Epsilon (Epsilon)[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

Epsilon (Epsilon).zip
Size

17.1MB
MD5

5e7e3fdab96e2e593c884b3d2f27d340
SHA1

8507f07bf0279ad43099a717d17f175704a94ff3
SHA256

34de42bdf2b9429c9069106b052533d3d8242336a9624a370be2b07d0557f9cc
SHA512

98195eef47a1eee3c3326695e8a3a7f59e582284bd1aacf35898a4197da86bc04d0448e37cb478df755e748dc32697cb791d2c18ce3ffec6d709580285e741b5
SSDEEP

196608:fkH6/dEdNCFWoOG0z1NYr1BIIUZc8Ovno3MP5M16JZ2g7gY6zExf6xtwkIZmBQcu:EdgWlZNYsImMx46J45EQU7ZwasJ3B3Dg

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Epsilon.exe
unpack001/flutter_windows.dll

Files

Epsilon (Epsilon).zip
.zip

Password: Epsilon
Epsilon.exe
.exe windows:4 windows x86 arch:x86

Password: Epsilon

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bss
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
api-ms-win-crt-runtime-l1-1-0.dll
.dll windows:10 windows x64 arch:x64

Password: Epsilon

Code Sign

33:00:00:03:26:ae:ce:ed:f9:bc:e4:7b:92:00:00:00:00:03:26
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:29

Not After

03-03-2021 18:29

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:fc:50:cb:59:16:c1:43:b3:c0:c4:28:9c:53:56:2e:1d:50:b4:4c:72:07:e1:41:12:c1:a6:b2:22:86:1a:10
Signer

Actual PE Digest

20:fc:50:cb:59:16:c1:43:b3:c0:c4:28:9c:53:56:2e:1d:50:b4:4c:72:07:e1:41:12:c1:a6:b2:22:86:1a:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-crt-runtime-l1-1-0.pdb

Exports

Exports

_Exit
__doserrno
__fpe_flt_rounds
__fpecode
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__pgmptr
__p__wcmdln
__p__wpgmptr
__pxcptinfoptrs
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__wcserror
__wcserror_s
_assert
_beginthread
_beginthreadex
_c_exit
_cexit
_clearfp
_configure_narrow_argv
_configure_wide_argv
_control87
_controlfp
_controlfp_s
_crt_at_quick_exit
_crt_atexit
_endthread
_endthreadex
_errno
_execute_onexit_table
_exit
_fpieee_flt
_fpreset
_get_doserrno
_get_errno
_get_initial_narrow_environment
_get_initial_wide_environment
_get_invalid_parameter_handler
_get_narrow_winmain_command_line
_get_pgmptr
_get_terminate
_get_thread_local_invalid_parameter_handler
_get_wide_winmain_command_line
_get_wpgmptr
_getdllprocaddr
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_query_app_type
_register_onexit_function
_register_thread_local_exe_atexit_callback
_resetstkoflw
_seh_filter_dll
_seh_filter_exe
_set_abort_behavior
_set_app_type
_set_controlfp
_set_doserrno
_set_errno
_set_error_mode
_set_invalid_parameter_handler
_set_new_handler
_set_thread_local_invalid_parameter_handler
_seterrormode
_sleep
_statusfp
_strerror
_strerror_s
_wassert
_wcserror
_wcserror_s
_wperror
_wsystem
abort
exit
feclearexcept
fegetenv
fegetexceptflag
fegetround
feholdexcept
fesetenv
fesetexceptflag
fesetround
fetestexcept
perror
quick_exit
raise
set_terminate
signal
strerror
strerror_s
system
terminate

