BLToolsv2[.]9PRO[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

BLToolsv2.9PRO.zip
Size

9.9MB
MD5

0e66465f74545dccadb38961898ac3d3
SHA1

57043bd36df6f2450487a1fe5feb77b33921010b
SHA256

c2c518b4b0f151045b3b1cba54b7b2a950763977d2db31299b98ad84756a784b
SHA512

86148eaf039a2534bea31f5c92cf730d28d0512e93f964f5fffc67fb1733e5b02c6798b8c42ced8057041f365a216762090030b48a36d6652a4cc58947836a58
SSDEEP

196608:Zc+RU9MniZdA3D0yBI6t+tnZRUQdNFX6KlJAGkG3GlluFWccrVk6:ZcEiZ6LBVt+FFDlvGlQFW3u6

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/BLTools v2.9 [PRO]/BLTools v2.9 [PRO].exe	vmprotect

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BLTools v2.9 [PRO]/AlphaFS.dll
unpack001/BLTools v2.9 [PRO]/BLTools v2.9 [PRO].exe
unpack001/BLTools v2.9 [PRO]/CookiesCreator.exe
unpack001/BLTools v2.9 [PRO]/Extreme.Net.dll
unpack001/BLTools v2.9 [PRO]/MaterialDesignColors.dll
unpack001/BLTools v2.9 [PRO]/MaterialDesignThemes.Wpf.dll
unpack001/BLTools v2.9 [PRO]/Ookii.Dialogs.Wpf.dll

Files

BLToolsv2.9PRO.zip
.zip
BLTools v2.9 [PRO]/AlphaFS.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\jjangli\Documents\GitHub\AlphaFS\AlphaFS\obj\Net452\AlphaFS.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BLTools v2.9 [PRO]/BLTools v2.9 [PRO].exe
.exe windows:6 windows x64 arch:x64

2df38a1ae5759eca19cd2d1b1cc4e208

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

DecryptMessage
AcceptSecurityContext
EncryptMessage
ApplyControlToken
DeleteSecurityContext
FreeContextBuffer
QueryContextAttributesW
InitializeSecurityContextW
AcquireCredentialsHandleA
LsaFreeReturnBuffer
LsaGetLogonSessionData
FreeCredentialsHandle
LsaEnumerateLogonSessions

kernel32

GetModuleHandleA
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
QueryPerformanceFrequency
FormatMessageW
GetCurrentProcess
GetEnvironmentVariableW
GetTempPathW
CreateFileW
SetFileInformationByHandle
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
CreateThread
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentProcessId
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
RtlVirtualUnwind
AcquireSRWLockShared
ReleaseSRWLockShared
DuplicateHandle
CopyFileExW
SetHandleInformation
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
GetSystemInfo
VirtualQueryEx
OpenProcess
GlobalMemoryStatusEx
GetQueuedCompletionStatusEx
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
Sleep
GetSystemDirectoryA
GetEnvironmentVariableA
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
MoveFileExA
CreateFileA
GetFileSizeEx
ReadFile
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
WakeConditionVariable
SetFileCompletionNotificationModes
CreateIoCompletionPort
CancelIoEx
PostQueuedCompletionStatus
SleepConditionVariableSRW
SwitchToThread
GetModuleHandleW
HeapReAlloc
HeapFree
SetThreadStackGuarantee
AddVectoredExceptionHandler
DeleteFileW
GetFileInformationByHandleEx
FreeLibrary
GetProcAddress
LoadLibraryExW
GetComputerNameExW
GetLogicalDrives
GetTickCount64
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetUserPreferredUILanguages
ReleaseSRWLockExclusive
GetLastError
GetFileInformationByHandle
AcquireSRWLockExclusive
WakeAllConditionVariable
CloseHandle
IsDebuggerPresent
ReadProcessMemory
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

