16864814f9068b1908eefdaa43aa6362337594bfbaed2132c15dd9612f260a1b[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

16864814f9068b1908eefdaa43aa6362337594bfbaed2132c15dd9612f260a1b.zip
Size

11.6MB
MD5

4678b5beb66a5cce0ebfd03a54faca92
SHA1

0d347573c2fe3f9c8560862747d2f638552135f9
SHA256

17c5595fd0351cfaa5b9450fd4ff99c1a79c368d853846e5282a2c5efd5cb0e0
SHA512

afd6d3e9fccb0b62f6aea23cb452e9339f7e875926aa11ac65bf286f39606cca2fb046d31d9f8b7bcda0b1149d603a736c771b570d4e77f25ea2504be7263f52
SSDEEP

196608:ujT7pRk+3kRwF81tPj52MgLyJfVl7FuY7JypAvGjj6txItZ3EzW9m4M/JVKhbVzc:GT7iE81tPQrLwvFbUm3ItZpnMCrzGx

Score

1^/10

Malware Config

Signatures

Files

16864814f9068b1908eefdaa43aa6362337594bfbaed2132c15dd9612f260a1b.zip
.zip

Password: infected
16864814f9068b1908eefdaa43aa6362337594bfbaed2132c15dd9612f260a1b
.dll windows:6 windows x64 arch:x64

Password: infected

5b57d3a1d8b13d43c2c1f591334d61c3

Code Sign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:3c:53:37:b0:86:3b:4a:d8:5e:c3:42:3c:e8:3f:be
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

23/02/2024, 00:00

Not After

22/02/2027, 23:59

Subject

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4e:e0:38:a3:b5:87:47:26:25:a0:81:1a:c6:fa:0d:31:95:5f:29:13:1a:89:f8:26:03:d0:48:f8:92:aa:90:3a
Signer

Actual PE Digest

4e:e0:38:a3:b5:87:47:26:25:a0:81:1a:c6:fa:0d:31:95:5f:29:13:1a:89:f8:26:03:d0:48:f8:92:aa:90:3a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

sas

SendSAS

newdev

UpdateDriverForPlugAndPlayDevicesW

wtsapi32

WTSEnumerateSessionsA
WTSQuerySessionInformationW
WTSFreeMemory

kernel32

ReleaseSemaphore
GetCurrentDirectoryW
FileTimeToSystemTime
GetModuleHandleW
GetProcessHeap
HeapFree
LoadLibraryExA
HeapAlloc
CreateEventW
SleepConditionVariableSRW
CreateNamedPipeW
LocalFree
LocalAlloc
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileSize
GetFileTime
ReadFile
SetFilePointer
ResetEvent
ReleaseMutex
CreateMutexA
Sleep
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
ReadProcessMemory
VirtualQueryEx
GetModuleHandleExW
GetModuleFileNameW
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessId
CreateFileMappingW
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
VirtualQuery
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
CreateSemaphoreW
SetThreadPriority
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
InitOnceBeginInitialize
InitOnceComplete
WakeAllConditionVariable
TryEnterCriticalSection
GetStdHandle
GetConsoleMode
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WideCharToMultiByte
InitializeSRWLock
InitializeCriticalSection
GetSystemTimeAsFileTime
GetSystemDirectoryW
SetThreadErrorMode
SwitchToThread
GetFullPathNameW
GetProcessAffinityMask
MoveFileExA
MoveFileExW
WaitForMultipleObjectsEx
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetLogicalDrives
FreeLibrary
SetConsoleMode
GetTickCount64
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetProcessTimes
GetSystemInfo
GetDriveTypeW
GetSystemTimes
GetProcessIoCounters
SetErrorMode
GetTimeZoneInformationForYear
GetFileType
GetFileInformationByHandleEx
SetHandleInformation
DuplicateHandle
GetLogicalProcessorInformation
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatusEx
SetFileCompletionNotificationModes
ConnectNamedPipe
CancelIoEx
GetOverlappedResult
WriteFile
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
SetThreadStackGuarantee
CreateWaitableTimerExW
SetWaitableTimer
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
FlushFileBuffers
SetFilePointerEx
WriteFileEx
SleepEx
HeapReAlloc
GetFileInformationByHandle
CreateDirectoryW
DeleteFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
CancelIo
ExitProcess
ReadFileEx
WaitForMultipleObjects
GetWindowsDirectoryW
CreateProcessW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
ReadConsoleW
GetTempPathW
SetUnhandledExceptionFilter
GetOEMCP
GetACP
IsValidCodePage
OutputDebugStringW
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
LoadLibraryExW
GetComputerNameExW
SetLastError
FormatMessageW
GetUserPreferredUILanguages
lstrlenW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
VerifyVersionInfoW
CreateThread
VerSetConditionMask
SetConsoleCtrlHandler
CreateSemaphoreA
GetExitCodeProcess
ResumeThread
QueueUserAPC
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
WTSGetActiveConsoleSessionId
CreateEventA
DeviceIoControl
CreateFileW
GetProcAddress
LoadLibraryA
GetNativeSystemInfo
GetCurrentProcess
OpenProcess
ProcessIdToSessionId
GetCurrentProcessId
LoadLibraryW
TerminateProcess
SetEvent
SetThreadExecutionState
CloseHandle
GetModuleHandleExA
WaitForSingleObject
GetCurrentThreadId
GetLastError
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapSize
HeapQueryInformation
GetTimeZoneInformation
SetStdHandle
SetEndOfFile
FindFirstFileExW
GetCommandLineA
SetFileTime
FlsGetValue
FlsAlloc
GetConsoleOutputCP
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
FreeLibraryAndExitThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
RtlUnwindEx
RaiseException
RtlPcToFileHeader
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
GetStringTypeW
FormatMessageA
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter

secur32

ApplyControlToken
AcceptSecurityContext
FreeContextBuffer
InitializeSecurityContextW
DecryptMessage
EncryptMessage
QueryContextAttributesW
DeleteSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA

advapi32

SystemFunction036
CopySid
GetLengthSid
IsValidSid
SetServiceStatus
RevertToSelf
ImpersonateAnonymousToken
SetSecurityDescriptorDacl
SetEntriesInAclW
InitializeSecurityDescriptor
RegEnumValueW
RegQueryInfoKeyW
CreateProcessWithTokenW
LookupPrivilegeValueW
ImpersonateLoggedOnUser
DuplicateTokenEx
AdjustTokenPrivileges
GetUserNameW
RegEnumKeyExW
RegDeleteKeyW
RegCloseKey
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
LookupAccountSidW
FreeSid
EqualSid
AllocateAndInitializeSid
RegisterServiceCtrlHandlerExW
CreateProcessAsUserW
RegSetValueExW
CreateProcessWithLogonW
GetTokenInformation
OpenProcessToken
RegDeleteTreeW
StartServiceCtrlDispatcherW
RegQueryValueExW
RegOpenKeyExW

ws2_32

socket
WSASend
accept
closesocket
WSAStartup
WSAIoctl
setsockopt
sendto
send
recvfrom
recv
shutdown
ioctlsocket
getsockopt
getpeername
getsockname
listen
bind
WSAGetLastError
connect
WSACleanup
freeaddrinfo
getaddrinfo
WSASocketW

user32

AttachThreadInput
GetSystemMetrics
RegisterClipboardFormatW
MapVirtualKeyExW
GetKeyboardState
GetRawInputData
SystemParametersInfoW
MsgWaitForMultipleObjectsEx
RegisterClassExA
CountClipboardFormats
CreateWindowExA
OpenClipboard
AdjustWindowRectEx
CloseClipboard
EnumDisplayDevicesW
FindWindowA
GetKeyState
CallNextHookEx
PostThreadMessageA
GetDoubleClickTime
AllowSetForegroundWindow
ChangeDisplaySettingsExW
GetClipboardFormatNameA
EmptyClipboard
IsClipboardFormatAvailable
RemoveClipboardFormatListener
EnumDisplaySettingsExW
SetWindowsHookExA
InvalidateRgn
SetWindowPos
GetWindowLongW
RegisterRawInputDevices
RegisterClassExW
GetClipboardOwner
PostQuitMessage
SystemParametersInfoA
CreateAcceleratorTableW
DestroyAcceleratorTable
IsProcessDPIAware
MonitorFromWindow
ClientToScreen
AppendMenuW
InsertMenuW
CreatePopupMenu
CreateMenu
DestroyMenu
DrawTextW
FillRect
GetWindowDC
OffsetRect
MapWindowPoints
GetClientRect
GetMenuBarInfo
GetMenu
SetMenu
DrawMenuBar
GetMessageA
TranslateMessage
DispatchMessageA
UnhookWindowsHookEx
DefWindowProcA
PostMessageW
RemoveMenu
SetMenuItemInfoW
DrawIconEx
CheckMenuItem
AddClipboardFormatListener
GetCursorInfo
GetCursorPos
LockWorkStation
GetForegroundWindow
GetWindowThreadProcessId
GetMenuItemInfoW
GetMessageW
DispatchMessageW
VkKeyScanExW
ToUnicodeEx
TrackPopupMenu
SetTimer
SetClipboardViewer
LoadCursorA
ChangeClipboardChain
KillTimer
DefWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
DestroyWindow
CreateWindowExW
RegisterClassW
SendMessageW
ExitWindowsEx
FindWindowExA
SetClipboardData
CreateIcon
OpenInputDesktop
DestroyIcon
RegisterWindowMessageA
GetClipboardData
wsprintfW
EnumDisplaySettingsW
SetForegroundWindow
ShowWindow
FindWindowW
SendInput
BlockInput
ReleaseDC
SetThreadDesktop
RegisterClipboardFormatA
GetDC
PostMessageA
GetKeyboardLayout
GetIconInfo
GetWindowRect
GetUserObjectInformationA
GetThreadDesktop
GetDesktopWindow
GetUpdateRect
MapVirtualKeyW
PeekMessageW
PostThreadMessageW
ValidateRect
RedrawWindow
MessageBoxW
CloseDesktop
SendMessageA

shell32

ShellExecuteA
Shell_NotifyIconW
ShellExecuteExW
SHAddToRecentDocs
Shell_NotifyIconGetRect
ShellExecuteW
SHGetKnownFolderPath
CommandLineToArgvW

comctl32

RemoveWindowSubclass
SetWindowSubclass
DefSubclassProc

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateStore
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertFreeCertificateContext

gdi32

CreateDIBitmap
GetDIBits
CreateSolidBrush
BitBlt
SetBkMode
SetTextColor
CreateCompatibleBitmap
CreateDCW
DeleteDC
SelectObject
CreateCompatibleDC
GetBitmapBits
GetObjectA
DeleteObject
CreateDIBSection
GetDeviceCaps

setupapi

SetupDiCreateDeviceInfoList
SetupDiCreateDeviceInfoW
SetupDiSetDeviceRegistryPropertyW
SetupDiCallClassInstaller
SetupDiGetINFClassW
SetupDiGetClassDevsW
SetupDiGetDeviceInfoListDetailW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList

cfgmgr32

CM_Get_DevNode_Status

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

iphlpapi

SendARP
GetAdaptersAddresses

ole32

OleIsCurrentClipboard
ReleaseStgMedium
CoUninitialize
OleSetClipboard
CoCreateInstance
CoTaskMemAlloc
PropVariantClear
OleUninitialize
CoInitializeEx
OleInitialize
StringFromGUID2
CoTaskMemFree
OleGetClipboard

ntdll

RtlGetNtVersionNumbers
RtlGetVersion
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
NtWriteFile
NtReadFile
NtQueryInformationProcess
NtQuerySystemInformation

oleaut32

SysFreeString
GetErrorInfo
SysStringLen

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

bcrypt

BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom

powrprof

CallNtPowerInformation

pdh

PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
PdhOpenQueryA
PdhAddEnglishCounterW
PdhCollectQueryDataEx
PdhCloseQuery
PdhAddEnglishCounterA

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

Exports

Exports

drop_dart_object
free_WireSyncReturn
free_c_args
free_zero_copy_buffer_f32
free_zero_copy_buffer_f64
free_zero_copy_buffer_i16
free_zero_copy_buffer_i32
free_zero_copy_buffer_i64
free_zero_copy_buffer_i8
free_zero_copy_buffer_u16
free_zero_copy_buffer_u32
free_zero_copy_buffer_u64
free_zero_copy_buffer_u8
get_dart_object
get_rustdesk_app_name
hwcodec_log
init_frb_dart_api_dl
new_StringList_0
new_dart_opaque
new_int_32_list_0
new_uint_8_list_0
privacy_mode_hook_keyboard
privacy_mode_hook_mouse
rustdesk_core_main_args
session_get_rgba
store_dart_post_cobject
wire_cm_can_elevate
wire_cm_check_click_time
wire_cm_check_clients_length
wire_cm_close_connection
wire_cm_close_voice_call
wire_cm_elevate_portable
wire_cm_get_click_time
wire_cm_get_clients_length
wire_cm_get_clients_state
wire_cm_get_config
wire_cm_handle_incoming_voice_call
wire_cm_init
wire_cm_login_res
wire_cm_remove_disconnected_connection
wire_cm_send_chat
wire_cm_switch_back
wire_cm_switch_permission
wire_get_double_click_time
wire_get_local_flutter_option
wire_get_local_kb_layout_type
wire_get_next_texture_key
wire_get_voice_call_input_device
wire_host_stop_system_key_propagate
wire_install_install_me
wire_install_install_options
wire_install_install_path
wire_install_run_without_install
wire_install_show_run_without_install
wire_is_custom_client
wire_is_disable_ab
wire_is_disable_account
wire_is_disable_group_panel
wire_is_disable_installation
wire_is_disable_settings
wire_is_incoming_only
wire_is_outgoing_only
wire_is_preset_password
wire_is_preset_password_mobile_only
wire_is_selinux_enforcing
wire_is_support_multi_ui_session
wire_main_account_auth
wire_main_account_auth_cancel
wire_main_account_auth_result
wire_main_change_id
wire_main_change_language
wire_main_change_theme
wire_main_check_connect_status
wire_main_check_hwcodec
wire_main_check_mouse_time
wire_main_check_super_user_permission
wire_main_clear_ab
wire_main_clear_group
wire_main_clear_trusted_devices
wire_main_create_shortcut
wire_main_current_is_wayland
wire_main_default_privacy_mode_impl
wire_main_device_id
wire_main_device_name
wire_main_discover
wire_main_forget_password
wire_main_generate2fa
wire_main_get_api_server
wire_main_get_app_name
wire_main_get_app_name_sync
wire_main_get_async_status
wire_main_get_build_date
wire_main_get_buildin_option
wire_main_get_connect_status
wire_main_get_data_dir_ios
wire_main_get_default_sound_input
wire_main_get_displays
wire_main_get_env
wire_main_get_error
wire_main_get_fav
wire_main_get_fingerprint
wire_main_get_hard_option
wire_main_get_home_dir
wire_main_get_http_status
wire_main_get_input_source
wire_main_get_lan_peers
wire_main_get_langs
wire_main_get_last_remote_id
wire_main_get_license
wire_main_get_local_option
wire_main_get_login_device_info
wire_main_get_main_display
wire_main_get_mouse_time
wire_main_get_my_id
wire_main_get_new_stored_peers
wire_main_get_new_version
wire_main_get_option
wire_main_get_option_sync
wire_main_get_options
wire_main_get_options_sync
wire_main_get_peer_flutter_option_sync
wire_main_get_peer_option
wire_main_get_peer_option_sync
wire_main_get_peer_sync
wire_main_get_permanent_password
wire_main_get_proxy_status
wire_main_get_socks
wire_main_get_software_update_url
wire_main_get_sound_inputs
wire_main_get_temporary_password
wire_main_get_trusted_devices
wire_main_get_unlock_pin
wire_main_get_use_texture_render
wire_main_get_user_default_option
wire_main_get_uuid
wire_main_get_version
wire_main_goto_install
wire_main_handle_relay_id
wire_main_handle_wayland_screencast_restore_token
wire_main_has_file_clipboard
wire_main_has_gpu_texture_render
wire_main_has_hwcodec
wire_main_has_valid_2fa_sync
wire_main_has_valid_bot_sync
wire_main_has_vram
wire_main_hide_dock
wire_main_http_request
wire_main_init
wire_main_init_input_source
wire_main_is_can_input_monitoring
wire_main_is_can_screen_recording
wire_main_is_installed
wire_main_is_installed_daemon
wire_main_is_installed_lower_version
wire_main_is_login_wayland
wire_main_is_option_fixed
wire_main_is_process_trusted
wire_main_is_root
wire_main_is_share_rdp
wire_main_is_using_public_server
wire_main_load_ab
wire_main_load_fav_peers
wire_main_load_group
wire_main_load_lan_peers
wire_main_load_lan_peers_sync
wire_main_load_recent_peers
wire_main_load_recent_peers_for_ab
wire_main_load_recent_peers_sync
wire_main_max_encrypt_len
wire_main_on_main_window_close
wire_main_peer_exists
wire_main_peer_has_password
wire_main_remove_discovered
wire_main_remove_peer
wire_main_remove_trusted_devices
wire_main_save_ab
wire_main_save_group
wire_main_set_home_dir
wire_main_set_input_source
wire_main_set_local_option
wire_main_set_option
wire_main_set_options
wire_main_set_peer_alias
wire_main_set_peer_flutter_option_sync
wire_main_set_peer_option
wire_main_set_peer_option_sync
wire_main_set_permanent_password
wire_main_set_share_rdp
wire_main_set_socks
wire_main_set_unlock_pin
wire_main_set_user_default_option
wire_main_show_option
wire_main_start_dbus_server
wire_main_start_ipc_url_server
wire_main_start_service
wire_main_stop_service
wire_main_store_fav
wire_main_support_remove_wallpaper
wire_main_supported_hwdecodings
wire_main_supported_input_source
wire_main_supported_privacy_mode_impls
wire_main_test_if_valid_server
wire_main_test_wallpaper
wire_main_update_me
wire_main_update_temporary_password
wire_main_uri_prefix_sync
wire_main_verify2fa
wire_main_verify_bot
wire_main_video_save_directory
wire_main_wol
wire_option_synced
wire_peer_get_default_sessions_count
wire_plugin_enable
wire_plugin_event
wire_plugin_feature_is_enabled
wire_plugin_get_session_option
wire_plugin_get_shared_option
wire_plugin_install
wire_plugin_is_enabled
wire_plugin_list_reload
wire_plugin_register_event_stream
wire_plugin_reload
wire_plugin_set_session_option
wire_plugin_set_shared_option
wire_plugin_sync_ui
wire_query_onlines
wire_send_url_scheme
wire_session_add_existed_sync
wire_session_add_job
wire_session_add_port_forward
wire_session_add_sync
wire_session_alternative_codecs
wire_session_cancel_job
wire_session_change_prefer_codec
wire_session_change_resolution
wire_session_close
wire_session_close_voice_call
wire_session_create_dir
wire_session_ctrl_alt_del
wire_session_elevate_direct
wire_session_elevate_with_logon
wire_session_enter_or_leave
wire_session_get_audit_server_sync
wire_session_get_custom_image_quality
wire_session_get_displays_as_individual_windows
wire_session_get_enable_trusted_devices
wire_session_get_flutter_option
wire_session_get_image_quality
wire_session_get_keyboard_mode
wire_session_get_option
wire_session_get_peer_option
wire_session_get_platform
wire_session_get_remember
wire_session_get_reverse_mouse_wheel_sync
wire_session_get_rgba_size
wire_session_get_scroll_style
wire_session_get_toggle_option
wire_session_get_toggle_option_sync
wire_session_get_use_all_my_displays_for_the_remote_session
wire_session_get_view_style
wire_session_handle_flutter_key_event
wire_session_handle_flutter_raw_key_event
wire_session_input_key
wire_session_input_os_password
wire_session_input_string
wire_session_is_keyboard_mode_supported
wire_session_is_multi_ui_session
wire_session_load_last_transfer_jobs
wire_session_lock_screen
wire_session_login
wire_session_new_rdp
wire_session_next_rgba
wire_session_on_waiting_for_image_dialog_show
wire_session_peer_option
wire_session_read_dir_recursive
wire_session_read_local_dir_sync
wire_session_read_remote_dir
wire_session_reconnect
wire_session_record_screen
wire_session_record_status
wire_session_refresh
wire_session_register_gpu_texture
wire_session_register_pixelbuffer_texture
wire_session_remove_all_empty_dirs
wire_session_remove_file
wire_session_remove_port_forward
wire_session_rename_file
wire_session_request_new_display_init_msgs
wire_session_request_voice_call
wire_session_restart_remote_device
wire_session_resume_job
wire_session_send2fa
wire_session_send_chat
wire_session_send_files
wire_session_send_mouse
wire_session_send_note
wire_session_send_pointer
wire_session_send_selected_session_id
wire_session_set_confirm_override_file
wire_session_set_custom_fps
wire_session_set_custom_image_quality
wire_session_set_displays_as_individual_windows
wire_session_set_flutter_option
wire_session_set_image_quality
wire_session_set_keyboard_mode
wire_session_set_reverse_mouse_wheel
wire_session_set_scroll_style
wire_session_set_size
wire_session_set_use_all_my_displays_for_the_remote_session
wire_session_set_view_style
wire_session_start
wire_session_start_with_displays
wire_session_switch_display
wire_session_switch_sides
wire_session_toggle_option
wire_session_toggle_privacy_mode
wire_session_toggle_virtual_display
wire_set_cur_session_id
wire_set_local_flutter_option
wire_set_local_kb_layout_type
wire_set_voice_call_input_device
wire_start_global_event_stream
wire_stop_global_event_stream
wire_translate
wire_version_to_number

Sections

.text
Size: 19.0MB - Virtual size: 19.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9.2MB - Virtual size: 9.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

5b57d3a1d8b13d43c2c1f591334d61c3

Code Sign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

b1:3c:53:37:b0:86:3b:4a:d8:5e:c3:42:3c:e8:3f:beCertificate

Extended Key Usages

Key Usages

4e:e0:38:a3:b5:87:47:26:25:a0:81:1a:c6:fa:0d:31:95:5f:29:13:1a:89:f8:26:03:d0:48:f8:92:aa:90:3aSigner

Headers

DLL Characteristics

File Characteristics

Imports

sas

newdev

wtsapi32

kernel32

secur32

advapi32

ws2_32

user32

shell32

comctl32

crypt32

gdi32

setupapi

cfgmgr32

userenv

iphlpapi

ole32

ntdll

oleaut32

d3d11

dxgi

bcrypt

powrprof

pdh

psapi

Exports

Exports

Sections

.text Size: 19.0MB - Virtual size: 19.0MB

.rodata Size: 2KB - Virtual size: 2KB

.rdata Size: 9.2MB - Virtual size: 9.2MB

.data Size: 56KB - Virtual size: 514KB

.pdata Size: 392KB - Virtual size: 391KB

_RDATA Size: 512B - Virtual size: 48B

.reloc Size: 219KB - Virtual size: 218KB

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

b1:3c:53:37:b0:86:3b:4a:d8:5e:c3:42:3c:e8:3f:be
Certificate

4e:e0:38:a3:b5:87:47:26:25:a0:81:1a:c6:fa:0d:31:95:5f:29:13:1a:89:f8:26:03:d0:48:f8:92:aa:90:3a
Signer

.text
Size: 19.0MB - Virtual size: 19.0MB

.rodata
Size: 2KB - Virtual size: 2KB

.rdata
Size: 9.2MB - Virtual size: 9.2MB

.data
Size: 56KB - Virtual size: 514KB

.pdata
Size: 392KB - Virtual size: 391KB

_RDATA
Size: 512B - Virtual size: 48B

.reloc
Size: 219KB - Virtual size: 218KB