Sections

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bin/fonts/Ermilov-bold.otf
bin/fonts/noirpro-bold.otf
bin/fonts/noirpro-light.otf
bin/fonts/noirpro-medium.otf
bin/fonts/noirpro-regular.otf
bin/fonts/noirpro-semibold.otf
bin/modificator/gamespanelTYPE.cfg
bin/modificator/libraryaddmod.cfg
bin/modificator/modsinstallationtime.cfg
bin/modificator/showaddgame.cfg
bin/modificator/showaddgamebutton.cfg
bin/modificator/showfiltersgames.cfg
bin/modificator/showfiltersmods.cfg
bin/modificator/showgamesicons.cfg
bin/modificator/showinstallations.cfg
bin/modificator/softwarename.cfg
bin/modificator/softwaretheme.cfg
bin/packages/media_kit/assets/web/hls1.4.10.js
.js
bin/packages/wakelock_plus/assets/no_sleep.js
.js
bin/resources/IconApp.ico
bin/resources/audio/abominationpissed_de.wav
bin/resources/audio/abominationpissed_en.wav
bin/resources/audio/abominationpissed_ru.wav
bin/resources/audio/csgo_hover.wav
bin/resources/audio/csgo_press.wav
bin/resources/audio/fortnite_hover.wav
bin/resources/audio/fortnite_press.wav
bin/resources/audio/standard_hover.wav
bin/resources/audio/standard_press.wav
bin/resources/audio/steam_hover.wav
bin/resources/audio/steam_press.wav
bin/resources/audio/windows_notification.wav
bin/resources/backgrounds/agents%20of%20mayhem.jpg
.jpg

Password: Epsilon
bin/resources/backgrounds/anime.jpg
.gif
bin/resources/backgrounds/catsday.jpg
.jpg

