Grabbers-Deobfuscator-main (1).zip
- SHA256 2214c790ed777d980cf509d7c903912266c345f34751c177507cccf2dfe92dc9
Behavioral task
behavioral1
Sample
Grabbers-Deobfuscator-main (1).zip
Resource
win10v2004-20240611-en
windows10-2004-x64
22 signatures
300 seconds
General
- Target Grabbers-Deobfuscator-main (1).zip
- Size 26.5MB
- Sample240617-va915awcph
- SHA256 2214c790ed777d980cf509d7c903912266c345f34751c177507cccf2dfe92dc9
- MD5 688d08a33882561e981fbb2bcec83d80
- SHA1 0c87866cb0f6c028e911c202dc7ab064cc74e1d1
- SHA512 93d7142184e8471ad26f4e2089862ce4cecce901abf5d34d2641ad0db9aeac7e2f0858b91feec0c4d90f772a7265487183fc54da8456611ac0a6504f976563ec
- SSDEEP 786432:CS5IlXgR4ZiXJbBHjXLmh4Eie+eYUgQPL:C9CJbJr04Eie+dPQPL
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Empyrean stealer 1 IoCs
resource yara_rule static1/unpack002/main.pyc family_empyrean - Empyrean family
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack003/out.upx patched_upx -
resource yara_rule static1/unpack001/Grabbers-Deobfuscator-main/utils/bin/upx upx static1/unpack001/Grabbers-Deobfuscator-main/utils/bin/upx.exe upx - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Grabbers-Deobfuscator-main/Decompiler.exe pyinstaller - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/Grabbers-Deobfuscator-main/Decompiler.exe unpack001/Grabbers-Deobfuscator-main/utils/bin/pycdas.exe unpack001/Grabbers-Deobfuscator-main/utils/bin/pycdc.exe unpack001/Grabbers-Deobfuscator-main/utils/bin/upx.exe unpack003/out.upx
File Explorer
-
Grabbers-Deobfuscator-main (1).zip.zip 26.5MB
-
Grabbers-Deobfuscator-main/.gitignore92B
-
Grabbers-Deobfuscator-main/Decompiler.exe.exe 20.7MB
-
main.pyc7KB
-
Grabbers-Deobfuscator-main/README.md1KB
-
Grabbers-Deobfuscator-main/config.json1KB
-
Grabbers-Deobfuscator-main/deobf.py6KB
-
Grabbers-Deobfuscator-main/methods/ben.py647B
-
Grabbers-Deobfuscator-main/methods/blank.py2KB
-
Grabbers-Deobfuscator-main/methods/empyrean.py969B
-
Grabbers-Deobfuscator-main/methods/luna.py599B
-
Grabbers-Deobfuscator-main/methods/notobf.py784B
-
Grabbers-Deobfuscator-main/methods/other.py3KB
-
Grabbers-Deobfuscator-main/requirements.txt77B
-
Grabbers-Deobfuscator-main/tutorial.gif.gif 5.4MB
-
Grabbers-Deobfuscator-main/utils/bin/fernflower.jar.jar 690KB
-
Grabbers-Deobfuscator-main/utils/bin/pycdas.elf 2.0MB
-
Grabbers-Deobfuscator-main/utils/bin/pycdas.exe.exe 124KB
-
Grabbers-Deobfuscator-main/utils/bin/pycdc.elf 2.3MB
-
Grabbers-Deobfuscator-main/utils/bin/pycdc.exe.exe 248KB
-
Grabbers-Deobfuscator-main/utils/bin/upx.elf 548KB
-
Grabbers-Deobfuscator-main/utils/bin/upx.exe.exe 551KB
-
out.upx.exe 2.0MB
-
Grabbers-Deobfuscator-main/utils/config.py835B
-
Grabbers-Deobfuscator-main/utils/decompile.py1KB
-
Grabbers-Deobfuscator-main/utils/deobfuscation.py2KB
-
Grabbers-Deobfuscator-main/utils/display.py857B
-
Grabbers-Deobfuscator-main/utils/download.py1KB
