OpenSSH-Win64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

OpenSSH-Win64.zip
Size

4.6MB
MD5

4c06c80454ef2cbb346de72c0df93691
SHA1

4b7a0987f5736f0bbf688799cb9350e7f657f901
SHA256

bd48fe985d400402c278c485db20e6a82bc4c7f7d8e0ef5a81128f523096530c
SHA512

67c31dc00fbadee74f2ee70c9278e24eeabcb2f186c826dce82c28115ed2b5eef112fc7d0cc62ee1493b139bf75d0934053a6c262f294cdfba0fe9b0f8baa561
SSDEEP

98304:im6NkH63PRkMXQNKyt6Qo5PbzvARxT/NpnFKyhx/yB6psOFp8X2hsB7:R1ckMAwyt6Qo5TzvMF/tzuBksO/8T7

Score

1^/10

Malware Config

Signatures

Files

OpenSSH-Win64.zip
.zip
OpenSSH-Win64/FixHostFilePermissions.ps1
.ps1
OpenSSH-Win64/FixUserFilePermissions.ps1
.ps1
OpenSSH-Win64/LICENSE.txt
OpenSSH-Win64/NOTICE.txt
OpenSSH-Win64/OpenSSHUtils.psd1
OpenSSH-Win64/OpenSSHUtils.psm1
.ps1
OpenSSH-Win64/_manifest/spdx_2.2/bsi.json
OpenSSH-Win64/_manifest/spdx_2.2/manifest.cat
OpenSSH-Win64/_manifest/spdx_2.2/manifest.spdx.json
OpenSSH-Win64/_manifest/spdx_2.2/manifest.spdx.json.sha256
OpenSSH-Win64/install-sshd.ps1
.ps1
OpenSSH-Win64/libcrypto.dll
.dll windows:6 windows x64 arch:x64

8929f19b8e99ca471b8cfa5b2eea4a18

Code Sign

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2023, 23:45

Not After

15/09/2024, 23:45

Subject

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:42:20:fc:bf:94:77:ef:de:9b:8f:f6:0d:7f:bb:bb:e4:e7:e1:d7:12:3f:94:bb:be:3f:27:cd:fc:04:d8:51
Signer

Actual PE Digest

4e:42:20:fc:bf:94:77:ef:de:9b:8f:f6:0d:7f:bb:bb:e4:e7:e1:d7:12:3f:94:bb:be:3f:27:cd:fc:04:d8:51

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\a\_work\1\s\Libressl\libressl\build_X64\crypto\Release\libcrypto.pdb

Imports

ws2_32

setsockopt
send
recv
getsockopt
connect
closesocket
WSAGetLastError
WSAStartup
inet_pton
ntohl
sendto
recvfrom
getsockname
htons
htonl
shutdown
getnameinfo
freeaddrinfo
getaddrinfo
gethostbyname
socket
ntohs
listen
ioctlsocket
bind
accept

ntdll

RtlCaptureContext
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind

bcrypt

BCryptGenRandom

kernel32

GetLastError
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
MultiByteToWideChar
GetFullPathNameW
GetCurrentDirectoryW
OutputDebugStringW
FlushFileBuffers
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
HeapSize
GetTimeZoneInformation
GetStringTypeW
SetEndOfFile
GetProcessHeap
GetCurrentThreadId
InitOnceExecuteOnce
FormatMessageA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetFileType
GetConsoleMode
SetConsoleMode
GetSystemTime
MoveFileExA
SystemTimeToFileTime
GetSystemInfo
GetModuleFileNameA
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetCurrentProcess
TerminateProcess
VirtualAlloc
VirtualFree
FlsGetValue
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
FlsAlloc
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
ReadFile
GetModuleFileNameW
WriteConsoleW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
SetFilePointerEx
ReadConsoleW
WriteFile
GetConsoleOutputCP
HeapFree
HeapAlloc
HeapReAlloc
GetFileSizeEx
GetCommandLineW

Exports

Exports

ACCESS_DESCRIPTION_free
ACCESS_DESCRIPTION_it
ACCESS_DESCRIPTION_new
AES_cbc_encrypt
AES_cfb128_encrypt
AES_cfb1_encrypt
AES_cfb8_encrypt
AES_ctr128_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_ige_encrypt
AES_ofb128_encrypt
AES_set_decrypt_key
AES_set_encrypt_key
AES_unwrap_key
AES_wrap_key
ASIdOrRange_free
ASIdOrRange_it
ASIdOrRange_new
ASIdentifierChoice_free
ASIdentifierChoice_it
ASIdentifierChoice_new
ASIdentifiers_free
ASIdentifiers_it
ASIdentifiers_new
ASN1_ANY_it
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_BIT_STRING_it
ASN1_BIT_STRING_new
ASN1_BIT_STRING_set
ASN1_BIT_STRING_set_bit
ASN1_BMPSTRING_free
ASN1_BMPSTRING_it
ASN1_BMPSTRING_new
ASN1_ENUMERATED_free
ASN1_ENUMERATED_get
ASN1_ENUMERATED_get_int64
ASN1_ENUMERATED_it
ASN1_ENUMERATED_new
ASN1_ENUMERATED_set
ASN1_ENUMERATED_set_int64
ASN1_ENUMERATED_to_BN
ASN1_GENERALIZEDTIME_adj
ASN1_GENERALIZEDTIME_check
ASN1_GENERALIZEDTIME_free
ASN1_GENERALIZEDTIME_it
ASN1_GENERALIZEDTIME_new
ASN1_GENERALIZEDTIME_print
ASN1_GENERALIZEDTIME_set
ASN1_GENERALIZEDTIME_set_string
ASN1_GENERALSTRING_free
ASN1_GENERALSTRING_it
ASN1_GENERALSTRING_new
ASN1_IA5STRING_free
ASN1_IA5STRING_it
ASN1_IA5STRING_new
ASN1_INTEGER_cmp
ASN1_INTEGER_dup
ASN1_INTEGER_free
ASN1_INTEGER_get
ASN1_INTEGER_get_int64
ASN1_INTEGER_get_uint64
ASN1_INTEGER_it
ASN1_INTEGER_new
ASN1_INTEGER_set
ASN1_INTEGER_set_int64
ASN1_INTEGER_set_uint64
ASN1_INTEGER_to_BN
ASN1_NULL_free
ASN1_NULL_it
ASN1_NULL_new
ASN1_OBJECT_create
ASN1_OBJECT_free
ASN1_OBJECT_it
ASN1_OBJECT_new
ASN1_OCTET_STRING_cmp
ASN1_OCTET_STRING_dup
ASN1_OCTET_STRING_free
ASN1_OCTET_STRING_it
ASN1_OCTET_STRING_new
ASN1_OCTET_STRING_set
ASN1_PCTX_free
ASN1_PCTX_get_cert_flags
ASN1_PCTX_get_flags
ASN1_PCTX_get_nm_flags
ASN1_PCTX_get_oid_flags
ASN1_PCTX_get_str_flags
ASN1_PCTX_new
ASN1_PCTX_set_cert_flags
ASN1_PCTX_set_flags
ASN1_PCTX_set_nm_flags
ASN1_PCTX_set_oid_flags
ASN1_PCTX_set_str_flags
ASN1_PRINTABLESTRING_free
ASN1_PRINTABLESTRING_it
ASN1_PRINTABLESTRING_new
ASN1_PRINTABLE_free
ASN1_PRINTABLE_it
ASN1_PRINTABLE_new
ASN1_PRINTABLE_type
ASN1_SEQUENCE_ANY_it
ASN1_SEQUENCE_it
ASN1_SET_ANY_it
ASN1_STRING_TABLE_add
ASN1_STRING_TABLE_cleanup
ASN1_STRING_TABLE_get
ASN1_STRING_cmp
ASN1_STRING_copy
ASN1_STRING_data
ASN1_STRING_dup
ASN1_STRING_free
ASN1_STRING_get0_data
ASN1_STRING_get_default_mask
ASN1_STRING_length
ASN1_STRING_length_set
ASN1_STRING_new
ASN1_STRING_print
ASN1_STRING_print_ex
ASN1_STRING_print_ex_fp
ASN1_STRING_set
ASN1_STRING_set0
ASN1_STRING_set_by_NID
ASN1_STRING_set_default_mask
ASN1_STRING_set_default_mask_asc
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_STRING_type_new
ASN1_T61STRING_free
ASN1_T61STRING_it
ASN1_T61STRING_new
ASN1_TIME_adj
ASN1_TIME_check
ASN1_TIME_cmp_time_t
ASN1_TIME_compare
ASN1_TIME_diff
ASN1_TIME_free
ASN1_TIME_it
ASN1_TIME_new
ASN1_TIME_normalize
ASN1_TIME_print
ASN1_TIME_set
ASN1_TIME_set_string
ASN1_TIME_set_string_X509
ASN1_TIME_set_tm
ASN1_TIME_to_generalizedtime
ASN1_TIME_to_tm
ASN1_TYPE_cmp
ASN1_TYPE_free
ASN1_TYPE_get
ASN1_TYPE_get_int_octetstring
ASN1_TYPE_get_octetstring
ASN1_TYPE_new
ASN1_TYPE_set
ASN1_TYPE_set1
ASN1_TYPE_set_int_octetstring
ASN1_TYPE_set_octetstring
ASN1_UNIVERSALSTRING_free
ASN1_UNIVERSALSTRING_it
ASN1_UNIVERSALSTRING_new
ASN1_UNIVERSALSTRING_to_string
ASN1_UTCTIME_adj
ASN1_UTCTIME_check
ASN1_UTCTIME_cmp_time_t
ASN1_UTCTIME_free
ASN1_UTCTIME_it
ASN1_UTCTIME_new
ASN1_UTCTIME_print
ASN1_UTCTIME_set
ASN1_UTCTIME_set_string
ASN1_UTF8STRING_free
ASN1_UTF8STRING_it
ASN1_UTF8STRING_new
ASN1_VISIBLESTRING_free
ASN1_VISIBLESTRING_it
ASN1_VISIBLESTRING_new
ASN1_add_oid_module
ASN1_d2i_bio
ASN1_d2i_fp
ASN1_dup
ASN1_generate_nconf
ASN1_generate_v3
ASN1_get_object
ASN1_i2d_bio
ASN1_i2d_fp
ASN1_item_d2i
ASN1_item_d2i_bio
ASN1_item_d2i_fp
ASN1_item_digest
ASN1_item_dup
ASN1_item_ex_d2i
ASN1_item_ex_free
ASN1_item_ex_i2d
ASN1_item_ex_new
ASN1_item_free
ASN1_item_i2d
ASN1_item_i2d_bio
ASN1_item_i2d_fp
ASN1_item_new
ASN1_item_pack
ASN1_item_print
ASN1_item_sign
ASN1_item_sign_ctx
ASN1_item_unpack
ASN1_item_verify
ASN1_mbstring_copy
ASN1_mbstring_ncopy
ASN1_object_size
ASN1_parse
ASN1_parse_dump
ASN1_put_eoc
ASN1_put_object
ASN1_tag2bit
ASN1_tag2str
ASN1_time_parse
ASN1_time_tm_clamp_notafter
ASN1_time_tm_cmp
ASRange_free
ASRange_it
ASRange_new
AUTHORITY_INFO_ACCESS_free
AUTHORITY_INFO_ACCESS_it
AUTHORITY_INFO_ACCESS_new
AUTHORITY_KEYID_free
AUTHORITY_KEYID_it
AUTHORITY_KEYID_new
BASIC_CONSTRAINTS_free
BASIC_CONSTRAINTS_it
BASIC_CONSTRAINTS_new
BF_cbc_encrypt
BF_cfb64_encrypt
BF_decrypt
BF_ecb_encrypt
BF_encrypt
BF_ofb64_encrypt
BF_set_key
BIGNUM_it
BIO_CONNECT_free
BIO_CONNECT_new
BIO_accept
BIO_callback_ctrl
BIO_clear_flags
BIO_copy_next_retry
BIO_ctrl
BIO_ctrl_get_read_request
BIO_ctrl_get_write_guarantee
BIO_ctrl_pending
BIO_ctrl_reset_read_request
BIO_ctrl_wpending
BIO_debug_callback
BIO_dgram_non_fatal_error
BIO_dump
BIO_dump_cb
BIO_dump_fp
BIO_dump_indent
BIO_dump_indent_cb
BIO_dump_indent_fp
BIO_dup_chain
BIO_f_base64
BIO_f_buffer
BIO_f_cipher
BIO_f_md
BIO_f_nbio_test
BIO_f_null
BIO_fd_non_fatal_error
BIO_fd_should_retry
BIO_find_type
BIO_free
BIO_free_all
BIO_get_accept_socket
BIO_get_callback
BIO_get_callback_arg
BIO_get_callback_ex
BIO_get_data
BIO_get_ex_data
BIO_get_ex_new_index
BIO_get_host_ip
BIO_get_init
BIO_get_new_index
BIO_get_port
BIO_get_retry_BIO
BIO_get_retry_reason
BIO_get_shutdown
BIO_gethostbyname
BIO_gets
BIO_indent
BIO_int_ctrl
BIO_meth_free
BIO_meth_get_callback_ctrl
BIO_meth_get_create
BIO_meth_get_ctrl
BIO_meth_get_destroy
BIO_meth_get_gets
BIO_meth_get_puts
BIO_meth_get_read
BIO_meth_get_write
BIO_meth_new
BIO_meth_set_callback_ctrl
BIO_meth_set_create
BIO_meth_set_ctrl
BIO_meth_set_destroy
BIO_meth_set_gets
BIO_meth_set_puts
BIO_meth_set_read
BIO_meth_set_write
BIO_method_name
BIO_method_type
BIO_new
BIO_new_CMS
BIO_new_PKCS7
BIO_new_accept
BIO_new_bio_pair
BIO_new_connect
BIO_new_dgram
BIO_new_fd
BIO_new_file
BIO_new_fp
BIO_new_mem_buf
BIO_new_socket
BIO_next
BIO_number_read
BIO_number_written
BIO_pop
BIO_printf
BIO_ptr_ctrl
BIO_push
BIO_puts
BIO_read
BIO_s_accept
BIO_s_bio
BIO_s_connect
BIO_s_datagram
BIO_s_fd
BIO_s_file
BIO_s_mem
BIO_s_null
BIO_s_socket
BIO_set
BIO_set_callback
BIO_set_callback_arg
BIO_set_callback_ex
BIO_set_cipher
BIO_set_data
BIO_set_ex_data
BIO_set_flags
BIO_set_init
BIO_set_next
BIO_set_retry_reason
BIO_set_shutdown
BIO_set_tcp_ndelay
BIO_snprintf
BIO_sock_cleanup
BIO_sock_error
BIO_sock_init
BIO_sock_non_fatal_error
BIO_sock_should_retry
BIO_socket_ioctl
BIO_socket_nbio
BIO_test_flags
BIO_up_ref
BIO_vfree
BIO_vprintf
BIO_vsnprintf
BIO_write
BN_CTX_end
BN_CTX_free
BN_CTX_get
BN_CTX_new
BN_CTX_start
BN_GENCB_call
BN_GENCB_free
BN_GENCB_get_arg
BN_GENCB_new
BN_GENCB_set
BN_GENCB_set_old
BN_MONT_CTX_copy
BN_MONT_CTX_free
BN_MONT_CTX_new
BN_MONT_CTX_set
BN_MONT_CTX_set_locked
BN_abs_is_word
BN_add
BN_add_word
BN_asc2bn
BN_bin2bn
BN_bn2bin
BN_bn2binpad
BN_bn2dec
BN_bn2hex
BN_bn2lebinpad
BN_bn2mpi
BN_clear
BN_clear_bit
BN_clear_free
BN_cmp
BN_consttime_swap
BN_copy
BN_dec2bn
BN_div
BN_div_word
BN_dup
BN_exp
BN_free
BN_from_montgomery
BN_gcd
BN_generate_prime_ex
BN_get_flags
BN_get_rfc2409_prime_1024
BN_get_rfc2409_prime_768
BN_get_rfc3526_prime_1536
BN_get_rfc3526_prime_2048
BN_get_rfc3526_prime_3072
BN_get_rfc3526_prime_4096
BN_get_rfc3526_prime_6144
BN_get_rfc3526_prime_8192
BN_get_word
BN_hex2bn
BN_is_bit_set
BN_is_negative
BN_is_odd
BN_is_one
BN_is_prime_ex
BN_is_prime_fasttest_ex
BN_is_word
BN_is_zero
BN_kronecker
BN_lebin2bn
BN_lshift
BN_lshift1
BN_mask_bits
BN_mod_add
BN_mod_add_quick
BN_mod_exp
BN_mod_exp2_mont
BN_mod_exp_mont
BN_mod_exp_mont_consttime
BN_mod_exp_mont_word
BN_mod_exp_simple
BN_mod_inverse
BN_mod_lshift
BN_mod_lshift1
BN_mod_lshift1_quick
BN_mod_lshift_quick
BN_mod_mul
BN_mod_mul_montgomery
BN_mod_sqr
BN_mod_sqrt
BN_mod_sub
BN_mod_sub_quick
BN_mod_word
BN_mpi2bn
BN_mul
BN_mul_word
BN_new
BN_nnmod
BN_num_bits
BN_num_bits_word
BN_one
BN_print
BN_print_fp
BN_pseudo_rand
BN_pseudo_rand_range
BN_rand
BN_rand_range
BN_rshift
BN_rshift1
BN_security_bits
BN_set_bit
BN_set_flags
BN_set_negative
BN_set_word
BN_sqr
BN_sub
BN_sub_word
BN_swap
BN_to_ASN1_ENUMERATED
BN_to_ASN1_INTEGER
BN_to_montgomery
BN_uadd
BN_ucmp
BN_usub
BN_value_one
BN_with_flags
BN_zero
BUF_MEM_free
BUF_MEM_grow
BUF_MEM_grow_clean
BUF_MEM_new
CAST_cbc_encrypt
CAST_cfb64_encrypt
CAST_decrypt
CAST_ecb_encrypt
CAST_encrypt
CAST_ofb64_encrypt
CAST_set_key
CBIGNUM_it
CERTIFICATEPOLICIES_free
CERTIFICATEPOLICIES_it
CERTIFICATEPOLICIES_new