Password: Epsilon
bin/resources/backgrounds/cyberpunk.jpg
.jpg

Password: Epsilon
bin/resources/backgrounds/fallguys_v1.jpg
.jpg

Password: Epsilon
bin/resources/backgrounds/fallguys_v2.jpg
.jpg

Password: Epsilon
bin/resources/backgrounds/fishingday.jpg
.jpg

Password: Epsilon
bin/resources/backgrounds/god%20of%20war.jpg
.jpg
bin/resources/backgrounds/halloween.jpg
.jpg
bin/resources/backgrounds/halo.jpg
.jpg
bin/resources/backgrounds/icecreamday.jpg
.jpg
bin/resources/backgrounds/jokeday.jpg
.jpg
bin/resources/backgrounds/loveday.jpg
.jpg
bin/resources/backgrounds/newyear.jpg
.gif
bin/resources/backgrounds/ori%20and%20the%20blind%20forest.jpg
.jpg
bin/resources/backgrounds/schoolday.jpg
.jpg
bin/resources/backgrounds/spaceday.jpg
.jpg
bin/resources/backgrounds/summerstart.jpg
.jpg
bin/resources/backgrounds/tastyfoodday.jpg
.jpg
bin/resources/backgrounds/victoryday.jpg
.jpg
bin/resources/backgrounds/warcraft.jpg
.jpg
bin/resources/backgrounds/warhammer.jpg
.jpg
bin/resources/compressed_logos/cats.ico
bin/resources/compressed_logos/clown.ico
bin/resources/compressed_logos/food.ico
bin/resources/compressed_logos/halloween.ico
bin/resources/compressed_logos/installer_logo.ico
bin/resources/compressed_logos/logo.ico
bin/resources/compressed_logos/newyear.ico
bin/resources/compressed_logos/romantic.ico
bin/resources/compressed_logos/space.ico
bin/resources/compressed_logos/summer.ico
bin/resources/compressed_logos/war.ico
bin/resources/fonts/noirpro-bold.otf
bin/resources/fonts/noirpro-light.otf
bin/resources/fonts/noirpro-medium.otf
bin/resources/fonts/noirpro-regular.otf
bin/resources/fonts/noirpro-semibold.otf
bin/resources/icons/0.svg
bin/resources/icons/add.svg
bin/resources/icons/admin-panel.svg
bin/resources/icons/advanced.svg
bin/resources/icons/alien.svg
bin/resources/icons/android.svg
bin/resources/icons/answer.svg
bin/resources/icons/arrow-down.svg
bin/resources/icons/arrow-left.svg
bin/resources/icons/arrow-right.svg
bin/resources/icons/auto-delete.svg
bin/resources/icons/back-arrow.svg
bin/resources/icons/bank.svg
bin/resources/icons/bell.svg
bin/resources/icons/bug.svg
bin/resources/icons/calendar-alternative.svg
bin/resources/icons/calendar.svg
bin/resources/icons/cancel.svg
bin/resources/icons/cat-1.svg
bin/resources/icons/cat.svg
bin/resources/icons/chart-bar-alt.svg
bin/resources/icons/check.svg
bin/resources/icons/check_circle.svg
bin/resources/icons/checked.svg
bin/resources/icons/checkmark.svg
bin/resources/icons/chevron-down.svg
bin/resources/icons/christmas-tree.svg
bin/resources/icons/circular-divider.svg
bin/resources/icons/close-circle.svg
bin/resources/icons/close.svg
bin/resources/icons/cloud-off.svg
bin/resources/icons/collapse.svg
bin/resources/icons/complain.svg
bin/resources/icons/cookie.svg
bin/resources/icons/crab.svg
bin/resources/icons/date-calendar.svg
bin/resources/icons/day.svg
bin/resources/icons/description-blank.svg
bin/resources/icons/directory.svg
bin/resources/icons/discord.svg
bin/resources/icons/doubled-arrow.svg
bin/resources/icons/download-sharp.svg
bin/resources/icons/download.svg
bin/resources/icons/edit.svg
bin/resources/icons/error-circle.svg
bin/resources/icons/farmbot.svg
bin/resources/icons/favourite-add.svg
bin/resources/icons/favourite-added.svg
bin/resources/icons/file-text.svg
bin/resources/icons/filter.svg
bin/resources/icons/flower.svg
bin/resources/icons/folder.svg