SystemFunction036
GetLengthSid
CopySid
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
IsValidSid

ws2_32

WSACloseEvent
recv
getpeername
shutdown
getsockopt
ioctlsocket
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
WSAEnumNetworkEvents
WSASocketW
WSAIoctl
WSASend
setsockopt
WSAEventSelect
recvfrom
WSAGetLastError
closesocket
send
getsockname
WSACreateEvent
WSAResetEvent
WSASetLastError
WSAWaitForMultipleEvents
htons
socket
ntohs
listen
htonl
accept
select
__WSAFDIsSet
bind
connect
WSARecv
WSAGetOverlappedResult

crypt32

CryptDecodeObjectEx
PFXImportCertStore
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertOpenStore
CryptStringToBinaryA
CryptUnprotectData
CertFindCertificateInStore
CertFindExtension

oleaut32

SysAllocString
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
SysFreeString
SafeArrayUnaccessData
SysAllocStringLen
SafeArrayAccessData

pdh

PdhCollectQueryData
PdhOpenQueryA
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhAddEnglishCounterW
PdhCloseQuery

iphlpapi

GetIfTable2
GetIfEntry2
FreeMibTable
GetAdaptersAddresses

netapi32

NetUserGetLocalGroups
NetUserGetInfo
NetApiBufferFree
NetUserEnum

user32

GetMonitorInfoW
EnumDisplayMonitors
EnumDisplaySettingsExW
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

DeleteDC
CreateDCW
CreateCompatibleDC
DeleteObject
SelectObject
SetStretchBltMode
StretchBlt
GetDIBits
GetObjectW
GetDeviceCaps
CreateCompatibleBitmap

ole32

CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoTaskMemFree

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW
SHGetKnownFolderPath

ntdll

NtReadFile
NtWriteFile
RtlNtStatusToDosError
NtCreateFile
RtlGetVersion
NtQueryInformationProcess
NtQuerySystemInformation

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
GetPerformanceInfo

vcruntime140

memset
__CxxFrameHandler3
memmove
memcmp
strchr
strrchr
strstr
memchr
__C_specific_handler
__current_exception
__current_exception_context
memcpy

api-ms-win-crt-string-l1-1-0

strcmp
_strdup
strncpy
strcpy
wcslen
isupper
strpbrk
tolower
strncmp
strlen
strspn
strcspn

api-ms-win-crt-heap-l1-1-0

calloc
malloc
realloc
free
_msize
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_cexit
_initialize_onexit_table
__p___argc
__sys_errlist
_exit
exit
_register_onexit_function
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_c_exit
__sys_nerr
_set_app_type
_seh_filter_exe
_endthreadex
_register_thread_local_exe_atexit_callback
_errno
_wassert
abort
_crt_atexit
terminate
_configure_narrow_argv
_beginthreadex
_initterm_e
__p___argv

api-ms-win-crt-convert-l1-1-0

strtoll
strtol
atoi
strtoul
wcstombs

api-ms-win-crt-stdio-l1-1-0

_open
_lseeki64
fopen
fflush
fgets
feof
_read
__stdio_common_vsscanf
ftell
_set_fmode
__p__commode
fclose
__acrt_iob_func
fread
fseek
_close
fputs
_write
fwrite
fputc
__stdio_common_vsprintf

api-ms-win-crt-time-l1-1-0

_time64
strftime
_gmtime64
_localtime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_access
_unlink
_stat64
_fstat64