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 533KB - Virtual size: 532KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/moduli
OpenSSH-Win64/openssh-events.man
.xml
OpenSSH-Win64/scp.exe
.exe windows:6 windows x64 arch:x64

06f24910225af976f7fd6e9730af9bdf

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:81:06:36:63:d0:27:00:78:da:60:0d:a6:14:83:46:15:c8:b7:0e:88:48:1f:c6:08:1c:e6:14:87:7d:b3:72
Signer

Actual PE Digest

42:81:06:36:63:d0:27:00:78:da:60:0d:a6:14:83:46:15:c8:b7:0e:88:48:1f:c6:08:1c:e6:14:87:7d:b3:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\scp.pdb

Imports

libcrypto

explicit_bzero
gettimeofday

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

ws2_32

ntohs
getservbyname
WSASend
WSAStartup
getsockname
socket
WSARecv
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
WSACleanup

shlwapi

PathMatchSpecW

kernel32

FlsAlloc
HeapFree
HeapAlloc
GetModuleFileNameW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetConsoleOutputCP
SetConsoleMode
SetConsoleOutputCP
SetHandleInformation
GetCurrentProcess
GetStdHandle
TerminateProcess
SetEndOfFile
GetCurrentThreadId
DuplicateHandle
GetTickCount64
GetLastError
CloseHandle
SetFilePointerEx
GetCurrentProcessId
CreateProcessW
GetFileType
OpenThread
FlushFileBuffers
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateDirectoryW
SetWaitableTimer
GetConsoleScreenBufferInfo
CreateWaitableTimerW
SetFileTime
WaitForSingleObject
CreateFileW
GetProcAddress
LocalFree
GetComputerNameW
FreeLibrary
WideCharToMultiByte
GetExitCodeProcess
GetSystemDirectoryW
GetWindowsDirectoryW
MultiByteToWideChar
FillConsoleOutputCharacterA
SetConsoleTextAttribute
SetConsoleScreenBufferSize
ScrollConsoleScreenBufferA
GetConsoleCursorInfo
SetConsoleWindowInfo
GetConsoleMode
FlsSetValue
ReadConsoleInputW
CreateFileA
WriteConsoleOutputA
FillConsoleOutputAttribute
WriteConsoleW
Beep
GetConsoleWindow
SetConsoleCursorPosition
ReadConsoleOutputA
CancelIo
CreateNamedPipeA
DeviceIoControl
WriteFileEx
GetFileInformationByHandle
GetFileAttributesExW
ReadFileEx
SleepEx
SetEvent
ResetEvent
VerSetConditionMask
VerifyVersionInfoW
CreateEventA
SetConsoleCtrlHandler
QueueUserAPC
GetFinalPathNameByHandleW
WaitForMultipleObjectsEx
LoadLibraryExW
ReadFile
WriteFile
CancelSynchronousIo
CancelIoEx
CancelWaitableTimer
CreateWaitableTimerA
PeekNamedPipe
GetCurrentDirectoryW
SetEnvironmentVariableW
CompareStringW
LCMapStringW
HeapReAlloc
GetTimeZoneInformation
GetStringTypeW
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetFileSizeEx
HeapSize
FlsGetValue
SetConsoleCursorInfo
FlsFree
GetLocalTime
ExpandEnvironmentStringsW
WaitForSingleObjectEx
GetFullPathNameW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
FindClose
FindFirstFileExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
SetFileAttributesW

user32

GetWindowPlacement
ShowWindow

advapi32

EventWrite
EventRegister
RegCloseKey
RegOpenKeyExW
ConvertSidToStringSidW
LookupAccountSidW
RegQueryValueExW
GetSidIdentifierAuthority
GetAce
CreateWellKnownSid
CopySid
GetNamedSecurityInfoW
IsWellKnownSid
IsValidSid
IsValidSecurityDescriptor
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetLengthSid
IsValidAcl
LookupAccountNameW
GetTokenInformation

Sections

.text
Size: 309KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/sftp-server.exe
.exe windows:6 windows x64 arch:x64

a606cef6e859b09db7a3871387aea1e9

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:c4:49:2c:b7:8f:d1:4b:09:96:b4:24:85:cc:9f:6b:96:e7:a4:5f:ff:0b:73:b3:b8:46:97:11:58:ff:fe:81
Signer

Actual PE Digest

20:c4:49:2c:b7:8f:d1:4b:09:96:b4:24:85:cc:9f:6b:96:e7:a4:5f:ff:0b:73:b3:b8:46:97:11:58:ff:fe:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\sftp-server.pdb