bin/resources/icons/fun.svg
bin/resources/icons/gamepad.svg
bin/resources/icons/gear.svg
bin/resources/icons/geo.svg
bin/resources/icons/ghost.svg
bin/resources/icons/google.svg
.xml
bin/resources/icons/heart.svg
bin/resources/icons/hot.svg
bin/resources/icons/icecream.svg
bin/resources/icons/info.svg
bin/resources/icons/information.svg
bin/resources/icons/key.svg
bin/resources/icons/keyboard-properties.svg
bin/resources/icons/library.svg
bin/resources/icons/logo.svg
bin/resources/icons/macros.svg
bin/resources/icons/mail.svg
bin/resources/icons/mask.svg
bin/resources/icons/medium.svg
bin/resources/icons/moon.svg
bin/resources/icons/movement.svg
bin/resources/icons/neuronet.svg
bin/resources/icons/new-year-star.svg
bin/resources/icons/notification.svg
bin/resources/icons/optical.svg
bin/resources/icons/pause.svg
bin/resources/icons/pencil.svg
bin/resources/icons/playback.svg
bin/resources/icons/plug.svg
bin/resources/icons/plus.svg
bin/resources/icons/preview.svg
bin/resources/icons/puffer-fish.svg
bin/resources/icons/pumpkin.svg
bin/resources/icons/refresh.svg
bin/resources/icons/reply.svg
bin/resources/icons/resolved.svg
bin/resources/icons/resume.svg
bin/resources/icons/safe-shield.svg
bin/resources/icons/search-alternative.svg
bin/resources/icons/search.svg
bin/resources/icons/selected-anixart.svg
.xml
bin/resources/icons/selected-check.svg
bin/resources/icons/selected-viewbox.svg
.xml
bin/resources/icons/selected.svg
bin/resources/icons/settings.svg
bin/resources/icons/shield-exclamation.svg
bin/resources/icons/shrimp.svg
bin/resources/icons/simple.svg
bin/resources/icons/sort-ascending-reflected.svg
.xml
bin/resources/icons/sort-ascending.svg
bin/resources/icons/sort.svg
bin/resources/icons/space.svg
bin/resources/icons/star-border.svg
bin/resources/icons/star-filled.svg
bin/resources/icons/star.svg
bin/resources/icons/stars.svg
bin/resources/icons/steam.svg
bin/resources/icons/store.svg
bin/resources/icons/sun.svg
bin/resources/icons/swords.svg
bin/resources/icons/tank.svg
bin/resources/icons/telegram.svg
bin/resources/icons/thumb-down.svg
bin/resources/icons/thumb-up.svg
bin/resources/icons/tick.svg
bin/resources/icons/translate-not-google.svg
bin/resources/icons/translate.svg
bin/resources/icons/trash-bin.svg
bin/resources/icons/trash-can.svg
bin/resources/icons/trash.svg
bin/resources/icons/trust-properties.svg
bin/resources/icons/unavailable.svg
bin/resources/icons/unsafe-shield.svg
bin/resources/icons/unverified.svg
bin/resources/icons/upload-sharp.svg
bin/resources/icons/user.svg
bin/resources/icons/users.svg
bin/resources/icons/vac.svg
bin/resources/icons/verified.svg
bin/resources/icons/warning.svg
bin/resources/icons/window-minimize.svg
bin/resources/icons/windows.svg
bin/resources/images/cloud.png
.png
bin/resources/images/fabric_first.png
.png
bin/resources/images/fabric_second.png
.png
bin/resources/images/fabric_third.png
.png
bin/resources/images/forge_first.png
.png
bin/resources/images/forge_second.png
.png
bin/resources/images/grain.png
.png
bin/resources/images/mascot.png
.png
bin/resources/images/rain.webp
bin/resources/images/rules.jpg
.jpg
bin/resources/images/snow.webp
bin/resources/images/snow_alternative.webp
bin/shaders/ink_sparkle.frag
bin/user/Avatar.jpg
.jpg
bin/user/level.txt
bin/user/login.cfg
bin/user/nickname.txt
flutter_windows.dll
.dll windows:5 windows x64 arch:x64

