3264d09d3a398417226b7d346c2fc4757ffa445373763e2d7c2f18ef6edb2354
- SHA256 3264d09d3a398417226b7d346c2fc4757ffa445373763e2d7c2f18ef6edb2354
Overview
overview
10Static
static
10AnyDesk.exe
windows7-x64
1AnyDesk.exe
windows10-2004-x64
1Archevod_XWorm.exe
windows7-x64
10Archevod_XWorm.exe
windows10-2004-x64
10ClickMe.lnk
windows7-x64
8ClickMe.lnk
windows10-2004-x64
8Cmstp.bat
windows7-x64
10Cmstp.bat
windows10-2004-x64
10GoogleChrome.exe
windows7-x64
10GoogleChrome.exe
windows10-2004-x64
10Hidden_Und...on.ps1
windows7-x64
8Hidden_Und...on.ps1
windows10-2004-x64
8Hidden_magic.vbs
windows7-x64
3Hidden_magic.vbs
windows10-2004-x64
7Manage.bat
windows7-x64
1Manage.bat
windows10-2004-x64
1Night_uac/...in.ps1
windows7-x64
8Night_uac/...in.ps1
windows10-2004-x64
8Night_uac/...ge.ps1
windows7-x64
8Night_uac/...ge.ps1
windows10-2004-x64
8Night_uac/...gen.py
windows7-x64
3Night_uac/...gen.py
windows10-2004-x64
3Night_uac/amsi.ps1
windows7-x64
3Night_uac/amsi.ps1
windows10-2004-x64
3Night_uac/amsi.ps1
windows7-x64
3Night_uac/amsi.ps1
windows10-2004-x64
3Night_uac/command.ps1
windows7-x64
3Night_uac/command.ps1
windows10-2004-x64
3Night_uac/down.ps1
windows7-x64
8Night_uac/down.ps1
windows10-2004-x64
8Night_uac/...gp.ps1
windows7-x64
3Night_uac/...gp.ps1
windows10-2004-x64
3Static task
static1
12 signatures
Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
AnyDesk.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Archevod_XWorm.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
Archevod_XWorm.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
ClickMe.lnk
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
ClickMe.lnk
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
Cmstp.bat
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
Cmstp.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral9
Sample
GoogleChrome.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral10
Sample
GoogleChrome.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral11
Sample
Hidden_Undected_CMSTP-Reflection.ps1
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Hidden_Undected_CMSTP-Reflection.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral13
Sample
Hidden_magic.vbs
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
Hidden_magic.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Manage.bat
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
Manage.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
Night_uac/Uac_main.ps1
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Night_uac/Uac_main.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
Night_uac/Uac_stage.ps1
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
Night_uac/Uac_stage.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
Night_uac/Uac_stage_gen.py
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
Night_uac/Uac_stage_gen.py
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
Night_uac/amsi.ps1
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
Night_uac/amsi.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
Night_uac/amsi.ps1
Resource
win7-20240729-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
Night_uac/amsi.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
Night_uac/command.ps1
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
Night_uac/command.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
Night_uac/down.ps1
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
Night_uac/down.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral31
Sample
Night_uac/payloads/0malm7gp.ps1
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
Night_uac/payloads/0malm7gp.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 3264d09d3a398417226b7d346c2fc4757ffa445373763e2d7c2f18ef6edb2354
- Size 6.6MB
- Sample241018-vxavjs1bnm
- SHA256 3264d09d3a398417226b7d346c2fc4757ffa445373763e2d7c2f18ef6edb2354
- MD5 ed24b048880a8a2a3b7ac4911a7e81df
- SHA1 80f631b5481ec48729c3a738dc7ab003b4cd61c1
- SHA512 fab270e82961ecf6c1db9a53eb0dc81b0a3d6251b39421486dfa6e6f20826577c2db0624444de39f8a91465fb5ab1530e5530480cdc9b5b33b8ab260350bfe2f
- SSDEEP 196608:Xx3sgZH4wNNHmaqTE6kTcSzCkNBcjx3sgZdJ:h8CnDm7HORBcF8CdJ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xworm
Version
-
3.0
C2
-
topics-junior.at.ply.gg:45283
Mutex
-
7K8kkC78j4IfMAr6
Attributes
-
Install_directory
%AppData%
-
install_file
wininit.exe
aes.plain
Extracted
Family
-
quasar
Version
-
1.4.0
Botnet
-
Test
C2
-
scambaiting2022.ddns.net:25565
-
192.168.1.3:25565
Mutex
-
41845399-4858-4791-bd1c-b2526f38e8cc
Attributes
-
encryption_key
77693888CF811B44AE75658ADBCA8897192A96FF
-
install_name
update.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Chrome Update
-
subdirectory
Chrome
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://54.208.157.120:80/Night_uac/amsi.ps1
-
ps1.dropper
http://54.208.157.120:80/Night_uac/uac.ps1
-
ps1.dropper
http://54.208.157.120:80/Night_uac/command.ps1
-
ps1.dropper
http://54.208.157.120:80/Night_uac/down.ps1
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://54.208.157.120:80/Night_uac/Uac_main.ps1
-
exe.dropper
http://54.208.157.120:80/Night_uac/payloads/9usd7yge.ps1
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://54.208.157.120:80/winlogin.exe
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
16.ip.gl.ply.gg:56795
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
127.0.0.1:10001
-
127.0.0.1:9147
-
windowsddns.duckdns.org:6606
-
windowsddns.duckdns.org:7707
-
windowsddns.duckdns.org:8808
-
windowsddns.duckdns.org:10001
-
windowsddns.duckdns.org:9147
-
country-wellness.gl.at.ply.gg:6606
-
country-wellness.gl.at.ply.gg:7707
-
country-wellness.gl.at.ply.gg:8808
-
country-wellness.gl.at.ply.gg:10001
-
country-wellness.gl.at.ply.gg:9147
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
true
-
install_file
Days Out.exe
-
install_folder
%AppData%
aes.plain
aes.plain
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
scammer
C2
-
topics-junior.at.ply.gg:45283
Mutex
-
87fbb7d05011dd3c6b564f136007bf19
Attributes
-
reg_key
87fbb7d05011dd3c6b564f136007bf19
-
splitter
|'|'|
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
My VM
C2
-
myownvm.anondns.net:13832
-
37.120.141.165:13832
-
server1.trustedvpnservices.com:13832
-
higradevpn.xyz:13832
Mutex
-
071e2576-e94a-492e-8303-baae1cb4641c
Attributes
-
encryption_key
402F6F1B2F63357285F585A5880FBC2C0F468F55
-
install_name
ShellExperienceHost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Shell Experience Host
-
subdirectory
drivers
Extracted
Family
-
orcus
Botnet
-
Scammers
C2
-
44.203.122.41:1604
Mutex
-
b040a0c11d1a4273bc5428c0c9cb2c5b
Attributes
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%appdata%\Orcus\explorer.exe
-
reconnect_delay
9000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\AnyDex.exe
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://54.208.157.120:80/scambtr_uac/amsi.ps1
-
ps1.dropper
http://54.208.157.120:80/scambtr_uac/uac.ps1
-
ps1.dropper
http://54.208.157.120:80/scambtr_uac/command.ps1
-
ps1.dropper
http://54.208.157.120:80/scambtr_uac/down.ps1
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://54.208.157.120:80/scambtr_uac/Uac_main.ps1
-
exe.dropper
http://54.208.157.120:80/scambtr_uac/payloads/fm1ri21p.ps1
Extracted
Family
-
xworm
Version
-
3.1
C2
-
miles-c.at.ply.gg:49826
Mutex
-
qzx0AtyVDsrQphps
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Extracted
Family
-
xworm
C2
-
180.ip.ply.gg:48892
Mutex
-
QWgaicbZP6H1puz7
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Async RAT payload 2 IoCs
resource yara_rule static1/unpack001/Runtimebroker.exe family_asyncrat static1/unpack001/spoolsvc.exe family_asyncrat - Asyncrat family