Imports

libcrypto

explicit_bzero

crypt32

CryptStringToBinaryA

ws2_32

WSASend
WSAStartup
getsockname
socket
WSARecv
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
WSACleanup

kernel32

HeapAlloc
HeapFree
GetModuleFileNameW
FreeLibraryAndExitThread
ExitThread
CreateThread
CreateDirectoryW
GetConsoleScreenBufferInfo
GetCurrentProcess
GetStdHandle
GetDiskFreeSpaceW
SetFileTime
WaitForSingleObject
CreateFileW
GetLastError
CloseHandle
GetProcAddress
LocalFree
MoveFileExW
GetComputerNameW
FreeLibrary
WideCharToMultiByte
GetFileType
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
SetHandleInformation
TerminateProcess
SetEndOfFile
GetCurrentThreadId
DuplicateHandle
GetTickCount64
SetFilePointerEx
GetCurrentProcessId
OpenThread
FlushFileBuffers
MultiByteToWideChar
FlsFree
DeviceIoControl
WriteFileEx
CreateHardLinkW
GetFileInformationByHandle
GetFileAttributesExW
CreateFileA
ReadFileEx
CreateSymbolicLinkW
SleepEx
GetFinalPathNameByHandleW
SetEvent
ResetEvent
VerSetConditionMask
FlsGetValue
CreateEventA
SetConsoleCtrlHandler
QueueUserAPC
GetExitCodeProcess
ReadFile
WriteFile
SetConsoleMode
GetConsoleMode
CancelSynchronousIo
CancelIoEx
WriteConsoleW
WaitForMultipleObjectsEx
WaitForSingleObjectEx
CreateWaitableTimerA
FillConsoleOutputCharacterA
SetConsoleTextAttribute
SetConsoleScreenBufferSize
GetConsoleOutputCP
ScrollConsoleScreenBufferA
GetConsoleCursorInfo
SetConsoleWindowInfo
SetConsoleCursorInfo
ReadConsoleInputW
WriteConsoleOutputA
FillConsoleOutputAttribute
Beep
GetConsoleWindow
SetConsoleCursorPosition
ReadConsoleOutputA
LoadLibraryExW
PeekNamedPipe
GetCommandLineW
GetCommandLineA
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
HeapReAlloc
GetTimeZoneInformation
GetStringTypeW
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetFileSizeEx
HeapSize
FlsAlloc
VerifyVersionInfoW
FlsSetValue
GetLocalTime
CancelIo
SystemTimeToTzSpecificLocalTime
FindNextFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
SetStdHandle
RemoveDirectoryW
SetFileAttributesW
GetFullPathNameW
DeleteFileW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
FindClose
FindFirstFileExW

user32

GetWindowPlacement
ShowWindow

advapi32

EventWrite
EventRegister
RegCloseKey
RegOpenKeyExW
ConvertSidToStringSidW
LookupAccountSidW
RegQueryValueExW
GetSidIdentifierAuthority
GetAce
CreateWellKnownSid
CopySid
GetNamedSecurityInfoW
IsWellKnownSid
IsValidSid
IsValidSecurityDescriptor
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetLengthSid
IsValidAcl
LookupAccountNameW
GetTokenInformation

Sections

.text
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/sftp.exe
.exe windows:6 windows x64 arch:x64

518fd3e61dd520ecf276c1cb50de019f

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e9:77:aa:b8:bc:2a:db:20:f4:7f:88:c4:0d:e9:86:0c:29:0b:63:dd:64:c8:71:ed:4a:71:b2:5e:07:3e:e0:30
Signer

Actual PE Digest

e9:77:aa:b8:bc:2a:db:20:f4:7f:88:c4:0d:e9:86:0c:29:0b:63:dd:64:c8:71:ed:4a:71:b2:5e:07:3e:e0:30

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\sftp.pdb

Imports

libcrypto

explicit_bzero
gettimeofday

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

ws2_32

ntohs
getservbyname
WSASend
WSAStartup
getsockname
socket
WSARecv
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
WSACleanup

kernel32

HeapAlloc
HeapFree
GetModuleFileNameW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetSystemDirectoryA
GetConsoleOutputCP
SetConsoleMode
SetConsoleOutputCP
SetHandleInformation
GetCurrentProcess
GetStdHandle
TerminateProcess
SetEndOfFile
GetCurrentThreadId
DuplicateHandle
GetTickCount64
GetLastError
CloseHandle
SetFilePointerEx
GetCurrentProcessId
CreateProcessW
GetFileType
OpenThread
FlushFileBuffers
SetWaitableTimer
CancelWaitableTimer
CreateWaitableTimerA
CreateDirectoryW
GetConsoleScreenBufferInfo
CreateWaitableTimerW
SetFileTime
WaitForSingleObject
CreateFileW
GetProcAddress
LocalFree
GetComputerNameW
FreeLibrary
WideCharToMultiByte
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
FlsFree
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
GetExitCodeProcess
MultiByteToWideChar
FillConsoleOutputCharacterA
SetConsoleTextAttribute
SetConsoleScreenBufferSize
ScrollConsoleScreenBufferA
GetConsoleCursorInfo
SetConsoleWindowInfo
FlsGetValue
GetConsoleMode
SetConsoleCursorInfo
ReadConsoleInputW
CreateFileA
WriteConsoleOutputA
FillConsoleOutputAttribute
WriteConsoleW
Beep
GetConsoleWindow
SetConsoleCursorPosition
ReadConsoleOutputA
CancelIo
CreateNamedPipeA
DeviceIoControl
WriteFileEx
GetFileInformationByHandle
GetFileAttributesExW
ReadFileEx
SleepEx
SetEvent
ResetEvent
VerSetConditionMask
VerifyVersionInfoW
CreateEventA
SetConsoleCtrlHandler
GetFinalPathNameByHandleW
WaitForMultipleObjectsEx
WaitForSingleObjectEx
LoadLibraryExW
ReadFile
WriteFile
CancelSynchronousIo
CancelIoEx
PeekNamedPipe
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
HeapReAlloc
GetTimeZoneInformation
GetStringTypeW
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetFileSizeEx
HeapSize
FlsAlloc
FlsSetValue
GetLocalTime
GetDriveTypeW
QueueUserAPC
FindFirstFileExW
FindClose
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
SetStdHandle
SetFileAttributesW
GetFullPathNameW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW

user32

GetWindowPlacement
ShowWindow

advapi32

EventWrite
EventRegister
RegCloseKey
RegOpenKeyExW
ConvertSidToStringSidW
LookupAccountSidW
RegQueryValueExW
GetSidIdentifierAuthority
GetAce
CreateWellKnownSid
CopySid
GetNamedSecurityInfoW
IsWellKnownSid
IsValidSid
IsValidSecurityDescriptor
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetLengthSid
IsValidAcl
LookupAccountNameW
GetTokenInformation

Sections

.text
Size: 329KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/ssh-add.exe
.exe windows:6 windows x64 arch:x64

0bd315abda4e96d6cf47c514de9e6bb9

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:cc:cf:c4:a1:40:d1:5f:d1:1b:a9:9d:34:fe:f5:4e:52:d1:5f:26:73:50:f2:63:61:18:e1:c6:1a:14:8c:28
Signer

Actual PE Digest

6b:cc:cf:c4:a1:40:d1:5f:d1:1b:a9:9d:34:fe:f5:4e:52:d1:5f:26:73:50:f2:63:61:18:e1:c6:1a:14:8c:28

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\ssh-add.pdb

Imports

libcrypto

DSA_do_sign
DSA_get0_key
BN_bn2bin
DSA_SIG_set0
DSA_set0_key
DSA_SIG_get0
DSA_new
DSA_SIG_new
EC_POINT_point2oct
DSA_get0_pqg
DSA_generate_key
DSA_generate_parameters_ex
BN_bin2bn
DSA_SIG_free
DSA_free
EC_POINT_oct2point
BN_dup
RSA_generate_key_ex
BN_set_flags
RSA_public_decrypt
RSA_new
RSA_set0_crt_params
RSA_free
BN_free
BN_set_word
RSA_sign
BN_div
RSA_set0_factors
RSA_size
RSA_get0_factors
RSA_get0_crt_params
RSA_set0_key
BN_CTX_new
BN_CTX_free
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
EVP_CipherInit
EVP_aes_128_ctr
EVP_aes_256_ctr
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
EVP_aes_192_ctr
DSA_set0_pqg
DSA_do_verify
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
ECDSA_do_sign
EC_POINT_cmp
EC_KEY_set_private_key
EC_KEY_generate_key
ECDSA_SIG_get0
EC_KEY_set_public_key
EC_KEY_free
ECDSA_SIG_free
ECDSA_SIG_set0
EC_KEY_set_asn1_flag
ECDSA_do_verify
EC_KEY_new_by_curve_name
ECDSA_SIG_new
EVP_sha384
EVP_md5
EVP_sha256
EVP_Digest
EVP_sha1
EVP_sha512
RAND_status
OpenSSL_version_num
RSA_blinding_on
EC_GROUP_get_order
BIO_new
BN_clear_free
ERR_peek_error
BN_value_one
EVP_PKEY_get1_EC_KEY
EC_METHOD_get_field_type
EC_POINT_mul
ERR_get_error
EC_POINT_get_affine_coordinates_GFp
ERR_peek_last_error
EC_KEY_set_group
EC_POINT_is_at_infinity
BIO_s_mem
RSA_get0_key
PEM_read_bio_PrivateKey
EC_POINT_free
EVP_aes_128_cbc
EVP_PKEY_free
EVP_PKEY_get1_RSA
EC_KEY_get0_public_key
EC_GROUP_free
EC_POINT_new
BIO_write
BIO_free
EC_GROUP_cmp
EVP_PKEY_get1_DSA
EC_GROUP_set_asn1_flag
EC_GROUP_get_curve_name
BN_new
EC_KEY_get0_private_key
EC_KEY_get0_group
BN_cmp
BN_sub
explicit_bzero
EC_GROUP_new_by_curve_name
EVP_PKEY_base_id
EC_GROUP_method_of
BN_num_bits
arc4random_buf

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

ws2_32

bind
WSAIoctl
WSASend
WSAStartup
getsockname
WSARecv
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
WSACleanup
socket

kernel32

HeapAlloc
FreeLibraryAndExitThread
ExitThread
CreateThread
FindNextFileW
FindFirstFileExW
FindClose
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetCommandLineW
GetCommandLineA
GetCurrentDirectoryW
SetEnvironmentVariableW
GetFullPathNameW
SetStdHandle
GetModuleHandleExW
ExitProcess
RtlPcToFileHeader
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetTimeZoneInformation
GetStringTypeW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleW
HeapReAlloc
GetFileSizeEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
GetLocalTime
CreateWaitableTimerA
CancelIoEx
CancelSynchronousIo
WriteFile
ReadFile
LoadLibraryExW
WaitForSingleObjectEx
WaitForMultipleObjectsEx
QueueUserAPC
SetConsoleCtrlHandler
CreateEventA
VerifyVersionInfoW
VerSetConditionMask
ResetEvent
SetEvent
GetDriveTypeW
SleepEx
SetLastError
ReadFileEx
GetFileAttributesExW
GetFileInformationByHandle
WriteFileEx
DeviceIoControl
CreateNamedPipeA
CancelIo
GetFinalPathNameByHandleW
ReadConsoleOutputA
SetConsoleCursorPosition
GetConsoleWindow
Beep
WriteConsoleW
FillConsoleOutputAttribute
WriteConsoleOutputA
CreateFileA
ReadConsoleInputW
SetConsoleCursorInfo
GetConsoleMode
SetConsoleWindowInfo
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
SetConsoleScreenBufferSize
SetConsoleTextAttribute
FillConsoleOutputCharacterA
GetExitCodeProcess
MultiByteToWideChar
FlushFileBuffers
OpenThread
CreateProcessW
GetModuleFileNameW
GetConsoleOutputCP
SetConsoleMode
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetLastError
GetWindowsDirectoryW
LocalFree
GetComputerNameW
GetConsoleScreenBufferInfo
GetCurrentProcess
GetStdHandle
WaitForSingleObject
CreateFileW
RtlUnwind
CloseHandle
GetProcAddress
FreeLibrary
WideCharToMultiByte
GetFileType
SetHandleInformation
TerminateProcess
SetEndOfFile
GetCurrentThreadId
DuplicateHandle
GetTickCount64
SetFilePointerEx
GetCurrentProcessId

user32

GetWindowPlacement
ShowWindow

advapi32

IsValidSid
EventWrite
EventRegister
ConvertSidToStringSidA
GetSidIdentifierAuthority
RegQueryValueExW
LookupAccountSidW
ConvertSidToStringSidW
RegOpenKeyExW
CopySid
RegCloseKey
GetTokenInformation
LookupAccountNameW
IsValidAcl
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
IsValidSecurityDescriptor
IsWellKnownSid
GetNamedSecurityInfoW
CreateWellKnownSid
GetAce
CreateProcessAsUserW
EqualSid