-
Grabbers-Deobfuscator-main/utils/pyaes/__init__.py2KB
-
Grabbers-Deobfuscator-main/utils/pyaes/aes.py59KB
-
Grabbers-Deobfuscator-main/utils/pyaes/blockfeeder.py7KB
-
Grabbers-Deobfuscator-main/utils/pyaes/util.py2KB
-
Grabbers-Deobfuscator-main/utils/pyinstaller/extractors/pyinstxtractor.py16KB
-
Grabbers-Deobfuscator-main/utils/pyinstaller/extractors/pyinstxtractorng.py16KB
-
Grabbers-Deobfuscator-main/utils/pyinstaller/pyinstaller.py901B
-
Grabbers-Deobfuscator-main/utils/pyinstaller/pyinstallerExceptions.py98B
-
Grabbers-Deobfuscator-main/utils/telegram.py1KB
-
Grabbers-Deobfuscator-main/utils/webhookspammer.py1KB
Grabbers-Deobfuscator-main/.gitignore
- SHA256 e724b3544b6a8a96e2484967183e22a434155463695b47aea7ef8ec62f4af4c8
- MD5 802dc1572376eb4d1272fa75fe6143e3
- SHA1 917dbc38550bbd1ab9cd6f7af679cacc23802b8e
- SHA512 b7741927487d4b8eb2bfd8994ea5726d430f534b0009b47bc995bf9df9424cdb026ce27442204b87846e25c2c482cff95c1cc95b9bce05cd341be3ef69373abd
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/Decompiler.exe
- IMPHASH 1e92fd54d65284238a0e3b74b2715062
- SHA256 5081400753d079b40c0b6fafbe98b789398fb551b958e64de29b1f8446c18e0d
- MD5 961e546f8ba1003638dca33515a6348a
- SHA1 20be138d7dc3111fe60bd5133f3f3344a4e4f6d4
- SHA512 d1b7a18ff79e2fa356dad776847815a355275e83d5eb1a859d57eba55e776930f4a9af17485544e142106734aa03a04b050dfd06c8130dbf30a6798c849ec566
- SSDEEP 393216:7qPnLFXlrfh2Jp5qC3njkVQ8DOETgsvfGF+KgpogivkvE4JzXF6cuXm:OPLFXNfh50sQhEOQtilIkg
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
44960
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetCPInfo
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=29395,
count=190, id=261, version=29395,
count=10, id=260, version=29395,
count=4, id=253, version=30818,
count=40, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=17, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=9, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=11, id=257, version=29395,
count=139, id=1, productName=Unmarked objects,
count=20, id=260, version=31328,
count=1, id=258, version=31328,
main.pyc
- SHA256 5ea7fdfe2ecc7d01302e3ffbfe341aa679746109bbd8dc08bcfad71fa8912cbb
- MD5 a73be20c60519000ede4030cb0507698
- SHA1 68f7155e3314f9c0e469bed242ecea9a20a20863
- SHA512 0bc49d00c20a174a50423104ee0d406292ac9b006adff7728e5c464b8b073659766128e817ae94042909e419e0481f8588d0cf7b66df2005a907e17d5464c180
- SSDEEP 192:wUhe5xD88ueWdXwuDcxWkUJhw2t4yMdwdSnw:/gpWuu49I2GPYw
- MD5 SHA1 SHA512 SSDEEP
-
Detects Empyrean stealer
Grabbers-Deobfuscator-main/README.md
- SHA256 84c01a52c699ede570de8a1f103a16d18dad17b4f15eab38ec1092ee3d47d09e
- MD5 c36b38bcd14f5cb192cc68072e6d9441
- SHA1 8fa5eab375fc3017cf65c3c537352c2cde9a243e
- SHA512 cc533ae4a974cac749abe8c432271bfe5241ad3d184cfff5579d8e45c169bff16549ce846a8d587a878fc868d98dd47ebcd1a9ddd514a67fd4d8280823d79ade
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/config.json
