwprintf
_strrev
_strupr
_time64
_ui64toa
_ultoa
_unlink
_unlock
_utime64
_vscprintf
_vsnprintf
_waccess
_wassert
_wcsicmp
_wcsnicmp
_wfindfirst64
_wfindnext64
_wfopen
_wfopen_s
_wfullpath
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wremove
_wrename
_wrmdir
_wsopen
_wstat64
_wunlink
abort
acos
asin
atan
atof
atoi
bsearch
calloc
clearerr
clock
cosh
div
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetws
fopen
fprintf
fputc
fputs
fputwc
fputws
fread
free
freopen
frexp
fseek
fsetpos
ftell
fwrite
getc
getenv
getwc
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
iswctype
isxdigit
localeconv
log10
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
perror
printf
putc
putchar
putwc
qsort
raise
rand
realloc
remove
rename
rewind
setlocale
setvbuf
signal
sinh
sprintf
srand
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtok_s
strtol
strtoul
strxfrm
swscanf_s
system
tan
tanh
tmpfile
tmpnam
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcscat
wcschr
wcscmp
wcscoll
wcscpy
wcscspn
wcsftime
wcslen
wcsncmp
wcsncpy
wcsrchr
wcsstr
wcstol
wcstombs
wcstoul
wcsxfrm
_vsnprintf_s
longjmp
_nextafter
_j1
_write
_wcsdup
_unlink
_strdup
_setmode
_rmdir
_read
_putenv
_open
_lseek
_itoa
_isatty
_getcwd
_fileno
_fdopen
_dup2
_close
_chmod
_access

ole32

CLSIDFromString
CoCreateInstance
CoGetMalloc
CoInitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateBindCtx
OleInitialize
OleLoadFromStream
OleSaveToStream
OleUninitialize
PropVariantClear
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
StringFromCLSID
StringFromGUID2

oleaut32

OleCreatePropertyFrame
SysFreeString

opengl32

wglCreateContext
wglDeleteContext
wglGetProcAddress
wglMakeCurrent

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA

shell32

CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
ExtractIconExW
SHGetFolderPathA
SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteW

shlwapi

SHCreateStreamOnFileA

user32

AdjustWindowRect
AdjustWindowRectEx
BeginPaint
CallNextHookEx
CallWindowProcW
ChangeDisplaySettingsExW
ClientToScreen
ClipCursor
CloseClipboard
CopyIcon
CreateIconFromResource
CreateIconIndirect
CreateWindowExA
CreateWindowExW
DefWindowProcA
DefWindowProcW
DestroyCursor
DestroyIcon
DestroyWindow
DialogBoxIndirectParamW
DispatchMessageA
DispatchMessageW
DrawIcon
DrawTextW
EmptyClipboard
EnableWindow
EndDialog
EndPaint
EnumDisplayDevicesW
EnumDisplayMonitors
EnumDisplaySettingsW
EqualRect
FindWindowExW
FindWindowW
FlashWindowEx
FrameRect
GetAsyncKeyState
GetClassInfoExW
GetClientRect
GetClipCursor
GetClipboardData
GetClipboardSequenceNumber
GetCursorInfo
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetMessageExtraInfo
GetMessageW
GetMonitorInfoW
GetParent
GetPropW
GetRawInputData
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetShellWindow
GetSystemMetrics
GetUpdateRect
GetWindowLongPtrA
GetWindowLongPtrW
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
IntersectRect
InvalidateRect
IsClipboardFormatAvailable
IsIconic
IsRectEmpty
IsWindowVisible
IsZoomed
KillTimer
LoadCursorA
LoadCursorW
LoadIconW
MapVirtualKeyW
MapWindowPoints
MessageBoxA
MonitorFromPoint
MonitorFromWindow
OffsetRect
OpenClipboard
PeekMessageA
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PtInRect
RegisterClassExA
RegisterClassExW
RegisterClassW
RegisterClipboardFormatW
RegisterDeviceNotificationW
RegisterRawInputDevices
RegisterWindowMessageA
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendMessageA
SendMessageW
SendNotifyMessageW
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetPropW
SetRect
SetTimer
SetWinEventHook
SetWindowLongPtrA
SetWindowLongPtrW
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowWindow
SystemParametersInfoA
SystemParametersInfoW
ToUnicode
TrackMouseEvent
TranslateMessage
UnhookWinEvent
UnhookWindowsHookEx
UnregisterClassA
UnregisterClassW
UnregisterDeviceNotification
ValidateRect
WindowFromPoint
wsprintfA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
VerQueryValueW

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime
waveInAddBuffer
waveInClose
waveInGetDevCapsW
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsW
waveOutGetErrorTextW
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite

ws2_32

WSARecvFrom
WSASendTo
WSASetLastError
WSAStringToAddressA
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
getnameinfo
getservbyname
getservbyport
inet_addr
inet_ntoa
inet_pton

wsock32

WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostname
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Exports