api-ms-win-crt-math-l1-1-0

_dclass
log
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

wtsapi32

WTSSendMessageW

Exports

Exports

!��I��e*��o{��c�I'ն1��ͭH�Q��1p�\��S��J�2��{�'�=@�v��Ǎۧ.rz�$��)��>�_�kӷ��iC;{KLY��f_��yd��r��#�ϵ4ۗA��r��J�t1ad��|�x�)��!�^�3��.��c(�PwWf��>�7��^��5��:]=V��SmCV��ɹ��D40 Sa9i��)��R��K'Y� �t�C��ۛ�ou(�+�p� �HfT�0�.�'6+�Oy��#��83��m�Pt\��M�R�|_��ֲʜw"*��p�/�C��?f�͐�߬��6�p2�Z�T��!�̑�f�}\@>P7�>B�l�ܚSB\��y-�@G�\��߼��$$�*5��fE�6+h�� d��_T��-Sl3��rA�tɧX��唆#{��AQe�8�x�j�^O�.�#��_��Hw^*�h U�(��J��fD��&d>7�5r��d8��T�ܺL�GR.�;�E6��1_Z��<�/�Gv�"�-X�$��C��g ��`�N^h��T]3*��PDf�k��"0蹶��J�W�l�� Uo��R |��G鶮xJ�!��Ǆ�B�{S�� :'սt��>�ZFM^��O��9m��Wް�9 ��A��՞��8᾿D�=��j�3Ħ��^\��w��P�2�'�tk0�$Jgũ?Izĸ��^X�32�]w�`<VɁV_uҖ�8��4.=SR��7Lqtr��Tm��3L�ص��Y/��7��9��oLO9tx��ꛅ��F.�'�:��U|/�aM�&�!G�)�J&�7��֝~WTTp8t�Y�"4)�BL� ��5�ן;\n!%�eGn�,%��自.�ѕ5�AA�M�ސ8�:��3��b�둍� �&-Iׄ2��G�3�,��s�V��Ǝ��_��n<b%fN�UƦ�s�g�6RV֬�1܊�4�{[C�I�]|��1� �W�@K��#g+�:�%��(�F�|ײ�Ş;��Y��d+!��N�j��)y�VUͤÙh� =:�8~sщKX�%>w��;_p�]��=�s��Bi �r��&�� 7Rml��qC��(��qp�I��#��* �R:��N�1]-��zG��'��۫"�?qo��&�o�=��7S�t'�x_��*�^ҧqy�Ǚ�v �� ̔��g+#��~��QJ��y�+��`L<o��s��O"/��<��fO�﷙'��)�� &�#��M�ꁤK�h�e7��h��a̞��X��p(��sv�܃ �% �v>�_ߐ@��G*.gFą��m� ��<@+��s��AW��B�Ҽ��.T"5��o�_X<H5&k\��iv�� H��Qʀ�|fEXǡ~� ��\��m$�G�1;u�z��0�y7��vT|�NL}�j��o �%E�-�l�Pt�ק>� ��z��G��;�O��r��\P��\�&�)ې��KǕ<K>P�4��ͮ-OTso��n&fE�q��Q��B��y!^��e� r+��ʝ�>��|�D)�"��>_��<�מnk`��Jr\�Z�e�w��P�t� `Uw�Ք.b]��T��k��g �x�C��yu��8��0�j1ĭ��p�r��&/��i�w��g ͆��H�Y]��a۫P�"��-,T��V�(/(b&"��P#V��[{�( �U��4��'d i\��M ��PcA�>�g�,w!A�>y� ��C��J��,�F��,�*�?gs�۬AY��W�+&�[���\"s�|+Q3��%��O�$�H�N��:H(��URSAl�n��4T�� %�u� �|E��E8��jtĞ�P��u��ji-Ҧ]pk >�Z<��dĵ .l�6Ԇb��h��s�@��,��.J�|��S)��y)"V ��=��i��7F4Ni�B+l~�L��`��v[�� ʰ4��N_��Z<Ʃǻ��]�i�u��C�qg�n�q��-�wc�?H�3��e0�2$#��C�R=��gO��B�Cy=:�ԔRI�!��5�kE��~r�ЛC-.��!ܩj��XGD��>��Ҧ��TV>I�L��T�N�#�t�C� ��!竀'�P`7`�5��e��K��]L��"��N�"Vt�|�p�+�"́��b�յk�J}9N��B�#(��v��V��ha�q*��D��(ܱ��Yq��j��Aq�jKh=>lt��a/�oj�R8�k�,�0��o�C��A<G6�6_Z�,��!�ys��_�G6#^Ma�(�+�f��Qp�C7�>\c��<��"��[��7Ĩ�d#�� M�$��-��G�� ~GKI�6c��s�Եʾ��j/LA�'ԏ�(�5H�Hy�D�� ǣ��Zrn�d��8�3Ylzݥ��sPP�oIN͕C��/��L�&��y0`�O��N��'�H��^�#��Q$��ᰜ#��U٨ �Z�I}��Q��u��*�;��~�7��V�kԲFD>pv�<az �T@9a(V2�H_2r,��V27��1E�e��W��y�)��8�ex�΅Bu�-2+v�b�e��z�ґɐ�crq�/�<xKb�铌��șO`]Cj��l��OIV��D*�4��."]Ǉ��<��aA��Qu�{��"��k��⺷��5g�W�j��X�B�< $��ϧ"A1�G�0p��XRƭ�G�p.�q��㼬�O�Cg��}��Aȥ��Bt��x�GCaw8&a�]{