- SHA256 49ea2cc9493fa469a4295a4acd6146a269e24348d617675dfb365514ba3cc394
- MD5 07be80c852d43079699113c9324bb578
- SHA1 7270128e32fa393c15148c1e9efd04067b701342
- SHA512 e06be89f93e3e7f3c6776a7d4c661a2dd501304ce48a162571ac1ea3cd9a20d0a7817b8ed999ebd5fc3828c85b82138a452cceb5ecc875033b01dc473ba61fb6
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/deobf.py
- SHA256 46614ff3690379626ab3109954d753d98fd750e4fd1d785172c1a82276ad5f85
- MD5 6b4b50783ef2c9d21751cd38bd9b3bf0
- SHA1 e400e78d11663a368d9852ccf4f1fcfda3296f17
- SHA512 8d00d3a31534a30b588ca932b89b24d64ec8e6c5d853f6f3dfc3dc39634c507b24411cd870aaf96d2b403f12f72508af587b38560f5745f1f913ca3aefd264e3
- SSDEEP 96:MbzxTlCdC+JU8H7s6pd9rng/mpVt/NSMA8RixUb8RisEP5fAoKqRqhp9:MhZ8bvBgmpHTrBsRqRip9
- MD5 SHA1 SHA512 SSDEEP
Grabbers-Deobfuscator-main/methods/ben.py
- SHA256 c28e4ff38d046e64af3d89d8db3eba4823b09b8223208929afae31d8c68dd6ae
- MD5 04915dc08e2aa81160cf532b7d3f940b
- SHA1 95c0f9a41b48028e8c1f6a10de6805b6829cadcc
- SHA512 94ec68fe8b2365443aedcea869d6f059b48b53acd919eca58d1fe5933914112444eb2571adf3bfb1d3f5899d341ea5a7b60531b1c94fc6eef21ac4712e1a1e96
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/methods/blank.py
- SHA256 e831ea73ec311352b6ef5a0de295771b2dd84147a450d64f40dcf620fa9386e8
- MD5 a9eec0c273d5c9add43b72745c3bc715
- SHA1 0345bf98fdd5282491936d7bcb77e8de890d373d
- SHA512 3ea5ab3c836eea288e501c09923650ac22b9f8750d674eb6957b52472181f393c5a74eb6ba33fb90aae2f0272fd6a346d68f6904a1c86208605624b2383d91eb
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/methods/empyrean.py
- SHA256 ea28f330301a9cbf0742c6aa3abe503d7cf773a073fa8d693b0a390754f0e1b8
- MD5 68c486c90545f3d750a6600fca3a9998
- SHA1 a09f37c175a5c5a80f0ca7a802d073050666a887
- SHA512 14dbc5067f7b84a043accba6e152a7ae62cee11e9945687522b008985b464f980619c79f7d184ee317e23bc7ab2ab36748f1abe6d9bf698d9a11d860a2ef1e2c
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/methods/luna.py
- SHA256 99ebd4549a057dc88070579456d1815d7c954cc4a200ed6fd43bff542118981f
- MD5 dabcbb5288a4cd2e6bd4502149cc47ca
- SHA1 b904848c1566d9e129f6eda7bd5860e52e988845
- SHA512 404528b996d0452738115155332746e6d60860d70e1a2c6262ae4459941c14dd809dc927c30cf520dd5f3c35d3aaad3c058dd6433a4a6ee8e99657e01a80608d
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/methods/notobf.py
- SHA256 a054a1a2c2329dfc8078ccae527dbc259396765754b0a09e88cdaff60cb89fba
- MD5 2677e35326ef5d285a346c5785b49b85
- SHA1 2df409f57f9768f03fdc1f86c23f3466822836ba
- SHA512 27c2852936c7f1ad81c51db097584effd68a910ecebda5d2e51a2dc947d5c5b650955aaeecc2d35d48083b478de6b3394f830b98e408077b997f06ed9bb0f647
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/methods/other.py
- SHA256 3c0f0714975cb012aed71ae396f038f2fa2f4a289825fe5e3c009f7693f01115
- MD5 3c81db58e15d886a0ac087048fd4eafb
- SHA1 22194979825e8e97c4daa2f561ca66dfad75d9df
