Phoenix.rar
- SHA256 7864b6a28009122c9200cc8bef5d0ba9a5389fe2662bf6e58c714ec9d10aa560
Behavioral task
behavioral1
Sample
Phoenix/Phoenix.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
25 signatures
300 seconds
Behavioral task
behavioral2
Sample
Phoenix/extatent.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
Phoenix/selenium-manager/linux/selenium-manager
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
Phoenix/selenium-manager/macos/selenium-manager
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
Phoenix/selenium-manager/windows/selenium-manager.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
300 seconds
General
- Target Phoenix.rar
- Size 17.5MB
- Sample240907-22pylasgnf
- SHA256 7864b6a28009122c9200cc8bef5d0ba9a5389fe2662bf6e58c714ec9d10aa560
- MD5 10a7a676d6d8e7a84a7c3f1460f7bcd8
- SHA1 bc878368d1e739de405d79290277b37a374685b6
- SHA512 fa918dc96744bb8b87232c6dbccae8c1a09285875ea6adc64dc990fcc84e8e66fe8edc1857399cba7944dd3590a783409255210200d2ace4520c3098833c0185
- SSDEEP 393216:Y6MxPwaKuIQezjboK9Vs3VH+1byJFGrtVNLkY7HIXY8hxZ:Y6xaKuIRjbr9K39xGrZnHgY8hv
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- A stealer written in Python and packaged with Pyinstaller 1 IoCs
resource yara_rule static1/unpack002/�� ���.pyc blankgrabber - Blankgrabber family
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/Phoenix/extatent.dll agile_net - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Phoenix/extatent.dll unpack001/Phoenix/selenium-manager/windows/selenium-manager.exe
File Explorer
-
Phoenix.rar.rar 17.5MB
-
Phoenix/Phoenix.exe.exe 13.3MB
-
�� ���.pyc1KB
-
Phoenix/WorkingTokens.txt2B
-
Phoenix/extatent.dll.dll 50KB
-
Phoenix/names.txt83B
-
Phoenix/selenium-manager/linux/selenium-manager.elf 4.3MB
-
Phoenix/selenium-manager/macos/selenium-manager.macho 3.6MB
-
Phoenix/selenium-manager/windows/selenium-manager.exe.exe 3.0MB
Phoenix/Phoenix.exe
- IMPHASH 1af6c885af093afc55142c2f1761dbe8
- SHA256 d2f8b4c9a80a2f276be93be766a552c5a1b429fcda93a8091e8f5615465800df
- MD5 f8182a874096aa691a180479123d8beb
- SHA1 9d740987406b45008d39b7ac499541b36eae082f
- SHA512 4db51e79ebdaed7774952a6189970bfd58521111f3bbcc5a3c7e6d9ff27fc1296feba5527a55b17ba41190774d3feb340975f94ec4877bcb4edb2c567995f7b6
- SSDEEP 196608:xhbCj0/sPdlV/wTQPb4FJ9Bawp5tC4OjmFQR4MVGFtwLPIrlvnL2hVUJz:PZ/sxwYaLPp5tC3KtM5LPIdGSz
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
20:19:67:74:b0:62:85:09:12:d4:27:5f:93:ec:4b:5c:03:af:6a:25:c5:54:8b:30:5d:3b:f4:36:dc:3c:bd:af
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Chains
Apr 25, 2023
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Serial Number
bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 29, 2021 - Sep 28, 2024
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
2
Major OS version
5
Entry point
49568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetCPInfo
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
167KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=187, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=32533,
count=40, id=261, version=32533,
count=17, id=260, version=32533,
count=9, id=259, version=32533,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=21, id=260, version=32825,
count=1, id=258, version=32825,
�� ���.pyc
- SHA256 4f5305f2e81f0882d2c9e6834186909d22b12f9cdc5632ee6744b42d25a533e7
- MD5 b15be7e6ce78beb7775768656511b92b
- SHA1 7c945981b52abd0ba91320d40b327c606ca1c286
- SHA512 1e78006c2eae6063c87a09d005a0b9b7077beca8dae76e98c61198fcb0be2a20aecae1cb0283cb3c481949916522fb2510947ae044c56d23ea3131977ea4abfe
- MD5 SHA1 SHA512
-
A stealer written in Python and packaged with Pyinstaller
Phoenix/WorkingTokens.txt
- SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
- MD5 81051bcc2cf1bedf378224b0a93e2877
- SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
- SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
- MD5 SHA1 SHA512
Phoenix/extatent.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 44f76629435b429bba3cc08fca63a8f6a8e460268a0792a9e76cda3162655b95
- MD5 4e6b9cd76713ec5af29998eb790a3e5a
- SHA1 66b246f6df2c83dff2dc702602eeeb24ac300582
- SHA512 b8b28d69493305e899f017e5c7203ef31f188e520dae3e56bc008b8f34fdc20759333f1ac0bf81ab5191492ccf27f19df6970d600be2906f96e263f74db5cf92
- SSDEEP 768:e4gOx89NGERw2A11HI+bFK603JLw8MdErPPPwZVTkeJbT1ehphQ:eDGB2KHIwoKyPPyqeJl+phQ
- MD5 SHA1 SHA512 SSDEEP