Sections

.text
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BLTools v2.9 [PRO]/CookiesCreator.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BLTools v2.9 [PRO]/Extreme.Net.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\scarf\source\repos\Extreme.Net\obj\Debug\Extreme.Net.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BLTools v2.9 [PRO]/License.dll
BLTools v2.9 [PRO]/MaterialDesignColors.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net462\MaterialDesignColors.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 293KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BLTools v2.9 [PRO]/MaterialDesignThemes.Wpf.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net462\MaterialDesignThemes.Wpf.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9.1MB - Virtual size: 9.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BLTools v2.9 [PRO]/Microsoft.Xaml.Behaviors.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b2:63:8a:cb:ae:08:38:57:4d:ee:95:eb:a6:58:3b:10:80:3d:86:3e:1c:8f:0d:12:62:f5:87:f8:01:ae:17:30
Signer

Actual PE Digest

b2:63:8a:cb:ae:08:38:57:4d:ee:95:eb:a6:58:3b:10:80:3d:86:3e:1c:8f:0d:12:62:f5:87:f8:01:ae:17:30

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\src\Microsoft.Xaml.Behaviors\obj\Release\net462\Microsoft.Xaml.Behaviors.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BLTools v2.9 [PRO]/Ookii.Dialogs.Wpf.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\ookii-dialogs-wpf\ookii-dialogs-wpf\src\Ookii.Dialogs.Wpf\obj\Release\net462\Ookii.Dialogs.Wpf.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BLTools v2.9 [PRO]/Projects/2Captcha.proj
BLTools v2.9 [PRO]/Projects/2dehands.be.proj
BLTools v2.9 [PRO]/Projects/2ememain.be.proj
BLTools v2.9 [PRO]/Projects/7BitCasino.proj
BLTools v2.9 [PRO]/Projects/AIRBNB.proj
BLTools v2.9 [PRO]/Projects/AOL Inbox Mail.proj
BLTools v2.9 [PRO]/Projects/Ahrefs @Cash_Out_Gang1337.proj
BLTools v2.9 [PRO]/Projects/AirBNB payment.proj
BLTools v2.9 [PRO]/Projects/Aliexpress.proj
BLTools v2.9 [PRO]/Projects/Altenens.is.proj
BLTools v2.9 [PRO]/Projects/Azure.com.proj
BLTools v2.9 [PRO]/Projects/BING AI @CashOutGang_Chat.proj
BLTools v2.9 [PRO]/Projects/Bitcoin Casino.proj
BLTools v2.9 [PRO]/Projects/Booking.proj
BLTools v2.9 [PRO]/Projects/Brightdata.proj
BLTools v2.9 [PRO]/Projects/Carbonite.proj
BLTools v2.9 [PRO]/Projects/Cash.App Capture.proj
BLTools v2.9 [PRO]/Projects/CashApp.proj
BLTools v2.9 [PRO]/Projects/Chaturbate.proj
BLTools v2.9 [PRO]/Projects/Codecanyon@Cash_Out_Gang1337.proj
BLTools v2.9 [PRO]/Projects/Cracked.io.proj
BLTools v2.9 [PRO]/Projects/CrackedIO.proj
BLTools v2.9 [PRO]/Projects/Crax Shop.proj
BLTools v2.9 [PRO]/Projects/CreativeMarket@Cash_Out_Gang1337.proj
BLTools v2.9 [PRO]/Projects/CrowdCube.proj
BLTools v2.9 [PRO]/Projects/Crown Office - Net30 Payments.proj
BLTools v2.9 [PRO]/Projects/DH Gate.proj
BLTools v2.9 [PRO]/Projects/DemonForums - Username Capture.proj
BLTools v2.9 [PRO]/Projects/Designs.Ai.proj
BLTools v2.9 [PRO]/Projects/Dropbox.proj
BLTools v2.9 [PRO]/Projects/Ebay Kaz.proj