- SHA512 949b5720fef68dfc90f7cf952252e9f70fe6beab2e0087cbcb41c001c4d09c1a369a157ce8f0ea63f6eff3855b7b325b40e4ca125cc5595df8ef84705842a972
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/requirements.txt
- SHA256 77a588a4a077a11bdc2437788fe890124e3a44651b178744bfcb36b9318ee956
- MD5 4e0914ea3584fea2aa56cd7af4b47e54
- SHA1 371dc0478fe7009fa4eb51519e4ad33545dea43f
- SHA512 30f4fe664c21762035627d65a6492fe817adb6b684b9a599df0dd07205ad95bde2ac9736a360540f339455221268e5aa82977c212b42825b93f34cb2982637d0
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/tutorial.gif
- SHA256 a5c5cba7e7bc708e6666f702399c1da349730cf1057fae424ae547eee8468e16
- MD5 5f0d866bbe33c89e20c65c8550cf1e0a
- SHA1 1225369d978e079633e32d14109312faef165677
- SHA512 a077957e18a3325907e609c21b5321f412b532069724915061534d50d6faaaea0c3aada86ea07ada9f06bfe404968d84d0fd897962e2b6b0d5b5341d212e58fb
- SSDEEP 49152:qBtH37m9CpZ9cjfjD+YkuVUEiRqfR8lrIumNnrJW6i3/FZAETeHs2MOC23JqyOB:YtLm9MujfOAecPHT/956
- MD5 SHA1 SHA512 SSDEEP
Grabbers-Deobfuscator-main/utils/bin/fernflower.jar
- SHA256 74b609647d74e4ce04e9beef230a7460e74de03bf41703f961bbe704d4938b8f
- MD5 be01dbc47a455dddfc724d5efe13b490
- SHA1 0d96a3b0cb32a0e70cc563a2dcdcea5ef61d45b5
- SHA512 4ee6e1b935bc428e16103485da5440ae5b968334f023c7872247d52f1d0c000f8f49bc9101e955999c0338c88d34392f14eff2143c167675f7f5888a0be91094
- SSDEEP 12288:lSBknFucLVNrGJASNYa5k3qIhOhsioN46D2xFGDwHyhfsYFY5D/:lUcLVNEA0N5kaVhBjGDdhkYUD
- MD5 SHA1 SHA512 SSDEEP
Grabbers-Deobfuscator-main/utils/bin/pycdas
- SHA256 24d64b99f88ce539ababf41503c33793110eca52d90bb25d5d9f8382fb96f040
- MD5 d1be2de3bdbb4fdb92e082e08aca4cbe
- SHA1 aebe16ddc04bd813a9ab207fb4c03a214cb65bff
- SHA512 708266641de9aea2f0f851c1ad94bda18502db6d3eaa2a0831a7a0ad8d9577e1401d16939a7fb1b326b49a32e42d2ecb9722ca797bfe73681a133aff47571d21
- SSDEEP 24576:AI3vfom++IihitiE1mPslvOTJPtCcTyxoVU1g+pxtXL:AI3vgwi4E1mUlvOTHCc4oa1j
- MD5 SHA1 SHA512 SSDEEP
Grabbers-Deobfuscator-main/utils/bin/pycdas.exe
- IMPHASH a0b986748fb3b79f1afa27913520271f
- SHA256 52370a2d59198239421954e1cb46284218d3c8ba70a1c161d2b5ab1cc7ed4d96
- MD5 c106613cf4fc594260ced59577936bfa
- SHA1 8a16fdacd947e6a8fedebde1c1eaf2ff899c6f37
- SHA512 55d24e2babed9fc81c53ca452d720911628001a9da24b156cc2560b0b8c3461058fd90da5ca0bbfd36c6fb4f985887535aad18a4bf7d9b199b2afdb32ddd4247
- SSDEEP 1536:PAXQ0AJO9eYJpPPuPZgkP8MqzjWdwsa8XKIilFRvrfS1l+YlDlT:41B9eYJpHuj8Mqz6dZv6IilFhYl+YD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
87212
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcp140
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?width@ios_base@std@@QEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flags@ios_base@std@@QEBAHXZ
?fail@ios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QEAA@XZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
??0_Lockit@std@@QEAA@H@Z
vcruntime140
__std_exception_destroy
_CxxThrowException
