windV3 remake[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

windV3 remake.exe
Size

671KB
MD5

ef4b736215f39ad3714cba87bd0c1cf9
SHA1

69a0862765e77de6bd8d8451f0a46fe6d1142795
SHA256

bdf4fce227595f29d68c50170d89a9bb3c71c29475b79da4bcf1a6f58e1428e6
SHA512

1dfe00955f64537433f4838812bec85416061b26007807dad9cd659cd8074c90c6fa5231e4034ebc4ca6733f3c2481d9fb84d9b4c3ef0726d59fdc3ccc75efe2
SSDEEP

6144:deOqEARCFC6yGxKC5AVaBw+VrgJLQM9Thu:dDhqCF4CS0u+iJLr9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
windV3 remake.exe

Files

windV3 remake.exe
.exe windows:6 windows x64 arch:x64

fb93e8f8e1127ed430903fed3e23e7fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\user\Downloads\DCppRat-main (1)\DCppRat-main\x64\Debug\windV3 remake.pdb

Imports

dpp

?reply@interaction_create_t@dpp@@QEBAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6AXAEBUconfirmation_callback_t@dpp@@@Z@4@@Z
??8snowflake@dpp@@QEBA_NV01@@Z
??Bsnowflake@dpp@@QEAAAEA_KXZ
??0channel@dpp@@QEAA@XZ
??1channel@dpp@@UEAA@XZ
?set_name@channel@dpp@@QEAAAEAV12@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1message@dpp@@UEAA@XZ
?set_guild_id@channel@dpp@@QEAAAEAV12@Vsnowflake@2@@Z
??0channel@dpp@@QEAA@AEBV01@@Z
??0message@dpp@@QEAA@Vsnowflake@1@V?$basic_string_view@DU?$char_traits@D@std@@@std@@W4message_type@1@@Z
?set_content@message@dpp@@QEAAAEAU12@V?$basic_string_view@DU?$char_traits@D@std@@@std@@@Z
?set_channel_id@message@dpp@@QEAAAEAU12@Vsnowflake@2@@Z
??1command_option_choice@dpp@@UEAA@XZ
??0command_option_choice@dpp@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$variant@Umonostate@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@_J_NVsnowflake@dpp@@N@3@@Z
??1command_option@dpp@@UEAA@XZ
??0command_option@dpp@@QEAA@W4command_option_type@1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1_N@Z
?log_error@utility@dpp@@YA?AV?$function@$$A6AXAEBUconfirmation_callback_t@dpp@@@Z@std@@XZ
?get_command_name@interaction@dpp@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0slashcommand@dpp@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0Vsnowflake@1@@Z
??1slashcommand@dpp@@UEAA@XZ
?add_option@slashcommand@dpp@@QEAAAEAV12@AEBUcommand_option@2@@Z
?cout_logger@utility@dpp@@YA?AV?$function@$$A6AXAEBUlog_t@dpp@@@Z@std@@XZ
?find_channel@dpp@@YAPEAVchannel@1@Vsnowflake@1@@Z
??1error_info@dpp@@QEAA@XZ
?is_error@confirmation_callback_t@dpp@@QEBA_NXZ
?get_error@confirmation_callback_t@dpp@@QEBA?AUerror_info@2@XZ
??0cluster@dpp@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IIII_NUcache_policy_t@1@II@Z
??1cluster@dpp@@UEAA@XZ
?log@cluster@dpp@@QEBAXW4loglevel@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?start@cluster@dpp@@QEAAX_N@Z
?global_command_create@cluster@dpp@@QEAAXAEBVslashcommand@2@V?$function@$$A6AXAEBUconfirmation_callback_t@dpp@@@Z@std@@@Z
?message_create@cluster@dpp@@QEAAXAEBUmessage@2@V?$function@$$A6AXAEBUconfirmation_callback_t@dpp@@@Z@std@@@Z
?channel_create@cluster@dpp@@QEAAXAEBVchannel@2@V?$function@$$A6AXAEBUconfirmation_callback_t@dpp@@@Z@std@@@Z
?reply@interaction_create_t@dpp@@QEBAXAEBUmessage@2@V?$function@$$A6AXAEBUconfirmation_callback_t@dpp@@@Z@std@@@Z
?add_choice@command_option@dpp@@QEAAAEAU12@AEBUcommand_option_choice@2@@Z
?add_file@message@dpp@@QEAAAEAU12@V?$basic_string_view@DU?$char_traits@D@std@@@std@@00@Z
??0message@dpp@@QEAA@XZ
?read_file@utility@dpp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z
?set_type@channel@dpp@@QEAAAEAV12@W4channel_type@2@@Z
??$validate_configuration@$00@dpp@@YA_NXZ

