Build[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Build.zip
Size

13.2MB
MD5

dc27a05bca028fdea32ce70deb829e30
SHA1

87df8d8884a8119651a881d3a3d2d66bc42e845c
SHA256

99b421b433eae70d9b28445cfcfee2185de5511a0c98355f817ba63e65b842c1
SHA512

e7721c9872a20c0646fe2d5a64e6edc730dab3b4105a04a7768331f16fd45f10976e250123a2c1d35b155658407ddbe9775fa3522deca9affcf4b7f96f05ea97
SSDEEP

393216:IilLgkSGJ2ErGI1uV7PfmL04PSQQ2ZgvhR2Essh:IiirZIona08IhR/sU

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/bin/Injector.exe	vmprotect

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Atlantis.exe
unpack001/bin/Injector.exe
unpack001/bin/VMProtectSDK64.dll
unpack001/bin/amdxx64.dll

Files

Build.zip
.zip
Atlantis.exe
.exe windows:6 windows x64 arch:x64

48179d4801024f7b6e9d9f729fcbb9be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

lxzp.pdb

Imports

kernel32

RtlUnwindEx
GetUserDefaultUILanguage
LCIDToLocaleName
GetLastError
FormatMessageW
lstrlenW
LoadLibraryA
GetProcAddress
TlsGetValue
LoadLibraryExA
TlsAlloc
EncodePointer
HeapFree
GetProcessHeap
RaiseException
RtlPcToFileHeader
IsProcessorFeaturePresent
DeleteCriticalSection
CreateProcessA
IsDebuggerPresent
GetCurrentThreadId
GetModuleHandleW
CloseHandle
WriteFile
CreateFileA
LoadLibraryW
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
SleepConditionVariableSRW
UnhandledExceptionFilter
WakeAllConditionVariable
CreateMutexA
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateThread
WideCharToMultiByte
WriteConsoleW
MultiByteToWideChar
GetFullPathNameW
ExitProcess
SetEnvironmentVariableW
GetFinalPathNameByHandleW
InitializeSListHead
TlsFree
TlsSetValue
DeviceIoControl
GetFileAttributesW
CreateFileW
OutputDebugStringA
OutputDebugStringW
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
GetEnvironmentVariableW
FindFirstFileW
CreateDirectoryW
GetFileInformationByHandleEx
FindClose
FindNextFileW
ReleaseMutex
HeapReAlloc
QueryPerformanceFrequency
TerminateProcess
GetCurrentProcessId
GetStdHandle
ReleaseSRWLockExclusive
GetTempPathW
InitializeCriticalSectionAndSpinCount
WaitNamedPipeA
WaitForSingleObject
HeapAlloc
GetCurrentProcess
GetFileInformationByHandle
GetConsoleMode
Sleep
GetModuleHandleA
SetFileInformationByHandle
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
GetSystemInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetCommandLineW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

oleaut32

SetErrorInfo
SysFreeString
SysStringLen
GetErrorInfo

bcryptprimitives

ProcessPrng

shell32

ord190
DragQueryFileW
SHGetKnownFolderPath
SHOpenFolderAndSelectItems
ord155
SHAppBarMessage
ShellExecuteExW
DragFinish

ole32

CoTaskMemAlloc
CoUninitialize
RevokeDragDrop
CoCreateInstance
OleInitialize
RegisterDragDrop
CoInitializeEx
CoInitialize
CoTaskMemFree

bcrypt

BCryptGenRandom

advapi32

EventRegister
EventSetInformation
EventWriteTransfer
RegGetValueW
EventUnregister
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
SystemFunction036