43bdba0e433437185a2ca3ff043f1bea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\b\s\w\ir\cache\builder\src\out\ci\host_release\flutter_windows.dll.pdb

Imports

advapi32

RegOpenKeyExW
RegCloseKey
RegGetValueW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW

iphlpapi

GetAdaptersAddresses

ole32

CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc

oleaut32

SysFreeString
SysStringLen
SafeArrayCreateVector
SafeArrayPutElement
VarBstrCmp
LoadTypeLi
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetVartype
VarUI4FromStr
VariantClear
LoadRegTypeLi
SafeArrayGetDim
SafeArrayDestroy
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
SysAllocStringLen
VariantInit
VariantCopy

psapi

GetProcessMemoryInfo
EnumProcessModules

shlwapi

PathIsRelativeW
PathCreateFromUrlW
UrlIsW

rpcrt4

UuidCreateSequential
RpcStringFreeW
UuidToStringW

winmm

timeBeginPeriod
timeEndPeriod

ws2_32

ioctlsocket
freeaddrinfo
socket
getaddrinfo
closesocket
shutdown
connect
setsockopt
recv
send
getsockopt
WSAGetLastError
WSASetLastError
WSARecv
WSASend
WSASendTo
WSARecvFrom
GetHostNameW
htons
ntohs
WSAAddressToStringW
WSAStartup
getsockname
getpeername
getnameinfo
InetPtonW
InetNtopW
WSAIoctl
WSASocketW
listen
bind

imm32

ImmGetCompositionStringW
ImmReleaseContext
ImmSetCompositionStringW
ImmNotifyIME
ImmGetContext
ImmSetCandidateWindow
ImmSetCompositionWindow

user32

GetSysColor
SetClipboardData
EmptyClipboard
GetClipboardData
IsClipboardFormatAvailable
IsWindow
CloseClipboard
MessageBeep
GetKeyState
CloseTouchInputHandle
GetTouchInputInfo
DestroyCaret
ReleaseCapture
CreateCaret
SetCapture
GetMessageExtraInfo
DefWindowProcW
RegisterTouchWindow
SetWindowLongPtrW
SendMessageW
MapVirtualKeyW
PeekMessageW
RegisterClassW
PostMessageW
TrackMouseEvent
ScreenToClient
GetCursorPos
SetCursor
DestroyWindow
SetTimer
SetUserObjectInformationA
CreateWindowExW
LoadCursorW
SystemParametersInfoW
ClientToScreen
MonitorFromPoint
MonitorFromWindow
UnregisterClassW
CreateIconIndirect
ReleaseDC
GetDC
GetClassInfoW
GetClientRect
WindowFromDC
GetWindowThreadProcessId
IsIconic
InvalidateRect
CreateWindowExA
KillTimer
GetFocus
SetCaretPos
PostQuitMessage
EnumThreadWindows
GetParent
CharNextW
NotifyWinEvent
GetWindowLongPtrW
UnregisterClassA
OpenClipboard