Sections

.text
Size: 360KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/ssh-agent.exe
.exe windows:6 windows x64 arch:x64

f96cbdbeb71f789cd01feff02f8b73f2

Code Sign

33:00:00:03:ae:2d:35:51:c8:53:8f:55:1d:00:00:00:00:03:ae
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:08

Not After

14/11/2024, 19:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c7:9a:57:aa:3f:34:2f:98:6d:61:a2:88:27:1d:5c:04:2f:da:c5:22:4e:89:f3:c0:4e:7e:8d:d9:7b:86:1e:20
Signer

Actual PE Digest

c7:9a:57:aa:3f:34:2f:98:6d:61:a2:88:27:1d:5c:04:2f:da:c5:22:4e:89:f3:c0:4e:7e:8d:d9:7b:86:1e:20

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\ssh-agent.pdb

Imports

libcrypto

DSA_get0_key
BN_bn2bin
DSA_do_verify
DSA_set0_key
DSA_SIG_get0
DSA_free
DSA_SIG_set0
EC_POINT_point2oct
DSA_do_sign
DSA_new
DSA_SIG_new
DSA_set0_pqg
DSA_get0_pqg
DSA_generate_key
EC_POINT_oct2point
BN_bin2bn
DSA_SIG_free
BN_dup
RSA_generate_key_ex
BN_set_flags
RSA_public_decrypt
RSA_new
RSA_set0_crt_params
RSA_free
BN_free
BN_set_word
RSA_sign
BN_div
RSA_set0_factors
RSA_get0_factors
RSA_get0_crt_params
RSA_set0_key
BN_CTX_new
BN_CTX_free
EVP_sha384
EVP_md5
EVP_sha256
EVP_Digest
EVP_sha1
EVP_sha512
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
EVP_CipherInit
EVP_aes_128_ctr
EVP_aes_256_ctr
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EC_KEY_METHOD_new
DSA_generate_parameters_ex
EVP_CIPHER_CTX_set_key_length
EVP_aes_192_ctr
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
ECDSA_do_sign
EC_POINT_cmp
EC_KEY_set_private_key
EC_KEY_generate_key
ECDSA_SIG_get0
EC_KEY_set_public_key
EC_KEY_free
ECDSA_SIG_free
ECDSA_SIG_set0
EC_KEY_set_asn1_flag
ECDSA_do_verify
EC_KEY_new_by_curve_name
ECDSA_SIG_new
RSA_blinding_on
EC_GROUP_get_order
BN_clear_free
BN_value_one
EC_METHOD_get_field_type
EC_POINT_mul
EC_POINT_get_affine_coordinates_GFp
EC_KEY_set_group
EC_POINT_is_at_infinity
arc4random_buf
RSA_get0_key
EC_POINT_free
EVP_aes_128_cbc
EC_KEY_get0_public_key
EC_GROUP_free
EC_POINT_new
EC_GROUP_cmp
EC_GROUP_set_asn1_flag
EC_GROUP_get_curve_name
BN_new
EC_KEY_get0_private_key
EC_KEY_get0_group
BN_cmp
BN_sub
explicit_bzero
EC_GROUP_new_by_curve_name
EC_GROUP_method_of
BN_num_bits
EC_KEY_METHOD_set_sign
RSA_up_ref
d2i_ECDSA_SIG
EC_KEY_set_method
RSA_meth_set_priv_enc
EC_KEY_METHOD_get_sign
RSA_meth_set1_name
RSA_set_method
RSA_meth_dup
RSA_size
RSA_get_default_method
EC_KEY_up_ref
EC_KEY_OpenSSL

crypt32

CryptProtectData
CryptStringToBinaryA
CryptBinaryToStringA
CryptUnprotectData

ws2_32

WSASend
WSAStartup
getsockname
WSARecv
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
socket

kernel32

SetCurrentDirectoryW
SetEnvironmentVariableW
RtlPcToFileHeader
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
GetCurrentDirectoryW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCommandLineA
GetCommandLineW
SetStdHandle
GetFullPathNameW
ExitProcess
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
HeapReAlloc
GetStringTypeW
ReadConsoleW
GetFileSizeEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
LoadLibraryExW
ReadConsoleOutputA
SetConsoleCursorPosition
GetConsoleWindow
Beep
FillConsoleOutputAttribute
WriteConsoleOutputA
ReadConsoleInputW
SetConsoleCursorInfo
GetLocalTime
IsDebuggerPresent
SetFilePointerEx
SetConsoleWindowInfo
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
GetConsoleOutputCP
SetConsoleScreenBufferSize
SetConsoleTextAttribute
FillConsoleOutputCharacterA
CreateWaitableTimerA
WriteConsoleW
CancelSynchronousIo
GetConsoleMode
SetConsoleMode
WaitForSingleObjectEx
WaitForMultipleObjectsEx
GetDriveTypeW
GetFinalPathNameByHandleW
QueueUserAPC
MultiByteToWideChar
VerifyVersionInfoW
VerSetConditionMask
ResetEvent
SleepEx
ReadFileEx
CreateFileA
WriteFileEx
SetConsoleCtrlHandler
GetModuleFileNameW
GetLastError
SetHandleInformation
CreateNamedPipeW
WaitForMultipleObjects
GetNamedPipeClientProcessId
GetQueuedCompletionStatus
OpenProcess
SetEvent
CloseHandle
GetCurrentProcessId
CreateProcessW
CreateEventA
CreateIoCompletionPort
ConnectNamedPipe
ReadFile
WriteFile
CancelIoEx
GetOverlappedResult
LocalFree
GetCurrentProcess
GetStdHandle
TerminateProcess
SetEndOfFile
GetCurrentThreadId
DuplicateHandle
GetTickCount64
GetFileType
OpenThread
FlushFileBuffers
GetConsoleScreenBufferInfo
WaitForSingleObject
CreateFileW
GetProcAddress
GetComputerNameW
FreeLibrary
WideCharToMultiByte
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
GetExitCodeProcess
CancelIo
CreateNamedPipeA

user32

GetWindowPlacement
ShowWindow

advapi32

RegDeleteKeyExA
EventWrite
EventRegister
OpenServiceW
StartServiceCtrlDispatcherW
StartServiceA
RegisterServiceCtrlHandlerW
SetServiceStatus
OpenSCManagerW
GetTokenInformation
DuplicateTokenEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
DuplicateToken
CheckTokenMembership
OpenProcessToken
RegSetValueExW
IsWellKnownSid
RegCreateKeyExW
CreateWellKnownSid
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegDeleteTreeW
ImpersonateLoggedOnUser
RegEnumKeyExW
RegCreateKeyExA
RegOpenCurrentUser
RegCloseKey
RevertToSelf
RegDeleteTreeA
CreateProcessAsUserW
LookupAccountNameW
GetLengthSid
IsValidSecurityDescriptor
CopySid
GetSidIdentifierAuthority
LookupAccountSidW
ConvertSidToStringSidW

Sections

.text
Size: 321KB - Virtual size: 321KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/ssh-keygen.exe
.exe windows:6 windows x64 arch:x64

0016f31674829e9b3acd87c749701935

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:29:a6:ea:3e:dd:c6:39:6d:11:64:ab:96:5f:6a:0c:47:fa:8c:b0:fe:7c:48:a6:94:db:04:5c:49:e7:ba:e8
Signer

Actual PE Digest

cd:29:a6:ea:3e:dd:c6:39:6d:11:64:ab:96:5f:6a:0c:47:fa:8c:b0:fe:7c:48:a6:94:db:04:5c:49:e7:ba:e8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\ssh-keygen.pdb

Imports

libcrypto

EC_POINT_point2oct
DSA_SIG_set0
DSA_free
DSA_do_sign
DSA_get0_key
BN_bn2bin
DSA_do_verify
DSA_SIG_get0
DSA_new
DSA_SIG_new
DSA_get0_pqg
DSA_generate_key
DSA_generate_parameters_ex
DSA_SIG_free
ECDSA_do_sign
EC_POINT_cmp
EC_KEY_set_private_key
EC_KEY_generate_key
ECDSA_SIG_get0
EC_POINT_oct2point
arc4random_uniform
ECDSA_do_verify
EC_KEY_new_by_curve_name
EVP_sha384
EVP_MD_CTX_copy_ex
EVP_MD_CTX_new
EVP_md5
EVP_sha256
EVP_DigestUpdate
EVP_Digest
EVP_MD_CTX_free
EVP_DigestInit_ex
EVP_MD_CTX_md
EVP_sha1
EVP_MD_block_size
EVP_sha512
EVP_DigestFinal_ex
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
EVP_CipherInit
EVP_aes_128_ctr
EVP_aes_256_ctr
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
EVP_aes_192_ctr
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
BN_dup
RSA_generate_key_ex
BN_set_flags
RSA_public_decrypt
RSA_set0_crt_params
RSA_sign
BN_div
RSA_get0_factors
RSA_get0_crt_params
BN_CTX_new
BN_CTX_free
BN_lshift
BN_is_prime_ex
BN_copy
PEM_write_RSAPrivateKey
EC_KEY_set_asn1_flag
EC_KEY_set_public_key
BN_rand
BN_rshift
BN_set_bit
BN_add
BN_bn2hex
BN_add_word
BN_mod_word
EC_KEY_METHOD_set_sign
RSAPublicKey_dup
X509_get_pubkey
EC_KEY_set_method
RSA_meth_set_priv_enc
o2i_ECPublicKey
d2i_ECPKParameters
EC_KEY_METHOD_get_sign
RSA_meth_set1_name
d2i_ASN1_OCTET_STRING
RSA_new
RSA_free
d2i_X509
d2i_X509_NAME
BN_free
ECDSA_size
EC_KEY_get_ex_data
EC_KEY_set_ex_data
X509_NAME_free
RSA_set_method
EVP_PKEY_get0_EC_KEY
EC_KEY_free
EVP_PKEY_get0_RSA
RSA_meth_dup
ECDSA_SIG_free
RSA_set_ex_data
ERR_error_string
EC_KEY_new
RSA_size
RSA_get_ex_data
RSA_get_default_method
RSA_get_ex_new_index
RSA_meth_set_priv_dec
ECDSA_SIG_set0
X509_free
X509_NAME_oneline
CRYPTO_get_ex_new_index
ASN1_OCTET_STRING_free
EC_KEY_METHOD_new
EC_KEY_dup
EC_KEY_OpenSSL
ECDSA_SIG_new
RAND_status
OpenSSL_version_num
gettimeofday
timegm
EVP_PKEY_set1_RSA
RSA_blinding_on
EC_GROUP_get_order
BIO_new
BIO_ctrl
ERR_peek_error
BN_value_one
PEM_write_bio_DSAPrivateKey
EVP_PKEY_new
EC_METHOD_get_field_type
EC_POINT_mul
EVP_PKEY_set1_DSA
ERR_get_error
EC_POINT_get_affine_coordinates_GFp
BN_print_fp
ERR_peek_last_error
arc4random
EC_KEY_set_group
EC_POINT_is_at_infinity
arc4random_buf
BIO_s_mem
RSA_get0_key
PEM_read_bio_PrivateKey
EC_POINT_free
EVP_aes_128_cbc
EC_KEY_get0_public_key
EC_GROUP_free
EC_POINT_new
BIO_write
BIO_free
EC_GROUP_cmp
PEM_write_bio_ECPrivateKey
EC_GROUP_set_asn1_flag
EC_GROUP_get_curve_name
EC_KEY_get0_private_key
PEM_write_bio_RSAPrivateKey
PEM_write_bio_PrivateKey
EC_KEY_get0_group
BN_cmp
BN_sub
EC_GROUP_new_by_curve_name
EC_GROUP_method_of
BN_num_bits
EVP_PKEY_set1_EC_KEY
BN_clear_free
BN_hex2bn
EVP_PKEY_get1_EC_KEY
PEM_read_PUBKEY
DSA_set0_key
PEM_write_RSA_PUBKEY
BN_set_word
PEM_write_RSAPublicKey
PEM_read_RSAPublicKey
EVP_PKEY_free
EVP_PKEY_get1_RSA
PEM_write_DSA_PUBKEY
RSA_set0_factors
EVP_PKEY_get1_DSA
BN_new
PEM_write_DSAPrivateKey
DSA_set0_pqg
PEM_write_EC_PUBKEY
RSA_set0_key
explicit_bzero
EVP_PKEY_base_id
PEM_write_ECPrivateKey
BN_bin2bn