user32

CreateAcceleratorTableW
DestroyAcceleratorTable
AppendMenuW
CreatePopupMenu
CreateMenu
DestroyMenu
RemoveMenu
DrawIconEx
SetMenuItemInfoW
CheckMenuItem
GetMenuItemInfoW
DrawMenuBar
SetMenu
TrackPopupMenu
ToUnicodeEx
GetKeyboardLayout
SendInput
SetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
DestroyIcon
SetWindowDisplayAffinity
PostQuitMessage
GetMenuBarInfo
SetWindowLongW
DestroyWindow
TranslateAcceleratorW
GetMessageA
EnableMenuItem
GetSystemMenu
MapVirtualKeyExW
GetKeyState
GetAsyncKeyState
GetKeyboardState
SystemParametersInfoA
SetPropW
IsWindowVisible
ClipCursor
GetClipCursor
ShowCursor
GetMenu
GetRawInputData
MonitorFromPoint
EnumDisplayMonitors
CreateIcon
SystemParametersInfoW
TranslateMessage
DispatchMessageA
PostMessageW
AdjustWindowRect
ReleaseCapture
SetCapture
RedrawWindow
SetWindowLongPtrW
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
DrawTextW
IsProcessDPIAware
OffsetRect
GetWindowDC
IsIconic
ScreenToClient
SetParent
MapWindowPoints
RegisterWindowMessageA
ShowWindow
ReleaseDC
GetDC
GetWindowLongPtrW
GetParent
SetWindowRgn
FindWindowExW
IsWindowEnabled
EnableWindow
InsertMenuW
EnumChildWindows
RegisterClassExW
GetWindowPlacement
SetWindowPlacement
ChangeDisplaySettingsExW
FlashWindowEx
DefWindowProcW
GetMessageW
MapVirtualKeyW
LoadCursorW
GetForegroundWindow
RegisterTouchWindow
IsWindow
CreateWindowExW
AdjustWindowRectEx
GetActiveWindow
UpdateWindow
InvalidateRect
SetCursorPos
InvalidateRgn
SetWindowPos
GetWindowRect
GetClientRect
DispatchMessageW
GetUpdateRect
PeekMessageW
PostThreadMessageW
ValidateRect
SendMessageW
GetMonitorInfoW
SetCursor
MonitorFromWindow
GetCursorPos
FillRect
CloseTouchInputHandle
GetTouchInputInfo
TrackMouseEvent
MonitorFromRect
GetSystemMetrics
ClientToScreen
GetWindowLongW

comctl32

DefSubclassProc
RemoveWindowSubclass
TaskDialogIndirect
SetWindowSubclass

gdi32

SetTextColor
GetDeviceCaps
CreateCompatibleDC
SetBkMode
SelectObject
CreateDIBSection
CreateRectRgn
CreateSolidBrush
BitBlt
CombineRgn
DeleteDC
DeleteObject

dwmapi

DwmGetWindowAttribute
DwmEnableBlurBehindWindow
DwmSetWindowAttribute

shlwapi

SHCreateMemStream

ntdll

NtReadFile
RtlNtStatusToDosError
RtlGetVersion
NtWriteFile

api-ms-win-crt-math-l1-1-0

trunc
__setusermatherr
pow
floor
round

api-ms-win-crt-string-l1-1-0

_wcsicmp
wcslen
wcsncmp
wcscmp
strcpy_s

api-ms-win-crt-convert-l1-1-0

_ultow_s
_wtoi
wcstol

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
_callnewh
calloc

api-ms-win-crt-runtime-l1-1-0

_exit
exit
_initterm_e
_initterm
_register_onexit_function
_initialize_onexit_table
abort
_initialize_narrow_environment
_configure_narrow_argv
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_crt_atexit
terminate
_get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/Injector.exe
.exe windows:6 windows x64 arch:x64

62a3e17fb27cb763359f1e14520f2a5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WriteConsoleW
Process32First
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
WriteConsoleA
WriteFile
GetDynamicTimeZoneInformation
CreateToolhelp32Snapshot
GetConsoleMode
Process32Next
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
OpenProcess
GetCurrentProcess
GetLastError
LocalFree
FormatMessageA
WriteProcessMemory
CreateFileW
DuplicateHandle
VirtualAllocEx
HeapSize
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
SetFilePointerEx
GetFileSizeEx
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
WakeConditionVariable
TryAcquireSRWLockExclusive
WideCharToMultiByte
WaitForSingleObjectEx
GetExitCodeThread
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
GetLocaleInfoEx
GetProcAddress
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetTimeZoneInformation
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

ntdll

ZwSetIoCompletion
RtlLookupFunctionEntry
NtQueryObject
RtlNtStatusToDosError
NtQueryInformationProcess
RtlVirtualUnwind
RtlCaptureContext

user32

GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 473KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bin/VMProtectSDK64.dll
.dll windows:5 windows x64 arch:x64

