C:\Users\jjangli\Documents\GitHub\AlphaFS\AlphaFS\obj\Net452\AlphaFS.pdb
Behavioral task
behavioral1
Sample
BLTools 2.9.1 Pro Cracked.rar
Resource
win11-20240419-en
General
-
Target
BLTools 2.9.1 Pro Cracked.rar
-
Size
9.3MB
-
MD5
08c2e0dc2399640e14b71a889b6ef0f4
-
SHA1
1e335cf1f51c3eb505e10c5fc18bf37f5fcd0f87
-
SHA256
3d5cd526c037a33bddd8dfea8d715dad47a0a0c19eb3e858b3ee575213a90644
-
SHA512
ded21a97bef79f699013a8929aa5b4af15b6a9fc8b38eeb006fe0fbed3801ab5de1a251fc6015b9da63d244a5308dc9983ba5214d0e5a7e6e1867a35dcba5ced
-
SSDEEP
196608:NydnqyFY0mCD/29Nv60BuJMlOcOn6x37eU9Z+qEVQnVRsuc0dfz+n:g3mCDuPv60cMBOn6p7iqqcRsuc0Rz+n
Malware Config
Signatures
-
resource yara_rule static1/unpack001/BLTools 2.9.1 Pro Cracked/CookiesCreator.exe themida -
Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/BLTools 2.9.1 Pro Cracked/AlphaFS.dll unpack001/BLTools 2.9.1 Pro Cracked/BLTools v2.9.1 Pro.exe unpack001/BLTools 2.9.1 Pro Cracked/CookiesCreator.exe unpack001/BLTools 2.9.1 Pro Cracked/Extreme.Net.dll unpack001/BLTools 2.9.1 Pro Cracked/FA12BB8C.dll unpack001/BLTools 2.9.1 Pro Cracked/MaterialDesignColors.dll unpack001/BLTools 2.9.1 Pro Cracked/MaterialDesignThemes.Wpf.dll unpack001/BLTools 2.9.1 Pro Cracked/Ookii.Dialogs.Wpf.dll
Files
-
BLTools 2.9.1 Pro Cracked.rar.rar
Password: 123
-
BLTools 2.9.1 Pro Cracked/AlphaFS.dll.dll windows:4 windows x86 arch:x86
Password: 123
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 356KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 2.9.1 Pro Cracked/BLTools v2.9.1 Pro.exe.exe windows:4 windows x86 arch:x86
Password: 123
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 908B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 2.9.1 Pro Cracked/CookiesCreator.exe.exe windows:4 windows x86 arch:x86
Password: 123
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 39KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 13KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
BLTools 2.9.1 Pro Cracked/Extreme.Net.dll.dll windows:4 windows x86 arch:x86
Password: 123
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\scarf\source\repos\Extreme.Net\obj\Debug\Extreme.Net.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 2.9.1 Pro Cracked/FA12BB8C.dll.dll windows:4 windows x86 arch:x86
Password: 123
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 2.9.1 Pro Cracked/License.dll
-
BLTools 2.9.1 Pro Cracked/MaterialDesignColors.dll.dll windows:4 windows x86 arch:x86
Password: 123
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net462\MaterialDesignColors.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 293KB - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 2.9.1 Pro Cracked/MaterialDesignThemes.Wpf.dll.dll windows:4 windows x86 arch:x86
Password: 123
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net462\MaterialDesignThemes.Wpf.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 2.9.1 Pro Cracked/Microsoft.Xaml.Behaviors.dll.dll windows:4 windows x86 arch:x86
Password: 123
dae02f32a21e03ce65412f6e56942daa
Code Sign
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4eCertificate
IssuerCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/03/2023, 18:43Not After14/03/2024, 18:43SubjectCN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:0e:90:d2:00:00:00:00:00:03Certificate
IssuerCN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before08/07/2011, 20:59Not After08/07/2026, 21:09SubjectCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
b2:63:8a:cb:ae:08:38:57:4d:ee:95:eb:a6:58:3b:10:80:3d:86:3e:1c:8f:0d:12:62:f5:87:f8:01:ae:17:30Signer
Actual PE Digestb2:63:8a:cb:ae:08:38:57:4d:ee:95:eb:a6:58:3b:10:80:3d:86:3e:1c:8f:0d:12:62:f5:87:f8:01:ae:17:30Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\a\_work\1\s\src\Microsoft.Xaml.Behaviors\obj\Release\net462\Microsoft.Xaml.Behaviors.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 130KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 2.9.1 Pro Cracked/Ookii.Dialogs.Wpf.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\a\ookii-dialogs-wpf\ookii-dialogs-wpf\src\Ookii.Dialogs.Wpf\obj\Release\net462\Ookii.Dialogs.Wpf.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 2.9.1 Pro Cracked/Projects/2dehands.be.proj
-
BLTools 2.9.1 Pro Cracked/Projects/2ememain.be.proj
-
BLTools 2.9.1 Pro Cracked/Projects/Ebay.proj
-
BLTools 2.9.1 Pro Cracked/Projects/Etsy.proj
-
BLTools 2.9.1 Pro Cracked/Projects/GitHub.proj
-
BLTools 2.9.1 Pro Cracked/Projects/Godaddy.proj
-
BLTools 2.9.1 Pro Cracked/Projects/KLEINANZEIGEN.proj
-
BLTools 2.9.1 Pro Cracked/Projects/Microsoft365.proj
-
BLTools 2.9.1 Pro Cracked/Projects/Namecheap.proj
-
BLTools 2.9.1 Pro Cracked/Projects/Office365.proj
-
BLTools 2.9.1 Pro Cracked/Projects/Willhaben.proj
-
BLTools 2.9.1 Pro Cracked/Projects/capmonster.cloud.proj
-
BLTools 2.9.1 Pro Cracked/Projects/carousell_MY.proj
-
BLTools 2.9.1 Pro Cracked/Projects/carousell_SG.proj
-
BLTools 2.9.1 Pro Cracked/Projects/dba.dk.proj
-
BLTools 2.9.1 Pro Cracked/Projects/finn.no.proj
-
BLTools 2.9.1 Pro Cracked/Projects/marktplaats.nl.proj
-
BLTools 2.9.1 Pro Cracked/Projects/nebenan.de.proj
-
BLTools 2.9.1 Pro Cracked/Projects/njuskalo.hr.proj
-
BLTools 2.9.1 Pro Cracked/Projects/otto.de.proj
-
BLTools 2.9.1 Pro Cracked/Projects/poshmark.com.proj
-
BLTools 2.9.1 Pro Cracked/Projects/rucaptcha.com.proj
-
BLTools 2.9.1 Pro Cracked/Projects/shpock.com.proj
-
BLTools 2.9.1 Pro Cracked/Projects/subito.it.proj
-
BLTools 2.9.1 Pro Cracked/Projects/tori.fi.proj
-
BLTools 2.9.1 Pro Cracked/Projects/zalando.de2.proj
-
BLTools 2.9.1 Pro Cracked/Settings.ini