Exports

Java_java_awt_BDFontMetrics_charWidthN
Java_java_awt_BDFontMetrics_charsWidthN
Java_java_awt_BDFontMetrics_destroyFontN
Java_java_awt_BDFontMetrics_destroyN
Java_java_awt_BDFontMetrics_getFontFamilyAndStyleN
Java_java_awt_BDFontMetrics_initN
Java_java_awt_BDFontMetrics_loadFontN
Java_java_awt_BDFontMetrics_resolveFontN
Java_java_awt_BDFontMetrics_stringWidthN
Java_java_awt_BDFontMetrics_unloadFontConfigN
Java_java_awt_BDGraphics_drawStringN
Java_org_videolan_Libbluray_cacheBdRomFileN
Java_org_videolan_Libbluray_getAacsDataN
Java_org_videolan_Libbluray_getBdjoN
Java_org_videolan_Libbluray_getPlaylistInfoN
Java_org_videolan_Libbluray_getTitleInfosN
Java_org_videolan_Libbluray_getUOMaskN
Java_org_videolan_Libbluray_listBdFilesN
Java_org_videolan_Libbluray_readRegN
Java_org_videolan_Libbluray_seekN
Java_org_videolan_Libbluray_selectAngleN
Java_org_videolan_Libbluray_selectPlaylistN
Java_org_videolan_Libbluray_selectRateN
Java_org_videolan_Libbluray_selectTitleN
Java_org_videolan_Libbluray_setKeyInterestN
Java_org_videolan_Libbluray_setUOMaskN
Java_org_videolan_Libbluray_setVirtualPackageN
Java_org_videolan_Libbluray_soundEffectN
Java_org_videolan_Libbluray_tellTimeN
Java_org_videolan_Libbluray_updateGraphicN
Java_org_videolan_Libbluray_writeRegN
Java_org_videolan_Logger_logN
archive_clear_error
archive_compression
archive_compression_name
archive_copy_error
archive_entry_acl
archive_entry_acl_add_entry
archive_entry_acl_add_entry_w
archive_entry_acl_clear
archive_entry_acl_count
archive_entry_acl_from_text
archive_entry_acl_from_text_w
archive_entry_acl_next
archive_entry_acl_reset
archive_entry_acl_text
archive_entry_acl_text_w
archive_entry_acl_to_text
archive_entry_acl_to_text_w
archive_entry_acl_types
archive_entry_atime
archive_entry_atime_is_set
archive_entry_atime_nsec
archive_entry_birthtime
archive_entry_birthtime_is_set
archive_entry_birthtime_nsec
archive_entry_clear
archive_entry_clone
archive_entry_copy_fflags_text
archive_entry_copy_fflags_text_w
archive_entry_copy_gname
archive_entry_copy_gname_w
archive_entry_copy_hardlink
archive_entry_copy_hardlink_w
archive_entry_copy_link
archive_entry_copy_link_w
archive_entry_copy_mac_metadata
archive_entry_copy_pathname
archive_entry_copy_pathname_w
archive_entry_copy_sourcepath
archive_entry_copy_sourcepath_w
archive_entry_copy_symlink
archive_entry_copy_symlink_w
archive_entry_copy_uname
archive_entry_copy_uname_w
archive_entry_ctime
archive_entry_ctime_is_set
archive_entry_ctime_nsec
archive_entry_dev
archive_entry_dev_is_set
archive_entry_devmajor
archive_entry_devminor
archive_entry_digest
archive_entry_fflags
archive_entry_fflags_text
archive_entry_filetype
archive_entry_free
archive_entry_gid
archive_entry_gname
archive_entry_gname_utf8
archive_entry_gname_w
archive_entry_hardlink
archive_entry_hardlink_utf8
archive_entry_hardlink_w
archive_entry_ino
archive_entry_ino64
archive_entry_ino_is_set
archive_entry_is_data_encrypted
archive_entry_is_encrypted
archive_entry_is_metadata_encrypted
archive_entry_mac_metadata
archive_entry_mode
archive_entry_mtime
archive_entry_mtime_is_set
archive_entry_mtime_nsec
archive_entry_new
archive_entry_new2
archive_entry_nlink
archive_entry_pathname
archive_entry_pathname_utf8
archive_entry_pathname_w
archive_entry_perm
archive_entry_rdev
archive_entry_rdevmajor
archive_entry_rdevminor
archive_entry_set_atime
archive_entry_set_birthtime
archive_entry_set_ctime
archive_entry_set_dev
archive_entry_set_devmajor
archive_entry_set_devminor
archive_entry_set_fflags
archive_entry_set_filetype
archive_entry_set_gid
archive_entry_set_gname
archive_entry_set_gname_utf8
archive_entry_set_hardlink
archive_entry_set_hardlink_utf8
archive_entry_set_ino
archive_entry_set_ino64
archive_entry_set_is_data_encrypted
archive_entry_set_is_metadata_encrypted
archive_entry_set_link
archive_entry_set_link_utf8
archive_entry_set_mode
archive_entry_set_mtime
archive_entry_set_nlink
archive_entry_set_pathname
archive_entry_set_pathname_utf8
archive_entry_set_perm
archive_entry_set_rdev
archive_entry_set_rdevmajor
archive_entry_set_rdevminor
archive_entry_set_size
archive_entry_set_symlink
archive_entry_set_symlink_type
archive_entry_set_symlink_utf8
archive_entry_set_uid
archive_entry_set_uname
archive_entry_set_uname_utf8
archive_entry_size
archive_entry_size_is_set
archive_entry_sourcepath
archive_entry_sourcepath_w
archive_entry_sparse_add_entry
archive_entry_sparse_clear
archive_entry_sparse_count
archive_entry_sparse_next
archive_entry_sparse_reset
archive_entry_symlink
archive_entry_symlink_type
archive_entry_symlink_utf8
archive_entry_symlink_w
archive_entry_uid
archive_entry_uname
archive_entry_uname_utf8
archive_entry_uname_w
archive_entry_unset_atime
archive_entry_unset_birthtime
archive_entry_unset_ctime
archive_entry_unset_mtime
archive_entry_unset_size
archive_entry_update_gname_utf8
archive_entry_update_hardlink_utf8
archive_entry_update_link_utf8
archive_entry_update_pathname_utf8
archive_entry_update_symlink_utf8
archive_entry_update_uname_utf8
archive_entry_xattr_add_entry
archive_entry_xattr_clear
archive_entry_xattr_count
archive_entry_xattr_next
archive_entry_xattr_reset
archive_errno
archive_error_string
archive_file_count
archive_filter_bytes
archive_filter_code
archive_filter_count
archive_filter_name
archive_format
archive_format_name
archive_free
archive_position_compressed
archive_position_uncompressed
archive_read_add_callback_data
archive_read_add_passphrase
archive_read_append_callback_data
archive_read_close
archive_read_data
archive_read_data_block
archive_read_data_skip
archive_read_extract_set_skip_file
archive_read_finish
archive_read_format_capabilities
archive_read_free
archive_read_has_encrypted_entries
archive_read_header_position
archive_read_new
archive_read_next_header
archive_read_next_header2
archive_read_open
archive_read_open1
archive_read_open2
archive_read_prepend_callback_data
archive_read_set_callback_data
archive_read_set_callback_data2
archive_read_set_close_callback
archive_read_set_open_callback
archive_read_set_passphrase_callback
archive_read_set_read_callback
archive_read_set_seek_callback
archive_read_set_skip_callback
archive_read_set_switch_callback
archive_read_support_compression_bzip2
archive_read_support_compression_gzip
archive_read_support_compression_lzip
archive_read_support_compression_lzma
archive_read_support_compression_xz
archive_read_support_filter_bzip2
archive_read_support_filter_gzip
archive_read_support_filter_lzip
archive_read_support_filter_lzma
archive_read_support_filter_xz
archive_read_support_format_7zip
archive_read_support_format_iso9660
archive_read_support_format_rar
archive_read_support_format_rar5
archive_read_support_format_zip
archive_read_support_format_zip_seekable
archive_read_support_format_zip_streamable
archive_seek_data
archive_set_error
archive_utility_string_sort
archive_version_number
archive_version_string
archive_write_close
archive_write_data
archive_write_data_block
archive_write_fail
archive_write_finish
archive_write_finish_entry
archive_write_free
archive_write_header