1851ff453adce0cef5274e320d5bed3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException

Exports

Exports

VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber

Sections

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/amdxx64.dll
.dll windows:6 windows x64 arch:x64

258493f6842b953cf9e315dfac5c0d9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

VerSetConditionMask
RtlPcToFileHeader
RtlNtStatusToDosError
NtWriteFile
RtlUnwindEx
RtlUnwind

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

ws2_32

WSAStartup
select
__WSAFDIsSet
WSAGetLastError
send
recv
closesocket
gethostname
WSAResetEvent
WSACleanup
WSASetLastError
WSAIoctl
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAWaitForMultipleEvents
inet_pton
inet_ntop
connect
ioctlsocket
setsockopt
socket
getaddrinfo
freeaddrinfo

advapi32

CryptDecrypt
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptAcquireContextW
CryptSignHashW
CryptEnumProvidersW
CryptExportKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA

bcrypt

BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertOpenStore
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA

wsock32

htons
ntohs
getsockopt
getservbyname
getservbyport
gethostbyname
gethostbyaddr
accept
bind
getsockname
htonl
listen
getpeername
recvfrom
sendto
ioctlsocket
inet_addr
shutdown

kernel32

EnumSystemLocalesW
GetConsoleOutputCP
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
InterlockedPushEntrySList
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
InitializeSListHead
GetStringTypeW
GetCPInfo
SetUnhandledExceptionFilter
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
VirtualQuery
CreateFileA
WriteFile
ReadFile
GetLastError
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
CloseHandle
SetEvent
ResetEvent
CreateEventA
FormatMessageA
SetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
GetLocaleInfoA
GetProcessHeap
HeapFree
HeapReAlloc
Sleep
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
GetModuleHandleW
FormatMessageW
lstrlenW
RtlCaptureContext
IsValidLocale
HeapSize
GetEnvironmentVariableW
HeapAlloc
GetCurrentDirectoryW
WaitForSingleObjectEx
GetCurrentProcess
CreateMutexA
ReleaseMutex
ReleaseSRWLockExclusive
FlushFileBuffers
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemDirectoryA
MoveFileExA
GetEnvironmentVariableA
SleepEx
VerifyVersionInfoW
GetFileSizeEx
InitializeCriticalSection
WakeConditionVariable
WakeAllConditionVariable
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
VirtualProtect
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleExW
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
GetExitCodeThread
CreateSemaphoreA
GetACP
GetSystemTimeAsFileTime
CompareStringEx
ConvertFiberToThread
ConvertThreadToFiberEx
LoadLibraryW
SetConsoleMode
ReadConsoleA
ReadConsoleW
LCMapStringEx
DecodePointer
EncodePointer
InitOnceComplete
InitOnceBeginInitialize
GetTickCount64
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
CopyFileW
DeviceIoControl
AreFileApisANSI
SetFileInformationByHandle
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
SetFilePointerEx
GetExitCodeProcess
CreateProcessW
GetTimeZoneInformation
GetModuleFileNameW
SetConsoleCtrlHandler
ExitProcess
AcquireSRWLockExclusive
FileTimeToSystemTime
RtlLookupFunctionEntry
GetUserDefaultLCID
FindFirstFileExW
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
LocalFree
HeapQueryInformation
SetStdHandle
SetEndOfFile
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
RtlVirtualUnwind
GetFileType
DeleteFileW

user32

SetCapture
MessageBoxA
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
keybd_event
mouse_event
MapVirtualKeyA
GetSystemMetrics
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
LoadCursorA
ScreenToClient
GetCursorPos
SetCursor
SetCursorPos
IsWindowUnicode
GetForegroundWindow
ReleaseCapture
GetCapture
GetKeyState
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
GetClipboardData
SetWindowLongPtrW
CallWindowProcA
GetWindowThreadProcessId
FindWindowA
ClientToScreen
GetClientRect