- Detect Xworm Payload 3 IoCs
resource yara_rule static1/unpack001/Archevod_XWorm.exe family_xworm static1/unpack001/taskhosts.exe family_xworm static1/unpack001/winlogin.exe family_xworm - Nanocore family
- Njrat family
- Orcurs Rat Executable 1 IoCs
resource yara_rule static1/unpack001/explorer_orcus.exe orcus - Orcus family
- Orcus main payload 1 IoCs
resource yara_rule static1/unpack001/explorer_orcus.exe family_orcus - Quasar family
- Quasar payload 3 IoCs
resource yara_rule static1/unpack001/GoogleChrome.exe family_quasar static1/unpack001/ShellExperienceHost.exe family_quasar static1/unpack001/fontdrvhost.exe family_quasar - Xworm family
- Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/Archevod_XWorm.exe unpack001/GoogleChrome.exe unpack001/Runtimebroker.exe unpack001/Server.exe unpack001/ShellExperienceHost.exe unpack001/Svchost.exe unpack001/UltraViewerUpdateService.exe unpack001/explorer_orcus.exe unpack001/fontdrvhost.exe unpack001/spoolsvc.exe unpack001/taskhosts.exe unpack001/winlogin.exe unpack001/wlms.exe
File Explorer
-
3264d09d3a398417226b7d346c2fc4757ffa445373763e2d7c2f18ef6edb2354.zip 6.6MB
-
AnyDesk.exe.exe 2.9MB
-
Archevod_XWorm.exe.exe 36KB
-
ClickMe.lnk.download.lnk 1KB
-
Cmstp.bat.bat .vbs 264B
-
GoogleChrome.exe.exe 690KB
-
Hidden_Undected_CMSTP-Reflection.ps1.bak.ps1 13KB
-
Hidden_magic.vbs.vbs 122B
-
Manage.bat289B
-
Night.tar.gz.gz 5KB
-
Night.tar.tar .ps1 40KB
-
Night_uac/Uac_main.ps1895B
-
Night_uac/Uac_stage.ps1.ps1 435B
-
Night_uac/Uac_stage_gen.py.py .ps1 1KB
-
Night_uac/amsi.ps1.ps1 1KB
-
Night_uac/amsi.ps1.bak.ps1 1KB
-
Night_uac/command.ps1131B
-
Night_uac/down.ps1.ps1 278B
-
Night_uac/payloads/0malm7gp.ps144B
-
Night_uac/payloads/264emg58.ps144B
-
Night_uac/payloads/7802ym6n.ps144B
-
Night_uac/payloads/9usd7yge.ps144B
-
Night_uac/payloads/fzrplyej.ps144B
-
Night_uac/payloads/jn2qnx41.ps144B
-
Night_uac/payloads/qs14offn.ps144B
-
Night_uac/payloads/remove_all.sh14B
-
Night_uac/payloads/t9r3mczo.ps144B
-
Night_uac/payloads/v6vfu81h.ps144B
-
Night_uac/uac.ps1.ps1 8KB
-
Night_magic.bat.bat .vbs 278B
-
Runtimebroker.exe.exe 47KB
-
Server.exe.exe 37KB
-
ShellExperienceHost.exe.exe 3.1MB
-
Svchost.exe.exe 2.9MB
-
Svchost.vbs.vbs 170B
-
UltraViewerUpdateService.exe.exe 17KB
-
Uni.vbs.vbs 118B
-
explorer_orcus.exe.exe 972KB
-
fodV2.bat.bat .vbs 267B
-
fontdrvhost.exe.exe 3.1MB
-
paypal.rtf.rtf 10KB
-
scambtr.tar.gz.gz 5KB
-
scambtr.tar.tar .ps1 30KB
-
scambtr_uac/Uac_main.ps1903B
-
scambtr_uac/Uac_stage.ps1.ps1 439B
-
scambtr_uac/Uac_stage_gen.py.py .ps1 1KB
-
scambtr_uac/amsi.ps1.ps1 1KB
-
scambtr_uac/command.ps187B
-
scambtr_uac/down.ps1.ps1 278B
-
scambtr_uac/payloads/fm1ri21p.ps144B
-
scambtr_uac/payloads/remove_all.sh14B
-
scambtr_uac/uac.ps1.ps1 8KB
-
spoolsvc.exe.exe 45KB
-
taskhosts.exe.exe 31KB
-
vnchooks.dll.dll 476KB
-
winlogin.exe.exe 40KB
-
winvnc.exe.exe 2.9MB
-
wlms.exe.exe 182KB
AnyDesk.exe
- IMPHASH 310b1cc8abef97edfcabf0ed406947cf
- SHA256 ec0ec7ce8ef71cb7e7d1c2418c47ad94cea8833db8578ccdf94271f8efed38d3
- MD5 7cd339f9be1417421acf8790c9738922
- SHA1 c25eff4d9d2d5b55f1cc4ffc623354004565e8b9
- SHA512 f118ea660a51ff38abc20a9ad16f6505cf8a862df1b564829d9af06710e0c4b91d0abbedc4b852696acf0e807a25138d82c2fc518cd54c32dba92f513467b411
- SSDEEP 49152:vAOdl4d7NHNUb75uEEbOyYWHxL9X5zT/dPUAUA/JH:El8DFWHTN
- MD5 SHA1 SHA512 SSDEEP
Digest
68:6b:c2:0f:5d:46:52:01:d3:b8:a5:1a:9b:e9:27:fa:eb:9f:08:72:b0:e3:2d:55:d6:31:f3:af:f1:d5:bb:85
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE
Chains
Apr 15, 2023
CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE
Serial Number
4c:03:67:0a:31:e6:2b:9f:ac:b9:d2:d3:70:39:bd:07
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 23, 2022 - Sep 22, 2025
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
1257148
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\rudi\Desktop\git_ultravnc\winvnc\winvnc\x64\Release\winvnc.pdb
ws2_32
setsockopt
getsockopt
WSAGetLastError
gethostbyname
inet_ntoa
htons
htonl
WSACleanup
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
select
shutdown
listen
WSAStartup
getpeername
inet_addr
getsockname
send
socket
connect
recv
ntohl
WSASendTo
gethostname
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
userenv
ExpandEnvironmentStringsForUserA
DestroyEnvironmentBlock
CreateEnvironmentBlock
kernel32
WritePrivateProfileStringA
GetPrivateProfileStructA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileSectionA
CreateFileMappingA
Sleep
CreateThread
MulDiv
VerSetConditionMask
VerifyVersionInfoW
ReadFile
WriteFile
OutputDebugStringA
WaitForMultipleObjects
GetEnvironmentVariableA
WaitForSingleObject
CreateFileW
GetSystemDirectoryW
SetCurrentDirectoryA
lstrcatW
LoadLibraryW
SetFileAttributesA
CreateEventA
WaitNamedPipeW
GetExitCodeProcess
ResumeThread
ResetEvent
CompareFileTime
CreateFileA
GetFileSize
GetFileTime
GetStdHandle
WriteConsoleA
FreeConsole
FormatMessageA
AllocConsole
GetExitCodeThread
MoveFileA
GetDriveTypeA
SetFileTime
SetErrorMode
SetFilePointer
SetEndOfFile
GetFileAttributesA
MoveFileExA
FileTimeToSystemTime
GetLogicalDriveStringsA
SystemTimeToFileTime
CreateDirectoryA
GetSystemTime
FlushFileBuffers
TerminateProcess
VirtualAllocEx
ReadProcessMemory
SetThreadExecutionState
VirtualFreeEx
TerminateThread
SizeofResource
FindResourceA
LockResource
LoadResource
CreateMutexA
ReleaseMutex
GlobalGetAtomNameA
GlobalDeleteAtom
GetModuleHandleW
SetProcessShutdownParameters
WinExec
WritePrivateProfileStructA
HeapReAlloc
RaiseException
FreeLibraryAndExitThread
ExitThread
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetCPInfo
SetStdHandle
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
GetModuleHandleExW
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
LoadLibraryExW
RtlUnwind
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateSemaphoreA
TlsFree
TlsGetValue
TlsAlloc
GetCurrentThread
DuplicateHandle
SetThreadPriority
ReleaseSemaphore
TlsSetValue
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SwitchToThread
GetFileType
lstrcatA
lstrcmpiA
lstrcpynA
DosDateTimeToFileTime
GetLocalTime
FileTimeToLocalFileTime
SetVolumeLabelA
LocalFileTimeToFileTime
GetVersion
GetLocaleInfoA
GetFullPathNameA
lstrcpyA
CompareStringW
LCMapStringW
GetLocaleInfoW
OpenProcess
FlsAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
DecodePointer
GetModuleFileNameW
GetStringTypeW
CreateDirectoryW
GetFileSizeEx
DeleteFileW
GetCurrentProcessId
WTSGetActiveConsoleSessionId
Process32FirstW
Process32Next
Process32NextW
GlobalAddAtomA
ProcessIdToSessionId
CreateToolhelp32Snapshot
Process32First
GetComputerNameA
GetSystemInfo
GetSystemDirectoryA
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
DeleteFileA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetProcessTimes
GetSystemTimeAsFileTime
DeleteCriticalSection
GetModuleHandleA
InitializeCriticalSection
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
CloseHandle
GetVersionExA
SetEvent
GetLastError
GetCurrentThreadId
OpenEventA
GetModuleFileNameA
GetTickCount
FreeLibrary
GetProcessHeap
GetProcAddress
HeapAlloc
InitializeCriticalSectionAndSpinCount
LoadLibraryA
lstrlenA
SetLastError
HeapFree
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GetFileAttributesExW
GlobalAlloc
GlobalSize
MultiByteToWideChar
SetFileAttributesW
MoveFileExW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
RemoveDirectoryW
HeapSize
WriteConsoleW
FlsGetValue
FlsSetValue
FlsFree
OpenThread
QueryPerformanceFrequency
LocalFree
SetThreadAffinityMask
InitializeCriticalSectionEx
GetVolumeInformationA
user32
GetSubMenu
SetMenuDefaultItem
DestroyMenu
TrackPopupMenuEx
RemoveMenu
EnableMenuItem