__RTDynamicCast
memchr
__current_exception
memcpy
memmove
_purecall
memset
memcmp
__C_specific_handler
strrchr
__std_terminate
__std_exception_copy
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_seh_filter_exe
_configure_narrow_argv
_exit
_initterm
_get_initial_narrow_environment
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
exit
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_errno
terminate
_initterm_e
api-ms-win-crt-stdio-l1-1-0
_fseeki64
__p__commode
fsetpos
_set_fmode
fwrite
__stdio_common_vsprintf_s
fread
fputs
fputc
fgetpos
fgetc
fflush
fclose
__acrt_iob_func
__stdio_common_vsprintf
fopen
setvbuf
__stdio_common_vfprintf
ungetc
_get_stream_buffer_pointers
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dsign
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
malloc
_callnewh
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
kernel32
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=33030,
count=3, id=259, version=33030,
count=27, id=261, version=33030,
count=7, id=257, version=33030,
count=2, id=257, version=30795,
count=143, id=1, productName=Unmarked objects,
count=36, id=261, version=33134,
count=1, id=255, version=33134,
count=1, id=258, version=33134,
Grabbers-Deobfuscator-main/utils/bin/pycdc
- SHA256 f7dbc7f92b2660608e3f75301215148760c8d85669c3b1775a842a32cf35d9f4
- MD5 dca8a4f7d9a8a1571ff7878e4b7b83fa
- SHA1 50d05e2cdaa0acc8cb8639f893e7132c66840d0d
- SHA512 04cb648807051d336d1c9d31d6cb07d7c9e97ebf6cde5d282db9e4f6ce42c1e78f624e68525159995e6c173f93d80822bd2eef08d383520cb882083ee46f719f
- SSDEEP 24576:0L6jwuRE/ASaaVzD9dfAukg1YkH0TAK+w5VT+3MpvMgiKLGvVI:0L6kKOxD9dfNkg1YNTAKx5Va8pvMgc
- MD5 SHA1 SHA512 SSDEEP
Grabbers-Deobfuscator-main/utils/bin/pycdc.exe
- IMPHASH 8933a45a4654b688012d7770158aef33
- SHA256 fc5a1007f29b7304e91fce22c036c3dc39134ed3b89ba76e3aaa02bc45beb76c
- MD5 0ad8ae7adb1223e4c02b977cfd024bb1
- SHA1 0794e82385e836dab7e16d0f2ca28aafeb489bf6
- SHA512 93c3af8c13459e67e1946dff346920916ff200566706b36eb41332125fc0a9454c4175f483683a4b0e99520c294eea6b061eb48e9d31c0870ec65dbeab9b5f07
- SSDEEP 6144:qGS8eDxDYUBqfN1l8nRRhJXbnPD+sHlc:qDfDtBqfR8RtbJH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
181984
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcp140
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?width@ios_base@std@@QEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?flags@ios_base@std@@QEBAHXZ
?fail@ios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0_Lockit@std@@QEAA@H@Z
vcruntime140
__std_exception_destroy
_CxxThrowException
memchr
memcpy
__current_exception
memmove
_purecall
__RTDynamicCast
memcmp
memset
__C_specific_handler
strrchr
__std_terminate
__std_exception_copy
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_seh_filter_exe
_configure_narrow_argv
_exit
_initterm
_get_initial_narrow_environment
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