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

ws2_32

WSADuplicateSocketW
WSASocketW
WSACleanup
FreeAddrInfoW
bind
WSAIoctl
closesocket
WSASend
WSAStartup
getsockname
socket
gethostname
GetAddrInfoW
WSARecv
WSAGetOverlappedResult
setsockopt
WSAGetLastError
htonl

kernel32

GetFileSizeEx
FreeLibraryAndExitThread
ExitThread
CreateThread
FindNextFileW
FindFirstFileExW
FindClose
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetCommandLineW
GetCommandLineA
GetCurrentDirectoryW
SetEnvironmentVariableW
DeleteFileW
GetFullPathNameW
SetFileAttributesW
RemoveDirectoryW
SetStdHandle
GetModuleHandleExW
ExitProcess
RtlPcToFileHeader
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetConsoleOutputCP
SetConsoleMode
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetTimeZoneInformation
GetStringTypeW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
GetEnvironmentStringsW
HeapAlloc
GetProcessHeap
HeapSize
GetLocalTime
SetConsoleOutputCP
CreateWaitableTimerA
CancelIoEx
CancelSynchronousIo
WriteFile
ReadFile
WaitForSingleObjectEx
WaitForMultipleObjectsEx
LoadLibraryExW
GetFinalPathNameByHandleW
QueueUserAPC
SetConsoleCtrlHandler
GetDriveTypeW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
ReadFileEx
GetFileAttributesExW
GetFileInformationByHandle
CreateHardLinkW
WriteFileEx
DeviceIoControl
CreateNamedPipeA
CancelIo
GetExitCodeProcess
ReadConsoleOutputA
SetConsoleCursorPosition
GetConsoleWindow
Beep
WriteConsoleW
FillConsoleOutputAttribute
WriteConsoleOutputA
CreateFileA
ReadConsoleInputW
SetConsoleCursorInfo
GetConsoleMode
SetConsoleWindowInfo
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
SetConsoleScreenBufferSize
SetConsoleTextAttribute
FillConsoleOutputCharacterA
MultiByteToWideChar
FlushFileBuffers
OpenThread
CreateProcessW
GetCurrentProcessId
SetFilePointerEx
GetTickCount64
DuplicateHandle
GetCurrentThreadId
SetEndOfFile
TerminateProcess
SetHandleInformation
GetWindowsDirectoryW
GetSystemDirectoryW
ExpandEnvironmentStringsW
CreateEventA
VerifyVersionInfoW
SleepEx
VerSetConditionMask
ResetEvent
SetEvent
GetFileType
WideCharToMultiByte
HeapFree
FreeEnvironmentStringsW
FreeLibrary
GetComputerNameW
MoveFileExW
LocalFree
GetProcAddress
LoadLibraryW
CloseHandle
GetLastError
FormatMessageW
CreateFileW
WaitForSingleObject
GetStdHandle
GetCurrentProcess
GetConsoleScreenBufferInfo
CreateDirectoryW
GetModuleFileNameW

user32

ShowWindow
GetWindowPlacement

advapi32

IsValidSid
EventWrite
EventRegister
GetTokenInformation
LookupAccountNameW
IsValidAcl
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
IsValidSecurityDescriptor
IsWellKnownSid
GetNamedSecurityInfoW
CopySid
CreateWellKnownSid
GetAce
GetSidIdentifierAuthority
RegQueryValueExW
LookupAccountSidW
ConvertSidToStringSidW
RegOpenKeyExW
RegCloseKey
CreateProcessAsUserW
EqualSid
ConvertSidToStringSidA

Sections

.text
Size: 562KB - Virtual size: 561KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 241KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/ssh-keyscan.exe
.exe windows:6 windows x64 arch:x64

6781107df7373a5e7d881052b9e12f9b

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:7d:40:fc:e4:9a:e6:24:e9:2a:a4:ea:17:7a:27:97:18:b0:28:ca:00:50:25:d6:66:ff:30:d5:1f:7f:60:1c
Signer

Actual PE Digest

bd:7d:40:fc:e4:9a:e6:24:e9:2a:a4:ea:17:7a:27:97:18:b0:28:ca:00:50:25:d6:66:ff:30:d5:1f:7f:60:1c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\ssh-keyscan.pdb

Imports

libcrypto

DH_new
BN_is_negative
DH_set0_pqg
DH_generate_key
EC_POINT_oct2point
EC_POINT_point2oct
DSA_SIG_set0
DSA_free
BN_hex2bn
DSA_get0_key
BN_bn2bin
DSA_do_verify
DSA_set0_key
BN_is_bit_set
DSA_new
DSA_SIG_new
DSA_set0_pqg
DSA_get0_pqg
DSA_generate_key
DSA_generate_parameters_ex
DSA_SIG_free
BN_dup
RSA_generate_key_ex
BN_set_flags
RSA_public_decrypt
RSA_new
DH_set_length
AES_set_encrypt_key
AES_encrypt
RSA_set0_crt_params
RSA_free
BN_set_word
RSA_sign
BN_div
RSA_set0_factors
RSA_size
RSA_get0_factors
RSA_get0_crt_params
RSA_set0_key
BN_CTX_new
BN_CTX_free
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
EVP_CipherInit
EVP_aes_128_ctr
EVP_aes_256_ctr
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
EVP_aes_192_ctr
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
ECDSA_do_sign
DSA_SIG_get0
DSA_do_sign
EC_POINT_cmp
EC_KEY_set_private_key
ECDSA_SIG_get0
EC_KEY_set_public_key
ECDSA_SIG_free
ECDSA_SIG_set0
EC_KEY_set_asn1_flag
ECDSA_do_verify
ECDSA_SIG_new
ECDH_compute_key
EC_KEY_generate_key
EC_POINT_clear_free
EC_GROUP_get_degree
EC_KEY_new_by_curve_name
BN_free
DH_compute_key
DH_size
BN_bin2bn
EVP_sha384
EVP_MD_CTX_copy_ex
EVP_MD_CTX_new
EVP_md5
EVP_sha256
EVP_DigestUpdate
EVP_Digest
EVP_MD_CTX_free
EVP_DigestInit_ex
EVP_MD_CTX_md
EVP_sha1
EVP_MD_block_size
EVP_sha512
EVP_DigestFinal_ex
EC_KEY_free
DH_get0_key
DH_free
DH_get0_pqg
RAND_status
OpenSSL_version_num
gettimeofday
RSA_blinding_on
EC_GROUP_get_order
BN_clear_free
BN_value_one
EC_METHOD_get_field_type
EC_POINT_mul
EC_POINT_get_affine_coordinates_GFp
EC_POINT_is_at_infinity
arc4random_buf
RSA_get0_key
EC_POINT_free
EVP_aes_128_cbc
EC_KEY_get0_public_key
EC_POINT_new
EC_GROUP_cmp
BN_new
EC_KEY_get0_private_key
EC_KEY_get0_group
BN_cmp
BN_sub
EC_GROUP_method_of
BN_num_bits
explicit_bzero

crypt32

CryptStringToBinaryA

ws2_32

bind
WSAIoctl
WSASend
WSAStartup
getpeername
getsockname
socket
WSACleanup
GetAddrInfoW
WSARecv
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
htonl
FreeAddrInfoW
htons
getnameinfo
ntohl
getservbyname
ntohs

kernel32

HeapFree
HeapAlloc
FreeLibraryAndExitThread
ExitThread
CreateThread
FindNextFileW
FindFirstFileExW
FindClose
GetCurrentDirectoryW
SetEnvironmentVariableW
GetFullPathNameW
SetStdHandle
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
ExitProcess
RtlPcToFileHeader
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
FlsAlloc
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetStringTypeW
ReadConsoleW
HeapReAlloc
GetFileSizeEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
GetLocalTime
FormatMessageA
LoadLibraryExW
ReadConsoleOutputA
SetConsoleCursorPosition
GetConsoleWindow
Beep
FillConsoleOutputAttribute
WriteConsoleOutputA
ReadConsoleInputW
SetConsoleCursorInfo
SetConsoleWindowInfo
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
GetConsoleOutputCP
SetConsoleScreenBufferSize
SetConsoleTextAttribute
FillConsoleOutputCharacterA
CreateWaitableTimerA
WriteConsoleW
CancelIoEx
CancelSynchronousIo
GetConsoleMode
SetConsoleMode
WriteFile
ReadFile
WaitForSingleObjectEx
GetModuleHandleW
GetFileType
WaitForMultipleObjectsEx
GetDriveTypeW
GetFinalPathNameByHandleW
QueueUserAPC
SetConsoleCtrlHandler
ReadFileEx
CreateFileA
WriteFileEx
CancelIo
GetExitCodeProcess
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetComputerNameW
LocalFree
GetProcAddress
CreateFileW
WaitForSingleObject
GetConsoleScreenBufferInfo
GetModuleFileNameW
SetHandleInformation
GetCurrentProcess
GetStdHandle
TerminateProcess
SetEndOfFile
GetCurrentThreadId
DuplicateHandle
GetTickCount64
GetLastError
CloseHandle
SetFilePointerEx
GetCurrentProcessId
RtlUnwind
OpenThread
FlushFileBuffers
SetEvent
ResetEvent
VerSetConditionMask
SleepEx
VerifyVersionInfoW
CreateEventA

user32

GetWindowPlacement
ShowWindow

advapi32

CreateWellKnownSid
EventWriteTransfer
EventUnregister
EventWrite
EventRegister
GetTokenInformation
LookupAccountNameW
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
IsValidSecurityDescriptor
IsWellKnownSid
CopySid
ConvertSidToStringSidW

Sections

.text
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/ssh-pkcs11-helper.exe
.exe windows:6 windows x64 arch:x64

20141d09c895ca5179d02a6bea674842

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f5:3d:a2:82:ad:cd:b3:51:7c:42:d6:f3:d1:9b:97:14:f3:71:8a:0c:5c:54:21:c1:43:39:f4:8b:4a:2e:ac:85
Signer

Actual PE Digest

f5:3d:a2:82:ad:cd:b3:51:7c:42:d6:f3:d1:9b:97:14:f3:71:8a:0c:5c:54:21:c1:43:39:f4:8b:4a:2e:ac:85

