Impactor_0[.]9[.]56[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Impactor_0.9.56.zip
Size

18.5MB
MD5

0bba628fa4372447b440fb94035ae51e
SHA1

f5c820a58f1e2ef5aa5564729b00224414e402f4
SHA256

3506f81c2783cd9b02d82ce0928f3b005d58a248cf15887d24590dced0617e18
SHA512

087a9a46901d7090d20e9d2e811dedee5af1165d30e9ee5d750f144e70a0af9692f27e434e3328097992424f23d1f926c3e7e3edceee212b2c3241d00d03911d
SSDEEP

393216:Up9na7NkOEESTzvnSmpFH3knVpZ77d0KQ2CozNZQKwa5KRgpgSJhzH:Aa7NkOEES/v/FUnl7RbNRN9gSJRH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/AdbWinApi.dll
unpack001/AdbWinUsbApi.dll
unpack001/Impactor.dll
unpack001/Impactor.exe
unpack001/WinSparkle.dll

Files

Impactor_0.9.56.zip
.zip
AdbWinApi.dll
.dll windows:6 windows x86 arch:x86

776334619bd19ec23e3a7a275473b5a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

z:\development\usb\api\objfre_win7_x86\i386\AdbWinApi.pdb

Imports

ole32

CoCreateInstance

kernel32

GetStartupInfoA
SetLastError
CloseHandle
GetLastError
DeviceIoControl
WriteFile
ReadFile
GetOverlappedResult
CreateFileW
WideCharToMultiByte
Sleep
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryW
GetFileAttributesW
GetSystemDirectoryW
RaiseException
FreeLibrary
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetCommandLineA
GetVersionExA
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
OutputDebugStringA
HeapSize
LoadLibraryExA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW

Exports

Exports

??0AdbEndpointObject@@QAE@ABV0@@Z
??0AdbEndpointObject@@QAE@PAVAdbInterfaceObject@@EE@Z
??0AdbIOCompletion@@QAE@ABV0@@Z
??0AdbIOCompletion@@QAE@PAVAdbEndpointObject@@KPAX@Z
??0AdbInterfaceObject@@QAE@ABV0@@Z
??0AdbInterfaceObject@@QAE@PBG@Z
??0AdbObjectHandle@@QAE@ABV0@@Z
??0AdbObjectHandle@@QAE@W4AdbObjectType@@@Z
??1AdbEndpointObject@@MAE@XZ
??1AdbIOCompletion@@MAE@XZ
??1AdbInterfaceObject@@MAE@XZ
??1AdbObjectHandle@@MAE@XZ
??4AdbEndpointObject@@QAEAAV0@ABV0@@Z
??4AdbIOCompletion@@QAEAAV0@ABV0@@Z
??4AdbInterfaceObject@@QAEAAV0@ABV0@@Z
??4AdbObjectHandle@@QAEAAV0@ABV0@@Z
??_7AdbEndpointObject@@6B@
??_7AdbIOCompletion@@6B@
??_7AdbInterfaceObject@@6B@
??_7AdbObjectHandle@@6B@
?AddRef@AdbObjectHandle@@UAEJXZ
?AsyncRead@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?AsyncWrite@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?CloseHandle@AdbObjectHandle@@UAE_NXZ
?CreateHandle@AdbObjectHandle@@UAEPAXXZ
?GetEndpointInformation@AdbEndpointObject@@UAE_NPAU_AdbEndpointInformation@@@Z
?GetInterfaceName@AdbInterfaceObject@@UAE_NPAXPAK_N@Z
?GetParentInterfaceHandle@AdbEndpointObject@@QBEPAXXZ
?GetParentObjectHandle@AdbIOCompletion@@QBEPAXXZ
?GetUsbConfigurationDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_CONFIGURATION_DESCRIPTOR@@@Z
?GetUsbDeviceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_DEVICE_DESCRIPTOR@@@Z
?GetUsbInterfaceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_INTERFACE_DESCRIPTOR@@@Z
?IsCompleted@AdbIOCompletion@@UAE_NXZ
?IsObjectOfType@AdbObjectHandle@@UBE_NW4AdbObjectType@@@Z
?IsOpened@AdbObjectHandle@@QBE_NXZ
?LastReferenceReleased@AdbObjectHandle@@MAEXXZ
?Lookup@AdbObjectHandle@@SGPAV1@PAX@Z
?Release@AdbObjectHandle@@UAEJXZ
?SyncRead@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?SyncWrite@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?Type@AdbEndpointObject@@SG?AW4AdbObjectType@@XZ
?Type@AdbIOCompletion@@SG?AW4AdbObjectType@@XZ
?Type@AdbInterfaceObject@@SG?AW4AdbObjectType@@XZ
?adb_handle@AdbObjectHandle@@QBEPAXXZ
?endpoint_id@AdbEndpointObject@@QBEEXZ
?endpoint_index@AdbEndpointObject@@QBEEXZ
?interface_name@AdbInterfaceObject@@QBEABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?object_type@AdbObjectHandle@@QBE?AW4AdbObjectType@@XZ
?overlapped@AdbIOCompletion@@QAEPAU_OVERLAPPED@@XZ
?parent_interface@AdbEndpointObject@@QBEPAVAdbInterfaceObject@@XZ
?parent_io_object@AdbIOCompletion@@QBEPAVAdbEndpointObject@@XZ
?usb_config_descriptor@AdbInterfaceObject@@QBEPBU_USB_CONFIGURATION_DESCRIPTOR@@XZ
?usb_device_descriptor@AdbInterfaceObject@@QBEPBU_USB_DEVICE_DESCRIPTOR@@XZ
?usb_interface_descriptor@AdbInterfaceObject@@QBEPBU_USB_INTERFACE_DESCRIPTOR@@XZ
AdbCloseHandle
AdbCreateInterface
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetDefaultBulkReadEndpointInformation
AdbGetDefaultBulkWriteEndpointInformation
AdbGetEndpointInformation
AdbGetEndpointInterface
AdbGetInterfaceName
AdbGetOvelappedIoResult
AdbGetSerialNumber
AdbGetUsbConfigurationDescriptor
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbHasOvelappedIoComplated
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbOpenEndpoint
AdbQueryInformationEndpoint
AdbReadEndpointAsync
AdbReadEndpointSync
AdbResetInterfaceEnum
AdbWriteEndpointAsync
AdbWriteEndpointSync

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AdbWinUsbApi.dll
.dll windows:6 windows x86 arch:x86

72b8c869f01047191838df5f58e88dd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

z:\development\usb\winusb\objfre_win7_x86\i386\AdbWinUsbApi.pdb

Imports

ole32

CoCreateInstance

kernel32

GetCommandLineA
GetVersionExA
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
WriteFile
OutputDebugStringA
LoadLibraryExA
GetCPInfo
GetACP
GetOEMCP
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
MultiByteToWideChar
InterlockedIncrement
RaiseException
CreateFileW
WideCharToMultiByte
CreateEventW
CloseHandle
Sleep
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
SetLastError
InterlockedDecrement
GetEnvironmentStringsW

winusb

WinUsb_GetOverlappedResult
WinUsb_ResetPipe
WinUsb_Free
WinUsb_SetPipePolicy
WinUsb_ReadPipe
WinUsb_WritePipe
WinUsb_GetDescriptor
WinUsb_QueryPipe
WinUsb_QueryInterfaceSettings
WinUsb_GetCurrentAlternateSetting
WinUsb_Initialize
WinUsb_AbortPipe

adbwinapi

??1AdbIOCompletion@@MAE@XZ
??0AdbEndpointObject@@QAE@PAVAdbInterfaceObject@@EE@Z
?AddRef@AdbObjectHandle@@UAEJXZ
?CreateHandle@AdbObjectHandle@@UAEPAXXZ
?IsObjectOfType@AdbObjectHandle@@UBE_NW4AdbObjectType@@@Z
?LastReferenceReleased@AdbObjectHandle@@MAEXXZ
?GetEndpointInformation@AdbEndpointObject@@UAE_NPAU_AdbEndpointInformation@@@Z
?AsyncRead@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?AsyncWrite@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?SyncRead@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?SyncWrite@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?CloseHandle@AdbObjectHandle@@UAE_NXZ
??0AdbInterfaceObject@@QAE@PBG@Z
?GetInterfaceName@AdbInterfaceObject@@UAE_NPAXPAK_N@Z
?GetUsbDeviceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_DEVICE_DESCRIPTOR@@@Z
?GetUsbConfigurationDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_CONFIGURATION_DESCRIPTOR@@@Z
?GetUsbInterfaceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_INTERFACE_DESCRIPTOR@@@Z
??1AdbInterfaceObject@@MAE@XZ
??0AdbIOCompletion@@QAE@PAVAdbEndpointObject@@KPAX@Z
?IsCompleted@AdbIOCompletion@@UAE_NXZ
??1AdbEndpointObject@@MAE@XZ

Exports

Exports

InstantiateWinUsbInterface

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Impactor.dat
.zip
busybox.armeabi
.elf linux arm
busybox.x86
.elf linux x86
extender.ipa
.zip
Payload/Extender.app/AppIcon29x29.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/AppIcon40x40.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/AppIcon60x60.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/AppIcon76x76@2x~ipad.png
.png
Payload/Extender.app/AppIcon76x76~ipad.png
.png
Payload/Extender.app/AppIcon83.5x83.5@2x~ipad.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/Default-Landscape.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/Default-Portrait.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/Default.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/Extender
.macho macos arch:arm64
Payload/Extender.app/Extender.dat
.zip
zip3.txt
Payload/Extender.app/Extender.dylib
.dylib macos arch:arm64
Payload/Extender.app/Extender.pem
Payload/Extender.app/Info.plist
.xml
Payload/Extender.app/PlugIns/Extender.VPN.appex/Extender.VPN
.macho macos arch:arm64
Payload/Extender.app/PlugIns/Extender.VPN.appex/Extender.VPN.dat
.zip
zip3.txt
Payload/Extender.app/PlugIns/Extender.VPN.appex/Extender.VPN.dylib
.dylib macos arch:arm64
Payload/Extender.app/PlugIns/Extender.VPN.appex/Extender.VPN.pem
Payload/Extender.app/PlugIns/Extender.VPN.appex/Info.plist
.xml
Payload/Extender.app/PlugIns/Extender.VPN.appex/_CodeSignature/CodeResources
.xml
Payload/Extender.app/_CodeSignature/CodeResources
.xml
Payload/Extender.app/ar.lproj/Localizable.strings
Payload/Extender.app/changes.png
.png
Payload/Extender.app/changes7.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/changes7s.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/de.lproj/Localizable.strings
Payload/Extender.app/el.lproj/Localizable.strings
Payload/Extender.app/en.lproj/Localizable.strings
Payload/Extender.app/es.lproj/Localizable.strings
Payload/Extender.app/fr.lproj/Localizable.strings
Payload/Extender.app/he.lproj/Localizable.strings
Payload/Extender.app/home.png
.png
Payload/Extender.app/home7.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/home7s.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/iOS7-Default-Landscape.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/iOS7-Default-Portrait.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/install.png
.png
Payload/Extender.app/install7.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/install7s.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/it.lproj/Localizable.strings
Payload/Extender.app/ja.lproj/Localizable.strings
Payload/Extender.app/ko.lproj/Localizable.strings
Payload/Extender.app/manage.png
.png
Payload/Extender.app/manage7.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/manage7s.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/nl.lproj/Localizable.strings
Payload/Extender.app/pl.lproj/Localizable.strings
Payload/Extender.app/pt-PT.lproj/Localizable.strings
Payload/Extender.app/pt.lproj/Localizable.strings
Payload/Extender.app/ru.lproj/Localizable.strings
Payload/Extender.app/search.png
.png
Payload/Extender.app/search7.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/search7s.png
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/[email protected]
.png
Payload/Extender.app/sv.lproj/Localizable.strings
Payload/Extender.app/th.lproj/Localizable.strings
Payload/Extender.app/tr.lproj/Localizable.strings
Payload/Extender.app/unknown.png
.png
Payload/Extender.app/vi.lproj/Localizable.strings
Payload/Extender.app/zh-Hans.lproj/Localizable.strings
Payload/Extender.app/zh-Hant.lproj/Localizable.strings
run.armeabi
.elf linux arm
run.x86
.elf linux x86
su.armeabi
.elf linux arm
su.x86
.elf linux x86
supersu.apk
.apk android arch:arm arch:x86

eu.chainfire.supersu

.MainActivity

Activities

.MainActivity

android.intent.action.MAIN

Permissions

android.permission.ACCESS_SUPERUSER
android.permission.WAKE_LOCK
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.GET_TASKS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.REBOOT

Receivers

.InstallReceiver

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED

.NativeAccessReceiver

eu.chainfire.supersu.NativeAccess

.BootCompleteReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.MY_PACKAGE_REPLACED

.UserPresentReceiver

android.intent.action.USER_PRESENT

.MainActivity$Launch

android.provider.Telephony.SECRET_CODE
android.provider.Telephony.SECRET_CODE

Services
Impactor.dll
.dll windows:4 windows x86 arch:x86

f04a7de02865203390658bd45b48d122

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CloseServiceHandle
ConvertSidToStringSidA
ConvertStringSidToSidA
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptGenKey
CryptGenRandom
CryptGetHashParam
CryptGetProvParam
CryptReleaseContext
CryptSetHashParam
CryptSetProvParam
CryptSignHashA
GetTokenInformation
InitializeSecurityDescriptor
OpenProcessToken
OpenSCManagerA
OpenServiceA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
SetSecurityDescriptorOwner

crypt32

CertCloseStore
CertDeleteCertificateFromStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreA
PFXImportCertStore

kernel32

CancelIo
CloseHandle
CreateDirectoryA
CreateEventA
CreateFileA
CreateFileW
CreateMutexA
CreateNamedPipeA
CreateProcessW
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputCharacterW
FindClose
FindFirstFileW
FindNextFileW
FindResourceA
FormatMessageA
FormatMessageW
FreeLibrary
GetACP
GetCPInfo
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExA
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameA
GetHandleInformation
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetProcessWorkingSetSize
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathA
GetThreadContext
GetThreadLocale
GetThreadPriority
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetVersionExA
GlobalMemoryStatus
InitializeCriticalSection
InterlockedCompareExchange
IsDBCSLeadByteEx
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalAlloc
LocalFree
LockFileEx
LockResource
MapViewOfFile
MoveFileExA
MoveFileExW
MultiByteToWideChar
OpenFileMappingA
OpenThread
PeekConsoleInputW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputW
ReadConsoleW
ReadFile
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryA
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetConsoleCursorPosition
SetConsoleMode
SetEvent
SetFilePointerEx
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepEx
SuspendThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoA
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile

msvcrt

__argv
__dllonexit
__doserrno
__mb_cur_max
__pioinfo
__setusermatherr
_access
_amsg_exit
_atoi64
_beginthread
_beginthreadex
_chmod
_close
_close
_dup
_endthread
_endthreadex
_errno
_exit
_fdopen
_filelengthi64
_fileno
_fileno
_findclose
_findfirst
_findnext
_fstat64
_fstati64
_fullpath
_get_osfhandle
_getch
_getcwd
_getpid
_gmtime64
_initterm
_iob
_localtime64
_lock
_lseek
_lseeki64
_mktime64
_open
_mkdir
_mkdir
_onexit
_open
_open_osfhandle
_read
_read
_setjmp3
_setmode
_setmode
_snprintf
_snwprintf
_sopen
_stat
_stat64
_stati64
_strdup
_stricmp
_stricmp
_stricmp
_strlwr
_strnicmp
_sys_nerr
_time64
_tempnam
_strdup
_umask
_unlink
_unlock
_vsnprintf
_vsnwprintf
_wcsdup
_wcsdup
_wcslwr
_wcsnicmp
_wfopen
_wgetenv
_wopen
_wputenv
_write
_write
_wstat
abort
atof
atoi
atol
calloc
clearerr
clock
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fscanf
fseek
fsetpos
ftell
fwprintf
fwrite
getc
getenv
gmtime
isalnum
isalpha
iscntrl
isgraph
islower
isprint
isspace
isupper
mktime
iswctype
isxdigit
localeconv
localtime
log10
longjmp
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
perror
printf
putc
putchar
puts
qsort
raise
rand
realloc
remove
rename
rewind
setlocale
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
swscanf
time
time
tolower
toupper
ungetc
vfprintf
vsprintf
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncpy
wcstombs

ole32

CoCreateGuid
CoTaskMemFree

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey

shell32

SHCreateDirectoryExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW

user32

ClientToScreen
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
EnableWindow
EnumChildWindows
GetActiveWindow
GetCapture
GetCaretPos
GetClassInfoExA
GetClientRect
GetClipboardOwner
GetClipboardViewer
GetCursorPos
GetDesktopWindow
GetFocus
GetInputState
GetMessageA
GetMessagePos
GetMessageTime
GetOpenClipboardWindow
GetParent
GetProcessWindowStation
GetSysColorBrush
GetUserObjectSecurity
GetWindowLongA
GetWindowRect
GetWindowTextA
LoadCursorA
LoadIconA
MessageBoxA
MessageBoxW
MoveWindow
PostMessageA
PostQuitMessage
RegisterClassExA
SendMessageA
SetTimer
SetWindowTextA
ShowWindow
TranslateMessage
UpdateWindow
wsprintfW

ws2_32

WSACleanup
WSAGetLastError
WSAIoctl
WSASetLastError
WSAStartup
WSAStringToAddressA
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Exports

Exports

afc_client_free
afc_client_new
afc_client_new_from_house_arrest_client
afc_client_new_with_service_client
afc_client_start_service
afc_dictionary_free
afc_file_close
afc_file_lock
afc_file_open
afc_file_read
afc_file_seek
afc_file_tell
afc_file_truncate
afc_file_write
afc_get_device_info
afc_get_device_info_key
afc_get_file_info
afc_make_directory
afc_make_link
afc_read_directory
afc_remove_path
afc_remove_path_and_contents
afc_rename_path
afc_set_file_time
afc_truncate
bsd_getopt
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info
cym_idevicebackup
cym_idevicebackup2
cym_idevicecrashreport
cym_idevicerestore
cym_idevicescreenshot
cym_idevicesyslog
cyr_main
debugserver_client_free
debugserver_client_new
debugserver_client_receive
debugserver_client_receive_response
debugserver_client_receive_with_timeout
debugserver_client_send
debugserver_client_send_command
debugserver_client_set_ack_mode
debugserver_client_set_argv
debugserver_client_set_environment_hex_encoded
debugserver_client_start_service
debugserver_command_free
debugserver_command_new
debugserver_decode_string
debugserver_encode_string
diagnostics_relay_client_free
diagnostics_relay_client_new
diagnostics_relay_client_start_service
diagnostics_relay_goodbye
diagnostics_relay_query_ioregistry_entry
diagnostics_relay_query_ioregistry_plane
diagnostics_relay_query_mobilegestalt
diagnostics_relay_request_diagnostics
diagnostics_relay_restart
diagnostics_relay_shutdown
diagnostics_relay_sleep
file_relay_client_free
file_relay_client_new
file_relay_client_start_service
file_relay_request_sources
file_relay_request_sources_timeout
heartbeat_client_free
heartbeat_client_new
heartbeat_client_start_service
heartbeat_receive
heartbeat_receive_with_timeout
heartbeat_send
house_arrest_client_free
house_arrest_client_new
house_arrest_client_start_service
house_arrest_get_result
house_arrest_send_command
house_arrest_send_request
idevice_connect
idevice_connection_disable_ssl
idevice_connection_enable_ssl
idevice_connection_get_fd
idevice_connection_receive
idevice_connection_receive_timeout
idevice_connection_send
idevice_device_list_free
idevice_disconnect
idevice_event_subscribe
idevice_event_unsubscribe
idevice_free
idevice_get_device_list
idevice_get_handle
idevice_get_udid
idevice_new
idevice_set_debug_level
instproxy_archive
instproxy_browse
instproxy_browse_with_callback
instproxy_check_capabilities_match
instproxy_client_free
instproxy_client_get_path_for_bundle_identifier
instproxy_client_new
instproxy_client_options_add
instproxy_client_options_free
instproxy_client_options_new
instproxy_client_options_set_return_attributes
instproxy_client_start_service
instproxy_command_get_name
instproxy_install
instproxy_lookup
instproxy_lookup_archives
instproxy_remove_archive
instproxy_restore
instproxy_status_get_current_list
instproxy_status_get_error
instproxy_status_get_name
instproxy_status_get_percent_complete
instproxy_uninstall
instproxy_upgrade
irecv_close
irecv_devices_get_all
irecv_devices_get_device_by_client
irecv_devices_get_device_by_hardware_model
irecv_devices_get_device_by_product_type
irecv_event_subscribe
irecv_event_unsubscribe
irecv_execute_script
irecv_exit
irecv_finish_transfer
irecv_get_device_info
irecv_get_mode
irecv_getenv
irecv_getret
irecv_init
irecv_open_with_ecid
irecv_open_with_ecid_and_attempts
irecv_reboot
irecv_receive
irecv_reconnect
irecv_recv_buffer
irecv_reset
irecv_reset_counters
irecv_saveenv
irecv_send_buffer
irecv_send_command
irecv_send_file
irecv_set_debug_level
irecv_setenv
irecv_strerror
irecv_trigger_limera1n_exploit
irecv_usb_bulk_transfer
irecv_usb_control_transfer
irecv_usb_set_configuration
irecv_usb_set_interface
libusb_alloc_streams@16
libusb_alloc_transfer@4
libusb_attach_kernel_driver@8
libusb_bulk_transfer@24
libusb_cancel_transfer@4
libusb_claim_interface@8
libusb_clear_halt@8
libusb_close@4
libusb_control_transfer@32
libusb_detach_kernel_driver@8
libusb_dev_mem_alloc@8
libusb_dev_mem_free@12
libusb_error_name@4
libusb_event_handler_active@4
libusb_event_handling_ok@4
libusb_exit@4
libusb_free_bos_descriptor@4
libusb_free_config_descriptor@4
libusb_free_container_id_descriptor@4
libusb_free_device_list@8
libusb_free_pollfds@4
libusb_free_ss_endpoint_companion_descriptor@4
libusb_free_ss_usb_device_capability_descriptor@4
libusb_free_streams@12
libusb_free_transfer@4
libusb_free_usb_2_0_extension_descriptor@4
libusb_get_active_config_descriptor@8
libusb_get_bos_descriptor@8
libusb_get_bus_number@4
libusb_get_config_descriptor@12
libusb_get_config_descriptor_by_value@12
libusb_get_configuration@8
libusb_get_container_id_descriptor@12
libusb_get_device@4
libusb_get_device_address@4
libusb_get_device_descriptor@8
libusb_get_device_list@8
libusb_get_device_speed@4
libusb_get_max_iso_packet_size@8
libusb_get_max_packet_size@8
libusb_get_next_timeout@8
libusb_get_parent@4
libusb_get_pollfds@4
libusb_get_port_number@4
libusb_get_port_numbers@12
libusb_get_port_path@16
libusb_get_ss_endpoint_companion_descriptor@12
libusb_get_ss_usb_device_capability_descriptor@12
libusb_get_string_descriptor_ascii@16
libusb_get_usb_2_0_extension_descriptor@12
libusb_get_version@0
libusb_handle_events@4
libusb_handle_events_completed@8
libusb_handle_events_locked@8
libusb_handle_events_timeout@8
libusb_handle_events_timeout_completed@12
libusb_has_capability@4
libusb_hotplug_deregister_callback@8
libusb_hotplug_register_callback@36
libusb_init@4
libusb_interrupt_event_handler@4
libusb_interrupt_transfer@24
libusb_kernel_driver_active@8
libusb_lock_event_waiters@4
libusb_lock_events@4
libusb_open@8
libusb_open_device_with_vid_pid@12
libusb_pollfds_handle_timeouts@4
libusb_ref_device@4
libusb_release_interface@8
libusb_reset_device@4
libusb_set_auto_detach_kernel_driver@8
libusb_set_configuration@8
libusb_set_debug@8
libusb_set_interface_alt_setting@12
libusb_set_option
libusb_set_pollfd_notifiers@16
libusb_setlocale@4
libusb_strerror@4
libusb_submit_transfer@4
libusb_transfer_get_stream_id@4
libusb_transfer_set_stream_id@8
libusb_try_lock_events@4
libusb_unlock_event_waiters@4
libusb_unlock_events@4
libusb_unref_device@4
libusb_wait_for_event@8
libusbmuxd_set_debug_level
libusbmuxd_set_use_inotify
lockdownd_activate
lockdownd_client_free
lockdownd_client_new
lockdownd_client_new_with_handshake
lockdownd_client_set_label
lockdownd_data_classes_free
lockdownd_deactivate
lockdownd_enter_recovery
lockdownd_get_device_name
lockdownd_get_device_udid
lockdownd_get_sync_data_classes
lockdownd_get_value
lockdownd_goodbye
lockdownd_pair
lockdownd_pair_with_options
lockdownd_query_type
lockdownd_receive
lockdownd_remove_value
lockdownd_send
lockdownd_service_descriptor_free
lockdownd_set_value
lockdownd_start_service
lockdownd_start_service_with_escrow_bag
lockdownd_start_session
lockdownd_stop_session
lockdownd_unpair
lockdownd_validate_pair
misagent_client_free
misagent_client_new
misagent_client_start_service
misagent_copy
misagent_copy_all
misagent_get_status_code
misagent_install
misagent_remove
mobile_image_mounter_free
mobile_image_mounter_hangup
mobile_image_mounter_lookup_image
mobile_image_mounter_mount_image
mobile_image_mounter_new
mobile_image_mounter_start_service
mobile_image_mounter_upload_image
mobileactivation_activate
mobileactivation_activate_with_session
mobileactivation_client_free
mobileactivation_client_new
mobileactivation_client_start_service
mobileactivation_create_activation_info
mobileactivation_create_activation_info_with_session
mobileactivation_create_activation_session_info
mobileactivation_deactivate
mobileactivation_get_activation_state
mobilebackup2_client_free
mobilebackup2_client_new
mobilebackup2_client_start_service
mobilebackup2_receive_message
mobilebackup2_receive_raw
mobilebackup2_send_message
mobilebackup2_send_raw
mobilebackup2_send_request
mobilebackup2_send_status_response
mobilebackup2_version_exchange
mobilebackup_client_free
mobilebackup_client_new
mobilebackup_client_start_service
mobilebackup_receive
mobilebackup_receive_restore_application_received
mobilebackup_receive_restore_file_received
mobilebackup_request_backup
mobilebackup_request_restore
mobilebackup_send
mobilebackup_send_backup_file_received
mobilebackup_send_error
mobilebackup_send_restore_complete
mobilesync_acknowledge_changes_from_device
mobilesync_actions_add
mobilesync_actions_free
mobilesync_actions_new
mobilesync_anchors_free
mobilesync_anchors_new
mobilesync_cancel
mobilesync_clear_all_records_on_device
mobilesync_client_free
mobilesync_client_new
mobilesync_client_start_service
mobilesync_finish
mobilesync_get_all_records_from_device
mobilesync_get_changes_from_device
mobilesync_ready_to_send_changes_from_computer
mobilesync_receive
mobilesync_receive_changes
mobilesync_remap_identifiers
mobilesync_send
mobilesync_send_changes
mobilesync_start
mount_free_export_list
mount_getexports
mount_getexports_async
mountstat3_to_errno
mountstat3_to_str
nfs4_set_client_name
nfs4_set_verifier
nfs_access
nfs_access2
nfs_access2_async
nfs_access_async
nfs_chdir
nfs_chdir_async
nfs_chmod
nfs_chmod_async
nfs_chown
nfs_chown_async
nfs_close
nfs_close_async
nfs_closedir
nfs_creat
nfs_creat_async
nfs_create
nfs_create_async
nfs_destroy_context
nfs_destroy_url
nfs_fchmod
nfs_fchmod_async
nfs_fchown
nfs_fchown_async
nfs_fcntl
nfs_fcntl_async
nfs_fstat
nfs_fstat64
nfs_fstat64_async
nfs_fstat_async
nfs_fsync
nfs_fsync_async
nfs_ftruncate
nfs_ftruncate_async
nfs_get_error
nfs_get_fd
nfs_get_fh
nfs_get_readmax
nfs_get_rpc_context
nfs_get_timeout
nfs_get_writemax
nfs_getcwd
nfs_init_context
nfs_lchmod
nfs_lchmod_async
nfs_lchown
nfs_lchown_async
nfs_link
nfs_link_async
nfs_lockf
nfs_lockf_async
nfs_lseek
nfs_lseek_async
nfs_lstat64
nfs_lstat64_async
nfs_lutimes
nfs_lutimes_async
nfs_mkdir
nfs_mkdir2
nfs_mkdir2_async
nfs_mkdir_async
nfs_mknod
nfs_mknod_async
nfs_mount
nfs_mount_async
nfs_open
nfs_open2
nfs_open2_async
nfs_open_async
nfs_opendir
nfs_opendir_async
nfs_pagecache_init
nfs_pagecache_invalidate
nfs_parse_url_dir
nfs_parse_url_full
nfs_parse_url_incomplete
nfs_pread
nfs_pread_async
nfs_pwrite
nfs_pwrite_async
nfs_queue_length
nfs_read
nfs_read_async
nfs_readdir
nfs_readlink
nfs_readlink2
nfs_readlink_async
nfs_rename
nfs_rename_async
nfs_rewinddir
nfs_rmdir
nfs_rmdir_async
nfs_seekdir
nfs_service
nfs_set_auth
nfs_set_autoreconnect
nfs_set_debug

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 7.6MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Impactor.exe
.exe windows:4 windows x86 arch:x86

e09cbf76574fe075f2c44d09748c4195

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges
CryptAcquireContextA
CryptGenRandom
DeregisterEventSource
GetUserNameW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegisterEventSourceA
ReportEventA

comctl32

CreateUpDownControl
ImageList_Add
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_Draw
ImageList_EndDrag
ImageList_GetIcon
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetDragCursorImage
InitCommonControls

comdlg32

ChooseFontW
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
PageSetupDlgW
PrintDlgW

crypt32

CryptProtectData
CryptUnprotectData

gdi32

Arc
BitBlt
CloseEnhMetaFile
CombineRgn
CopyEnhMetaFileW
CreateBitmap
CreateBitmapIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateDIBitmap
CreateEnhMetaFileW
CreateFontIndirectW
CreateHatchBrush
CreateICW
CreatePalette
CreatePatternBrush
CreatePen
CreatePolygonRgn
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
Ellipse
EndDoc
EndPage
EnumFontFamiliesExW
EqualRgn
ExcludeClipRect
ExtCreatePen
ExtCreateRegion
ExtFloodFill
ExtSelectClipRgn
ExtTextOutW
GdiFlush
GetBkColor
GetCharABCWidthsW
GetClipBox
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetEnhMetaFileHeader
GetEnhMetaFileW
GetMetaFileBitsEx
GetNearestPaletteIndex
GetObjectA
GetObjectW
GetOutlineTextMetricsW
GetPaletteEntries
GetPixel
GetRegionData
GetRgnBox
GetStockObject
GetSystemPaletteEntries
GetTextExtentExPointW
GetTextExtentPoint32W
GetTextMetricsW
GetWinMetaFileBits
LineTo
MaskBlt
MoveToEx
OffsetRgn
Pie
PlayEnhMetaFile
PolyBezier
PolyPolygon
Polygon
Polyline
PtInRegion
RealizePalette
RectInRegion
Rectangle
RoundRect
SelectClipRgn
SelectObject
SelectPalette
SetAbortProc
SetBkColor
SetBkMode
SetBrushOrgEx
SetMapMode
SetMetaFileBitsEx
SetPixel
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextAlign
SetTextColor
SetViewportExtEx
SetViewportOrgEx
SetWinMetaFileBits
SetWindowExtEx
SetWindowOrgEx
StartDocW
StartPage
StretchBlt
StretchDIBits