kernel32

GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThreadId
Sleep
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
WideCharToMultiByte
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CopyFileW
CreateDirectoryExW
DeviceIoControl
AreFileApisANSI
GetTempPathW
CreateFileA
CloseHandle
GetCurrentProcess
VirtualProtect
RaiseException
MapViewOfFile
UnmapViewOfFile
GetModuleHandleA
K32GetModuleInformation
GetModuleHandleW
GetProcAddress
LoadLibraryA
DeleteFileA
OpenProcess
MultiByteToWideChar
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ReadFile
DuplicateHandle
SetHandleInformation
CreatePipe
WaitForSingleObject
CreateProcessA
ReleaseMutex
GetModuleFileNameW
GetLastError
CreateMutexA
GetComputerNameA
GetConsoleWindow
GetCurrentDirectoryW
SetFileTime
SetFileInformationByHandle
SetFileAttributesW
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileInformationByHandle
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
HeapAlloc
GetProcessHeap
HeapFree
VirtualQuery
FreeLibrary
SetCurrentDirectoryW
GetLocaleInfoEx
FormatMessageA
CreateFileMappingW
FindFirstFileW
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileExW
LocalFree
CreateDirectoryW
CreateFileW
FindClose

user32

ShowWindow
ReleaseDC
GetDC
GetSystemMetrics
BlockInput

gdi32

DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SelectObject

advapi32

CheckTokenMembership
AllocateAndInitializeSid
RegSetValueExA
RegCreateKeyExA
RegCloseKey
FreeSid

shell32

ShellExecuteExW

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

CreateErrorInfo
SysFreeString
SysAllocString
VariantInit
GetErrorInfo
VariantChangeType
SetErrorInfo
VariantClear

msvcp140d

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Mbrtowc
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getdays@_Locinfo@std@@QEBAPEBDXZ
?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

gdiplus

GdipGetImageEncodersSize
GdipGetImageEncoders
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile

vcruntime140d

_CxxThrowException
memmove
memcmp
__C_specific_handler
__current_exception
__current_exception_context
__C_specific_handler_noexcept
__std_type_info_destroy_list
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
memset
__std_exception_destroy
memcpy
__std_exception_copy

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

strcat_s
strcpy_s
wcscpy_s
__p__commode
_set_new_mode
_register_thread_local_exe_atexit_callback
_c_exit
__stdio_common_vsprintf_s
_wsplitpath_s
terminate
_wmakepath_s
_set_fmode
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
__setusermatherr
_set_app_type
_seh_filter_exe
_CrtDbgReportW
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_callnewh
_malloc_dbg
_free_dbg
abort
___lc_codepage_func
_unlock_file
_lock_file
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fread
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
exit
malloc
free
wcscmp
strcmp
strlen
wcslen
_CrtDbgReport
_calloc_dbg
_invalid_parameter
_configthreadlocale

Sections

.textbss
Size: - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb93e8f8e1127ed430903fed3e23e7fc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dpp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp140d

gdiplus

vcruntime140d

vcruntime140_1d

ucrtbased

Sections

.textbss Size: - Virtual size: 203KB

.text Size: 452KB - Virtual size: 451KB

.rdata Size: 132KB - Virtual size: 132KB

.data Size: 8KB - Virtual size: 15KB

.pdata Size: 42KB - Virtual size: 41KB

.idata Size: 22KB - Virtual size: 21KB

.msvcjmc Size: 6KB - Virtual size: 6KB

.00cfg Size: 512B - Virtual size: 373B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.textbss
Size: - Virtual size: 203KB

.text
Size: 452KB - Virtual size: 451KB

.rdata
Size: 132KB - Virtual size: 132KB

.data
Size: 8KB - Virtual size: 15KB

.pdata
Size: 42KB - Virtual size: 41KB

.idata
Size: 22KB - Virtual size: 21KB

.msvcjmc
Size: 6KB - Virtual size: 6KB

.00cfg
Size: 512B - Virtual size: 373B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB