goodbyedpi-0[.]2[.]2[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

goodbyedpi-0.2.2.zip
Size

595KB
MD5

d94dfb71d33f2762fa9dda9bee1751cf
SHA1

0a2a74d9de260c37e905e7ed87c5d756c1fa2868
SHA256

0a4c3a2c66f1ab9535a3dcb3ff2034e2f22bb464a33cca6adb65c3335bce8ba1
SHA512

bb6a65d36fe2952a0d7fbd5ca7c80238df2413ffe59dd4fa2c60758e1f048acf04f9326c9fb0b8f13da0bf66466a9e8b5a34c77f07a28dd6aa5f3a00f9fb9670
SSDEEP

12288:A+oTmZ/AUfOtCIf/2TmUGi0Tywa/cLNcWH1UE0/wnqQkA8VmdXqAz7IehA9nxGs:ATmZ8F+Tm9iGclEFqQkBu6G7RA9nxGs

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/goodbyedpi-0.2.2/x86/WinDivert.dll
unpack001/goodbyedpi-0.2.2/x86/goodbyedpi.exe
unpack001/goodbyedpi-0.2.2/x86_64/WinDivert.dll
unpack001/goodbyedpi-0.2.2/x86_64/goodbyedpi.exe

Files

goodbyedpi-0.2.2.zip
.zip
goodbyedpi-0.2.2/0_russia_update_blacklist_file.cmd
goodbyedpi-0.2.2/1_russia_blacklist.cmd
goodbyedpi-0.2.2/1_russia_blacklist_dnsredir.cmd
goodbyedpi-0.2.2/2_any_country.cmd
goodbyedpi-0.2.2/2_any_country_dnsredir.cmd
goodbyedpi-0.2.2/licenses/LICENSE-getline.txt
goodbyedpi-0.2.2/licenses/LICENSE-goodbyedpi.txt
goodbyedpi-0.2.2/licenses/LICENSE-uthash.txt
goodbyedpi-0.2.2/licenses/LICENSE-windivert.txt
goodbyedpi-0.2.2/russia-blacklist.txt
goodbyedpi-0.2.2/service_install_russia_blacklist.cmd
goodbyedpi-0.2.2/service_install_russia_blacklist_dnsredir.cmd
goodbyedpi-0.2.2/service_remove.cmd
goodbyedpi-0.2.2/x86/WinDivert.dll
.dll windows:4 windows x86 arch:x86

449da16269f8d6ce18260c222ccc7b7c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW

kernel32

CloseHandle
CreateEventW
CreateFileW
DeviceIoControl
GetCurrentProcess
GetLastError
GetModuleFileNameW
GetOverlappedResult
GetProcessHeap
HeapAlloc
HeapFree
IsWow64Process
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue

Exports

Exports

WinDivertClose
WinDivertDllEntry
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperCheckFilter
WinDivertHelperEvalFilter
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
goodbyedpi-0.2.2/x86/WinDivert32.sys
.sys windows:6 windows x86 arch:x86

fab8edc849a481b7ea3cf4fd768e421b

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:9e:36:c6:d4:6d:69:53:20:84:a1:45:3d:80:73:22
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/09/2017, 00:00

Not After

30/09/2020, 12:00

Subject

SERIALNUMBER=539 259 416 00029,CN=Ars Nova Systems,O=Ars Nova Systems,L=NANTES,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1f:98:00:c9:11:02:95:69:be:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/10/2017, 17:44

Not After

05/10/2018, 17:44

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c9:d1:0b:9c:1a:77:38:2e:be:04:3b:9c:09:c5:54:56:d0:17:4d:47:fa:ad:89:8e:4d:9c:03:14:f4:68:cf:70
Signer

Actual PE Digest

c9:d1:0b:9c:1a:77:38:2e:be:04:3b:9c:09:c5:54:56:d0:17:4d:47:fa:ad:89:8e:4d:9c:03:14:f4:68:cf:70

Digest Algorithm

sha256

PE Digest Matches

true

c9:d1:0b:9c:1a:77:38:2e:be:04:3b:9c:09:c5:54:56:d0:17:4d:47:fa:ad:89:8e:4d:9c:03:14:f4:68:cf:70
Signer

Actual PE Digest

c9:d1:0b:9c:1a:77:38:2e:be:04:3b:9c:09:c5:54:56:d0:17:4d:47:fa:ad:89:8e:4d:9c:03:14:f4:68:cf:70

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\windivert-1.4.0-rc\install\WDDK\i386\WinDivert32.pdb