kernel32

AllocConsole
CloseHandle
CopyFileW
CreateEventA
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileW
CreateMutexA
CreateMutexW
CreatePipe
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DebugBreak
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
EnumResourceNamesW
ExitProcess
ExpandEnvironmentStringsW
FillConsoleOutputCharacterW
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindResourceW
FindVolumeClose
FormatMessageW
FreeConsole
FreeLibrary
GetACP
GetCPInfo
GetCommandLineW
GetComputerNameW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeW
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetHandleInformation
GetLastError
GetLocaleInfoW
GetLogicalDriveStringsW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProfileStringW
GetShortPathNameW
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadPriority
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalSize
GlobalUnlock
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
IsBadReadPtr
IsBadStringPtrA
IsDBCSLeadByteEx
IsValidCodePage
IsValidLocale
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LocalFree
LockResource
MapViewOfFile
MulDiv
MultiByteToWideChar
OpenProcess
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputA
ReadConsoleOutputCharacterA
ReadFile
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetConsoleCursorPosition
SetConsoleMode
SetCurrentDirectoryW
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetFileTime
SetHandleInformation
SetLastError
SetNamedPipeHandleState
SetProcessAffinityMask
SetThreadContext
SetThreadLocale
SetThreadPriority
SetUnhandledExceptionFilter
SignalObjectAndWait
SizeofResource
Sleep
SuspendThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile

msvcrt

__argc
__argv
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_access
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_chmod
_chsize
_commit
_close
_close
_ctime64
_dup
_dup2
_endthread
_endthreadex
_environ
_errno
_exit
_fdopen
_fdopen
_filelengthi64
_fileno
_fileno
_findclose
_findfirst
_findnext
_fmode
_fstat64
_fstati64
_fullpath
_get_osfhandle
_getch
_getcwd
_getcwd
_getpid
_gmtime64
_initterm
_iob
_localtime64
_lock
_lseeki64
_mktime64
_open
_mkdir
_mkdir
_onexit
_open
_open_osfhandle
_putws
_read
_read
_setjmp3
_setmode
_sleep
_snwprintf
_stat
_stati64
_strdup
_stricmp
_stricmp
_strnicmp
_telli64
_time64
_strdup
_timezone
_tzset
_umask
_unlink
_unlock
_utime
_vsnprintf
_waccess
_wchmod
_wcsdup
_wfindfirst
_wfindnext
_wfopen
_wfullpath
_wgetenv
_wmkdir
_wopen
_wperror
_wputenv
_wremove
_wrename
_write
_write
_wrmdir
_wstat64
_wstat
_wtoi
_wtol
_wunlink
_wutime64
abort
ctime
atof
atoi
atol
bsearch
calloc
clearerr
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fputwc
fputws
fread
free
frexp
fseek
fsetpos
ftell
fwprintf
fwrite
getc
getenv
getwc
gmtime
isalnum
isalpha
islower
isspace
isupper
iswalnum
mktime
iswalpha
iswctype
iswdigit
iswprint
iswspace
isxdigit
localeconv
localtime
log10
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
perror
printf
putc
putchar
puts
putwc
qsort
raise
rand
realloc
remove
rename
rewind
setlocale
setvbuf
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtod
strtok
strtol
strtoul
strxfrm
swscanf
time
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
vsprintf
vswprintf
wcscat
wcschr
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsncpy
wcspbrk
wcsspn
wcsstr
wcstod
wcstol
wcstombs
wcstoul
wcsxfrm

ole32

CoCreateInstance
CoLockObjectExternal
CoTaskMemAlloc
OleFlushClipboard
OleGetClipboard
OleInitialize
OleIsCurrentClipboard
OleSetClipboard
OleUninitialize
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop

oleaut32

SafeArrayCreate
SafeArrayDestroy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetVartype
SafeArrayLock
SafeArrayUnlock
SysAllocString
SysFreeString
SysReAllocString
SysStringLen
SystemTimeToVariantTime
VarBstrFromCy
VariantInit
VariantTimeToSystemTime

shell32

DragAcceptFiles
DragFinish
DragQueryFileW
DragQueryPoint
ExtractIconExW
ExtractIconW
SHFileOperationW
SHGetFileInfoW
SHGetFolderPathA
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW

user32

AdjustWindowRectEx
AppendMenuW
BeginDeferWindowPos
BeginPaint
BringWindowToTop
CallNextHookEx
CallWindowProcW
ChangeDisplaySettingsW
CheckMenuItem
CheckMenuRadioItem
ChildWindowFromPoint
ChildWindowFromPointEx
ClientToScreen
CloseClipboard
CopyRect
CreateAcceleratorTableW
CreateDialogIndirectParamW
CreateDialogParamW
CreateIconIndirect
CreateMenu
CreatePopupMenu
CreateWindowExW
DdeClientTransaction
DdeConnect
DdeCreateDataHandle
DdeCreateStringHandleW
DdeDisconnect
DdeFreeDataHandle
DdeFreeStringHandle
DdeGetData
DdeGetLastError
DdeInitializeW
DdeNameService
DdePostAdvise
DdeQueryStringW
DdeUninitialize
DefFrameProcW
DefMDIChildProcW
DefWindowProcW
DeferWindowPos
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawMenuBar
DrawStateW
DrawTextW
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndDeferWindowPos
EndPaint
EnumClipboardFormats
EnumDisplaySettingsW
EnumWindows
ExitWindowsEx
FillRect
FindWindowExW
FlashWindow
GetActiveWindow
GetAsyncKeyState
GetCapture
GetClassInfoW
GetClassNameW
GetClientRect
GetClipboardData
GetClipboardFormatNameW
GetCursorPos
GetDC
GetDesktopWindow
GetDialogBaseUnits
GetDlgItem
GetDoubleClickTime
GetFocus
GetIconInfo
GetKeyState
GetMenuItemCount
GetMenuItemInfoW
GetMenuState
GetMenuStringW
GetMessagePos
GetMessageTime
GetMessageW
GetParent
GetProcessWindowStation
GetScrollInfo
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetUpdateRgn
GetUserObjectInformationW
GetWindow
GetWindowDC
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
HideCaret
InflateRect
InsertMenuItemW
InsertMenuW
InvalidateRect
IsClipboardFormatAvailable
IsDialogMessageW
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadAcceleratorsW
LoadBitmapW
LoadCursorFromFileW
LoadCursorW
LoadIconW
LoadImageW
MapVirtualKeyA
MapVirtualKeyW
MapWindowPoints
MessageBeep
MessageBoxA
MessageBoxW
ModifyMenuW
MoveWindow
MsgWaitForMultipleObjects
OffsetRect
OpenClipboard
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PtInRect
RedrawWindow
RegisterClassW
RegisterClipboardFormatW
RegisterHotKey
ReleaseCapture
ReleaseDC
RemoveMenu
ScreenToClient
ScrollWindow
SendMessageW
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemInfoW
SetParent
SetRect
SetScrollInfo
SetTimer
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowCaret
ShowCursor
ShowWindow
SystemParametersInfoW
ToAscii
TrackPopupMenu
TranslateAcceleratorW
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnionRect
UnregisterClassW
UnregisterHotKey
UpdateWindow
ValidateRect
ValidateRgn
VkKeyScanW
WaitForInputIdle
WindowFromPoint
keybd_event