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Sections

.text
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 296KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
workspace/.tests/appendfile.txt
workspace/.tests/getcustomasset.txt
workspace/.tests/isfile.txt
workspace/.tests/listfiles/test_1.txt
workspace/.tests/listfiles/test_2.txt
workspace/.tests/loadfile.txt
workspace/.tests/readfile.txt
workspace/.tests/writefile
workspace/.tests/writefile.txt
workspace/CMD-X.lua
workspace/IY_FE.iy
workspace/SimpleSpy/Settings.json
workspace/__oh_version.txt
workspace/_orca/options.json
workspace/dex/deps_version.dat
workspace/dex/rbx_api.dat
workspace/dex/rbx_rmd.dat
workspace/f42f3746fb3eb60f837d3673581c14a5-cache.lua
.js
workspace/hydroxide/user/Upbolt/methods/environment.lua
workspace/hydroxide/user/Upbolt/methods/string.lua
workspace/hydroxide/user/Upbolt/methods/table.lua
workspace/hydroxide/user/Upbolt/methods/userdata.lua
workspace/hydroxide/user/Upbolt/modules/ClosureSpy.lua
workspace/hydroxide/user/Upbolt/modules/ConstantScanner.lua
workspace/hydroxide/user/Upbolt/modules/ModuleScanner.lua
workspace/hydroxide/user/Upbolt/modules/RemoteSpy.lua
workspace/hydroxide/user/Upbolt/modules/ScriptScanner.lua
workspace/hydroxide/user/Upbolt/modules/UpvalueScanner.lua
workspace/hydroxide/user/Upbolt/objects/Closure.lua
workspace/hydroxide/user/Upbolt/objects/Constant.lua
workspace/hydroxide/user/Upbolt/objects/LocalScript.lua
workspace/hydroxide/user/Upbolt/objects/ModuleScript.lua
workspace/hydroxide/user/Upbolt/objects/Remote.lua
workspace/hydroxide/user/Upbolt/objects/Upvalue.lua
workspace/hydroxide/user/Upbolt/ui/controls/CheckBox.lua
workspace/hydroxide/user/Upbolt/ui/controls/ContextMenu.lua
workspace/hydroxide/user/Upbolt/ui/controls/Dropdown.lua
workspace/hydroxide/user/Upbolt/ui/controls/List.lua
workspace/hydroxide/user/Upbolt/ui/controls/MessageBox.lua
workspace/hydroxide/user/Upbolt/ui/controls/Prompt.lua
workspace/hydroxide/user/Upbolt/ui/controls/TabSelector.lua
workspace/hydroxide/user/Upbolt/ui/modules/ClosureSpy.lua
workspace/hydroxide/user/Upbolt/ui/modules/ModuleScanner.lua
workspace/hydroxide/user/Upbolt/ui/modules/RemoteSpy.lua
workspace/hydroxide/user/Upbolt/ui/modules/ScriptScanner.lua
workspace/newvape/assets/new/add.png
.png
workspace/newvape/assets/new/allowedicon.png
.png
workspace/newvape/assets/new/allowedtab.png
.png
workspace/newvape/assets/new/back.png
.png
workspace/newvape/assets/new/bind.png
.png
workspace/newvape/assets/new/bindbkg.png
.png
workspace/newvape/assets/new/blatanticon.png
.png
workspace/newvape/assets/new/blockedicon.png
.png
workspace/newvape/assets/new/blockedtab.png
.png
workspace/newvape/assets/new/blur.png
.png
workspace/newvape/assets/new/blurnotif.png
.png
workspace/newvape/assets/new/close.png
.png
workspace/newvape/assets/new/colorpreview.png
.png
workspace/newvape/assets/new/combaticon.png
.png
workspace/newvape/assets/new/customsettings.png
.png
workspace/newvape/assets/new/dots.png
.png
workspace/newvape/assets/new/expandicon.png
.png
workspace/newvape/assets/new/expandright.png
.png
workspace/newvape/assets/new/expandup.png
.png
workspace/newvape/assets/new/friendstab.png
.png
workspace/newvape/assets/new/guisettings.png
.png
workspace/newvape/assets/new/guislider.png
.png
workspace/newvape/assets/new/guisliderrain.png
.png
workspace/newvape/assets/new/guiv4.png
.png
workspace/newvape/assets/new/guivape.png
.png
workspace/newvape/assets/new/info.png
.png
workspace/newvape/assets/new/inventoryicon.png
.png
workspace/newvape/assets/new/legit.png
.png
workspace/newvape/assets/new/legittab.png
.png
workspace/newvape/assets/new/miniicon.png
.png
workspace/newvape/assets/new/notification.png
.png
workspace/newvape/assets/new/overlaysicon.png
.png
workspace/newvape/assets/new/overlaystab.png
.png
workspace/newvape/assets/new/pin.png
.png
workspace/newvape/assets/new/profilesicon.png
.png
workspace/newvape/assets/new/radaricon.png
.png
workspace/newvape/assets/new/rainbow_1.png
.png
workspace/newvape/assets/new/rainbow_2.png
.png
workspace/newvape/assets/new/rainbow_3.png
.png
workspace/newvape/assets/new/rainbow_4.png
.png
workspace/newvape/assets/new/range.png
.png
workspace/newvape/assets/new/rangearrow.png
.png
workspace/newvape/assets/new/rendericon.png
.png
workspace/newvape/assets/new/search.png
.png
workspace/newvape/assets/new/targetinfoicon.png
.png
workspace/newvape/assets/new/targetnpc1.png
.png
workspace/newvape/assets/new/targetnpc2.png
.png
workspace/newvape/assets/new/targetplayers1.png
.png
workspace/newvape/assets/new/targetplayers2.png
.png
workspace/newvape/assets/new/targetstab.png
.png
workspace/newvape/assets/new/textguiicon.png
.png
workspace/newvape/assets/new/textv4.png
.png
workspace/newvape/assets/new/textvape.png
.png
workspace/newvape/assets/new/utilityicon.png
.png
workspace/newvape/assets/new/worldicon.png
.png
workspace/newvape/games/universal.lua
.js
workspace/newvape/guis/new.lua
.js
workspace/newvape/libraries/entity.lua
.js
workspace/newvape/libraries/hash.lua
.js
workspace/newvape/libraries/prediction.lua
workspace/newvape/main.lua
.js
workspace/newvape/profiles/1430993116.gui.txt
workspace/newvape/profiles/commit.txt
workspace/newvape/profiles/default4483381587.txt
workspace/newvape/profiles/gui.txt
workspace/newvape/profiles/whitelist.json