BLTools v2.9 [PRO]/Projects/Ebay.proj
BLTools v2.9 [PRO]/Projects/EbayCheck.proj
BLTools v2.9 [PRO]/Projects/Eneba.proj
BLTools v2.9 [PRO]/Projects/Envato Elements with Capture.proj
BLTools v2.9 [PRO]/Projects/Envato Elements.proj
BLTools v2.9 [PRO]/Projects/Epic Games.proj
BLTools v2.9 [PRO]/Projects/Escrow.com.proj
BLTools v2.9 [PRO]/Projects/Etsy.proj
BLTools v2.9 [PRO]/Projects/FIVERR Payment Method.proj
BLTools v2.9 [PRO]/Projects/FIVERR 💸.proj
BLTools v2.9 [PRO]/Projects/FIVERR.proj
BLTools v2.9 [PRO]/Projects/Facebook with Geo.proj
BLTools v2.9 [PRO]/Projects/FacebookADS.proj
BLTools v2.9 [PRO]/Projects/Figma.proj
BLTools v2.9 [PRO]/Projects/Fiverr Capture.proj
BLTools v2.9 [PRO]/Projects/Flipkart.proj
BLTools v2.9 [PRO]/Projects/Flippa.com.proj
BLTools v2.9 [PRO]/Projects/Fourshared.proj
BLTools v2.9 [PRO]/Projects/Freecash Com.proj
BLTools v2.9 [PRO]/Projects/Gamestop.proj
BLTools v2.9 [PRO]/Projects/Gammaapp.proj
BLTools v2.9 [PRO]/Projects/GenerateDeps.proj
BLTools v2.9 [PRO]/Projects/GitHub.proj
BLTools v2.9 [PRO]/Projects/Godaddy Login.proj
BLTools v2.9 [PRO]/Projects/Godaddy Shopper ID.proj
BLTools v2.9 [PRO]/Projects/Godaddy.proj
BLTools v2.9 [PRO]/Projects/Google Ads.proj
BLTools v2.9 [PRO]/Projects/Gumroad Balance.proj
.js
BLTools v2.9 [PRO]/Projects/Hulu.proj
BLTools v2.9 [PRO]/Projects/ICloud.proj
BLTools v2.9 [PRO]/Projects/Indiedigo.proj
BLTools v2.9 [PRO]/Projects/InfinityFree@Cash_Out_Gang1337.proj
BLTools v2.9 [PRO]/Projects/Instacart.proj
BLTools v2.9 [PRO]/Projects/Jyriqad.proj
BLTools v2.9 [PRO]/Projects/KICK 🎵.proj
BLTools v2.9 [PRO]/Projects/KOHO.proj
BLTools v2.9 [PRO]/Projects/KRAKEN.proj
BLTools v2.9 [PRO]/Projects/Kickstarter.com @Cash_Out_Gang1337.proj
BLTools v2.9 [PRO]/Projects/Kinguin.net.proj
BLTools v2.9 [PRO]/Projects/Ko-fi.proj
BLTools v2.9 [PRO]/Projects/Kohls.proj
BLTools v2.9 [PRO]/Projects/LegalZoom.proj
BLTools v2.9 [PRO]/Projects/Marriott.proj
BLTools v2.9 [PRO]/Projects/Microsoft Office 365 @Cash_Out_Gang1337.proj
BLTools v2.9 [PRO]/Projects/Microsoft365.proj
BLTools v2.9 [PRO]/Projects/Midasbuy.proj
BLTools v2.9 [PRO]/Projects/Monday.com.proj
BLTools v2.9 [PRO]/Projects/Motion Array.proj
BLTools v2.9 [PRO]/Projects/Mubi.proj
BLTools v2.9 [PRO]/Projects/Mukipyf.proj
BLTools v2.9 [PRO]/Projects/Niflheim World.proj
BLTools v2.9 [PRO]/Projects/Nulled.to.proj
BLTools v2.9 [PRO]/Projects/Office365.proj
BLTools v2.9 [PRO]/Projects/Ok RU.proj
BLTools v2.9 [PRO]/Projects/OnlineSIM.proj
BLTools v2.9 [PRO]/Projects/Outlook Mail.proj
BLTools v2.9 [PRO]/Projects/PIAPRoxy.proj
BLTools v2.9 [PRO]/Projects/POF @CashOutGang_Chat.proj
BLTools v2.9 [PRO]/Projects/Paramount.proj
BLTools v2.9 [PRO]/Projects/Patreon.proj
BLTools v2.9 [PRO]/Projects/Paxful @Cash_Out_Gang1337.proj
BLTools v2.9 [PRO]/Projects/Paypal with Capture @CashOutGang_Chat.proj
BLTools v2.9 [PRO]/Projects/Paypal.proj
BLTools v2.9 [PRO]/Projects/Perplexity.proj
BLTools v2.9 [PRO]/Projects/Petsmart.com.proj
BLTools v2.9 [PRO]/Projects/Postmates.proj
BLTools v2.9 [PRO]/Projects/Proxyscrape.proj