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

ws2_32

WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSASetLastError
gethostbyaddr
getservbyname
getservbyport
inet_addr
inet_ntoa

wsock32

WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
select
send
setsockopt
shutdown
socket

adbwinapi

AdbCloseHandle
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetEndpointInformation
AdbGetInterfaceName
AdbGetSerialNumber
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbReadEndpointSync
AdbWriteEndpointSync

impactor

afc_client_free
afc_client_new
afc_client_new_with_service_client
afc_file_close
afc_file_open
afc_file_read
afc_file_seek
afc_file_tell
afc_file_truncate
afc_file_write
afc_get_device_info
afc_get_file_info
afc_make_directory
afc_make_link
afc_read_directory
afc_remove_path
afc_remove_path_and_contents
afc_rename_path
afc_set_file_time
afc_truncate
bsd_getopt
curl_easy_cleanup
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_easy_strerror
curl_global_init
curl_slist_append
curl_slist_free_all
cym_idevicebackup
cym_idevicebackup2
cym_idevicecrashreport
cym_idevicerestore
cym_idevicescreenshot
cym_idevicesyslog
cyr_main
idevice_connection_receive_timeout
idevice_connection_send
idevice_disconnect
idevice_free
idevice_get_udid
idevice_set_debug_level
instproxy_browse
instproxy_client_free
instproxy_client_new
instproxy_client_options_add
instproxy_client_options_free
instproxy_client_options_new
instproxy_client_options_set_return_attributes
instproxy_lookup
libusb_attach_kernel_driver@8
libusb_bulk_transfer@24
libusb_claim_interface@8
libusb_close@4
libusb_control_transfer@32
libusb_detach_kernel_driver@8
libusb_exit@4
libusb_free_config_descriptor@4
libusb_free_device_list@8
libusb_get_config_descriptor@12
libusb_get_device_descriptor@8
libusb_get_device_list@8
libusb_get_string_descriptor_ascii@16
libusb_init@4
libusb_open@8
libusb_ref_device@4
libusb_release_interface@8
libusb_set_debug@8
libusb_set_interface_alt_setting@12
libusb_unref_device@4
libusbmuxd_set_debug_level
lockdownd_client_free
lockdownd_client_new_with_handshake
lockdownd_get_device_name
lockdownd_get_value
lockdownd_service_descriptor_free
lockdownd_start_service
lockdownd_start_service_with_escrow_bag
mobilebackup2_client_free
mobilebackup2_client_new
mobilebackup2_send_request
mobilebackup2_send_status_response
mobilebackup2_version_exchange
nfs_close
nfs_closedir
nfs_fstat64
nfs_ftruncate
nfs_link
nfs_lseek
nfs_lstat64
nfs_mkdir2
nfs_open
nfs_opendir
nfs_read
nfs_readdir
nfs_rename
nfs_rewinddir
nfs_rmdir
nfs_symlink
nfs_truncate
nfs_unlink
nfs_utimes
nfs_write
plist_array_append_item
plist_array_get_item
plist_array_get_size
plist_array_remove_item
plist_array_set_item
plist_copy
plist_dict_get_item
plist_dict_get_size
plist_dict_new_iter
plist_dict_next_item
plist_dict_remove_item
plist_dict_set_item
plist_free
plist_from_bin
plist_from_memory
plist_from_xml
plist_get_bool_val
plist_get_data_val
plist_get_node_type
plist_get_real_val
plist_get_string_val
plist_get_uint_val
plist_new_array
plist_new_bool
plist_new_data
plist_new_date
plist_new_dict
plist_new_real
plist_new_string
plist_new_uint
plist_to_bin
plist_to_xml
property_list_service_client_free
property_list_service_client_new
property_list_service_receive_plist_with_timeout
property_list_service_send_xml_plist
usbmuxd_subscribe
usbmuxd_unsubscribe
wdi_create_list@8
wdi_destroy_list@4
wdi_install_driver@16
wdi_prepare_driver@16
wdi_strerror@4
zip_close
zip_error_fini
zip_error_init
zip_error_set
zip_error_strerror
zip_error_to_data
zip_fclose
zip_file_get_error
zip_file_get_external_attributes
zip_fopen_index
zip_fread
zip_fseek
zip_ftell
zip_get_error
zip_get_name
zip_get_num_entries
zip_name_locate
zip_open_from_source
zip_source_free
zip_source_function_create
zip_stat_index
zip_stat_init

Sections

.text
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 203KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Impactor.pem
WinSparkle.dll
.dll windows:5 windows x86 arch:x86

4507e40cf23f097d52b0ef3f70b350b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Z:\home\Development\winsparkle\Release\WinSparkle.pdb

Imports

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

GetTickCount
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetModuleHandleA
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryA
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
QueryPerformanceCounter
CompareStringW
SetEnvironmentVariableA
GetVersionExW
GetEnvironmentVariableW
DebugBreak
FormatMessageW
LoadLibraryW
CreateFileW
GetFileAttributesW
GetTempPathW
FindFirstFileW
FindClose
WaitForMultipleObjects
OutputDebugStringW
SetCurrentDirectoryW
FreeConsole
GetConsoleScreenBufferInfo
ReadConsoleOutputCharacterA
SetConsoleCursorPosition
FillConsoleOutputCharacterW
SetErrorMode
GetCommandLineW
MulDiv
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ReadFile
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleW
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
HeapReAlloc
HeapAlloc
GetCommandLineA
CreateThread
GetCurrentThreadId
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
MultiByteToWideChar
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
ResumeThread
CloseHandle
CreateEventW
RaiseException
Sleep
SetEvent
WaitForSingleObject
DeleteCriticalSection
LockResource
GetModuleFileNameW
SizeofResource
InitializeCriticalSection
LoadResource
FindResourceA
LocalFree
OutputDebugStringA
GetLastError
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
GetFullPathNameW
GetDriveTypeA
SetEnvironmentVariableW
GetCurrentDirectoryA
SetEndOfFile
CompareStringA
GetProcessHeap

advapi32

RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey

ole32

OleInitialize
OleUninitialize
OleLockRunning
OleSetContainedObject
OleRun
CoCreateInstance