exit
_errno
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_invalid_parameter_noinfo_noreturn
terminate
_initterm_e
api-ms-win-crt-stdio-l1-1-0
fsetpos
__p__commode
fread
_set_fmode
_fseeki64
__stdio_common_vsprintf_s
fputs
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vsprintf
fopen
fwrite
__stdio_common_vfprintf
ungetc
setvbuf
__acrt_iob_func
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dsign
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
malloc
_callnewh
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
kernel32
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
Name
.text
Size
189KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=33030,
count=4, id=259, version=33030,
count=27, id=261, version=33030,
count=7, id=257, version=33030,
count=2, id=257, version=30795,
count=144, id=1, productName=Unmarked objects,
count=38, id=261, version=33134,
count=1, id=255, version=33134,
count=1, id=258, version=33134,
Grabbers-Deobfuscator-main/utils/bin/upx
- SHA256 1dbdeb502fc80807af72560b0c361fd073c714fb68d429dfedf83597d36db2f3
- MD5 59e0bfa3352db08097a9f62c51934192
- SHA1 be017e943ab0bbf4c4e6b655b8648ff124550d44
- SHA512 23c0303a9dd12f0066c13f122760d7495d783690207d14c288f3babbc5670d8d6c3bf1149cd07694e15eb757152ecf9ca152b193832e6427dabb0de65fd76d41
- SSDEEP 12288:bkuvAY7aDFiQDq7+EKyxGOxadM/RxyMAYhMOPNMQNYgmiJDlxupZqS/5m:dNa5O7WjkxyMrMO3YgmG0pY/
- MD5 SHA1 SHA512 SSDEEP
Grabbers-Deobfuscator-main/utils/bin/upx.exe
- SHA256 902e597a5eb89f345901280eb396394146b3937d4c84b880e8ee1300c901ec9b
- MD5 90391271aa0ca4d340c6c78d5426cea3
- SHA1 c6bc571809512e5a9afd909790ec37fb6fc7bc59
- SHA512 b6599cd7de6e4eb18b724670bd26f1566a52999fe2171224f330512ee8bebcd4d4e74845293f32a22ad998957655a2982b8bae183a8171e77789afce678214ae
- SSDEEP 12288:F6sMe2eOno9jftrZ4X52zGt1wnp5/euBAKPLdmDoDnavsu+Xoi5ZW6q:Msie6STtFC8G1wfZBAaLdVavsfXoa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2182608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
548KB
Virtual Size
552KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 16825fa627579886bf34c48f4e4d0e833b9497e9e50152e349073db90b1df2ae
- MD5 fb27b0502cde2509e324a2051b7b4cef
- SHA1 ea44651a1a35dd65abb637cf3e315a91f4c65885
- SHA512 cbc17a1a5afa00fb354871415af07b890e60e9b92f66943b154d751917aa919c9035fbb1270645b658908730ab822ad9bfecab16305d089cc5a933bc68891b1b
- SSDEEP 24576:tbwKyQRY2e5aef0gqvxjk5l4wpYMDfZYAOmPaOy0OHtigZwl2:iKyQ8Tftf4iYMDfZYAPrO
- MD5 SHA1 SHA512 SSDEEP
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
891KB
Virtual Size
890KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Grabbers-Deobfuscator-main/utils/config.py
- SHA256 ca78c3213eaa61d1a1773428b47ebc753831a61c946356d3ce3b0f3ab02721bd
- MD5 96f8034a7e38860d79c01d7933ee1a87
- SHA1 bcaf6f3a8ad007fb11d579e02ffec38e80e364b9