BLTools v2.9 [PRO]/Projects/Proxystore.proj
BLTools v2.9 [PRO]/Projects/Replit.proj
BLTools v2.9 [PRO]/Projects/Rplt.proj
BLTools v2.9 [PRO]/Projects/SEM-Rush.proj
BLTools v2.9 [PRO]/Projects/SIP Station VOIP.proj
BLTools v2.9 [PRO]/Projects/Samsung Payment Method.proj
BLTools v2.9 [PRO]/Projects/Samsung Points.proj
BLTools v2.9 [PRO]/Projects/Shein.proj
BLTools v2.9 [PRO]/Projects/Snapchat @Cash_Out_Gang1337.proj
BLTools v2.9 [PRO]/Projects/SoundCloud.proj
BLTools v2.9 [PRO]/Projects/Spotify.proj
BLTools v2.9 [PRO]/Projects/StockX.proj
BLTools v2.9 [PRO]/Projects/TRENDYOL.proj
BLTools v2.9 [PRO]/Projects/Temu CC Capture.proj
BLTools v2.9 [PRO]/Projects/Temu Products Captured.proj
BLTools v2.9 [PRO]/Projects/Temu.proj
BLTools v2.9 [PRO]/Projects/TextNow.proj
BLTools v2.9 [PRO]/Projects/Trucksmarter.proj
BLTools v2.9 [PRO]/Projects/Tumbler.proj
BLTools v2.9 [PRO]/Projects/Uber.proj
BLTools v2.9 [PRO]/Projects/Ulta.proj
BLTools v2.9 [PRO]/Projects/UltraVPN2.proj
BLTools v2.9 [PRO]/Projects/Upwork.proj
BLTools v2.9 [PRO]/Projects/Vendor Mercuryvmp.proj
BLTools v2.9 [PRO]/Projects/VidPros.proj
BLTools v2.9 [PRO]/Projects/Vimeo Videos.proj
BLTools v2.9 [PRO]/Projects/WISE.proj
BLTools v2.9 [PRO]/Projects/Walmart - Full Capture.proj
BLTools v2.9 [PRO]/Projects/WalmartCAN.proj
BLTools v2.9 [PRO]/Projects/Watyzyg.proj
BLTools v2.9 [PRO]/Projects/Wayfair.proj
BLTools v2.9 [PRO]/Projects/Willhaben.proj
BLTools v2.9 [PRO]/Projects/WinTube.proj
BLTools v2.9 [PRO]/Projects/XVideos.proj
BLTools v2.9 [PRO]/Projects/Xnxx.proj
BLTools v2.9 [PRO]/Projects/ZIllow.proj
BLTools v2.9 [PRO]/Projects/Zelenka.proj
BLTools v2.9 [PRO]/Projects/Zoho.proj
BLTools v2.9 [PRO]/Projects/ZoomInfo.proj
BLTools v2.9 [PRO]/Projects/account.xbox.com.proj
BLTools v2.9 [PRO]/Projects/amateur.tv.proj
BLTools v2.9 [PRO]/Projects/att.proj
BLTools v2.9 [PRO]/Projects/capmonster.cloud.proj
BLTools v2.9 [PRO]/Projects/carousell_MY.proj
BLTools v2.9 [PRO]/Projects/carousell_SG.proj
BLTools v2.9 [PRO]/Projects/dba.dk.proj
BLTools v2.9 [PRO]/Projects/finn.no.proj
BLTools v2.9 [PRO]/Projects/formswift.proj
BLTools v2.9 [PRO]/Projects/freelancer.proj
BLTools v2.9 [PRO]/Projects/indiegogo.proj
BLTools v2.9 [PRO]/Projects/linkedin @Cash_Out_Gang1337.proj
BLTools v2.9 [PRO]/Projects/marktplaats.nl.proj
BLTools v2.9 [PRO]/Projects/mullvad.net.proj
BLTools v2.9 [PRO]/Projects/nebenan.de.proj
BLTools v2.9 [PRO]/Projects/njuskalo.hr.proj
BLTools v2.9 [PRO]/Projects/office.com.proj
BLTools v2.9 [PRO]/Projects/olx.br.proj
BLTools v2.9 [PRO]/Projects/otto.de.proj
BLTools v2.9 [PRO]/Projects/output.txt
BLTools v2.9 [PRO]/Projects/poshmark.com.proj
BLTools v2.9 [PRO]/Projects/rucaptcha.com.proj
BLTools v2.9 [PRO]/Projects/sexlog.proj
BLTools v2.9 [PRO]/Projects/shpock.com.proj
BLTools v2.9 [PRO]/Projects/stubhub.proj
BLTools v2.9 [PRO]/Projects/subito.it.proj
BLTools v2.9 [PRO]/Projects/t.py
BLTools v2.9 [PRO]/Projects/xss.proj
BLTools v2.9 [PRO]/Projects/zalando.de2.proj
BLTools v2.9 [PRO]/Projects/zelenka.guru.proj
.js
BLTools v2.9 [PRO]/Projects/zoosk.proj
.js
BLTools v2.9 [PRO]/Settings.ini