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\ssh-pkcs11-helper.pdb

Imports

libcrypto

DSA_get0_key
BN_bn2bin
DSA_do_verify
DSA_set0_key
DSA_SIG_get0
DSA_new
DSA_SIG_new
DSA_set0_pqg
DSA_get0_pqg
DSA_generate_key
DSA_generate_parameters_ex
DSA_SIG_free
BN_dup
RSA_generate_key_ex
BN_set_flags
RSA_public_decrypt
RSA_set0_crt_params
BN_set_word
RSA_sign
DSA_free
RSA_set0_factors
RSA_get0_factors
RSA_get0_crt_params
BN_CTX_new
DSA_SIG_set0
EVP_sha384
EVP_md5
EVP_sha256
EVP_Digest
EVP_sha1
EVP_sha512
EVP_aes_256_cbc
EVP_aes_128_ctr
EVP_aes_256_ctr
DSA_do_sign
EC_POINT_point2oct
EC_POINT_oct2point
ECDSA_sign
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_aes_192_ctr
EVP_aes_256_gcm
EVP_aes_128_gcm
ECDSA_do_sign
EC_POINT_cmp
EC_KEY_set_private_key
EC_KEY_generate_key
ECDSA_SIG_get0
EC_KEY_set_public_key
EC_KEY_set_asn1_flag
ECDSA_do_verify
EC_KEY_new_by_curve_name
RAND_status
OpenSSL_version_num
RSA_blinding_on
EC_GROUP_get_order
BN_clear_free
BN_value_one
BN_CTX_free
BN_div
EC_METHOD_get_field_type
EC_POINT_mul
EC_POINT_get_affine_coordinates_GFp
EC_POINT_is_at_infinity
arc4random_buf
RSA_get0_key
EC_POINT_free
EVP_aes_128_cbc
EC_KEY_get0_public_key
EC_POINT_new
EC_GROUP_cmp
EC_GROUP_set_asn1_flag
EC_GROUP_get_curve_name
BN_new
EC_KEY_get0_private_key
EC_KEY_get0_group
BN_cmp
BN_sub
EC_GROUP_new_by_curve_name
EC_GROUP_method_of
BN_num_bits
explicit_bzero
EC_KEY_METHOD_set_sign
RSAPublicKey_dup
X509_get_pubkey
EC_KEY_set_method
RSA_meth_set_priv_enc
o2i_ECPublicKey
d2i_ECPKParameters
EC_KEY_METHOD_get_sign
RSA_meth_set1_name
d2i_ASN1_OCTET_STRING
RSA_new
RSA_free
d2i_X509
ERR_get_error
d2i_X509_NAME
BN_free
EC_KEY_get_ex_data
EC_KEY_set_ex_data
EC_KEY_set_group
X509_NAME_free
RSA_set_method
EVP_PKEY_get0_EC_KEY
EC_KEY_free
EVP_PKEY_get0_RSA
RSA_meth_dup
ECDSA_SIG_free
RSA_set_ex_data
ERR_error_string
EC_GROUP_free
EC_KEY_new
RSA_get_ex_data
RSA_get_default_method
RSA_get_ex_new_index
RSA_meth_set_priv_dec
ECDSA_SIG_set0
X509_free
X509_NAME_oneline
RSA_set0_key
CRYPTO_get_ex_new_index
ASN1_OCTET_STRING_free
EC_KEY_METHOD_new
EC_KEY_dup
EVP_PKEY_base_id
EC_KEY_OpenSSL
ECDSA_SIG_new
BN_bin2bn
ECDSA_size
RSA_private_encrypt
RSA_size

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

ws2_32

WSASend
WSAStartup
getsockname
WSARecv
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
socket

kernel32

FlsAlloc
HeapFree
HeapAlloc
FreeLibraryAndExitThread
ExitThread
CreateThread
FindNextFileW
FindFirstFileExW
FindClose
GetCurrentDirectoryW
SetEnvironmentVariableW
GetFullPathNameW
SetStdHandle
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
ExitProcess
RtlPcToFileHeader
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetStringTypeW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleW
HeapReAlloc
GetFileSizeEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
GetLocalTime
LoadLibraryExW
ReadConsoleOutputA
SetConsoleCursorPosition
GetConsoleWindow
Beep
FillConsoleOutputAttribute
WriteConsoleOutputA
ReadConsoleInputW
SetConsoleCursorInfo
SetConsoleWindowInfo
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
GetConsoleOutputCP
SetConsoleScreenBufferSize
SetConsoleTextAttribute
FillConsoleOutputCharacterA
CreateWaitableTimerA
WriteConsoleW
CancelIoEx
CancelSynchronousIo
GetConsoleMode
SetConsoleMode
WriteFile
ReadFile
WaitForSingleObjectEx
WaitForMultipleObjectsEx
GetDriveTypeW
GetFinalPathNameByHandleW
QueueUserAPC
SetConsoleCtrlHandler
CreateEventA
VerifyVersionInfoW
VerSetConditionMask
ResetEvent
SetEvent
SleepEx
ReadFileEx
CreateFileA
WriteFileEx
RtlCaptureContext
TerminateProcess
CreateNamedPipeA
CancelIo
MultiByteToWideChar
GetExitCodeProcess
WideCharToMultiByte
FreeLibrary
LocalFree
GetProcAddress
LoadLibraryW
FormatMessageW
CreateFileW
WaitForSingleObject
GetConsoleScreenBufferInfo
FlushFileBuffers
OpenThread
GetFileType
CreateProcessW
GetCurrentProcessId
SetFilePointerEx
CloseHandle
GetLastError
GetTickCount64
DuplicateHandle
GetCurrentThreadId
SetEndOfFile
GetModuleFileNameW
SetHandleInformation
GetCurrentProcess
GetStdHandle

user32

GetWindowPlacement
ShowWindow

advapi32

EventWrite
EventRegister
CreateProcessAsUserW
GetTokenInformation
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
IsValidSecurityDescriptor
IsWellKnownSid
CopySid
ConvertSidToStringSidW

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/ssh-shellhost.exe
.exe windows:6 windows x64 arch:x64

1b97f83f75c1b93cc0e77123a1a8b210

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:91:2d:c8:6b:72:4b:95:bb:e4:9b:88:59:39:d0:5b:61:91:59:05:af:d0:f7:66:68:67:c3:fc:89:72:50:a5
Signer

Actual PE Digest

4e:91:2d:c8:6b:72:4b:95:bb:e4:9b:88:59:39:d0:5b:61:91:59:05:af:d0:f7:66:68:67:c3:fc:89:72:50:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\ssh-shellhost.pdb

Imports

kernel32

GetStartupInfoW
ReadFile
SetConsoleCtrlHandler
SetHandleInformation
EnterCriticalSection
GetCommandLineW
SetConsoleScreenBufferSize
GetStdHandle
WriteFile
TerminateProcess
GetConsoleCP
SetConsoleWindowInfo
LeaveCriticalSection
InitializeCriticalSection
GetConsoleScreenBufferInfoEx
WaitForSingleObject
CreateFileW
GetCurrentThreadId
GetSystemDirectoryW
Sleep
GetLastError
GetLargestConsoleWindowSize
AttachConsole
ReadConsoleOutputW
TerminateThread
CloseHandle
FreeConsole
LoadLibraryW
WriteConsoleInputW
GetProcAddress
DeleteCriticalSection
GetCurrentProcessId
CreateProcessW
WideCharToMultiByte
GenerateConsoleCtrlEvent
GetExitCodeProcess
MultiByteToWideChar
WriteConsoleW
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameW
GetCommandLineA
HeapFree
HeapAlloc
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
GetFileSizeEx

user32

DispatchMessageW
MapVirtualKeyA
TranslateMessage
PostThreadMessageW
GetMessageW
GetWindowThreadProcessId

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/ssh-sk-helper.exe
.exe windows:6 windows x64 arch:x64

1e6e70f7c4537d8bafe075f358d38a46

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:41:0b:3b:24:d9:f1:f4:f6:41:78:e7:4d:d0:f1:f9:9d:d9:ba:95:dc:25:58:1d:ed:70:d5:b4:d0:93:6f:42
Signer

Actual PE Digest

41:41:0b:3b:24:d9:f1:f4:f6:41:78:e7:4d:d0:f1:f9:9d:d9:ba:95:dc:25:58:1d:ed:70:d5:b4:d0:93:6f:42

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\ssh-sk-helper.pdb

Imports

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDevicePropertyW

hid

HidP_GetCaps
HidD_GetPreparsedData
HidD_FreePreparsedData
HidD_GetManufacturerString
HidD_GetProductString
HidD_GetAttributes

libcrypto

RSA_bits
EVP_PKEY_keygen
EVP_PKEY_keygen_init
EVP_PKEY_paramgen
EVP_PKEY_paramgen_init
EVP_PKEY_verify
EVP_PKEY_verify_init
EVP_PKEY_CTX_ctrl
EVP_PKEY_CTX_new_id
EVP_PKEY_get0_EC_KEY
EVP_PKEY_assign
EC_POINT_is_on_curve
BN_CTX_end
BN_CTX_get
BN_CTX_start
HKDF
EVP_PKEY_derive
EVP_PKEY_derive_set_peer
EVP_PKEY_derive_init
EVP_PKEY_CTX_free
EVP_PKEY_CTX_new
d2i_X509
HMAC
EVP_MD_meth_dup
X509_get_pubkey
X509_free
d2i_X509_bio
RSA_pkey_ctx_ctrl
SHA256
DSA_SIG_set0
DSA_free
DSA_do_sign
DSA_get0_key
DSA_do_verify
DSA_set0_key
DSA_SIG_get0
DSA_new
DSA_SIG_new
DSA_set0_pqg
DSA_get0_pqg
DSA_generate_key
DSA_generate_parameters_ex
DSA_SIG_free
BN_dup
RSA_generate_key_ex
EVP_PKEY_new_raw_public_key
EVP_DigestVerifyInit
EVP_DigestVerify
SHA1
BN_set_flags
RSA_public_decrypt
RSA_new
RSA_set0_crt_params
RSA_free
BN_free
BN_set_word
RSA_sign
BN_div
RSA_set0_factors
BIO_new_mem_buf
RSA_get0_factors
RSA_get0_crt_params
RSA_set0_key
BN_CTX_new
BN_CTX_free
EVP_sha384
EVP_MD_CTX_new
EVP_md5
EVP_sha256
EVP_DigestUpdate
EVP_Digest
EVP_MD_CTX_free
EVP_DigestInit_ex
EVP_sha1
EVP_sha512
EVP_DigestFinal_ex
EVP_CIPHER_CTX_key_length
EVP_MD_meth_free
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
EVP_CipherInit
EVP_aes_128_ctr
EVP_aes_256_ctr
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
EVP_aes_192_ctr
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
ECDSA_do_sign
EC_POINT_cmp
EC_KEY_set_private_key
EC_KEY_generate_key
EC_KEY_free
ECDSA_SIG_set0
EC_KEY_set_asn1_flag
ECDSA_do_verify
ECDSA_SIG_new
EC_POINT_oct2point
gettimeofday
RSA_blinding_on
EC_GROUP_get_order
BN_value_one
EVP_PKEY_new
EC_METHOD_get_field_type
EC_POINT_mul
EC_POINT_get_affine_coordinates_GFp
EC_POINT_is_at_infinity
RSA_get0_key
EVP_aes_128_cbc
EVP_PKEY_free
EC_KEY_get0_public_key
BIO_free
EC_GROUP_cmp
EC_KEY_get0_private_key
BN_cmp
BN_sub
EVP_PKEY_base_id
EC_GROUP_method_of
d2i_ECDSA_SIG
BN_clear_free
BN_bn2bin
ECDSA_SIG_get0
ECDSA_SIG_free
EC_GROUP_free
EC_POINT_point2oct
EC_POINT_set_affine_coordinates_GFp
BN_new
EC_GROUP_new_by_curve_name
BN_num_bits
BN_bin2bn
EC_KEY_set_public_key
arc4random_buf
EC_POINT_free
EC_POINT_new
EC_KEY_get0_group
EC_KEY_new_by_curve_name
RSA_size

bcrypt

BCryptGenRandom

crypt32

CryptStringToBinaryA

ws2_32

WSASend
WSAStartup
getsockname
socket
WSACleanup
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
ntohl
htonl
ntohs
WSARecv
htons

kernel32

FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
GetModuleFileNameW
FreeLibraryAndExitThread
ExitThread
CreateThread
FindNextFileW
FindFirstFileExW
FindClose
GetCurrentDirectoryW
SetEnvironmentVariableW
GetFullPathNameW
SetStdHandle
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
ExitProcess
RtlPcToFileHeader
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LCMapStringW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
ReadConsoleW
HeapReAlloc
GetFileSizeEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
GetLocalTime
CompareStringW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
SetEndOfFile
TerminateProcess
DuplicateHandle
GetOverlappedResult
LoadLibraryA
LoadLibraryExW
ReadConsoleOutputA
SetConsoleCursorPosition
GetConsoleWindow
Beep
FillConsoleOutputAttribute
WriteConsoleOutputA
ReadConsoleInputW
SetConsoleCursorInfo
SetConsoleWindowInfo
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
GetConsoleOutputCP
SetConsoleScreenBufferSize
SetConsoleTextAttribute
FillConsoleOutputCharacterA
CreateWaitableTimerA
WaitForSingleObjectEx
WaitForMultipleObjectsEx
WriteConsoleW
CancelIoEx
CancelSynchronousIo
GetConsoleMode
SetConsoleMode
WriteFile
ReadFile
GetDriveTypeW
GetFinalPathNameByHandleW
GetExitCodeProcess
QueueUserAPC
SetConsoleCtrlHandler
CreateEventA
VerifyVersionInfoW
VerSetConditionMask
ResetEvent
SetEvent
SleepEx
ReadFileEx
CreateFileA
WriteFileEx
CancelIo
MultiByteToWideChar
GetStdHandle
GetCurrentProcess
RtlVirtualUnwind
WideCharToMultiByte
FreeLibrary
LocalFree
GetProcAddress
LoadLibraryW
FormatMessageW
Sleep
CreateFileW
WaitForSingleObject
CreateWaitableTimerW
GetConsoleScreenBufferInfo
SetWaitableTimer
FlushFileBuffers
OpenThread
GetFileType
GetCurrentProcessId
SetFilePointerEx
CloseHandle
GetLastError
GetTickCount64
SetHandleInformation

user32

GetTopWindow
GetForegroundWindow
ShowWindow
GetWindowPlacement

advapi32

GetTokenInformation
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
IsValidSecurityDescriptor
IsWellKnownSid
EventWrite
EventRegister
CopySid
ConvertSidToStringSidW