opengl32

wglGetProcAddress
wglGetCurrentContext

bcrypt

BCryptGenRandom

api-ms-win-core-path-l1-1-0

PathCchCombineEx
PathCchRemoveFileSpec

ntdll

RtlAddGrowableFunctionTable
VerSetConditionMask
RtlDeleteGrowableFunctionTable
RtlUnwindEx
RtlUnwind

oleacc

LresultFromObject

uiautomationcore

UiaRaiseAutomationEvent
UiaRaiseAutomationPropertyChangedEvent
UiaGetReservedNotSupportedValue
UiaGetReservedMixedAttributeValue
UiaHostProviderFromHwnd

propsys

VariantCompare

dxgi

CreateDXGIFactory1
CreateDXGIFactory

gdi32

GetPixelFormat
SwapBuffers
DescribePixelFormat
SetPixelFormat
ChoosePixelFormat
SetDIBitsToDevice
PatBlt
GetDeviceCaps
DeleteDC
SetPixel
GetPixel
SelectObject
CreateCompatibleBitmap
GetObjectW
CreateCompatibleDC
CreateDIBSection
DeleteObject

d3d9

D3DPERF_EndEvent
D3DPERF_GetStatus
Direct3DCreate9
D3DPERF_SetMarker
D3DPERF_BeginEvent

kernel32

GetCommandLineA
GetCPInfo
CompareStringEx
FlsFree
FlsSetValue
FlsAlloc
LCMapStringEx
InitializeCriticalSectionEx
EncodePointer
RtlPcToFileHeader
GetStringTypeW
InitOnceComplete
InitOnceBeginInitialize
GetExitCodeThread
SwitchToThread
GetFileInformationByHandleEx
AreFileApisANSI
FindFirstFileExW
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
GetProcessHeap
GetOEMCP
GetACP
InterlockedPushEntrySList
InterlockedFlushSList
CreateThread
ExitThread
FlsGetValue
FreeLibraryAndExitThread
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetEnvironmentVariableW
SetEnvironmentVariableW
GetTempFileNameA
GetTempPathA
GetDriveTypeW
GetFileAttributesExW
LoadLibraryExA
GetModuleHandleExA
GetModuleHandleA
LocaleNameToLCID
lstrcmpiW
SizeofResource
LoadResource
FindResourceW
GetTimeZoneInformationForYear
SleepConditionVariableSRW
VirtualQuery
TlsFree
CreatePipe
SetEvent
Sleep
QueryPerformanceCounter
QueryPerformanceFrequency
WakeAllConditionVariable
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
TryAcquireSRWLockExclusive
SetFileTime
DeviceIoControl
MoveFileW
CopyFileExW
CreateSymbolicLinkW
GetFullPathNameW
UnlockFileEx
LockFileEx
VirtualFree
VirtualProtect
SetFilePointerEx
VirtualAlloc
SetFileAttributesW
MoveFileExW
GetConsoleScreenBufferInfo
GetExitCodeProcess
CreateNamedPipeW
TerminateProcess
OpenProcess
WaitForMultipleObjects
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLocaleName
GetSystemInfo
SetUnhandledExceptionFilter
SetCurrentDirectoryW
GetCurrentDirectoryW
GetQueuedCompletionStatus
ReadDirectoryChangesW
WriteFile
PostQueuedCompletionStatus
GetFileType
OpenThread
CancelIoEx
CreateIoCompletionPort
PeekNamedPipe
HeapSize
ReadConsoleW
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetModuleHandleExW
IsValidCodePage
SetStdHandle
SetConsoleMode
GetConsoleMode
GetStdHandle
SetConsoleCP
SetConsoleOutputCP
InitializeCriticalSectionAndSpinCount
GetLastError
FormatMessageW
DecodePointer
DeleteCriticalSection
LoadLibraryA
GetProcAddress
CreateEventW
RegisterWaitForSingleObject
ResetEvent
UnregisterWait
CloseHandle
OutputDebugStringW
LocalFree
GetCurrentProcess
GetModuleHandleW
GetCurrentThread
SetThreadPriority
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetLocaleInfoEx
GetCurrentThreadId
GetCurrentProcessId
CreateToolhelp32Snapshot
Thread32Next
Thread32First
FormatMessageA
GetThreadPreferredUILanguages
CreateSemaphoreW
WaitForSingleObject
ReleaseSemaphore
WaitForSingleObjectEx
RaiseException
GetCommandLineW
WideCharToMultiByte
GetTempPathW
CreateDirectoryW
CreateFileW
DuplicateHandle
GetFileInformationByHandle
GetFileAttributesW
RemoveDirectoryW
DeleteFileW
SetFilePointer
SetEndOfFile
FlushViewOfFile
FlushFileBuffers
FindFirstFileW
FindNextFileW
FindClose
GetFinalPathNameByHandleW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateWaitableTimerW
VerifyVersionInfoW
SetWaitableTimer
LoadLibraryW
FreeLibrary
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetSystemTimeAsFileTime
CreateFileA
IsDebuggerPresent
GetNativeSystemInfo
LoadLibraryExW
MultiByteToWideChar
GetFileSizeEx
ReadFile
OutputDebugStringA
InitOnceExecuteOnce
InitializeSRWLock
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
TlsGetValue
TlsAlloc
SetLastError
TlsSetValue
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetFinalPathNameByHandleA
SetConsoleCtrlHandler
GetConsoleOutputCP
WriteConsoleW