EnableWindow
GetWindow
VkKeyScanA
IsWindow
GetAsyncKeyState
MapVirtualKeyA
ToAscii
SendInput
SetClipboardViewer
GetClipboardOwner
WaitMessage
PostThreadMessageA
ChangeClipboardChain
SendNotifyMessageA
PeekMessageA
IsWindowVisible
LoadMenuA
GetIconInfo
GetClassNameA
WindowFromPoint
ChangeWindowMessageFilter
EnumDesktopWindows
SetRect
DrawIconEx
DestroyIcon
GetKeyboardState
mouse_event
PtInRect
MessageBeep
FlashWindow
EnumDisplaySettingsExA
EnumDisplayDevicesA
ChangeDisplaySettingsExA
GetKeyState
keybd_event
EnumDisplaySettingsA
EnumWindows
GetWindowLongA
SetWindowLongA
RedrawWindow
SetDlgItemInt
CheckDlgButton
GetDlgItemInt
IntersectRect
GetWindowRect
LoadStringA
ScreenToClient
GetScrollInfo
IsDlgButtonChecked
FillRect
MoveWindow
SetFocus
SendDlgItemMessageA
GetCursorPos
ExitWindowsEx
LockWorkStation
DrawIcon
SetLayeredWindowAttributes
UpdateWindow
InvalidateRect
GetMessageA
LoadImageA
DispatchMessageA
LoadCursorA
DestroyWindow
SetWindowPos
DrawTextA
SetWindowDisplayAffinity
AdjustWindowRect
DefWindowProcA
IsRectEmpty
CreateWindowExA
TranslateMessage
LoadIconA
GetClientRect
PostQuitMessage
RegisterClassExA
BeginPaint
EndPaint
wsprintfA
SystemParametersInfoA
GetWindowThreadProcessId
GetUserObjectInformationA
PostMessageA
RegisterWindowMessageA
FindWindowExA
OpenDesktopA
MessageBoxA
GetProcessWindowStation
FindWindowA
GetSystemMetrics
EndDialog
DialogBoxParamA
ShowWindow
GetDlgItemTextA
SetTimer
SetDlgItemTextA
SendMessageA
GetDlgItem
GetWindowLongPtrA
KillTimer
SetWindowLongPtrA
SetForegroundWindow
SetThreadDesktop
GetThreadDesktop
CloseDesktop
GetForegroundWindow
OpenInputDesktop
GetDesktopWindow
GetDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
RegisterClipboardFormatA
GetTopWindow
OemToCharA
CharToOemA
wvsprintfA
SetWindowTextA
gdi32
GetBitmapBits
SetDIBColorTable
GdiFlush
RealizePalette
SelectPalette
SetBkColor
CreateFontIndirectA
GetObjectA
ExtEscape
GetSystemPaletteEntries
DeleteObject
DeleteDC
GetPixel
GetDeviceCaps
GetDIBits
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
BitBlt
CreateFontA
CreateDCA
CreateSolidBrush
Rectangle
CreatePen
SetBkMode
SetTextColor
GetClipBox
GetStockObject
StretchBlt
PatBlt
GetRgnBox
CombineRgn
PtInRegion
GetRegionData
CreateRectRgn
OffsetRgn
CreatePalette
SetRectRgn
advapi32
SetSecurityInfo
RegCreateKeyA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
CreateServiceA
GetSecurityDescriptorLength
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
IsValidSid
IsValidSecurityDescriptor
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidAcl
AdjustTokenPrivileges
StartServiceCtrlDispatcherA
QueryServiceStatus
RegDeleteKeyA
SetTokenInformation
LookupPrivilegeValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
DeleteService
DuplicateTokenEx
ImpersonateLoggedOnUser
EqualSid
AllocateAndInitializeSid
FreeSid
OpenProcessToken
RevertToSelf
CloseServiceHandle
OpenSCManagerA
GetUserNameA
LookupAccountSidA
OpenServiceA
GetTokenInformation
CreateProcessAsUserA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
shell32
ShellExecuteA
SHGetMalloc
Shell_NotifyIconA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHFileOperationA
ShellExecuteExA
ole32
CoInitialize
CoCreateInstance
CoUninitialize
shlwapi
PathStripPathA
imm32
ImmGetDefaultIMEWnd
dwmapi
DwmIsCompositionEnabled
ord102
iphlpapi
GetAdaptersInfo
adler32
adler32_combine
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_final
crc32_init
crc32_update
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
uncompress
uncompress2
zError
zlibCompileFlags
zlibVersion
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
561KB
Virtual Size
560KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
629KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
801KB
Virtual Size
800KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=29395,
count=235, id=261, version=29395,
count=18, id=260, version=29395,
count=15, id=253, version=28518,
count=19, id=260, version=30034,
count=12, id=259, version=30034,
count=84, id=261, version=30034,
count=39, id=260, version=30146,
count=13, id=261, version=30146,
count=27, productName=Unmarked objects (old),
count=1, id=262, version=29395,
count=533, id=1, productName=Unmarked objects,
count=27, id=257, version=29395,
count=186, id=265, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=151,
count=1, id=258, version=30146,
Archevod_XWorm.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 50a3d3508c4b826b4e36678dd91b374c339b0c57a89a31cd3e9f5a4441772dc0
- MD5 95b3c12592ed7de85aeb86fe9c54e23a
- SHA1 4a6f7b46d077ad0e1dabea9f30efa95c52f79f3d
- SHA512 7a1cd098641bbada8ad6015dfa6cb922ed425632eedc9c7b9ef2774b9c81ff74083d6d8549bb708f39f3dae479b53e46eddb068ed457883cd803ce593e50b08a
- SSDEEP 768:tRmCfIsRkrkdeoQR/auzH9R1acc/FPr9lqO9h52ZL:tRmC8r+uL/EcKFz9lqO9yZL
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ClickMe.lnk.download
- SHA256 3ba3c169988a8bc600b58e2ca578e36b48de210bbf058f61b3e7525af01c982d
- MD5 08b5b3505abb428c860598363761f2e8
- SHA1 2344992168414c023bd6851d63ea62520770365a
- SHA512 1b547c089197aba0dce835de875dbdb2c69ed2e9c2199f10ed767b642935dc1c3f50b1ef0521924459d09942fceac5478cf5a0471f94b7bc06c18da9149a2c4c
- MD5 SHA1 SHA512
Cmstp.bat
- SHA256 1521435d9d3fb9dc5b08494130f2118b073a6bc6dc233e3ec404225a57b9c4b3
- MD5 31254e5f0a767dba0d013d83d8949be8
- SHA1 a5f59a60307eb142d30c3ff14b9b916dce8b3733
- SHA512 c97829934e12efe7d8b78c177666ce1fe30c6a77e6617c06f8a0c23cd4a59a1ec625ee3edc72fe512ce79b56e4f3be716be6bd5ab4089b4ccdbb48b5b56a12d1
- MD5 SHA1 SHA512
GoogleChrome.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1416bd55b04a4d8299c3e976e4e6a160850471e330d25f332f70d8ca618de894
- MD5 5818f4fecb0dcc52227035dc0d88830b
- SHA1 ccda411e1e7c643308f8c643b384ec979c185787
- SHA512 b245d21747c40722fd8c53a8bef3acb17aabce894ec6213547a2554f4c4f168b1d43f9a2f1383f4bfd4ccd436e3034d7aa64c6118aff9d886ea39c05ad7bb81f
- SSDEEP 12288:jTEgdfY8l6hdV6l4et8klwIdctVdrcdirMBgJS9UOIK3:8UwBD6lbt8ufcVrcdiMCJSuOIK3
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
518046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
498KB
Virtual Size
497KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Hidden_Undected_CMSTP-Reflection.ps1.bak
- SHA256 5812fe6944f400d00f4ab4b4189779c3caddc419c3346842e30c07d238f4d186
- MD5 39d26ba464405a52eec059c38fde3742
- SHA1 b8e15337cbdfe46d6c712bf45a381b5a97d30db1
- SHA512 7fb159fbedc68cd0a353534b30cca7f0f6a95f327c69d2a4cc1b7d4c4b591ea893451b18f188d5739873a64c64bd314546a20bb272d76931cee1937a6104e337
- SSDEEP 384:lc2055WPIbP1ermV2qvkXLuwYiou2tc428QuB:lc2eWgP1UIEuwhom4tQW
- MD5 SHA1 SHA512 SSDEEP
Hidden_magic.vbs
- SHA256 acbd157e5546a03b6a1695974294b99f751a4a9ef21dcfc9794da26ee1623a23
- MD5 3e168164fe0f6469cb14efd628bb15de
- SHA1 d1319d3c0264ee65258982090a8b8e6ea5832169
- SHA512 085d64420abf67fbeb394fb229e24fdd0be9139e320d63e9d249275013fee1a352499c985629800f694a4053a41499cc30d3913c1a783c3757804ff81de78439
- MD5 SHA1 SHA512
Manage.bat
- SHA256 303666e8136c8f5d1471f503dfa7ba32e5ac303f3b758a8af6a80cc7fdd61253
- MD5 3b001f8d88211bf2f64a1fbd7cfc22a4
- SHA1 f27eec327bc4689848fcda18bf88402d649143c2
- SHA512 2a94b1311fad0a408773ec30851f1a68d525b0db9a185865c1faf209eb1e6d8f8768ce35051e245b17e468714e645c2553898a833090e1ccb56db56e9bf2c4c3
- MD5 SHA1 SHA512
Night.tar.gz
- SHA256 3557f225573a9827f24a1b83455bedc883a304b38d0376b6a553eee1bda7c863
- MD5 e73e6c52fd1e3ae7fb1433fb84fc4b2c
- SHA1 99b091887d65d2299a4af2997914163524d8ba45
- SHA512 7caf90f49a67b1cac654fb333628bbbe9eb73ea519092dabbf1631f7428a0218461d19c24b0a41e50a8fc7fd1af03aa57ba8ee7f824cf4d79d6c93b735fd0d6d
- SSDEEP 96:01Qu/JWUDP0NcQZOVgU8fmxKgIgtvQAmJrJb4YqcrZs4EDb2UF2X2iwNNH+:01Quhd0NbycmUgxt4HJrJHqmZZEPhDNI