- SHA512 f766869cc75ac6a05c22ec601018af51f93b07b1e82f99e67c7623fe648ad900c539f7204d50a0a815c482657d052d08bb9235a73d71b72a46a39ed0cc2450f0
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/utils/decompile.py
- SHA256 f198bbeb7807aae1db733ba5ba3b8bc9503843fafba755faf3685b65f9984944
- MD5 b1b5f2eb1a2392805b196ce35e178e5a
- SHA1 310826373be640f736aa807ee040758cb5a4d40c
- SHA512 4079441e0458c267821af5047532a11f86fc86d26d0d965067ac2a0860ce2f86cce8a37d38c53f4cb39370dd4a6e8f90a3313826751e13794f39406f9d63c039
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/utils/deobfuscation.py
- SHA256 74db49437d60d5cbb6299c02c42bb496dd65a2b3f0b9fc51c2cebb54d9177ccb
- MD5 1c8aa7595dfdeb287c7dd57e7a67b71a
- SHA1 f724297b4405e425bbe0888a6ebf3be3b99ded70
- SHA512 8f23e1bb13654f8588b6d3700ef469ea141d4a4abaa76005e941ee1c8dbc75425c7e6880248964b88f3c94d4714f62cf623ca01869d03fcec52b78f3b4ddb67a
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/utils/display.py
- SHA256 65acca473c564fba4227c60542b2e68f7e2959159b3a1a49297924ad85819b26
- MD5 395770ff948cf733940f3efc9fbd4c49
- SHA1 8abf4551b1775e646bebc39df3ea928af317b590
- SHA512 bf4d6609bce08df6d90c80d3c173d12b09dabc424dd89bbbf464a6e7b3f2737e762711f80fe83e94342bea79e8cdce72379fc704c32b9e45830258904a4fc304
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/utils/download.py
- SHA256 7e89b18361246e2f94c1e396408ca1ff52d9084249aa99c7f87f4fb7420ca9bc
- MD5 76119a3eaa53cde358a1b959a59ba9de
- SHA1 831383cd63e871bdfa3dccd83b83847087c0868b
- SHA512 8ab88759bcf611c7f2797997dfb0f3da3793d591d63122a2f069eea82f677b3f4fefa2e3ae2088cf1e30f80007d9d859f4a73b43c3cbf8a62552c2b251090821
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/utils/pyaes/__init__.py
- SHA256 9611b462af27328c438e30fafd41e5495d1d2068ad2f7695c77e036129aa4ce7
- MD5 cb72cd7c418b4b68f8df730511d533a5
- SHA1 1a957bc18ca931ae21decb28737d261e8fb21ebd
- SHA512 dba71841bd8f979193a76cfee3793fa5b136613dfdcc9ca6fe8dd34d3958464746ba420547a5a1df226e43255d83490817a4a95cb2650bf934acf1d104ff60c7
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/utils/pyaes/aes.py
- SHA256 c5bb1897d2a63f726f7b89c584fc7aa0a914445e889d274c8c0b5e2b6630f2bc
- MD5 37807d25dc68ee66ca7afdc9415d02be
- SHA1 0d927d80e6701a034eca2618d5871292fdee5c89
- SHA512 0a820d2a5ad7c39ccb77e41a9b6be23140010bae72fdc35f5d6b2fa8a5a3d7ad7acb0630a351f4d54f7d3d4344a538650c6e8ba89db5fec2b9f4b0de4f911e52
- SSDEEP 1536:4hcZZK94DPuI8Ltsq6LzSJ8Ns56/QFWR3Gz/1P:ecZZK9yPuI8+2JYd/Qj
- MD5 SHA1 SHA512 SSDEEP
Grabbers-Deobfuscator-main/utils/pyaes/blockfeeder.py
- SHA256 34c550f66d284b4c2866f17130d646bf6c3fc2bf2806203268865782e12e0e44
- MD5 f527c7e232efe70605eacfcf187a1abe
- SHA1 04f8d66117f41d63ac53173659a5ceae32e88541
- SHA512 81d33f8de1c4d67b909a088ebe29bf9310d1b00b93277ea46e9af6b297e95686ba973c8d416436c74dbf1a8a11c6fedfc354c217203e5cc8ce5d36c96f0b409c
- SSDEEP 192:dQHWSmmjOeBQb2++79AAv5ln5hfLmL2DdzAfnrE7g8:djSmm1QbH+79Haq0frE08
- MD5 SHA1 SHA512 SSDEEP