crypt32

CertCloseStore
CertOpenStore
CertEnumCertificatesInStore
CertFreeCertificateContext

Exports

Exports

FlutterDesktopEngineCreate
FlutterDesktopEngineCreateViewController
FlutterDesktopEngineDestroy
FlutterDesktopEngineGetMessenger
FlutterDesktopEngineGetPluginRegistrar
FlutterDesktopEngineGetTextureRegistrar
FlutterDesktopEngineProcessExternalWindowMessage
FlutterDesktopEngineProcessMessages
FlutterDesktopEngineRegisterPlatformViewType
FlutterDesktopEngineReloadSystemFonts
FlutterDesktopEngineRun
FlutterDesktopEngineSetNextFrameCallback
FlutterDesktopGetDpiForHWND
FlutterDesktopGetDpiForMonitor
FlutterDesktopMessengerAddRef
FlutterDesktopMessengerIsAvailable
FlutterDesktopMessengerLock
FlutterDesktopMessengerRelease
FlutterDesktopMessengerSend
FlutterDesktopMessengerSendResponse
FlutterDesktopMessengerSendWithReply
FlutterDesktopMessengerSetCallback
FlutterDesktopMessengerUnlock
FlutterDesktopPluginRegistrarGetMessenger
FlutterDesktopPluginRegistrarGetView
FlutterDesktopPluginRegistrarGetViewById
FlutterDesktopPluginRegistrarRegisterTopLevelWindowProcDelegate
FlutterDesktopPluginRegistrarSetDestructionHandler
FlutterDesktopPluginRegistrarUnregisterTopLevelWindowProcDelegate
FlutterDesktopRegistrarGetTextureRegistrar
FlutterDesktopResyncOutputStreams
FlutterDesktopTextureRegistrarMarkExternalTextureFrameAvailable
FlutterDesktopTextureRegistrarRegisterExternalTexture
FlutterDesktopTextureRegistrarUnregisterExternalTexture
FlutterDesktopViewControllerCreate
FlutterDesktopViewControllerDestroy
FlutterDesktopViewControllerForceRedraw
FlutterDesktopViewControllerGetEngine
FlutterDesktopViewControllerGetView
FlutterDesktopViewControllerGetViewId
FlutterDesktopViewControllerHandleTopLevelWindowProc
FlutterDesktopViewGetGraphicsAdapter
FlutterDesktopViewGetHWND
InternalFlutterGpuTestClass_Create
InternalFlutterGpuTestClass_Method
InternalFlutterGpuTestProc
InternalFlutterGpuTestProcWithCallback
InternalFlutterGpu_CommandBuffer_Initialize
InternalFlutterGpu_CommandBuffer_Submit
InternalFlutterGpu_Context_GetDefaultColorFormat
InternalFlutterGpu_Context_GetDefaultDepthStencilFormat
InternalFlutterGpu_Context_GetDefaultStencilFormat
InternalFlutterGpu_Context_InitializeDefault
InternalFlutterGpu_DeviceBuffer_Initialize
InternalFlutterGpu_DeviceBuffer_InitializeWithHostData
InternalFlutterGpu_DeviceBuffer_Overwrite
InternalFlutterGpu_HostBuffer_EmplaceBytes
InternalFlutterGpu_HostBuffer_Initialize
InternalFlutterGpu_RenderPass_Begin
InternalFlutterGpu_RenderPass_BindIndexBufferDevice
InternalFlutterGpu_RenderPass_BindIndexBufferHost
InternalFlutterGpu_RenderPass_BindPipeline
InternalFlutterGpu_RenderPass_BindTexture
InternalFlutterGpu_RenderPass_BindUniformDevice
InternalFlutterGpu_RenderPass_BindUniformHost
InternalFlutterGpu_RenderPass_BindVertexBufferDevice
InternalFlutterGpu_RenderPass_BindVertexBufferHost
InternalFlutterGpu_RenderPass_ClearBindings
InternalFlutterGpu_RenderPass_Draw
InternalFlutterGpu_RenderPass_Initialize
InternalFlutterGpu_RenderPass_SetColorAttachment
InternalFlutterGpu_RenderPass_SetColorBlendEnable
InternalFlutterGpu_RenderPass_SetColorBlendEquation
InternalFlutterGpu_RenderPass_SetDepthCompareOperation
InternalFlutterGpu_RenderPass_SetDepthStencilAttachment
InternalFlutterGpu_RenderPass_SetDepthWriteEnable
InternalFlutterGpu_RenderPipeline_Initialize
InternalFlutterGpu_ShaderLibrary_GetShader
InternalFlutterGpu_ShaderLibrary_InitializeWithAsset
InternalFlutterGpu_Shader_GetUniformMemberOffset
InternalFlutterGpu_Shader_GetUniformStructSize
InternalFlutterGpu_Texture_AsImage
InternalFlutterGpu_Texture_BytesPerTexel
InternalFlutterGpu_Texture_Initialize
InternalFlutterGpu_Texture_Overwrite
InternalFlutterGpu_Texture_SetCoordinateSystem

Sections

.text
Size: 13.5MB - Virtual size: 13.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 373KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vcruntime140.dll
.dll windows:6 windows x64 arch:x64

7f07fd94e5bb907093556781cc464017

Code Sign

33:00:00:00:f8:ae:a0:bd:67:8b:63:ac:eb:00:00:00:00:00:f8
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2023 19:43

Not After

16-10-2024 19:43

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01-05-2013 20:44

Not After

01-05-2028 20:54

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2023 19:51

Not After

16-10-2024 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:10:bc:7c:70:3a:63:1e:59:62:cd:e6:a1:79:12:c0:c4:d6:01:d7:92:6a:f3:49:92:51:74:e7:92:fb:3d:a0
Signer

Actual PE Digest

1a:10:bc:7c:70:3a:63:1e:59:62:cd:e6:a1:79:12:c0:c4:d6:01:d7:92:6a:f3:49:92:51:74:e7:92:fb:3d:a0

