Extracted

• cred64.dll

  .dll windows:6 windows x64 arch:x64

  3eb70f83441fc8632e81bd6eb89f424d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  D:\Mktmp\StealerDLL\x64\Release\STEALERDLL.pdb

  Imports

  crypt32

  CryptUnprotectData

  kernel32

  GetFullPathNameA

  SetEndOfFile

  UnlockFileEx

  GetTempPathW

  CreateMutexW

  WaitForSingleObject

  CreateFileW

  GetFileAttributesW

  GetCurrentThreadId

  UnmapViewOfFile

  HeapValidate

  HeapSize

  MultiByteToWideChar

  Sleep

  GetTempPathA

  FormatMessageW

  GetDiskFreeSpaceA

  GetLastError

  GetFileAttributesA

  GetFileAttributesExW

  OutputDebugStringW

  CreateFileA

  LoadLibraryA

  WaitForSingleObjectEx

  DeleteFileA

  DeleteFileW

  HeapReAlloc

  CloseHandle

  GetSystemInfo

  LoadLibraryW

  HeapAlloc

  HeapCompact

  HeapDestroy

  UnlockFile

  GetProcAddress

  CreateFileMappingA

  LocalFree

  LockFileEx

  GetFileSize

  DeleteCriticalSection

  GetCurrentProcessId

  GetProcessHeap

  SystemTimeToFileTime

  FreeLibrary

  WideCharToMultiByte

  GetSystemTimeAsFileTime

  GetSystemTime

  FormatMessageA

  CreateFileMappingW

  MapViewOfFile

  QueryPerformanceCounter

  GetTickCount

  FlushFileBuffers

  SetHandleInformation

  FindFirstFileA

  Wow64DisableWow64FsRedirection

  K32GetModuleFileNameExW

  FindNextFileA

  CreatePipe

  PeekNamedPipe

  lstrlenA

  FindClose

  GetCurrentDirectoryA

  lstrcatA

  OpenProcess

  SetCurrentDirectoryA

  CreateToolhelp32Snapshot

  ProcessIdToSessionId

  CopyFileA

  Wow64RevertWow64FsRedirection

  Process32NextW

  Process32FirstW

  CreateThread

  CreateProcessA

  CreateDirectoryA

  WriteConsoleW

  InitializeCriticalSection

  LeaveCriticalSection

  LockFile

  OutputDebugStringA

  GetDiskFreeSpaceW

  WriteFile

  GetFullPathNameW

  EnterCriticalSection

  HeapFree

  HeapCreate

  TryEnterCriticalSection

  ReadFile

  AreFileApisANSI

  SetFilePointer

  ReadConsoleW

  SetFilePointerEx

  GetConsoleMode

  GetConsoleCP

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetOEMCP

  GetACP

  IsValidCodePage

  FindNextFileW

  FindFirstFileExW

  SetStdHandle

  GetCurrentDirectoryW

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  InitializeSListHead

  SetLastError

  InitializeCriticalSectionAndSpinCount

  SwitchToThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  DecodePointer

  GetCPInfo

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  GetStringTypeW

  RtlUnwindEx

  RtlPcToFileHeader

  RaiseException

  InterlockedFlushSList

  LoadLibraryExW

  ExitThread

  FreeLibraryAndExitThread

  GetModuleHandleExW

  GetDriveTypeW

  GetFileInformationByHandle

  GetFileType

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  ExitProcess

  GetModuleFileNameW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetTimeZoneInformation

  GetStdHandle

  advapi32

  GetSidSubAuthorityCount

  RegEnumValueW

  RegEnumKeyA

  RegCloseKey

  RegQueryInfoKeyW

  RegOpenKeyA

  RegQueryValueExA

  GetSidIdentifierAuthority

  GetSidSubAuthority

  GetUserNameA

  RegEnumKeyExW

  LookupAccountNameA

  RegOpenKeyExA

  shell32

  SHGetFolderPathA

  SHFileOperationA

  wininet

  HttpOpenRequestA

  InternetWriteFile

  InternetReadFile

  InternetConnectA

  HttpSendRequestA

  InternetCloseHandle

  InternetOpenA

  HttpAddRequestHeadersA

  HttpSendRequestExW

  HttpEndRequestA

  InternetOpenW

  bcrypt

  BCryptOpenAlgorithmProvider

  BCryptSetProperty

  BCryptGenerateSymmetricKey

  BCryptDecrypt

  Exports

  Exports

  Main

  Save

  Sections

  .text

  Size: 1007KB - Virtual size: 1006KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 180KB - Virtual size: 179KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 17KB - Virtual size: 46KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 43KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 148B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 248B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