Imports

ntoskrnl.exe

IoFreeMdl
memmove
MmBuildMdlForNonPagedPool
IoAllocateMdl
_allmul
ExUuidCreate
RtlGetVersion
_alldiv
RtlCopyUnicodeString
KeTickCount
KeBugCheckEx
memcpy
MmMapLockedPagesSpecifyCache
ExFreePoolWithTag
ExAllocatePoolWithTag
memset

hal

KeAcquireInStackQueuedSpinLock
KeQueryPerformanceCounter
KeReleaseInStackQueuedSpinLock

ndis.sys

NdisFreeNetBufferPool
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisAllocateNetBufferPool
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart

fwpkclnt.sys

FwpmTransactionAbort0
FwpsInjectionHandleCreate0
FwpmEngineOpen0
FwpsQueryPacketInjectionState0
FwpsAllocateNetBufferAndNetBufferList0
FwpsInjectForwardAsync0
FwpsInjectNetworkSendAsync0
FwpsInjectNetworkReceiveAsync0
FwpsCalloutRegister0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsFreeNetBufferList0
FwpmEngineClose0
FwpmTransactionCommit0
FwpmSubLayerDeleteByKey0
FwpmTransactionBegin0
FwpsInjectionHandleDestroy0
FwpmSubLayerAdd0
FwpsCalloutUnregisterByKey0
FwpmFilterDeleteByKey0
FwpmCalloutDeleteByKey0

wdfldr.sys

WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
goodbyedpi-0.2.2/x86/WinDivert64.sys
.sys windows:6 windows x64 arch:x64

7c9fea38756202fa53d3fb9ec37222c4

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:9e:36:c6:d4:6d:69:53:20:84:a1:45:3d:80:73:22
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/09/2017, 00:00

Not After

30/09/2020, 12:00

Subject

SERIALNUMBER=539 259 416 00029,CN=Ars Nova Systems,O=Ars Nova Systems,L=NANTES,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1f:98:00:c9:11:02:95:69:be:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/10/2017, 17:44

Not After

05/10/2018, 17:44

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:aa:b2:a7:3f:ee:0f:ad:dd:0b:b2:72:ef:60:5e:b4:e9:79:5d:3f:24:d7:4a:01:4c:6f:fc:03:c4:d3:dd:52
Signer

Actual PE Digest

14:aa:b2:a7:3f:ee:0f:ad:dd:0b:b2:72:ef:60:5e:b4:e9:79:5d:3f:24:d7:4a:01:4c:6f:fc:03:c4:d3:dd:52

Digest Algorithm

sha256

PE Digest Matches

true

14:aa:b2:a7:3f:ee:0f:ad:dd:0b:b2:72:ef:60:5e:b4:e9:79:5d:3f:24:d7:4a:01:4c:6f:fc:03:c4:d3:dd:52
Signer

Actual PE Digest

14:aa:b2:a7:3f:ee:0f:ad:dd:0b:b2:72:ef:60:5e:b4:e9:79:5d:3f:24:d7:4a:01:4c:6f:fc:03:c4:d3:dd:52

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\windivert-1.4.0-rc\install\WDDK\amd64\WinDivert64.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString
KeBugCheckEx
IoAllocateMdl
MmMapLockedPagesSpecifyCache
IoFreeMdl
MmBuildMdlForNonPagedPool
KeAcquireInStackQueuedSpinLock
RtlGetVersion
KeReleaseInStackQueuedSpinLock
ExFreePoolWithTag
ExUuidCreate
ExAllocatePoolWithTag

hal

KeQueryPerformanceCounter

ndis.sys

NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisFreeNetBufferPool
NdisGetDataBuffer
NdisAllocateNetBufferPool
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool

fwpkclnt.sys

FwpsQueryPacketInjectionState0
FwpmCalloutDeleteByKey0
FwpsInjectNetworkReceiveAsync0
FwpmSubLayerAdd0
FwpsCalloutUnregisterByKey0
FwpmSubLayerDeleteByKey0
FwpsInjectionHandleDestroy0
FwpsFreeNetBufferList0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmFilterAdd0
FwpmEngineOpen0
FwpmTransactionAbort0
FwpsCalloutRegister0
FwpsInjectForwardAsync0
FwpmFilterDeleteByKey0
FwpmCalloutAdd0
FwpsInjectNetworkSendAsync0
FwpmTransactionCommit0
FwpsInjectionHandleCreate0
FwpsAllocateNetBufferAndNetBufferList0

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 246B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
goodbyedpi-0.2.2/x86/goodbyedpi.exe
.exe windows:4 windows x86 arch:x86

104cf4780b09866b14058beddf435568

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

windivert

WinDivertClose
WinDivertHelperCalcChecksums
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertSend

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA

kernel32

DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
QueryPerformanceCounter
SetDllDirectoryA
SetSearchPathMode
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__getmainargs
__initenv
__lconv_init
__p___argv
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_exit
_initterm
_iob
_onexit
_vsnprintf
abort
atoi
calloc
exit
fclose
feof
fgetc
fopen
fprintf
fputc
free
fwrite
getenv
malloc
memcmp
memcpy
memmove
difftime
printf
puts
realloc
signal
sprintf
strchr
strcpy
strcspn
strlen
strncmp
strstr
strtok
strtoul
toupper
vfprintf
time
_write
_strdup
_open
_close

ws2_32

htonl
htons
inet_pton
ntohl
ntohs

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 55B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
goodbyedpi-0.2.2/x86_64/WinDivert.dll
.dll windows:4 windows x64 arch:x64

80270498a1041f39f009d05f85532359

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW

kernel32

CloseHandle
CreateEventW
CreateFileW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
GetProcessHeap
HeapAlloc
HeapFree
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue

Exports

Exports

WinDivertClose
WinDivertDllEntry
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperCheckFilter
WinDivertHelperEvalFilter
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
goodbyedpi-0.2.2/x86_64/goodbyedpi.exe
.exe windows:4 windows x64 arch:x64

1eed2f6b2180542cea71672810fd2aa6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

windivert

WinDivertClose
WinDivertHelperCalcChecksums
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertSend

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA

kernel32

DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetDllDirectoryA
SetSearchPathMode
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__C_specific_handler
__argv
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_difftime64
_exit
_fmode
_initterm
_onexit
_time64
_vsnprintf
abort
atoi
calloc
exit
fclose
feof
fgetc
fopen
fprintf
fputc
free
fwrite
getenv
malloc
memcmp
memcpy
memmove
printf
puts
realloc
signal
sprintf
strchr
strcpy
strcspn
strlen
strncmp
strstr
strtok
strtoul
toupper
vfprintf
_write
_strdup
_open
_close

ws2_32

htonl
htons
inet_pton
ntohl
ntohs

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 55B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

449da16269f8d6ce18260c222ccc7b7c

Headers

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 4KB - Virtual size: 4KB

.bss Size: - Virtual size: 8B

.edata Size: 1024B - Virtual size: 520B

.idata Size: 1024B - Virtual size: 788B

.reloc Size: 1024B - Virtual size: 856B

fab8edc849a481b7ea3cf4fd768e421b

Code Sign

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

09:9e:36:c6:d4:6d:69:53:20:84:a1:45:3d:80:73:22Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

33:00:00:00:1f:98:00:c9:11:02:95:69:be:00:00:00:00:00:1fCertificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

c9:d1:0b:9c:1a:77:38:2e:be:04:3b:9c:09:c5:54:56:d0:17:4d:47:fa:ad:89:8e:4d:9c:03:14:f4:68:cf:70Signer

c9:d1:0b:9c:1a:77:38:2e:be:04:3b:9c:09:c5:54:56:d0:17:4d:47:fa:ad:89:8e:4d:9c:03:14:f4:68:cf:70Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

ndis.sys

fwpkclnt.sys

wdfldr.sys

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 2KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

7c9fea38756202fa53d3fb9ec37222c4

Code Sign

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

09:9e:36:c6:d4:6d:69:53:20:84:a1:45:3d:80:73:22Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

33:00:00:00:1f:98:00:c9:11:02:95:69:be:00:00:00:00:00:1fCertificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

14:aa:b2:a7:3f:ee:0f:ad:dd:0b:b2:72:ef:60:5e:b4:e9:79:5d:3f:24:d7:4a:01:4c:6f:fc:03:c4:d3:dd:52Signer

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 4KB - Virtual size: 4KB

.bss
Size: - Virtual size: 8B

.edata
Size: 1024B - Virtual size: 520B

.idata
Size: 1024B - Virtual size: 788B

.reloc
Size: 1024B - Virtual size: 856B

61:20:4d:b4:00:00:00:00:00:27
Certificate

09:9e:36:c6:d4:6d:69:53:20:84:a1:45:3d:80:73:22
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

33:00:00:00:1f:98:00:c9:11:02:95:69:be:00:00:00:00:00:1f
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

c9:d1:0b:9c:1a:77:38:2e:be:04:3b:9c:09:c5:54:56:d0:17:4d:47:fa:ad:89:8e:4d:9c:03:14:f4:68:cf:70
Signer

c9:d1:0b:9c:1a:77:38:2e:be:04:3b:9c:09:c5:54:56:d0:17:4d:47:fa:ad:89:8e:4d:9c:03:14:f4:68:cf:70
Signer

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 2KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

61:20:4d:b4:00:00:00:00:00:27
Certificate

09:9e:36:c6:d4:6d:69:53:20:84:a1:45:3d:80:73:22
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

33:00:00:00:1f:98:00:c9:11:02:95:69:be:00:00:00:00:00:1f
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

14:aa:b2:a7:3f:ee:0f:ad:dd:0b:b2:72:ef:60:5e:b4:e9:79:5d:3f:24:d7:4a:01:4c:6f:fc:03:c4:d3:dd:52
Signer

14:aa:b2:a7:3f:ee:0f:ad:dd:0b:b2:72:ef:60:5e:b4:e9:79:5d:3f:24:d7:4a:01:4c:6f:fc:03:c4:d3:dd:52
Signer

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 516B

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 246B

.text
Size: 32KB - Virtual size: 32KB

.data
Size: 512B - Virtual size: 392B

.rdata
Size: 13KB - Virtual size: 12KB

.bss
Size: - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 55B

.idata
Size: 3KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 5KB - Virtual size: 5KB

.pdata
Size: 512B - Virtual size: 312B

.xdata
Size: 512B - Virtual size: 340B

.bss
Size: - Virtual size: 16B

.edata
Size: 1024B - Virtual size: 520B

.idata
Size: 1024B - Virtual size: 920B

.reloc
Size: 512B - Virtual size: 144B

.text
Size: 36KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 848B

.rdata
Size: 14KB - Virtual size: 13KB