- MD5 SHA1 SHA512 SSDEEP
Night.tar
- SHA256 8f136d73ae83b5be0c67d4d949728c1ae9e1dcbcfcd96b8ca81552b8c4a5efef
- MD5 349a62aaebcf258fff67f871c0422d9a
- SHA1 a11e41ac76f1d6969a3bf55ea257a0c5495e4993
- SHA512 cf96f580b7e07a29d39be12cde09622a1ddd630d79e17542628bb96c0ff1291fc0556ce317b9fac618d8ef5bdff2d0e5410c0ca5704c9d6b5651c12eace00e61
- SSDEEP 384:kd5pyFXFhdcvRFqI8ER/57f4Jh4zrkskMH1tXOKEEhI:kdzyFXFhdcYEB54SzdFzEE
- MD5 SHA1 SHA512 SSDEEP
Night_uac/Uac_main.ps1
- SHA256 af1c04051180e61745b676d36bf583a9e95995a810bba71c26d6366fc4eedb6e
- MD5 550a412ff00f92f90795bec6a8c8286e
- SHA1 1929e24de6fd883b4f5c191c317b272001a43973
- SHA512 7d29881c6f7f2be8a48bba0b7e7e755a02ae2c648320a9daedb68591f4995323c495d9c5bc4cbb79ad8321d4fdf55774d33d7eaaf36218336576e729ed3e7ade
- MD5 SHA1 SHA512
Night_uac/Uac_stage.ps1
- SHA256 e442ae7d9792416c46c134c8587ac7bfd947a6062c4abe9b700f83a5274b72cc
- MD5 9c0b29cea5533806aee83f5c49fcf6cd
- SHA1 659155db6497a1d5c1e6fb2dc40b16f63bf0e1db
- SHA512 72e6b4b55a4c16c12408a46b668073d0b09d59a0d4bc0941a33dc6859af8f8358df224f07d7fd2de780945c503c46a7f5cf98e957e4031884e9d0ec497463def
- MD5 SHA1 SHA512
Night_uac/Uac_stage_gen.py
- SHA256 4d505f1f2b73cf7e857164dfdf1d18a4488f3b593a0ea9a7d051e9d46c15ddaf
- MD5 a68f17114a988b00f30a0eed296733ac
- SHA1 22c4aa93ce3fc2a191f32359d6fe8c2ffe79dafb
- SHA512 6d1a93c6f0389972477b6841d2e830874fbf45c1dbc446bbdfc884e0c6f69e0cb1dfbb23d0a0fa583d7308eb8cc83199b95eadb77fd84fd5a16db85732d7c96b
- MD5 SHA1 SHA512
Night_uac/amsi.ps1
- SHA256 e4519785cbdda3fe7f85b3e0ef1bfd0bb857966dcc9fd7e62bd028b04a35cda3
- MD5 ab586dd0a3d8dc473e8a12a5a4c6a484
- SHA1 247455520a6b3706355e6afc4815fc0fbec331c4
- SHA512 898dfc95b3016a8c8ec164ddff5b5b58aa3470802f5cc9265837dc1d4356de251fa256ff6dd130e39399ab24ebe903172dee214fc9b3e36be04d0ef654b9fb20
- MD5 SHA1 SHA512
Night_uac/amsi.ps1.bak
- SHA256 dcc98c13be598654871475b3028f304f2a580b47c9c46531d2793de49f5f8d7d
- MD5 ce55b86a579ff526c25fdfeb398fa285
- SHA1 134fb6ec72f0123f5111333ca6d4c4a9c125cf67
- SHA512 ca4f09c14caee9282006a0a3251b17ab8c5cf3c370b81bb49579437d470d62bcb2b8909c461784d163c57e7ca725ecb1bb86036b401315fd2ff0fedcd8b51f2f
- MD5 SHA1 SHA512
Night_uac/command.ps1
- SHA256 e7c87640a365548db623dbbf029aa30b57f6d57e3040695b997d8dc073a35cf8
- MD5 5fe24b6b15d15df6b534a5815b6f0c9d
- SHA1 b13c4de3c056ab8f96664d66fc2ad3b63278adfe
- SHA512 ec354dc51d3a6885e0b32ed405becba092581a85d8060a8a901dbe1b41ff1ff55d2ae272a7651e8ef996acc7fd8e643bbec29b6d5d94ee00ab0a229c72457445
- MD5 SHA1 SHA512
Night_uac/down.ps1
- SHA256 ab12c751a1da5db32da6abb02fb8b24a873866b65ec45905db842877c7ff5c8d
- MD5 de07ecbd1be6e54daa4e8eaf6303b157
- SHA1 d5865ba74f03ccf7c03e27d1399e6b46e85f895e
- SHA512 e8bc8f9f272c3ba792779292dd5cc4f64f7092e63de5d58ebe4e13a755000ea2ec195eb7b20c973865728aa0d9bf198e6bf68118533de2f6664185b5e07501da
- MD5 SHA1 SHA512
Night_uac/payloads/0malm7gp.ps1
- SHA256 80d6bdb1d89d5c6b81f4a09dc469cc5f0a094602ce2241e0d60fd714a7fc9327
- MD5 2d663bdc95565ef04c1d3db0e4bde2f0
- SHA1 1c1aaa0b478be1cd6732825d73f90168fe7c5790
- SHA512 75de1067200dde50a559db01da8f2b4ea22735447ce4a85dae76703a4401213edb6921960aff1fd8de5a8dd86b5d0c071f43ba49592b0993c00fa6bc7980e152
- MD5 SHA1 SHA512
Night_uac/payloads/264emg58.ps1
- SHA256 80d6bdb1d89d5c6b81f4a09dc469cc5f0a094602ce2241e0d60fd714a7fc9327
- MD5 2d663bdc95565ef04c1d3db0e4bde2f0
- SHA1 1c1aaa0b478be1cd6732825d73f90168fe7c5790
- SHA512 75de1067200dde50a559db01da8f2b4ea22735447ce4a85dae76703a4401213edb6921960aff1fd8de5a8dd86b5d0c071f43ba49592b0993c00fa6bc7980e152
- MD5 SHA1 SHA512
Night_uac/payloads/7802ym6n.ps1
- SHA256 80d6bdb1d89d5c6b81f4a09dc469cc5f0a094602ce2241e0d60fd714a7fc9327
- MD5 2d663bdc95565ef04c1d3db0e4bde2f0
- SHA1 1c1aaa0b478be1cd6732825d73f90168fe7c5790
- SHA512 75de1067200dde50a559db01da8f2b4ea22735447ce4a85dae76703a4401213edb6921960aff1fd8de5a8dd86b5d0c071f43ba49592b0993c00fa6bc7980e152
- MD5 SHA1 SHA512
Night_uac/payloads/9usd7yge.ps1
- SHA256 80d6bdb1d89d5c6b81f4a09dc469cc5f0a094602ce2241e0d60fd714a7fc9327
- MD5 2d663bdc95565ef04c1d3db0e4bde2f0
- SHA1 1c1aaa0b478be1cd6732825d73f90168fe7c5790
- SHA512 75de1067200dde50a559db01da8f2b4ea22735447ce4a85dae76703a4401213edb6921960aff1fd8de5a8dd86b5d0c071f43ba49592b0993c00fa6bc7980e152
- MD5 SHA1 SHA512
Night_uac/payloads/fzrplyej.ps1
- SHA256 80d6bdb1d89d5c6b81f4a09dc469cc5f0a094602ce2241e0d60fd714a7fc9327
- MD5 2d663bdc95565ef04c1d3db0e4bde2f0
- SHA1 1c1aaa0b478be1cd6732825d73f90168fe7c5790
- SHA512 75de1067200dde50a559db01da8f2b4ea22735447ce4a85dae76703a4401213edb6921960aff1fd8de5a8dd86b5d0c071f43ba49592b0993c00fa6bc7980e152
- MD5 SHA1 SHA512
Night_uac/payloads/jn2qnx41.ps1
- SHA256 80d6bdb1d89d5c6b81f4a09dc469cc5f0a094602ce2241e0d60fd714a7fc9327
- MD5 2d663bdc95565ef04c1d3db0e4bde2f0
- SHA1 1c1aaa0b478be1cd6732825d73f90168fe7c5790
- SHA512 75de1067200dde50a559db01da8f2b4ea22735447ce4a85dae76703a4401213edb6921960aff1fd8de5a8dd86b5d0c071f43ba49592b0993c00fa6bc7980e152
- MD5 SHA1 SHA512
Night_uac/payloads/qs14offn.ps1
- SHA256 80d6bdb1d89d5c6b81f4a09dc469cc5f0a094602ce2241e0d60fd714a7fc9327
- MD5 2d663bdc95565ef04c1d3db0e4bde2f0
- SHA1 1c1aaa0b478be1cd6732825d73f90168fe7c5790
- SHA512 75de1067200dde50a559db01da8f2b4ea22735447ce4a85dae76703a4401213edb6921960aff1fd8de5a8dd86b5d0c071f43ba49592b0993c00fa6bc7980e152
- MD5 SHA1 SHA512
Night_uac/payloads/remove_all.sh
- SHA256 d5d934287b98314389e19c68a8080445533dd8898e85985ddd868962ea89b639
- MD5 c0dd87c47f9372e498f1b705c5e4dc57
- SHA1 f68716aebb22e3b9119a4a37356b089e56546790
- SHA512 a6adbecf7f80c0b4753746a91e7c12e81ab3f8190de348c4410de1a5b65b9e82f297cbeb533a9f645dbeb3c8226a93c1227201150346748ded205f42b6db1603
- MD5 SHA1 SHA512
Night_uac/payloads/t9r3mczo.ps1
- SHA256 80d6bdb1d89d5c6b81f4a09dc469cc5f0a094602ce2241e0d60fd714a7fc9327
- MD5 2d663bdc95565ef04c1d3db0e4bde2f0
- SHA1 1c1aaa0b478be1cd6732825d73f90168fe7c5790
- SHA512 75de1067200dde50a559db01da8f2b4ea22735447ce4a85dae76703a4401213edb6921960aff1fd8de5a8dd86b5d0c071f43ba49592b0993c00fa6bc7980e152
- MD5 SHA1 SHA512
Night_uac/payloads/v6vfu81h.ps1
- SHA256 80d6bdb1d89d5c6b81f4a09dc469cc5f0a094602ce2241e0d60fd714a7fc9327
- MD5 2d663bdc95565ef04c1d3db0e4bde2f0
- SHA1 1c1aaa0b478be1cd6732825d73f90168fe7c5790
- SHA512 75de1067200dde50a559db01da8f2b4ea22735447ce4a85dae76703a4401213edb6921960aff1fd8de5a8dd86b5d0c071f43ba49592b0993c00fa6bc7980e152
- MD5 SHA1 SHA512
Night_uac/uac.ps1
- SHA256 86183e5926ddf331af460df0b74bbd581ba5f3a40306e1f4ceec656bf990054a
- MD5 1bd9f45089694130d04b2d521a8869ac
- SHA1 cb547d915da6ab4301f8e058962942728a0a7c19
- SHA512 03ea5950673ffe64cbdc50d0842d16dda3e1b265a7882b553340a3996598f5fb92a40f183d870befc98691597c7f3f0c15c5bf99dd4271a0915ab8ba2f46a1fb
- SSDEEP 192:bviELE51vJNhBH7f4YfKh4EChqakskgXH1mqX9cnKEnEe:3ER/57f4Jh4zrkskMH1tXOKEEe
- MD5 SHA1 SHA512 SSDEEP
Night_magic.bat
- SHA256 2d64c375ca793ba18c627b4addc5dfe992ae261b3832f2570e775d28c353e751
- MD5 b872b34b2852036af72b80d2341022cd
- SHA1 4653652eff15e49d083a3d3b18be317b12b028ee
- SHA512 9f6cfa1928fd905d424ff1427a0a4927d3b3500dae998b39db95aed2f5764dc7d46d003644e7ad5d5280bc775fdf665154eda3fda4657fd9aff44e8427fe9921
- MD5 SHA1 SHA512
Runtimebroker.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0c632f02f1425550215ea5fdbe96cd91c037841013276deaffd2e4d7e273e9e2
- MD5 0b530ea3e0289423468f807b87988c9b
- SHA1 f9378d6cf8f44481060c41165efa9ecead2159f8
- SHA512 78a5c3599adc18c4b58c8d9cbe1e7aa72225808d01ee5968113fd9e41b4186d9472c81e4eb1147af5901fa425381ec6e23d7426c4614a652a34381d988bdb56e
- SSDEEP 768:2u439TskvpDWUPANxmo2qb1wsd6Cp6+ORpgtPItwl0bsJVmDHlGo6nPTQSlmOfeq:2u439TswI2KwsdvZOvgKtwSbs7mr85PJ
