libcapstone[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

libcapstone.dll
Size

7.2MB
MD5

c5e887e4c38d1f94dcdfebc519ab0fcb
SHA1

412c42f5f84c5cfc6df3e396376c39f1f49069af
SHA256

bfc5ebe59fd2fcb9491086315c7b8a3b20af65523cc45bf3c73872cb21bedd0a
SHA512

a7fd7d158bdc9c1e0ff2323a9de3f7225aee36f5796d39d4846ecb268bcab0c98cb2afbfac857e4fdd1221a2e44a358e011499640c72a1600284a0423fff381f
SSDEEP

49152:oLVELE1bGKeJ3YZN+JZ9ulhTn/ZcCD0ED/p1F3B:awEbDWoZYkhzys0EDXF3B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libcapstone.dll

Files

libcapstone.dll
.dll windows:4 windows x64 arch:x64

5c8f8af1c4cf945d36e9fc61452cdb0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetLastError
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
_write
abort
atoi
calloc
fputc
free
fwrite
localeconv
malloc
memcpy
memmove
memset
realloc
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strrchr
strstr
vfprintf
wcslen

Exports

Exports

AArch64SysReg_genericRegisterString
AArch64_getFeatureBits
AArch64_getInstruction
AArch64_get_insn_id
AArch64_get_op_access
AArch64_global_init
AArch64_group_name
AArch64_init
AArch64_insn_name
AArch64_map_insn
AArch64_map_sys_op
AArch64_map_vregister
AArch64_option
AArch64_post_printer
AArch64_printInst
AArch64_reg_access
AArch64_reg_name
ARM_addReg
ARM_addSysReg
ARM_addUserMode
ARM_addVectorDataSize
ARM_addVectorDataType
ARM_blx_to_arm_mode
ARM_getFeatureBits
ARM_getInstruction
ARM_getRegName
ARM_get_detail_op
ARM_get_insn_id
ARM_get_op_access
ARM_global_init
ARM_group_name
ARM_init
ARM_insn_name
ARM_option
ARM_post_printer
ARM_printInst
ARM_reg_access
ARM_reg_name
ARM_reg_name2
ARM_rel_branch
BPF_getInstruction
BPF_get_insn_id
BPF_global_init
BPF_group_name
BPF_insn_name
BPF_option
BPF_printInst
BPF_reg_access
BPF_reg_name
EVM_getInstruction
EVM_get_insn_id
EVM_global_init
EVM_group_name
EVM_insn_name
EVM_option
EVM_printInst
M680X_disassembler_init
M680X_getInstruction
M680X_get_insn_id
M680X_global_init
M680X_group_name
M680X_insn_name
M680X_instprinter_init
M680X_option
M680X_printInst
M680X_reg_access
M680X_reg_name
M68K_getInstruction
M68K_get_insn_id
M68K_global_init
M68K_group_name
M68K_insn_name
M68K_option
M68K_printInst
M68K_reg_name
MCInst_Init
MCInst_addOperand2
MCInst_clear
MCInst_getNumOperands
MCInst_getOpcode
MCInst_getOpcodePub
MCInst_getOperand
MCInst_handleWriteback
MCInst_insert0
MCInst_isPredicable
MCInst_opIsTied
MCInst_opIsTying
MCInst_setOpcode
MCInst_setOpcodePub
MCOperandInfo_getOperandConstraint
MCOperandInfo_isOptionalDef
MCOperandInfo_isPredicate
MCOperandInfo_isTiedToOp
MCOperand_CreateImm0
MCOperand_CreateImm1
MCOperand_CreateReg0
MCOperand_CreateReg1
MCOperand_getFPImm
MCOperand_getImm
MCOperand_getReg
MCOperand_isDFPImm
MCOperand_isExpr
MCOperand_isFPImm
MCOperand_isImm
MCOperand_isInst
MCOperand_isReg
MCOperand_isValid
MCOperand_setFPImm
MCOperand_setImm
MCOperand_setReg
MCRegisterClass_contains
MCRegisterInfo_InitMCRegisterInfo
MCRegisterInfo_getMatchingSuperReg
MCRegisterInfo_getRegClass
MCRegisterInfo_getSubReg
MOS65XX_getInstruction
MOS65XX_get_insn_id
MOS65XX_global_init
MOS65XX_group_name
MOS65XX_insn_name
MOS65XX_option
MOS65XX_printInst
MOS65XX_reg_name
Mips_getInstruction
Mips_get_insn_id
Mips_global_init
Mips_group_name
Mips_init
Mips_insn_name
Mips_map_insn
Mips_map_register
Mips_option
Mips_printInst
Mips_reg_name
PPC_abs_branch
PPC_alias_insn
PPC_getInstruction
PPC_get_detail_op
PPC_get_insn_id
PPC_global_init
PPC_group_name
PPC_init
PPC_insn_name
PPC_map_insn
PPC_name_reg
PPC_option
PPC_post_printer
PPC_printInst
PPC_reg_name
RISCV_getInstruction
RISCV_get_insn_id
RISCV_global_init
RISCV_group_name
RISCV_init
RISCV_insn_name
RISCV_map_insn
RISCV_map_register
RISCV_option
RISCV_printInst
RISCV_reg_name
SH_getInstruction
SH_get_insn_id
SH_global_init
SH_group_name
SH_insn_name
SH_option
SH_printInst
SH_reg_access
SH_reg_name
SStream_Init
SStream_concat
SStream_concat0
SStream_concat1
Sparc_addReg
Sparc_getInstruction
Sparc_get_insn_id
Sparc_global_init
Sparc_group_name
Sparc_init
Sparc_insn_name
Sparc_map_FCC
Sparc_map_ICC
Sparc_map_hint
Sparc_map_insn
Sparc_map_register
Sparc_option
Sparc_post_printer
Sparc_printInst
Sparc_reg_name
SystemZMC_AR32Regs