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 356KB - Virtual size: 356KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

2df38a1ae5759eca19cd2d1b1cc4e208

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

oleaut32

pdh

iphlpapi

netapi32

user32

gdi32

ole32

bcrypt

shell32

ntdll

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 2.9MB

.rdata Size: - Virtual size: 1.2MB

.data Size: - Virtual size: 30KB

.pdata Size: - Virtual size: 88KB

.vmp0 Size: - Virtual size: 3.5MB

.vmp1 Size: 7.1MB - Virtual size: 7.1MB

.reloc Size: 512B - Virtual size: 224B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 111KB - Virtual size: 110KB

.rsrc Size: 68KB - Virtual size: 67KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 118KB - Virtual size: 118KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 356KB - Virtual size: 356KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: - Virtual size: 2.9MB

.rdata
Size: - Virtual size: 1.2MB

.data
Size: - Virtual size: 30KB

.pdata
Size: - Virtual size: 88KB

.vmp0
Size: - Virtual size: 3.5MB

.vmp1
Size: 7.1MB - Virtual size: 7.1MB

.reloc
Size: 512B - Virtual size: 224B

.text
Size: 111KB - Virtual size: 110KB

.rsrc
Size: 68KB - Virtual size: 67KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 118KB - Virtual size: 118KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 293KB - Virtual size: 292KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 9.1MB - Virtual size: 9.1MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

b2:63:8a:cb:ae:08:38:57:4d:ee:95:eb:a6:58:3b:10:80:3d:86:3e:1c:8f:0d:12:62:f5:87:f8:01:ae:17:30
Signer

.text
Size: 130KB - Virtual size: 130KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 100KB - Virtual size: 100KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B