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Server.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6a65ffab90209b9a5fad0523b2878228f7062afc4679742d1efa0e77f419a8d8
- MD5 b52996195bd6af110e82523da49f7bd9
- SHA1 9a85fa621679d1629b15f6ed2953f4d7665f5091
- SHA512 6095f9e45461964c0ba27c1d252c579ac4f080a6b9da8363d6ad84836cc09775e3f4da9ca3eba44fb9df623d3d9f0dd089b35ed91bdc601c418030cb06d64e08
- SSDEEP 384:63OqIiuhjtD+P3V+y0bLqXOtHBEs++LhrAF+rMRTyN/0L+EcoinblneHQM3epzXO:TpmV10bLqXOtyN+9rM+rMRa8NuWpht
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ShellExperienceHost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 017154018a7290c534578cdbb64110339cff0d69f1e40f89db8176681b47981d
- MD5 66f2cd749924ebcd3cd4e8e6882b50de
- SHA1 9a188abd5c98c3fec2da7b9dd5fed1927a191164
- SHA512 7deb88001b59a7364099d014fa655d8dc23ef28c6b8d5cf3a111506dee08945e52f2e432e2583751484e87310a83b10aa08c7c3a8c5ab3f4080f149abfee0962
- SSDEEP 49152:Hv3hBYjCO4Dt2d5aKCuVPzlEmVQL0wvwka3mhEmzfSoGdOTHHB72eh2NT:Hvnt2d5aKCuVPzlEmVQ0wvwf3mhs
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3269678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Svchost.exe
- IMPHASH 310b1cc8abef97edfcabf0ed406947cf
- SHA256 9746da7f7f9ccb11fd893a9c2d6c679b11b3dec646e5d003df447536d75e1344
- MD5 879bde30b75f5876be483ce8393278c2
- SHA1 8185750999bfaba1641380c954a3c9dbe8b5ac98
- SHA512 28221351fa98cf68dda9c0565ac064138f83ab72376e0303a8a8cefe3bfd60c03dcb13fe5be4973cda184f87f02024ce8e98770fcc331c38f795088229b180cf
- SSDEEP 49152:CAOdl4d7NHNUb75uEEbOyYWHxL9X5zT/dCvAUA/J:Pl8DFWHG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1257148
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\rudi\Desktop\git_ultravnc\winvnc\winvnc\x64\Release\winvnc.pdb
ws2_32
setsockopt
getsockopt
WSAGetLastError
gethostbyname
inet_ntoa
htons
htonl
WSACleanup
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
select
shutdown
listen
WSAStartup
getpeername
inet_addr
getsockname
send
socket
connect
recv
ntohl
WSASendTo
gethostname
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
userenv
ExpandEnvironmentStringsForUserA
DestroyEnvironmentBlock
CreateEnvironmentBlock
kernel32
WritePrivateProfileStringA
GetPrivateProfileStructA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileSectionA
CreateFileMappingA
Sleep
CreateThread
MulDiv
VerSetConditionMask
VerifyVersionInfoW
ReadFile
WriteFile
OutputDebugStringA
WaitForMultipleObjects
GetEnvironmentVariableA
WaitForSingleObject
CreateFileW
GetSystemDirectoryW
SetCurrentDirectoryA
lstrcatW
LoadLibraryW
SetFileAttributesA
CreateEventA
WaitNamedPipeW
GetExitCodeProcess
ResumeThread
ResetEvent
CompareFileTime
CreateFileA
GetFileSize
GetFileTime
GetStdHandle
WriteConsoleA
FreeConsole
FormatMessageA
AllocConsole
GetExitCodeThread
MoveFileA
GetDriveTypeA
SetFileTime
SetErrorMode
SetFilePointer
SetEndOfFile
GetFileAttributesA
MoveFileExA
FileTimeToSystemTime
GetLogicalDriveStringsA
SystemTimeToFileTime
CreateDirectoryA
GetSystemTime
FlushFileBuffers
TerminateProcess
VirtualAllocEx
ReadProcessMemory
SetThreadExecutionState
VirtualFreeEx
TerminateThread
SizeofResource
FindResourceA
LockResource
LoadResource
CreateMutexA
ReleaseMutex
GlobalGetAtomNameA
GlobalDeleteAtom
GetModuleHandleW
SetProcessShutdownParameters
WinExec
WritePrivateProfileStructA
HeapReAlloc
RaiseException
FreeLibraryAndExitThread
ExitThread
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetCPInfo
SetStdHandle
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
GetModuleHandleExW
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
LoadLibraryExW
RtlUnwind
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateSemaphoreA
TlsFree
TlsGetValue
TlsAlloc
GetCurrentThread
DuplicateHandle
SetThreadPriority
ReleaseSemaphore
TlsSetValue
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SwitchToThread
GetFileType
lstrcatA
lstrcmpiA
lstrcpynA
DosDateTimeToFileTime
GetLocalTime
FileTimeToLocalFileTime
SetVolumeLabelA
LocalFileTimeToFileTime
GetVersion
GetLocaleInfoA
GetFullPathNameA
lstrcpyA
CompareStringW
LCMapStringW
GetLocaleInfoW
OpenProcess
FlsAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
DecodePointer
GetModuleFileNameW
GetStringTypeW
CreateDirectoryW
GetFileSizeEx
DeleteFileW
GetCurrentProcessId
WTSGetActiveConsoleSessionId
Process32FirstW
Process32Next
Process32NextW
GlobalAddAtomA
ProcessIdToSessionId
CreateToolhelp32Snapshot
Process32First
GetComputerNameA
GetSystemInfo
GetSystemDirectoryA
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
DeleteFileA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetProcessTimes
GetSystemTimeAsFileTime
DeleteCriticalSection
GetModuleHandleA
InitializeCriticalSection
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
CloseHandle
GetVersionExA
SetEvent
GetLastError
GetCurrentThreadId
OpenEventA
GetModuleFileNameA
GetTickCount
FreeLibrary
GetProcessHeap
GetProcAddress
HeapAlloc
InitializeCriticalSectionAndSpinCount
LoadLibraryA
lstrlenA
SetLastError
HeapFree
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GetFileAttributesExW
GlobalAlloc
GlobalSize
MultiByteToWideChar
SetFileAttributesW
MoveFileExW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
RemoveDirectoryW
HeapSize
WriteConsoleW
FlsGetValue
FlsSetValue
FlsFree
OpenThread
QueryPerformanceFrequency
LocalFree
SetThreadAffinityMask
InitializeCriticalSectionEx
GetVolumeInformationA
user32
GetSubMenu
SetMenuDefaultItem
DestroyMenu
TrackPopupMenuEx
RemoveMenu
EnableMenuItem
EnableWindow
GetWindow
VkKeyScanA
IsWindow
GetAsyncKeyState
MapVirtualKeyA
ToAscii
SendInput
SetClipboardViewer
GetClipboardOwner
WaitMessage
PostThreadMessageA
ChangeClipboardChain
SendNotifyMessageA
PeekMessageA
IsWindowVisible
LoadMenuA
GetIconInfo
GetClassNameA
WindowFromPoint
ChangeWindowMessageFilter
EnumDesktopWindows
SetRect
DrawIconEx
DestroyIcon
GetKeyboardState
mouse_event
PtInRect
MessageBeep
FlashWindow
EnumDisplaySettingsExA
EnumDisplayDevicesA
ChangeDisplaySettingsExA
GetKeyState
keybd_event
EnumDisplaySettingsA
EnumWindows
GetWindowLongA
SetWindowLongA
RedrawWindow
SetDlgItemInt
CheckDlgButton
GetDlgItemInt
IntersectRect
GetWindowRect
LoadStringA
ScreenToClient
GetScrollInfo
IsDlgButtonChecked
FillRect
MoveWindow
SetFocus
SendDlgItemMessageA
GetCursorPos
ExitWindowsEx
LockWorkStation
DrawIcon
SetLayeredWindowAttributes
UpdateWindow
InvalidateRect
GetMessageA
LoadImageA
DispatchMessageA
LoadCursorA
DestroyWindow
SetWindowPos
DrawTextA
SetWindowDisplayAffinity
AdjustWindowRect
DefWindowProcA
IsRectEmpty
CreateWindowExA
TranslateMessage
LoadIconA
GetClientRect
PostQuitMessage
RegisterClassExA
BeginPaint
EndPaint
wsprintfA
SystemParametersInfoA
GetWindowThreadProcessId
GetUserObjectInformationA
PostMessageA
RegisterWindowMessageA
FindWindowExA
OpenDesktopA
MessageBoxA
GetProcessWindowStation
FindWindowA
GetSystemMetrics
EndDialog
DialogBoxParamA
ShowWindow
GetDlgItemTextA
SetTimer
SetDlgItemTextA
SendMessageA
GetDlgItem
GetWindowLongPtrA
KillTimer
SetWindowLongPtrA
SetForegroundWindow
SetThreadDesktop
GetThreadDesktop
CloseDesktop
GetForegroundWindow
OpenInputDesktop
GetDesktopWindow
GetDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
RegisterClipboardFormatA
GetTopWindow
OemToCharA
CharToOemA
wvsprintfA
SetWindowTextA
gdi32
GetBitmapBits
SetDIBColorTable
GdiFlush
RealizePalette
SelectPalette
SetBkColor
CreateFontIndirectA
GetObjectA
ExtEscape
GetSystemPaletteEntries
DeleteObject
DeleteDC
GetPixel
GetDeviceCaps
GetDIBits
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
BitBlt
CreateFontA
CreateDCA
CreateSolidBrush
Rectangle
CreatePen
SetBkMode
SetTextColor
GetClipBox
GetStockObject
StretchBlt
PatBlt
GetRgnBox
CombineRgn
PtInRegion
GetRegionData
CreateRectRgn
OffsetRgn
CreatePalette
SetRectRgn
advapi32
SetSecurityInfo
RegCreateKeyA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
CreateServiceA
GetSecurityDescriptorLength
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
IsValidSid
IsValidSecurityDescriptor
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidAcl
AdjustTokenPrivileges
StartServiceCtrlDispatcherA
QueryServiceStatus
RegDeleteKeyA
SetTokenInformation
LookupPrivilegeValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
DeleteService
DuplicateTokenEx
ImpersonateLoggedOnUser
EqualSid
AllocateAndInitializeSid
FreeSid
OpenProcessToken
RevertToSelf
CloseServiceHandle
OpenSCManagerA
GetUserNameA
LookupAccountSidA
OpenServiceA
GetTokenInformation
CreateProcessAsUserA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
shell32
ShellExecuteA
SHGetMalloc
Shell_NotifyIconA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHFileOperationA
ShellExecuteExA
ole32
CoInitialize
CoCreateInstance
CoUninitialize
shlwapi
PathStripPathA
imm32
ImmGetDefaultIMEWnd
dwmapi
DwmIsCompositionEnabled
ord102
iphlpapi
GetAdaptersInfo
adler32
adler32_combine
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_final
crc32_init
crc32_update
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
uncompress
uncompress2
zError
zlibCompileFlags
zlibVersion
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
561KB
Virtual Size
560KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
629KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
845KB
Virtual Size
845KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=29395,
count=235, id=261, version=29395,
count=18, id=260, version=29395,
count=15, id=253, version=28518,
count=19, id=260, version=30034,
count=12, id=259, version=30034,
count=84, id=261, version=30034,
count=39, id=260, version=30146,
count=13, id=261, version=30146,
count=27, productName=Unmarked objects (old),
count=1, id=262, version=29395,
count=533, id=1, productName=Unmarked objects,
count=27, id=257, version=29395,
count=186, id=265, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=151,
count=1, id=258, version=30146,
Svchost.vbs
- SHA256 104c4b4b3e9c92d7d56c7b809e6f5b1f2e6cfb41ca3f8ac9ac2c7c5346934488
- MD5 6a419d41d96de80983f2d54c6860aa6e
- SHA1 3efd347283bbaf84774f8460c65d61c640ec6bb5
- SHA512 789dd413cdcbb68d30e8daafdb564612652460e4acef92a1d56d4dae526e1c5361a3ee563e8faf4d184cfc256acb89729c853f099b19dcfd62f2fadcf4634716
- MD5 SHA1 SHA512
UltraViewerUpdateService.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e30eb80a15e89bfa7461661979423647fd4657ff59b92497319b5bbae55bae0a
- MD5 80f2e48f8ed0421996f8711644ef163a
- SHA1 5d6265891886b5eb6c4febfbb9c8e28d5d6a5566
- SHA512 0f9f3c9ac3c807cd713a8ef83aaa8be0b935d20897a8c9e856ee6624d3b13b7f6c0839bcc15d52409dfeea2e5c4b9247cb3f6a93f152d7d6eddd7a0e5290e6e0
- SSDEEP 192:jxHuir11sEJQJr8mBNMGBUKdepk0KVOyghWsxu3zXxGaBZOvXTmaz1:jf1sEJQJCSUaepk0OOyd3zXzYK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Kyle\source\repos\Disable\Disable\obj\Release\Disable.pdb
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Uni.vbs
- SHA256 9296e3954760ca0cbafd22eb0dfb89e37781bfbc1ba2665ebb4409de2a507081
- MD5 a982bccf6808e712be952196f8f11061
- SHA1 bf0f35f515ade4fa89bff7c3c81847e432dbdb7d
- SHA512 28be2af4aa2f253f0e25cf7ba882c42684442d81b8e8c6a9dc9bc191adb5e9854f1149de666bfa22f77284ac467ebc2f21405af4b90dd2debe0706658c91b58e
- MD5 SHA1 SHA512
explorer_orcus.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 30a2a674d55d7898d304713dd2f69a043d875230ea7ebee22596ba4c640768db
- MD5 baae678f196efc6e9a1aa87d274cbb2c
- SHA1 dc6586f49689d75670d7b93eb2fd443b0fb85eab
- SHA512 a8e315443125367cba54f6224ce70ea6d764b37de4e391511865fd4a244bfcae222e0f336403605a977450d16bf601309d06b8c636fcaad89e57bc78963e26c8
- SSDEEP 24576:zCC4MROxnFH3pRM4/rrcI0AilFEvxHPAHzoo4d:zKMihpl/rrcI0AilFEvxHPf
- MD5 SHA1 SHA512 SSDEEP
-
Orcurs Rat Executable
-
Orcus main payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
945390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
915KB
Virtual Size
915KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
fodV2.bat
- SHA256 25ce5f5f6ecc016cf5af64aaadb14c650abaa756a9f9557410603e740bfa2ae6
- MD5 7cfa5217f41186022364de70f821493c
- SHA1 188420194600b2b0ed86f0a3c3723e19e44e02f2
- SHA512 5010f7db8f4cfe755b3bae192a2a5fffd23075e748f60f714399ca885703a4126a59052f040d0aa4950a04e7fb4772589c7ff39d3aaeeabecdc4e88a604b832d
- MD5 SHA1 SHA512
fontdrvhost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 29f9003753e24d20e597b7c71661dadd221b011c9f14531e25e0bf1c55145123
- MD5 3aaaf4be968f7846cc3697959a6ba5ec
- SHA1 66c6de49521762033bc0f08d2fc2a18c2c678197
- SHA512 6626e7e982e65c02fac4b9ae40f5f57e7bc4e79aaa08c9aa12d4b42f1fee0ca6449608972dbe19d634fe48cd8835f8fa5456780f62da143614b28a1f18489ecf
- SSDEEP 49152:fvve821/aQWl8P0lSk3aKA3Z+new/6BxyLoGd0qQTHHB72eh2NT:fvm821/aQWl8P0lSk3DA3Z+n5/5E
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3269774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
paypal.rtf
- SHA256 03f9d6e19ea827c4cc317e06ffe15c5bdb49d930cac1c175cbfa38d7d104565f
- MD5 36d201da06db690c243a38fc791fc90c
- SHA1 2c0637516ee2ab45ed7404b5c91ec054c6efd281
- SHA512 78287219cf00762c104ff05560ea0081ae67626de47af2a433ec82bdbc9e758238074c9a08578cace9429a17ed15ec296051a656cb46dee111de12048b5e5a67
- SSDEEP 192:ITfstwan8YS/01HmK8xl+0omISlysDeYH/YBM7ViBpBrAi8QHF06MYS81Qpf8U28:r8Ya016w0omHTHgBMBYBtF0iw/ev2
- MD5 SHA1 SHA512 SSDEEP
scambtr.tar.gz
- SHA256 02ce427d8e28784b34334ff5a7d501745e79375513bd7fc10711f2e1777f0e4f
- MD5 a2784193c464d4440cce94b9df942b02
- SHA1 07bbe686860cdb97efb5b9482c8eb3bd62ac535b
- SHA512 41987192489e7d23113a4055667edabd92c3f930676459aa0e29abd13bd9aa91028c78a67483f59caadf214a604f33e3e4949447b8ee105f781b40b2fe5f9c55
- SSDEEP 96:vO2UHlpLZUcghLcX8C+H2e6Fjm0NNLF4SHhKmuQXP27:FYlrUcwLhlWekjm0z6Sf/27
- MD5 SHA1 SHA512 SSDEEP
scambtr.tar
- SHA256 fa3fcd167a58a849106f0508e395612de471a660f601793d3d4f324bcc5cba0f
- MD5 7ea82f236dfda356e0b3c782a652cd58
- SHA1 bca99ca194b3887752668c4c63818c038e4cc612
- SHA512 dccd1c64c532351b3ca57efb7c69d1b963fc7fd06ca0d3ac89a6433b4e350a05498e66f78fb5ae1b894d05fda9472f4ca5b3cfe7bb1cb1b307e808e8cc09e7a4
- SSDEEP 384:2dTJsF9Fndu6I+ER/57f4Jh4zrkskMH1tXOKEE:2dFsF9FnduOEB54SzdFzEE
- MD5 SHA1 SHA512 SSDEEP
scambtr_uac/Uac_main.ps1
- SHA256 40700c3c5b8b34e105d09a5e25b920e3340ddde754a4a4903f9fab9a2743ef6e
- MD5 4bf038d8c8f25a0eea81f27147bf001e
- SHA1 e343693bbad6d1c70d82fad4ea0ca038ef26e76e
- SHA512 f6e193168fd0453f2d6969c42c660a21ec7b3d7439831bdfe817783de54ee6d1a0e58880136dea5b41f1d464afb2c383061da042cc44d0677c497dcdfb8338bc
- MD5 SHA1 SHA512
scambtr_uac/Uac_stage.ps1
- SHA256 fba13d9ece7fb0374247702650d929bb32748c20f10eeea0f21e37a1d596182f
- MD5 0b8dde09dda2c9b609dfba6652e6b74c
- SHA1 87348cdd51fd12ad4a3a635de4faf5f9c7efdb17
- SHA512 2d131b9081977a191f3191aab5474430e99a9a87d071741255c27d92488eb8491a9f82251d5619da457e1cb2c3b00b3ea4998b844ada6c70a784dc9085fc83a1
- MD5 SHA1 SHA512
scambtr_uac/Uac_stage_gen.py
- SHA256 4030c37799a112ac91aeba27f1383306084175ae4c108b033eaa27b2859e55c7
- MD5 dc8921fef81a051b06f8397d7f7ea51f
- SHA1 e95195ad66879a7e4c30cac9de549363136c633b
- SHA512 87e6ecd9c2a230a0c1356ef9e5307f024608e3cc826ff5f2e0b153a60db21e7aef5fba533226cfb74d6ecc738cc50a602e15de6aba184f3a44a7f05ade13af09
- MD5 SHA1 SHA512
scambtr_uac/amsi.ps1
- SHA256 dcc98c13be598654871475b3028f304f2a580b47c9c46531d2793de49f5f8d7d
- MD5 ce55b86a579ff526c25fdfeb398fa285
- SHA1 134fb6ec72f0123f5111333ca6d4c4a9c125cf67
- SHA512 ca4f09c14caee9282006a0a3251b17ab8c5cf3c370b81bb49579437d470d62bcb2b8909c461784d163c57e7ca725ecb1bb86036b401315fd2ff0fedcd8b51f2f
- MD5 SHA1 SHA512
scambtr_uac/command.ps1