SystemZMC_CR64Regs
SystemZMC_FP128Regs
SystemZMC_FP32Regs
SystemZMC_FP64Regs
SystemZMC_GR128Regs
SystemZMC_GR32Regs
SystemZMC_GR64Regs
SystemZMC_GRH32Regs
SystemZMC_VR128Regs
SystemZMC_VR32Regs
SystemZMC_VR64Regs
SystemZMC_getFirstReg
SystemZ_getInstruction
SystemZ_get_insn_id
SystemZ_global_init
SystemZ_group_name
SystemZ_init
SystemZ_insn_name
SystemZ_map_register
SystemZ_option
SystemZ_post_printer
SystemZ_printInst
SystemZ_reg_name
TMS320C64x_getInstruction
TMS320C64x_get_insn_id
TMS320C64x_global_init
TMS320C64x_group_name
TMS320C64x_init
TMS320C64x_insn_name
TMS320C64x_map_register
TMS320C64x_option
TMS320C64x_post_printer
TMS320C64x_printInst
TMS320C64x_reg_id
TMS320C64x_reg_name
TRICORE_global_init
TRICORE_option
Thumb_getInstruction
TriCore_LLVM_getInstruction
TriCore_LLVM_getRegisterName
TriCore_LLVM_printInst
TriCore_getFeatureBits
TriCore_getInstruction
TriCore_getRegisterName
TriCore_get_detail_op
TriCore_get_insn_id
TriCore_group_name
TriCore_init_mri
TriCore_insn_name
TriCore_printInst
TriCore_reg_access
TriCore_set_access
TriCore_set_instr_map_data
WASM_getInstruction
WASM_get_insn_id
WASM_global_init
WASM_group_name
WASM_insn_name
WASM_kind_name
WASM_option
WASM_printInst
X86_ATT_printInst
X86_Intel_printInst
X86_getInstruction
X86_get_insn_id
X86_get_op_access
X86_global_init
X86_group_name
X86_immediate_size
X86_init
X86_insn_name
X86_insn_reg_att
X86_insn_reg_att2
X86_insn_reg_intel
X86_insn_reg_intel2
X86_lockrep
X86_option
X86_reg_access
X86_reg_name
X86_register_map
XCore_getInstruction
XCore_get_insn_id
XCore_global_init
XCore_group_name
XCore_init
XCore_insn_extract
XCore_insn_name
XCore_map_register
XCore_option
XCore_post_printer
XCore_printInst
XCore_reg_id
XCore_reg_name
arch_masks
arm64_op_addFP
arm64_op_addImm
arm64_op_addReg
arm64_op_addVectorArrSpecifier
arr_exist
arr_exist8
binsearch_IndexTypeEncoding
count_positive
count_positive8
cs_close
cs_disasm
cs_disasm_iter
cs_errno
cs_free
cs_group_name
cs_insn_group
cs_insn_name
cs_malloc
cs_mem_calloc
cs_mem_free
cs_mem_malloc
cs_mem_realloc
cs_op_count
cs_op_index
cs_open
cs_option
cs_reg_name
cs_reg_read
cs_reg_write
cs_regs_access
cs_snprintf
cs_strdup
cs_strerror
cs_support
cs_version
cs_vsnprintf
decode
decodeInstruction
find_cs_id
find_insn
id2name
insn_find
insn_operands
insns
lookupATByEncoding
lookupBTIByEncoding
lookupBankedRegByEncoding
lookupDBByEncoding
lookupDBnXSByEncoding
lookupDCByEncoding
lookupExactFPImmByEnum
lookupICByEncoding
lookupISBByEncoding
lookupMClassSysRegByM1Encoding12
lookupMClassSysRegByM2M3Encoding8
lookupPRFMByEncoding
lookupPSBByEncoding
lookupPStateByEncoding
lookupSVCRByEncoding
lookupSVEPREDPATByEncoding
lookupSVEPRFMByEncoding
lookupSysRegByEncoding
lookupTLBIByEncoding
lookupTSBByEncoding
map_add_implicit_write
map_cs_id
map_groups
map_implicit_reads
map_implicit_writes
mapping_get_op_access
mapping_get_op_type
name2id
op_addAvxBroadcast
op_addAvxCC
op_addAvxRoundingMode
op_addAvxSae
op_addAvxZeroOpmask
op_addImm
op_addReg
op_addSseCC
op_addXopCC
printInt32
printInt32Bang
printInt32BangDec
printInt64
printInt64Bang
printRoundingControl
printSSEAVXCC
printUInt32
printUInt32Bang
printUInt64
printUInt64Bang
printXOPCC
readBytes16
readBytes32
regsize_map_32
regsize_map_64
x86_map_segment
x86_map_sib_base
x86_map_sib_index

Sections

.text
Size: 956KB - Virtual size: 956KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c8f8af1c4cf945d36e9fc61452cdb0e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 956KB - Virtual size: 956KB

.data Size: 119KB - Virtual size: 119KB

.rdata Size: 6.0MB - Virtual size: 6.0MB

.pdata Size: 15KB - Virtual size: 14KB

.xdata Size: 14KB - Virtual size: 14KB

.bss Size: - Virtual size: 2KB

.edata Size: 10KB - Virtual size: 10KB

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 170KB - Virtual size: 170KB

.text
Size: 956KB - Virtual size: 956KB

.data
Size: 119KB - Virtual size: 119KB

.rdata
Size: 6.0MB - Virtual size: 6.0MB

.pdata
Size: 15KB - Virtual size: 14KB

.xdata
Size: 14KB - Virtual size: 14KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 10KB - Virtual size: 10KB

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 170KB - Virtual size: 170KB