comctl32

ImageList_Add
ImageList_Destroy
ImageList_Create
ord17
ImageList_Replace

user32

DrawIconEx
DestroyCursor
GetWindowDC
BeginPaint
EndPaint
MapWindowPoints
FindWindowExW
ChangeDisplaySettingsW
EnumDisplaySettingsW
CopyRect
LoadIconW
LoadImageW
LoadBitmapW
GetDlgItem
CreateDialogParamW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetActiveWindow
GetAsyncKeyState
VkKeyScanW
GetMessageTime
EndDeferWindowPos
BeginDeferWindowPos
GetWindow
FillRect
GetUpdateRgn
GetSysColor
InflateRect
IsWindowVisible
IsWindowEnabled
IsDialogMessageW
CallWindowProcW
DeferWindowPos
ClientToScreen
ScreenToClient
UpdateWindow
RedrawWindow
SetParent
GetParent
WindowFromPoint
IsWindow
ScrollWindow
EnableScrollBar
SetScrollInfo
DrawFrameControl
SetCursorPos
SetCursor
GetDoubleClickTime
GetCursorPos
GetCapture
ReleaseCapture
SetCapture
EnableWindow
GetFocus
SetFocus
FlashWindow
GetMenu
AdjustWindowRectEx
GetClientRect
SetWindowRgn
DrawMenuBar
EnableMenuItem
GetSystemMenu
SetWindowPos
GetDesktopWindow
SetWindowLongW
GetWindowLongW
GetWindowPlacement
IsIconic
IsZoomed
ShowWindow
BringWindowToTop
SetWindowTextW
MoveWindow
CreateDialogIndirectParamW
GetWindowRect
GetSystemMetrics
CreateIconIndirect
GetDC
GetIconInfo
DestroyIcon
GetKeyState
LoadCursorW
MsgWaitForMultipleObjects
KillTimer
SetTimer
PeekMessageW
DefWindowProcW
DestroyWindow
SendMessageW
UnregisterClassW
PostThreadMessageW
MessageBoxW
CreateWindowExW
SetMenu
GetMessageW
ValidateRect
SetActiveWindow
SetForegroundWindow
GetClassNameW
GetWindowTextW
GetWindowTextLengthW
DispatchMessageW
TranslateMessage
GetScrollInfo
InvalidateRect
RegisterClassW
PostMessageW
SystemParametersInfoW
OffsetRect
DrawFocusRect
PtInRect
DrawTextW
ReleaseDC

gdi32

PolyPolygon
Polygon
SetPolyFillMode
Polyline
Rectangle
SetPixel
Arc
Pie
GetPixel
ExtFloodFill
GetBkColor
SetMapMode
SelectClipRgn
ExtSelectClipRgn
GetClipBox
SetStretchBltMode
LineTo
MoveToEx
GetStockObject
GetObjectW
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
RoundRect
Ellipse
MaskBlt
ExtTextOutW
SetBrushOrgEx
SetROP2
GetCharABCWidthsW
GetTextExtentExPointW
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetWindowOrgEx
StretchBlt
StretchDIBits
CreateDIBSection
GetDIBits
GetDIBColorTable
CreateDIBitmap
CreatePatternBrush
CreateHatchBrush
ExtCreatePen
SaveDC
RestoreDC
CombineRgn
GetRgnBox
EqualRgn
SetBkMode
PtInRegion
RectInRegion
CreateSolidBrush
CreatePen
GetDeviceCaps
CreateFontIndirectW
GetOutlineTextMetricsW
CreateRectRgn
ExcludeClipRect
GetTextMetricsW
GetTextExtentPoint32W
GdiFlush
OffsetRgn
ExtCreateRegion
DeleteObject
SetTextColor
SetBkColor
BitBlt
SelectObject
GetRegionData

shell32

ExtractIconW
ExtractIconExW
DragFinish
DragQueryPoint
DragQueryFileW
DragAcceptFiles
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW

oleaut32

SafeArrayUnaccessData
SafeArrayDestroy
SysAllocString
SysFreeString
VariantInit
SafeArrayCreate
SafeArrayAccessData

Exports

Exports

win_sparkle_check_update_with_ui
win_sparkle_cleanup
win_sparkle_init
win_sparkle_set_app_details
win_sparkle_set_appcast_url
win_sparkle_set_registry_path

Sections

.text
Size: 589KB - Virtual size: 589KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 219KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

776334619bd19ec23e3a7a275473b5a7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

kernel32

setupapi

Exports

Exports

Sections

.text Size: 81KB - Virtual size: 81KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

72b8c869f01047191838df5f58e88dd8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

kernel32

winusb

adbwinapi

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 49KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

eu.chainfire.supersu

.MainActivity

Activities

.MainActivity

Permissions

Receivers

.InstallReceiver

.NativeAccessReceiver

.BootCompleteReceiver

.UserPresentReceiver

.MainActivity$Launch

Services

f04a7de02865203390658bd45b48d122

Headers

File Characteristics

Imports

advapi32

crypt32

kernel32

msvcrt

ole32

setupapi

shell32

user32

ws2_32

Exports

Exports

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.data Size: 36KB - Virtual size: 36KB

.rdata Size: 7.6MB - Virtual size: 7.6MB

.bss Size: - Virtual size: 18KB

.edata Size: 29KB - Virtual size: 28KB

.idata Size: 13KB - Virtual size: 12KB

.CRT Size: 512B - Virtual size: 48B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 141KB - Virtual size: 140KB

e09cbf76574fe075f2c44d09748c4195

Headers

File Characteristics

Imports

.text
Size: 81KB - Virtual size: 81KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 50KB - Virtual size: 49KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 36KB - Virtual size: 36KB

.rdata
Size: 7.6MB - Virtual size: 7.6MB

.bss
Size: - Virtual size: 18KB

.edata
Size: 29KB - Virtual size: 28KB

.idata
Size: 13KB - Virtual size: 12KB

.CRT
Size: 512B - Virtual size: 48B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 141KB - Virtual size: 140KB

.text
Size: 6.2MB - Virtual size: 6.2MB

.data
Size: 240KB - Virtual size: 240KB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.bss
Size: - Virtual size: 203KB

.idata
Size: 29KB - Virtual size: 28KB

.CRT
Size: 512B - Virtual size: 56B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 30KB - Virtual size: 29KB

.text
Size: 589KB - Virtual size: 589KB

.rdata
Size: 219KB - Virtual size: 219KB

.data
Size: 22KB - Virtual size: 64KB

.tls
Size: 512B - Virtual size: 13B

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 76KB - Virtual size: 76KB