- SHA256 4cbebed2fd52141d910fc534bdb9229ed12eccbee3d3c1d2fe86be573e697f6b
- MD5 6baed326e7132435d823b001bf8425bf
- SHA1 177637e1ae66b10f00d46798ba9c53d8952fa392
- SHA512 22ed0760c9ce4d80329f78cb13c191551297aa24726facf5f9ef5de140c6301b917acc9f5b7904d0990c83a295ceec202336c5b804af2b8fef27c9af5f51bc99
- MD5 SHA1 SHA512
scambtr_uac/down.ps1
- SHA256 ab12c751a1da5db32da6abb02fb8b24a873866b65ec45905db842877c7ff5c8d
- MD5 de07ecbd1be6e54daa4e8eaf6303b157
- SHA1 d5865ba74f03ccf7c03e27d1399e6b46e85f895e
- SHA512 e8bc8f9f272c3ba792779292dd5cc4f64f7092e63de5d58ebe4e13a755000ea2ec195eb7b20c973865728aa0d9bf198e6bf68118533de2f6664185b5e07501da
- MD5 SHA1 SHA512
scambtr_uac/payloads/fm1ri21p.ps1
- SHA256 80d6bdb1d89d5c6b81f4a09dc469cc5f0a094602ce2241e0d60fd714a7fc9327
- MD5 2d663bdc95565ef04c1d3db0e4bde2f0
- SHA1 1c1aaa0b478be1cd6732825d73f90168fe7c5790
- SHA512 75de1067200dde50a559db01da8f2b4ea22735447ce4a85dae76703a4401213edb6921960aff1fd8de5a8dd86b5d0c071f43ba49592b0993c00fa6bc7980e152
- MD5 SHA1 SHA512
scambtr_uac/payloads/remove_all.sh
- SHA256 d5d934287b98314389e19c68a8080445533dd8898e85985ddd868962ea89b639
- MD5 c0dd87c47f9372e498f1b705c5e4dc57
- SHA1 f68716aebb22e3b9119a4a37356b089e56546790
- SHA512 a6adbecf7f80c0b4753746a91e7c12e81ab3f8190de348c4410de1a5b65b9e82f297cbeb533a9f645dbeb3c8226a93c1227201150346748ded205f42b6db1603
- MD5 SHA1 SHA512
scambtr_uac/uac.ps1
- SHA256 86183e5926ddf331af460df0b74bbd581ba5f3a40306e1f4ceec656bf990054a
- MD5 1bd9f45089694130d04b2d521a8869ac
- SHA1 cb547d915da6ab4301f8e058962942728a0a7c19
- SHA512 03ea5950673ffe64cbdc50d0842d16dda3e1b265a7882b553340a3996598f5fb92a40f183d870befc98691597c7f3f0c15c5bf99dd4271a0915ab8ba2f46a1fb
- SSDEEP 192:bviELE51vJNhBH7f4YfKh4EChqakskgXH1mqX9cnKEnEe:3ER/57f4Jh4zrkskMH1tXOKEEe
- MD5 SHA1 SHA512 SSDEEP
spoolsvc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8543474ae1a34d47807c217b1537c109790be9b0d2f01dafce773d413a9442f7
- MD5 a7762550bcd9e497a17dae4bb8dab7d8
- SHA1 e1b0d4f41db0f9378e20159879c5db30d918d91b
- SHA512 531e3bc380856a67aa9cd0a525303fc39145e0f291df341d967397c72d0eb955731ada0e04fe2bbe6e97173a6ed8792bd29ab9c55c5a03f040dc8153e7f4bc15
- SSDEEP 768:XuRcNTkAJFuLWU36z+Zmo2qASKjGKG6PIyzjbFgX3iYwCbvcQ1AsZLYqXIIGQBDn:XuRcNTk85y2GKYDy3bCXSYwuvbAa45Gb
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
51166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
taskhosts.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cbfb37a30549dfc3b45cb0619d9f810f8ea32c59e63aa91a21ab8d4192f74c72
- MD5 0ae9d4d91bde4d050f899f917a56048c
- SHA1 148dd73b7a98df5a3990b016cdbed476e4320f13
- SHA512 2b7583e81947fb4a451ffd15d861956fe4be347e868678d2925a992b87367f25a6b100982999c5b212321aa2921bba042af1a0b6aaadd1226d1da6a7e1f33deb
- SSDEEP 768:gMzW03/EQupuLtpXn+Pd1IHZFl99QsOmhWbrelI:b3cQ0itp3+M5Fl997Om4yI
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
vnchooks.dll
- IMPHASH d2181aeca5f4d84ebf9b4656dd8a9ba2
- SHA256 9f4d42ef2893257fb2725ab66e9f938812e98b7270801885ca45dd30b7ed2089
- MD5 1dda065d3bd9d01799fd7e480e342993
- SHA1 af5e7592b1ebb2d295bfb2909acfa6004d2d9cb7
- SHA512 6e040ec37c4bc7c350a0ad42c7305bc178818ba75194852f370b3194ed6ce8f6529f9159bea278229b969e10c7db17fb22e8347390c8cd4170ff87f816a8fc7d
- SSDEEP 12288:qz3lKqNpYmBzR4vyj/DiSOzvL/fye6VOTC3aevaMo4YXbGggjli8:qz3l96Fgpi8
- MD5 SHA1 SHA512 SSDEEP
Digest
73:e8:6b:10:6e:0f:23:e4:ca:4e:48:ba:9e:f4:54:40:3a:44:05:6e:dc:63:1a:0d:86:d9:8c:72:73:7b:82:f3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE
Chains
Dec 8, 2022
CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE
Serial Number
4c:03:67:0a:31:e6:2b:9f:ac:b9:d2:d3:70:39:bd:07
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 23, 2022 - Sep 22, 2025
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
12932
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\rudi\Desktop\git_ultravnc\winvnc\x64\Release\vnchooks.pdb
kernel32
CreateFileW
OutputDebugStringW
ReadConsoleW
ReadFile
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
SetConsoleCtrlHandler
GetFileType
GetStdHandle
GetProcessHeap
MapViewOfFile
CreateFileMappingA
GlobalAddAtomA
CloseHandle
Sleep
GetModuleHandleA
UnmapViewOfFile
GlobalDeleteAtom
WriteFile
GetModuleFileNameA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetCurrentThread
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
RtlUnwind
user32
GetUpdateRgn
SetPropA
GetWindowRect
IsWindowVisible
PostMessageA
CallNextHookEx
GetCursor
RemovePropA
PostThreadMessageA
ClientToScreen
SetWindowsHookExA
UnhookWindowsHookEx
GetPropA
EnumWindows
GetClientRect
FindWindowA
RegisterWindowMessageA
gdi32
GetRegionData
DeleteObject
CreateRectRgn
advapi32
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
HooksType
SetHooks
SetKeyboardFilterHook
SetMouseFilterHook
UnSetHooks
Name
.text
Size
367KB
Virtual Size
367KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=29395,
count=134, id=261, version=29395,
count=10, id=260, version=29395,
count=35, id=261, version=30034,
count=14, id=260, version=30034,
count=9, id=259, version=30034,
count=9, id=257, version=29395,
count=121, id=1, productName=Unmarked objects,
count=1, id=265, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=151,
count=1, id=258, version=30146,
winlogin.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 02cda252627b911029c6123d83e211312a5bba40b4afcc06d3eb40595f0baee8
- MD5 64aa45857bbf819ca0516126748ddfdb
- SHA1 7b57da0f3115410b67456983b72df35c0f168ba8
- SHA512 138b7a4e8f07d063240cdb918660682036a13dc4e518095404211c7d67ee34c0620adf344a488f5102c47bdcc68de80584dd3b83f42f35ef0d858541ade6f4d9
- SSDEEP 768:k1/imAZfCL6p0nMskv+JUBkquxKdVC7kadRzdq2:k9imNPnMtTCTbq2
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
winvnc.exe
- IMPHASH 310b1cc8abef97edfcabf0ed406947cf
- SHA256 ec0ec7ce8ef71cb7e7d1c2418c47ad94cea8833db8578ccdf94271f8efed38d3
- MD5 7cd339f9be1417421acf8790c9738922
- SHA1 c25eff4d9d2d5b55f1cc4ffc623354004565e8b9
- SHA512 f118ea660a51ff38abc20a9ad16f6505cf8a862df1b564829d9af06710e0c4b91d0abbedc4b852696acf0e807a25138d82c2fc518cd54c32dba92f513467b411
- SSDEEP 49152:vAOdl4d7NHNUb75uEEbOyYWHxL9X5zT/dPUAUA/JH:El8DFWHTN
- MD5 SHA1 SHA512 SSDEEP
Digest
68:6b:c2:0f:5d:46:52:01:d3:b8:a5:1a:9b:e9:27:fa:eb:9f:08:72:b0:e3:2d:55:d6:31:f3:af:f1:d5:bb:85
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE
Chains
Apr 15, 2023
CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE
Serial Number
4c:03:67:0a:31:e6:2b:9f:ac:b9:d2:d3:70:39:bd:07
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 23, 2022 - Sep 22, 2025
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
1257148
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\rudi\Desktop\git_ultravnc\winvnc\winvnc\x64\Release\winvnc.pdb
ws2_32
setsockopt
getsockopt
WSAGetLastError
gethostbyname
inet_ntoa
htons
htonl
WSACleanup
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
select
shutdown
listen
WSAStartup
getpeername
inet_addr
getsockname
send
socket
connect
recv
ntohl
WSASendTo
gethostname
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
userenv
ExpandEnvironmentStringsForUserA
DestroyEnvironmentBlock
CreateEnvironmentBlock
kernel32
WritePrivateProfileStringA
GetPrivateProfileStructA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileSectionA
CreateFileMappingA
Sleep
CreateThread
MulDiv
VerSetConditionMask
VerifyVersionInfoW
ReadFile
WriteFile
OutputDebugStringA
WaitForMultipleObjects
GetEnvironmentVariableA
WaitForSingleObject
CreateFileW
GetSystemDirectoryW
SetCurrentDirectoryA
lstrcatW
LoadLibraryW
SetFileAttributesA
CreateEventA
WaitNamedPipeW
GetExitCodeProcess
ResumeThread
ResetEvent
CompareFileTime
CreateFileA
GetFileSize
GetFileTime
GetStdHandle
WriteConsoleA
FreeConsole
FormatMessageA