Sections

.text
Size: 397KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/ssh.exe
.exe windows:6 windows x64 arch:x64

510dac140f7c7be7b2f9e319aec68503

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c7:b4:e1:e2:75:98:22:e0:d5:8f:cd:64:a6:27:62:3a:fe:8d:d0:3c:1c:11:05:10:60:6e:68:ef:21:44:70:c4
Signer

Actual PE Digest

c7:b4:e1:e2:75:98:22:e0:d5:8f:cd:64:a6:27:62:3a:fe:8d:d0:3c:1c:11:05:10:60:6e:68:ef:21:44:70:c4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\ssh.pdb

Imports

libcrypto

DH_set_length
DH_new
BN_is_negative
DH_set0_pqg
DH_generate_key
ECDH_compute_key
EC_POINT_clear_free
EC_GROUP_get_degree
DH_compute_key
DH_size
AES_encrypt
AES_set_encrypt_key
EC_POINT_oct2point
EC_POINT_point2oct
DSA_SIG_set0
DSA_free
DSA_do_sign
DSA_get0_key
BN_hex2bn
BN_is_bit_set
DSA_set0_key
DSA_SIG_get0
DSA_new
DSA_SIG_new
DSA_set0_pqg
DSA_get0_pqg
DSA_generate_key
DSA_generate_parameters_ex
DSA_SIG_free
BN_dup
RSA_generate_key_ex
BN_set_flags
RSA_public_decrypt
RSA_set0_crt_params
BN_set_word
RSA_sign
BN_div
RSA_set0_factors
RSA_get0_factors
RSA_get0_crt_params
BN_CTX_new
BN_CTX_free
ECDSA_do_sign
EC_POINT_cmp
EC_KEY_set_private_key
EC_KEY_generate_key
ECDSA_SIG_get0
EC_KEY_set_public_key
EC_KEY_set_asn1_flag
ECDSA_do_verify
EC_KEY_new_by_curve_name
DH_get0_key
DH_get0_pqg
RAND_status
OpenSSL_version_num
EC_KEY_METHOD_set_sign
RSAPublicKey_dup
X509_get_pubkey
EC_KEY_set_method
RSA_meth_set_priv_enc
o2i_ECPublicKey
d2i_ECPKParameters
EC_KEY_METHOD_get_sign
RSA_meth_set1_name
d2i_ASN1_OCTET_STRING
RSA_new
RSA_free
d2i_X509
d2i_X509_NAME
arc4random_buf
DSA_do_verify
BN_bn2bin
BN_free
ECDSA_size
EC_KEY_get_ex_data
EC_KEY_set_ex_data
X509_NAME_free
RSA_set_method
EVP_PKEY_get0_EC_KEY
EVP_PKEY_get0_RSA
RSA_meth_dup
ECDSA_SIG_free
RSA_set_ex_data
ERR_error_string
EC_KEY_new
RSA_size
RSA_get_ex_data
RSA_get_default_method
RSA_get_ex_new_index
RSA_meth_set_priv_dec
ECDSA_SIG_set0
X509_free
X509_NAME_oneline
RSA_set0_key
CRYPTO_get_ex_new_index
ASN1_OCTET_STRING_free
EC_KEY_METHOD_new
EC_KEY_dup
EC_KEY_OpenSSL
ECDSA_SIG_new
BN_bin2bn
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
EVP_CipherInit
EVP_aes_128_ctr
EVP_aes_256_ctr
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
EVP_aes_192_ctr
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
EVP_sha384
EVP_MD_CTX_copy_ex
EVP_MD_CTX_new
EVP_md5
EVP_sha256
EVP_DigestUpdate
EVP_Digest
EVP_MD_CTX_free
EVP_DigestInit_ex
EVP_MD_CTX_md
EVP_sha1
EVP_MD_block_size
EVP_sha512
EVP_DigestFinal_ex
DH_free
EC_KEY_free
RSA_blinding_on
EC_GROUP_get_order
BIO_new
BN_clear_free
ERR_peek_error
BN_value_one
EVP_PKEY_get1_EC_KEY
EC_METHOD_get_field_type
EC_POINT_mul
ERR_get_error
EC_POINT_get_affine_coordinates_GFp
ERR_peek_last_error
EC_KEY_set_group
EC_POINT_is_at_infinity
BIO_s_mem
RSA_get0_key
PEM_read_bio_PrivateKey
EC_POINT_free
EVP_aes_128_cbc
EVP_PKEY_free
EVP_PKEY_get1_RSA
EC_KEY_get0_public_key
EC_GROUP_free
EC_POINT_new
BIO_write
BIO_free
EC_GROUP_cmp
EVP_PKEY_get1_DSA
EC_GROUP_set_asn1_flag
EC_GROUP_get_curve_name
BN_new
EC_KEY_get0_private_key
EC_KEY_get0_group
BN_cmp
BN_sub
EC_GROUP_new_by_curve_name
EVP_PKEY_base_id
EC_GROUP_method_of
BN_num_bits
gettimeofday
OpenSSL_version
explicit_bzero
arc4random_uniform

userenv

LoadUserProfileW

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

ws2_32

bind
WSAIoctl
WSASend
shutdown
listen
WSAStartup
getpeername
getsockname
socket
gethostname
GetAddrInfoW
WSARecv
FreeAddrInfoW
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
ntohl
htonl
htons
getnameinfo
ntohs
getservbyname
getsockopt
WSACleanup
inet_ntoa
inet_ntop

secur32

InitSecurityInterfaceW
LsaDeregisterLogonProcess
LsaLogonUser
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
LsaRegisterLogonProcess

kernel32

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
GetCurrentDirectoryW
SetEnvironmentVariableW
DeleteFileW
GetFullPathNameW
SetFileAttributesW
RemoveDirectoryW
SetStdHandle
ExitProcess
RtlPcToFileHeader
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FindClose
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
CreatePipe
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
HeapReAlloc
GetFileSizeEx
GetStringTypeW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleW
FindFirstFileExW
HeapSize
RtlUnwind
GetLocalTime
Sleep
CancelIoEx
CancelSynchronousIo
WriteFile
ReadFile
CreateWaitableTimerA
LoadLibraryExW
GetFinalPathNameByHandleW
GetDriveTypeW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
ReadFileEx
GetFileAttributesExW
GetFileInformationByHandle
CreateHardLinkW
WriteFileEx
DeviceIoControl
CreateNamedPipeA
CancelIo
WaitForSingleObjectEx
WaitForMultipleObjectsEx
QueueUserAPC
SetConsoleCtrlHandler
ReadConsoleOutputA
SetConsoleCursorPosition
GetConsoleWindow
SetConsoleCP
Beep
WriteConsoleW
PeekConsoleInputW
FillConsoleOutputAttribute
WriteConsoleOutputA
CreateFileA
ReadConsoleInputW
SetConsoleCursorInfo
GetConsoleMode
SetConsoleWindowInfo
GetConsoleCP
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
SetConsoleScreenBufferSize
SetConsoleTextAttribute
FillConsoleOutputCharacterA
MultiByteToWideChar
GetSystemTime
GetModuleHandleExW
GetWindowsDirectoryW
GetSystemDirectoryW
ExpandEnvironmentStringsW
CreateEventA
VerifyVersionInfoW
SleepEx
VerSetConditionMask
ResetEvent
SetEvent
FlushFileBuffers
OpenThread
CreateProcessW
SetFilePointerEx
GetTickCount64
DuplicateHandle
GetCurrentThreadId
SetEndOfFile
SetHandleInformation
GetFileType
WideCharToMultiByte
FreeLibrary
FindNextFileW
GetProcessHeap
HeapAlloc
GetComputerNameW
MoveFileExW
LocalFree
GetProcAddress
LoadLibraryW
FreeConsole
GetLastError
FormatMessageW
CreateFileW
GetStdHandle
GetCurrentProcess
GetConsoleScreenBufferInfo
CreateDirectoryW
GetExitCodeProcess
GetCurrentProcessId
CloseHandle
WaitForSingleObject
TerminateProcess
FormatMessageA
GetModuleFileNameW
SetConsoleOutputCP
SetConsoleMode
GetConsoleOutputCP

user32

ShowWindow
GetWindowPlacement

advapi32

GetTokenInformation
EventWrite
IsWellKnownSid
LookupAccountNameW
IsValidAcl
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
IsValidSecurityDescriptor
IsValidSid
GetNamedSecurityInfoW
CopySid
CreateWellKnownSid
GetAce
CreateProcessAsUserW
GetSidIdentifierAuthority
RegQueryValueExW
LookupAccountSidW
ConvertSidToStringSidW
RegOpenKeyExW
RegCloseKey
EventUnregister
EventRegister
EventWriteTransfer
LsaNtStatusToWinError
FreeSid
CreateRestrictedToken
LookupPrivilegeValueA
AllocateAndInitializeSid
EqualSid
AllocateLocallyUniqueId
AdjustTokenPrivileges
LsaManageSidNameMapping
ConvertSidToStringSidA

Sections

.text
Size: 847KB - Virtual size: 847KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/sshd.exe
.exe windows:6 windows x64 arch:x64

f4b3fde8d45d3569d6514408e8b02df7

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

df:d9:39:78:1f:96:71:e9:a8:12:a3:47:54:e5:e5:1b:66:29:8d:19:6d:8d:67:c1:cb:fa:49:a1:da:40:38:69
Signer

Actual PE Digest

df:d9:39:78:1f:96:71:e9:a8:12:a3:47:54:e5:e5:1b:66:29:8d:19:6d:8d:67:c1:cb:fa:49:a1:da:40:38:69