Digest Algorithm

sha256

PE Digest Matches

true

1a:10:bc:7c:70:3a:63:1e:59:62:cd:e6:a1:79:12:c0:c4:d6:01:d7:92:6a:f3:49:92:51:74:e7:92:fb:3d:a0
Signer

Actual PE Digest

1a:10:bc:7c:70:3a:63:1e:59:62:cd:e6:a1:79:12:c0:c4:d6:01:d7:92:6a:f3:49:92:51:74:e7:92:fb:3d:a0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

terminate
abort

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free

api-ms-win-crt-string-l1-1-0

strcpy_s
strncmp
wcsncmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vsprintf_s

api-ms-win-crt-convert-l1-1-0

atol

kernel32

GetLastError
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlUnwindEx
GetModuleHandleW
GetModuleFileNameW
RtlUnwind
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetProcAddress
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW

Exports

Exports

_CreateFrameInfo
_CxxThrowException
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__C_specific_handler_noexcept
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__intrinsic_setjmpex
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_get_purecall_handler
_get_unexpected
_is_exception_typeof
_local_unwind
_purecall
_set_purecall_handler
_set_se_translator
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: Epsilon

Password: Epsilon

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 17KB - Virtual size: 16KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 512B - Virtual size: 12B

.bss Size: 312KB - Virtual size: 312KB

Password: Epsilon

Code Sign

33:00:00:03:26:ae:ce:ed:f9:bc:e4:7b:92:00:00:00:00:03:26Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

20:fc:50:cb:59:16:c1:43:b3:c0:c4:28:9c:53:56:2e:1d:50:b4:4c:72:07:e1:41:12:c1:a6:b2:22:86:1a:10Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Exports

Exports

Sections

.rdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 1024B - Virtual size: 1008B

Password: Epsilon

Password: Epsilon

Password: Epsilon

Password: Epsilon

Password: Epsilon

Password: Epsilon

43bdba0e433437185a2ca3ff043f1bea

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

iphlpapi

ole32

oleaut32

psapi

shlwapi

rpcrt4

winmm

ws2_32

imm32

user32

opengl32

bcrypt

api-ms-win-core-path-l1-1-0

ntdll

oleacc

uiautomationcore

propsys

dxgi

gdi32

d3d9

kernel32

crypt32

Exports

Exports

Sections

.text Size: 13.5MB - Virtual size: 13.5MB

.rdata Size: 2.9MB - Virtual size: 2.9MB

.data Size: 373KB - Virtual size: 451KB

.pdata Size: 460KB - Virtual size: 460KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 135KB - Virtual size: 134KB

7f07fd94e5bb907093556781cc464017

Code Sign

.text
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 512B - Virtual size: 12B

.bss
Size: 312KB - Virtual size: 312KB

33:00:00:03:26:ae:ce:ed:f9:bc:e4:7b:92:00:00:00:00:03:26
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

20:fc:50:cb:59:16:c1:43:b3:c0:c4:28:9c:53:56:2e:1d:50:b4:4c:72:07:e1:41:12:c1:a6:b2:22:86:1a:10
Signer

.rdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 1008B

.text
Size: 13.5MB - Virtual size: 13.5MB

.rdata
Size: 2.9MB - Virtual size: 2.9MB

.data
Size: 373KB - Virtual size: 451KB

.pdata
Size: 460KB - Virtual size: 460KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 135KB - Virtual size: 134KB

33:00:00:00:f8:ae:a0:bd:67:8b:63:ac:eb:00:00:00:00:00:f8
Certificate

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

1a:10:bc:7c:70:3a:63:1e:59:62:cd:e6:a1:79:12:c0:c4:d6:01:d7:92:6a:f3:49:92:51:74:e7:92:fb:3d:a0
Signer

1a:10:bc:7c:70:3a:63:1e:59:62:cd:e6:a1:79:12:c0:c4:d6:01:d7:92:6a:f3:49:92:51:74:e7:92:fb:3d:a0
Signer

.text
Size: 68KB - Virtual size: 67KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 2KB

_RDATA
Size: 512B - Virtual size: 504B

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 1024B - Virtual size: 732B