AllocConsole
GetExitCodeThread
MoveFileA
GetDriveTypeA
SetFileTime
SetErrorMode
SetFilePointer
SetEndOfFile
GetFileAttributesA
MoveFileExA
FileTimeToSystemTime
GetLogicalDriveStringsA
SystemTimeToFileTime
CreateDirectoryA
GetSystemTime
FlushFileBuffers
TerminateProcess
VirtualAllocEx
ReadProcessMemory
SetThreadExecutionState
VirtualFreeEx
TerminateThread
SizeofResource
FindResourceA
LockResource
LoadResource
CreateMutexA
ReleaseMutex
GlobalGetAtomNameA
GlobalDeleteAtom
GetModuleHandleW
SetProcessShutdownParameters
WinExec
WritePrivateProfileStructA
HeapReAlloc
RaiseException
FreeLibraryAndExitThread
ExitThread
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetCPInfo
SetStdHandle
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
GetModuleHandleExW
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
LoadLibraryExW
RtlUnwind
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateSemaphoreA
TlsFree
TlsGetValue
TlsAlloc
GetCurrentThread
DuplicateHandle
SetThreadPriority
ReleaseSemaphore
TlsSetValue
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SwitchToThread
GetFileType
lstrcatA
lstrcmpiA
lstrcpynA
DosDateTimeToFileTime
GetLocalTime
FileTimeToLocalFileTime
SetVolumeLabelA
LocalFileTimeToFileTime
GetVersion
GetLocaleInfoA
GetFullPathNameA
lstrcpyA
CompareStringW
LCMapStringW
GetLocaleInfoW
OpenProcess
FlsAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
DecodePointer
GetModuleFileNameW
GetStringTypeW
CreateDirectoryW
GetFileSizeEx
DeleteFileW
GetCurrentProcessId
WTSGetActiveConsoleSessionId
Process32FirstW
Process32Next
Process32NextW
GlobalAddAtomA
ProcessIdToSessionId
CreateToolhelp32Snapshot
Process32First
GetComputerNameA
GetSystemInfo
GetSystemDirectoryA
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
DeleteFileA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetProcessTimes
GetSystemTimeAsFileTime
DeleteCriticalSection
GetModuleHandleA
InitializeCriticalSection
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
CloseHandle
GetVersionExA
SetEvent
GetLastError
GetCurrentThreadId
OpenEventA
GetModuleFileNameA
GetTickCount
FreeLibrary
GetProcessHeap
GetProcAddress
HeapAlloc
InitializeCriticalSectionAndSpinCount
LoadLibraryA
lstrlenA
SetLastError
HeapFree
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GetFileAttributesExW
GlobalAlloc
GlobalSize
MultiByteToWideChar
SetFileAttributesW
MoveFileExW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
RemoveDirectoryW
HeapSize
WriteConsoleW
FlsGetValue
FlsSetValue
FlsFree
OpenThread
QueryPerformanceFrequency
LocalFree
SetThreadAffinityMask
InitializeCriticalSectionEx
GetVolumeInformationA
user32
GetSubMenu
SetMenuDefaultItem
DestroyMenu
TrackPopupMenuEx
RemoveMenu
EnableMenuItem
EnableWindow
GetWindow
VkKeyScanA
IsWindow
GetAsyncKeyState
MapVirtualKeyA
ToAscii
SendInput
SetClipboardViewer
GetClipboardOwner
WaitMessage
PostThreadMessageA
ChangeClipboardChain
SendNotifyMessageA
PeekMessageA
IsWindowVisible
LoadMenuA
GetIconInfo
GetClassNameA
WindowFromPoint
ChangeWindowMessageFilter
EnumDesktopWindows
SetRect
DrawIconEx
DestroyIcon
GetKeyboardState
mouse_event
PtInRect
MessageBeep
FlashWindow
EnumDisplaySettingsExA
EnumDisplayDevicesA
ChangeDisplaySettingsExA
GetKeyState
keybd_event
EnumDisplaySettingsA
EnumWindows
GetWindowLongA
SetWindowLongA
RedrawWindow
SetDlgItemInt
CheckDlgButton
GetDlgItemInt
IntersectRect
GetWindowRect
LoadStringA
ScreenToClient
GetScrollInfo
IsDlgButtonChecked
FillRect
MoveWindow
SetFocus
SendDlgItemMessageA
GetCursorPos
ExitWindowsEx
LockWorkStation
DrawIcon
SetLayeredWindowAttributes
UpdateWindow
InvalidateRect
GetMessageA
LoadImageA
DispatchMessageA
LoadCursorA
DestroyWindow
SetWindowPos
DrawTextA
SetWindowDisplayAffinity
AdjustWindowRect
DefWindowProcA
IsRectEmpty
CreateWindowExA
TranslateMessage
LoadIconA
GetClientRect
PostQuitMessage
RegisterClassExA
BeginPaint
EndPaint
wsprintfA
SystemParametersInfoA
GetWindowThreadProcessId
GetUserObjectInformationA
PostMessageA
RegisterWindowMessageA
FindWindowExA
OpenDesktopA
MessageBoxA
GetProcessWindowStation
FindWindowA
GetSystemMetrics
EndDialog
DialogBoxParamA
ShowWindow
GetDlgItemTextA
SetTimer
SetDlgItemTextA
SendMessageA
GetDlgItem
GetWindowLongPtrA
KillTimer
SetWindowLongPtrA
SetForegroundWindow
SetThreadDesktop
GetThreadDesktop
CloseDesktop
GetForegroundWindow
OpenInputDesktop
GetDesktopWindow
GetDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
RegisterClipboardFormatA
GetTopWindow
OemToCharA
CharToOemA
wvsprintfA
SetWindowTextA
gdi32
GetBitmapBits
SetDIBColorTable
GdiFlush
RealizePalette
SelectPalette
SetBkColor
CreateFontIndirectA
GetObjectA
ExtEscape
GetSystemPaletteEntries
DeleteObject
DeleteDC
GetPixel
GetDeviceCaps
GetDIBits
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
BitBlt
CreateFontA
CreateDCA
CreateSolidBrush
Rectangle
CreatePen
SetBkMode
SetTextColor
GetClipBox
GetStockObject
StretchBlt
PatBlt
GetRgnBox
CombineRgn
PtInRegion
GetRegionData
CreateRectRgn
OffsetRgn
CreatePalette
SetRectRgn
advapi32
SetSecurityInfo
RegCreateKeyA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
CreateServiceA
GetSecurityDescriptorLength
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
IsValidSid
IsValidSecurityDescriptor
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidAcl
AdjustTokenPrivileges
StartServiceCtrlDispatcherA
QueryServiceStatus
RegDeleteKeyA
SetTokenInformation
LookupPrivilegeValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
DeleteService
DuplicateTokenEx
ImpersonateLoggedOnUser
EqualSid
AllocateAndInitializeSid
FreeSid
OpenProcessToken
RevertToSelf
CloseServiceHandle
OpenSCManagerA
GetUserNameA
LookupAccountSidA
OpenServiceA
GetTokenInformation
CreateProcessAsUserA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
shell32
ShellExecuteA
SHGetMalloc
Shell_NotifyIconA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHFileOperationA
ShellExecuteExA
ole32
CoInitialize
CoCreateInstance
CoUninitialize
shlwapi
PathStripPathA
imm32
ImmGetDefaultIMEWnd
dwmapi
DwmIsCompositionEnabled
ord102
iphlpapi
GetAdaptersInfo
adler32
adler32_combine
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_final
crc32_init
crc32_update
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
uncompress
uncompress2
zError
zlibCompileFlags
zlibVersion
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
561KB
Virtual Size
560KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
629KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
801KB
Virtual Size
800KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=29395,
count=235, id=261, version=29395,
count=18, id=260, version=29395,
count=15, id=253, version=28518,
count=19, id=260, version=30034,
count=12, id=259, version=30034,
count=84, id=261, version=30034,
count=39, id=260, version=30146,
count=13, id=261, version=30146,
count=27, productName=Unmarked objects (old),
count=1, id=262, version=29395,
count=533, id=1, productName=Unmarked objects,
count=27, id=257, version=29395,
count=186, id=265, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=151,
count=1, id=258, version=30146,
wlms.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d1f622488a88176e81cdb1cb8669f586803c2dff54f660ac72a18f0a1d27194c
- MD5 a1d4eaa6f0f151d604a1e6f79583ff88
- SHA1 0388fa9634f697cf371cd51ee28654a19f051bee
- SHA512 a2291c4d121061098bf9102bdd9bf304d96f53f9ba39a813973d29af4c6a88ae982aae5bfd3be1a7ffd005eabef4331f3fdc882020978e46fcd601ce564c351b
- SSDEEP 3072:qfpQ+eycKYOl5xUP7BEhoGNSuFraxC9+JPQcU8gJu2JvVT0mLjqZ9NRbqzyxXNsE:qfpQ+vJKyGTs+tP0JSmLjqZ9NRbq+x9r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
193374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