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\erand\Dropbox\Dev\ag.v66\Libraries\VMRuntime\obj\Trial\AgileDotNet.VMRuntime.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Phoenix/names.txt
- SHA256 5c83f6c9b64060fb0d265ce88d16dffbef1f63c1916baaa6d582a502fede2f61
- MD5 3d30567bbee10a7802d0b042bbf94a49
- SHA1 dadd723ca9e97830bdac4657f7828c31cd3585f6
- SHA512 feb17da0e16553cd038c2226860ca1bba3e3fc3df395e0d09cb9bcf7b6784fb7d65f3b84d38d1c04120b820e8a0b1d80e30871a5137598b6219cfe6ab2b4d071
- MD5 SHA1 SHA512
Phoenix/selenium-manager/linux/selenium-manager
- SHA256 b7c8968038e9112e6cb549a0b58172ab53658262946835ff39c041ec44c871b8
- MD5 6a956ddd8f1e71ca2707aedb59a7f779
- SHA1 d12c5efd25bb9b0b77054f4a83a38504094f240d
- SHA512 186c91a19b4f1f2ff9bc14b144ca109ef6599a21d126472c90e2022ed26b20cf878ecd9758a069b0c4ba768cc3621150269f861810b8284e146405bc227b8e63
- SSDEEP 49152:d/M6p1KU1mIU6ifVovQfFAtDa6E4alFSmcrTKbalFMeDYieEhEQ/Lic1XgAcTaMK:tR1Kq+yhukbLN
- MD5 SHA1 SHA512 SSDEEP
Phoenix/selenium-manager/macos/selenium-manager
- SHA256 81a2056f4616f8ba3ef50c3a81db3f4963565cac1da46f57688fe455ac73763c
- MD5 4e3e74d882f2a2ef2f983f65077d7b10
- SHA1 112bd6ffdc55f8ec2d0bbaaac2b72edf679e6e3d
- SHA512 d51f7cf7e11a7c199d28a0fe8f9020a1113e5aac8625392a9a8ba07c7d3328decd7ace47c26fba1e9b64f17a1c119770df63c3fd31d31a8d64081ec5d7a80003
- SSDEEP 49152:x/MxNkflKGKhmGV7ALIut7Fulx/DyWwNOlvMqVBBhxtEDu7bQzVktjsNaOaIVqE7:mO/GVlx/rx70zV+sw1Ew62+tl5LHTd
- MD5 SHA1 SHA512 SSDEEP
Phoenix/selenium-manager/windows/selenium-manager.exe
- IMPHASH d47805a84aebeff710339a49110d2096
- SHA256 c99709759258ae4a7174e23d395801f1e709f743d12ffe3e00bc638ae59fadfb
- MD5 b97e5ecdfd825a3a31183927e23e0199
- SHA1 ab3d793868cc689699ce35d27e53cd0b8db76fcf
- SHA512 61a8e401013d3fb04be465bab2eeb943585e11ae7249b5cfd16fcd1fdc12a433151c1e701a202c6b9a5ccbb4254d6b60b91da787e9666028c7190a2d6ced64f2
- SSDEEP 49152:GgD4UMNOYj788gbCe85TGHwHG9Xg2s1+2IU6iYuCoh0ueLi:G396Cfp4Xg2t+FC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1785676
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapReAlloc
ReleaseSRWLockExclusive
lstrlenW
TlsSetValue
TlsGetValue
AcquireSRWLockExclusive
SwitchToThread
GetConsoleOutputCP
FlushFileBuffers
HeapSize
GetBinaryTypeW
GetConsoleMode
GetStdHandle
GetFileType
GetFileInformationByHandleEx
CloseHandle
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
LCMapStringW
CompareStringW
CreateIoCompletionPort
SetFileCompletionNotificationModes
AcquireSRWLockShared
ReleaseSRWLockShared
GetStringTypeW
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
WaitForMultipleObjects
GetOverlappedResult
WaitForSingleObject
GetExitCodeProcess
WakeAllConditionVariable
SetHandleInformation
SetStdHandle
SetEnvironmentVariableW
GetModuleHandleA
GetProcAddress
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetLastError
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
SetFilePointerEx
CreateDirectoryW
FindFirstFileW
FindClose
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
SetThreadStackGuarantee
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
CreateEventW
CancelIo
ReadFile
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
RtlCaptureContext
DeleteFileW
SetFileInformationByHandle
SleepConditionVariableSRW
CreateSymbolicLinkW
CreateHardLinkW
SetFileTime
SetFileAttributesW
SetConsoleMode
WakeConditionVariable
PostQueuedCompletionStatus
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetSystemInfo
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
AddVectoredExceptionHandler
GetCommandLineA
GetModuleHandleExW
WriteFile
RaiseException
GetCurrentProcess
GetCommandLineW
LoadLibraryExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
DecodePointer
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
ws2_32
freeaddrinfo
getaddrinfo
setsockopt
bind
send
WSAStartup
ioctlsocket
WSASocketW
WSASend
closesocket
WSAIoctl
WSACleanup
connect
recv
getsockname
WSAGetLastError
getpeername
shutdown
getsockopt
ntdll
NtCreateFile
NtCancelIoFileEx
NtDeviceIoControlFile
RtlNtStatusToDosError
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
bcrypt
BCryptGenRandom
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=143, id=261, version=30795,
count=20, id=260, version=30795,
count=39, id=261, version=31935,
count=17, id=260, version=31935,
count=20, id=259, version=31935,
count=174, id=1, productName=Unmarked objects,
count=15, id=257, version=30148,
count=34, id=260, version=32217,
count=10, productName=Unmarked objects (old),
count=1, id=258, version=32217,