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\sshd.pdb

Imports

libcrypto

EC_POINT_clear_free
EC_GROUP_get_degree
AES_set_encrypt_key
DH_size
DSA_SIG_set0
DSA_free
DSA_do_sign
DSA_get0_key
DSA_do_verify
DSA_set0_key
DSA_SIG_get0
DSA_new
DSA_SIG_new
DSA_set0_pqg
DSA_get0_pqg
DSA_generate_key
DSA_generate_parameters_ex
DSA_SIG_free
BN_dup
RSA_generate_key_ex
BN_set_flags
RSA_public_decrypt
RSA_new
RSA_set0_crt_params
RSA_free
BN_free
BN_set_word
RSA_sign
BN_div
RSA_set0_factors
RSA_size
RSA_get0_factors
RSA_get0_crt_params
AES_encrypt
explicit_bzero
ECDH_compute_key
DH_compute_key
RSA_set0_key
BN_CTX_new
BN_CTX_free
ECDSA_do_sign
EC_POINT_cmp
EC_KEY_set_private_key
EC_KEY_generate_key
ECDSA_SIG_get0
ECDSA_SIG_free
ECDSA_SIG_set0
EC_KEY_set_asn1_flag
ECDSA_do_verify
EC_KEY_new_by_curve_name
ECDSA_SIG_new
RAND_status
OpenSSL_version_num
EC_KEY_free
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
EVP_CIPHER_CTX_iv_length
EVP_CipherInit
EVP_aes_128_ctr
EVP_aes_256_ctr
EVP_CIPHER_CTX_get_iv
EVP_des_ede3_cbc
EVP_aes_192_cbc
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
EVP_aes_192_ctr
EVP_Cipher
EVP_aes_256_gcm
EVP_aes_128_gcm
EVP_CIPHER_CTX_free
EC_POINT_oct2point
BN_bn2bin
EC_KEY_set_public_key
EC_POINT_point2oct
BN_bin2bn
BN_is_bit_set
DH_get0_key
BN_hex2bn
DH_set_length
DH_new
BN_is_negative
DH_set0_pqg
DH_generate_key
EVP_sha384
EVP_MD_CTX_copy_ex
EVP_MD_CTX_new
EVP_md5
EVP_sha256
EVP_DigestUpdate
EVP_Digest
EVP_MD_CTX_free
EVP_DigestInit_ex
EVP_MD_CTX_md
EVP_sha1
EVP_MD_block_size
EVP_sha512
EVP_DigestFinal_ex
RSA_blinding_on
EC_GROUP_get_order
BIO_new
BN_clear_free
ERR_peek_error
BN_value_one
EVP_PKEY_get1_EC_KEY
EC_METHOD_get_field_type
EC_POINT_mul
ERR_get_error
EC_POINT_get_affine_coordinates_GFp
ERR_peek_last_error
EC_KEY_set_group
EC_POINT_is_at_infinity
BIO_s_mem
RSA_get0_key
PEM_read_bio_PrivateKey
EC_POINT_free
EVP_aes_128_cbc
EVP_PKEY_free
EVP_PKEY_get1_RSA
EC_KEY_get0_public_key
EC_GROUP_free
EC_POINT_new
BIO_write
BIO_free
EC_GROUP_cmp
EVP_PKEY_get1_DSA
EC_GROUP_set_asn1_flag
EC_GROUP_get_curve_name
BN_new
EC_KEY_get0_private_key
EC_KEY_get0_group
BN_cmp
BN_sub
EC_GROUP_new_by_curve_name
EVP_PKEY_base_id
EC_GROUP_method_of
BN_num_bits
timegm
RAND_poll
RAND_seed
arc4random_buf
RAND_bytes
OpenSSL_version
DH_free
DH_get0_pqg
gettimeofday
arc4random_uniform

userenv

LoadUserProfileW

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

ws2_32

WSACleanup
FreeAddrInfoW
bind
WSAIoctl
WSASend
shutdown
listen
WSAStartup
getpeername
getsockname
socket
htons
GetAddrInfoW
WSARecv
getsockopt
WSAGetOverlappedResult
setsockopt
closesocket
WSADuplicateSocketW
WSASocketW
WSAGetLastError
ntohs
getservbyname
getnameinfo
gethostname
inet_ntop
ntohl
inet_ntoa
htonl

secur32

InitSecurityInterfaceW
FreeContextBuffer
LsaFreeReturnBuffer
LsaLookupAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaRegisterLogonProcess
LsaLogonUser

kernel32

GetCommandLineW
GetCommandLineA
DeleteFileW
GetFullPathNameW
SetFileAttributesW
RemoveDirectoryW
SetStdHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
ExitProcess
RtlPcToFileHeader
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
HeapReAlloc
GetTimeZoneInformation
GetFileSizeEx
GetStringTypeW
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
CancelIoEx
CancelSynchronousIo
WriteFile
ReadFile
WaitForSingleObjectEx
WaitForMultipleObjectsEx
GetDriveTypeW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
ReadFileEx
GetFileAttributesExW
GetFileInformationByHandle
WriteFileEx
DeviceIoControl
CreateNamedPipeA
CancelIo
ReadConsoleOutputA
SetConsoleCursorPosition
GetConsoleWindow
Beep
WriteConsoleW
FillConsoleOutputAttribute
WriteConsoleOutputA
CreateFileA
ReadConsoleInputW
SetConsoleCursorInfo
GetConsoleMode
SetConsoleWindowInfo
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
SetConsoleScreenBufferSize
HeapSize
GetLocalTime
GetEnvironmentVariableW
SetConsoleTextAttribute
FillConsoleOutputCharacterA
LoadLibraryExW
MultiByteToWideChar
CreateWaitableTimerA
CancelWaitableTimer
QueueUserAPC
SetConsoleCtrlHandler
GetExitCodeProcess
GetModuleHandleExW
GetSystemTime
GetWindowsDirectoryW
GetSystemDirectoryW
CreateEventA
VerifyVersionInfoW
SleepEx
VerSetConditionMask
ResetEvent
SetEvent
FlushFileBuffers
OpenThread
SetFilePointerEx
GetTickCount64
GetCurrentThreadId
SetEndOfFile
SetHandleInformation
GetCurrentProcessId
GetFinalPathNameByHandleW
GetFileType
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryW
Sleep
CreateFileW
CreateWaitableTimerW
GetLastError
CloseHandle
GetComputerNameW
WaitForSingleObject
GetFileAttributesW
CreateProcessW
CopyFileW
SetInformationJobObject
GetCurrentProcess
ExpandEnvironmentStringsW
AssignProcessToJobObject
TerminateProcess
SetEnvironmentVariableW
CreateJobObjectW
RtlUnwind
DuplicateHandle
OpenProcess
FormatMessageW
LocalFree
FormatMessageA
GetModuleFileNameW
GetConsoleOutputCP
SetConsoleMode
CreateDirectoryW
SetWaitableTimer
GetConsoleScreenBufferInfo
GetStdHandle

user32

ShowWindow
GetWindowPlacement

advapi32

IsValidSecurityDescriptor
EventWrite
EventWriteTransfer
EventRegister
GetTokenInformation
GetSidIdentifierAuthority
LookupAccountSidW
CheckTokenMembership
IsValidSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegCreateKeyExW
SetServiceStatus
RegCloseKey
RegEnumValueW
RegOpenKeyExW
IsWellKnownSid
LookupAccountNameW
IsValidAcl
GetLengthSid
OpenProcessToken
ConvertSidToStringSidA
GetNamedSecurityInfoW
CopySid
CreateWellKnownSid
GetAce
RegQueryValueExW
LsaNtStatusToWinError
DuplicateToken
FreeSid
CreateRestrictedToken
LookupPrivilegeValueA
AllocateAndInitializeSid
EqualSid
AllocateLocallyUniqueId
AdjustTokenPrivileges
LsaManageSidNameMapping
CreateProcessAsUserW
ConvertSidToStringSidW
EventUnregister

Sections

.text
Size: 923KB - Virtual size: 923KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 329KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenSSH-Win64/sshd_config_default
OpenSSH-Win64/uninstall-sshd.ps1

Sharing

General

Malware Config

Signatures

Files

8929f19b8e99ca471b8cfa5b2eea4a18

Code Sign

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

4e:42:20:fc:bf:94:77:ef:de:9b:8f:f6:0d:7f:bb:bb:e4:e7:e1:d7:12:3f:94:bb:be:3f:27:cd:fc:04:d8:51Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

ntdll

bcrypt

kernel32

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 533KB - Virtual size: 532KB

.data Size: 24KB - Virtual size: 38KB

.pdata Size: 62KB - Virtual size: 62KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1024B - Virtual size: 920B

.reloc Size: 17KB - Virtual size: 16KB

06f24910225af976f7fd6e9730af9bdf

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:afCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

42:81:06:36:63:d0:27:00:78:da:60:0d:a6:14:83:46:15:c8:b7:0e:88:48:1f:c6:08:1c:e6:14:87:7d:b3:72Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcrypto

crypt32

ws2_32

shlwapi

kernel32

user32

advapi32

Sections

.text Size: 309KB - Virtual size: 308KB

.rdata Size: 85KB - Virtual size: 84KB

.data Size: 4KB - Virtual size: 210KB

.pdata Size: 13KB - Virtual size: 13KB

_RDATA Size: 512B - Virtual size: 512B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

a606cef6e859b09db7a3871387aea1e9

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:afCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

20:c4:49:2c:b7:8f:d1:4b:09:96:b4:24:85:cc:9f:6b:96:e7:a4:5f:ff:0b:73:b3:b8:46:97:11:58:ff:fe:81Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcrypto

crypt32

ws2_32

kernel32

user32

advapi32

Sections

.text Size: 263KB - Virtual size: 263KB

.rdata Size: 79KB - Virtual size: 79KB

.data Size: 4KB - Virtual size: 114KB

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

4e:42:20:fc:bf:94:77:ef:de:9b:8f:f6:0d:7f:bb:bb:e4:e7:e1:d7:12:3f:94:bb:be:3f:27:cd:fc:04:d8:51
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 533KB - Virtual size: 532KB

.data
Size: 24KB - Virtual size: 38KB

.pdata
Size: 62KB - Virtual size: 62KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 17KB - Virtual size: 16KB

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

42:81:06:36:63:d0:27:00:78:da:60:0d:a6:14:83:46:15:c8:b7:0e:88:48:1f:c6:08:1c:e6:14:87:7d:b3:72
Signer

.text
Size: 309KB - Virtual size: 308KB

.rdata
Size: 85KB - Virtual size: 84KB

.data
Size: 4KB - Virtual size: 210KB

.pdata
Size: 13KB - Virtual size: 13KB

_RDATA
Size: 512B - Virtual size: 512B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

20:c4:49:2c:b7:8f:d1:4b:09:96:b4:24:85:cc:9f:6b:96:e7:a4:5f:ff:0b:73:b3:b8:46:97:11:58:ff:fe:81
Signer

.text
Size: 263KB - Virtual size: 263KB

.rdata
Size: 79KB - Virtual size: 79KB

.data
Size: 4KB - Virtual size: 114KB

.pdata
Size: 12KB - Virtual size: 11KB

_RDATA
Size: 512B - Virtual size: 512B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

e9:77:aa:b8:bc:2a:db:20:f4:7f:88:c4:0d:e9:86:0c:29:0b:63:dd:64:c8:71:ed:4a:71:b2:5e:07:3e:e0:30
Signer

.text
Size: 329KB - Virtual size: 328KB

.rdata
Size: 92KB - Virtual size: 91KB

.data
Size: 4KB - Virtual size: 219KB

.pdata
Size: 14KB - Virtual size: 14KB

_RDATA
Size: 512B - Virtual size: 512B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

6b:cc:cf:c4:a1:40:d1:5f:d1:1b:a9:9d:34:fe:f5:4e:52:d1:5f:26:73:50:f2:63:61:18:e1:c6:1a:14:8c:28
Signer

.text
Size: 360KB - Virtual size: 360KB

.rdata
Size: 204KB - Virtual size: 203KB

.data
Size: 3KB - Virtual size: 113KB

.pdata
Size: 16KB - Virtual size: 15KB

_RDATA
Size: 512B - Virtual size: 512B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB

33:00:00:03:ae:2d:35:51:c8:53:8f:55:1d:00:00:00:00:03:ae
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

c7:9a:57:aa:3f:34:2f:98:6d:61:a2:88:27:1d:5c:04:2f:da:c5:22:4e:89:f3:c0:4e:7e:8d:d9:7b:86:1e:20
Signer