Sections

.text
Size: 56.1MB - Virtual size: 56.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 11.8MB - Virtual size: 11.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 934KB - Virtual size: 933KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 10.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 239KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: P@$$w0rd

Password: P@$$w0rd

ee76ed2f66ee560e90972651752a9767

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

avrt

bcrypt

cfgmgr32

dwmapi

gdi32

imm32

kernel32

mfplat

msvcrt

ole32

oleaut32

opengl32

setupapi

shell32

shlwapi

user32

version

avicap32

winmm

ws2_32

wsock32

Exports

Exports

Sections

.text Size: 56.1MB - Virtual size: 56.1MB

.data Size: 198KB - Virtual size: 198KB

.rdata Size: 11.8MB - Virtual size: 11.8MB

.rodata Size: 14KB - Virtual size: 14KB

.pdata Size: 934KB - Virtual size: 933KB

.xdata Size: 1.3MB - Virtual size: 1.3MB

.bss Size: - Virtual size: 10.8MB

.edata Size: 9KB - Virtual size: 9KB

.idata Size: 31KB - Virtual size: 30KB

.CRT Size: 512B - Virtual size: 112B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 267KB - Virtual size: 267KB

.reloc Size: 239KB - Virtual size: 238KB

/4 Size: 512B - Virtual size: 16B

.text
Size: 56.1MB - Virtual size: 56.1MB

.data
Size: 198KB - Virtual size: 198KB

.rdata
Size: 11.8MB - Virtual size: 11.8MB

.rodata
Size: 14KB - Virtual size: 14KB

.pdata
Size: 934KB - Virtual size: 933KB

.xdata
Size: 1.3MB - Virtual size: 1.3MB

.bss
Size: - Virtual size: 10.8MB

.edata
Size: 9KB - Virtual size: 9KB

.idata
Size: 31KB - Virtual size: 30KB

.CRT
Size: 512B - Virtual size: 112B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 267KB - Virtual size: 267KB

.reloc
Size: 239KB - Virtual size: 238KB

/4
Size: 512B - Virtual size: 16B