Grabbers-Deobfuscator-main/utils/pyaes/util.py
- SHA256 b632d6ad0990972eb0969ec1551e8d302baf241476864f86112e40353f02c52f
- MD5 a6af659a56f78294f5f663b38bd150ab
- SHA1 4cc6c17a12ba13dc1bb1ec3dcf70ef21dfae269e
- SHA512 8b881c16e150b350e8caeb6f0f15656c943fd24ae05c9422dafe2d2c36f40e48be8f55c46f7dd6d7735acc4f80de61716e69ed5c47f0dea63c6d224c23d3a986
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/utils/pyinstaller/extractors/pyinstxtractor.py
- SHA256 964098032616c2927eb1214b08c8c065a947fc44d345de47e27a652ba61a3427
- MD5 1c921977023de5c687a4bc7e649bb8a5
- SHA1 e4d287135531648f8f299cd8fe33358c0049d949
- SHA512 cf98e79cf769153fcae513fc549ce8e771f590c483397cb968694465a49bcb4ed75459708dbc3c18bdaf4a302040ae3aef24de31bdd7be881cc5b64e7bb54531
- SSDEEP 192:igOmCh5qHR93qLp0N2Vf4bun7juQYMGq9cZXBknkevPSQ541jBFW2lKHh8rzxP:igIjqxELpDVf4bunotQ541nW2KMzR
- MD5 SHA1 SHA512 SSDEEP
Grabbers-Deobfuscator-main/utils/pyinstaller/extractors/pyinstxtractorng.py
- SHA256 dbf0d95d496a49583b54ca76dd45062db8aadee34f196582d6ef25a886eea3d4
- MD5 622d98c5ddb8336a860b48d1180abd7c
- SHA1 dbec45596ebc6febd70b9ffaf19583ef9e4c66f7
- SHA512 6549be215fa4395e31115c55592f17e16006610a503ca0b44087daf57c88267c8f56662136f8a3b0a8523e1e118d5f8e0e92164bec5d21b11e92dab08bc87322
- SSDEEP 192:cgOsMnz+lVnGQbq7n6bXuQYOA8KDX5GIoCwvPjUsnx1jq1iLlK3QGixBp2WP:cg1Mn4VGQbqWomUEjq12KgxGo
- MD5 SHA1 SHA512 SSDEEP
Grabbers-Deobfuscator-main/utils/pyinstaller/pyinstaller.py
- SHA256 ae66de3c2819e729de248b028e62ab0f9ed5bf0466b683c51b94f55c1d74fd4f
- MD5 97b8f67fc716e9578ab24fbf58474905
- SHA1 980462b702b120233a15d385155d8f8d2e967c95
- SHA512 329bd9072896bf44a32597abd6716486c18551bc8057079887cd7620bd31a34654f1e86c9892b1deee6161bff42fe0725787ddbe393135023133157a7bce4616
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/utils/pyinstaller/pyinstallerExceptions.py
- SHA256 619d874c150e9bebcef2edd657f78b7459a79277ce7f37679ccb156f38e5b58b
- MD5 e73c379c3ed94b367d9514551b7fa4ed
- SHA1 69b0ed89af01e3d72f9ccac50a9989939c46aa26
- SHA512 a218db7a1aae9eac6bd6cd3c4afe50bf4a7cb59c7b98fd2218a287068a260ed4e6dbeb4107672a2e252a12c8af7ea696751a4fa1ccfb047ec221282295eae8b4
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/utils/telegram.py
- SHA256 1b599fc188a0fa7c74f811e2ae726bdd853dfdc35031eef07b5fe4dbc9b0d0e0
- MD5 798c472339a5f076bd4bd8f7ef3ffd17
- SHA1 9f367781caa19688b0d0a00fc8adb297522b24dd
- SHA512 11a688ec950bdbafe3dcd1ba23b0565bcaf29a88acd6cecd15a14d0208e32fd34c5d23d2ef02a769f64cfcc6d5fcebc2a7a1524669955499547090c2c402e50e
- MD5 SHA1 SHA512
Grabbers-Deobfuscator-main/utils/webhookspammer.py
- SHA256 5d5a450a7dd92d10c759b061f71972c36fe0cb7906ce0a473b92562be243b207
- MD5 6af4ea75e548347d93ed6cdd31a1cc4e
- SHA1 6a76b9a6e37f6109e2d7cbb1e55f59f167fb930a
- SHA512 d2a48700589c63b8bd81a6d72ba5310154faef08e2889f3e3767502f6ed6bf1486ca8e88e60c4fbfe6293bb13bfc5c0ea8916dec7a99fbdfb591246f277dbec7
- MD5 SHA1 SHA512