Sharing

General

Malware Config

Signatures

Files

48179d4801024f7b6e9d9f729fcbb9be

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

api-ms-win-core-synch-l1-2-0

oleaut32

bcryptprimitives

shell32

ole32

bcrypt

advapi32

user32

comctl32

gdi32

dwmapi

shlwapi

ntdll

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 6.1MB - Virtual size: 6.1MB

.rdata Size: 5.1MB - Virtual size: 5.1MB

.data Size: 2KB - Virtual size: 13KB

.pdata Size: 353KB - Virtual size: 353KB

.rsrc Size: 86KB - Virtual size: 85KB

.reloc Size: 17KB - Virtual size: 16KB

62a3e17fb27cb763359f1e14520f2a5e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

user32

Sections

.text Size: - Virtual size: 473KB

.rdata Size: - Virtual size: 116KB

.data Size: - Virtual size: 24KB

.pdata Size: - Virtual size: 19KB

.fptable Size: - Virtual size: 256B

.vmp0 Size: - Virtual size: 1.6MB

.vmp1 Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 512B - Virtual size: 228B

.rsrc Size: 512B - Virtual size: 469B

1851ff453adce0cef5274e320d5bed3c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 67KB - Virtual size: 66KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 4KB - Virtual size: 3KB

.gfids Size: 512B - Virtual size: 148B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

258493f6842b953cf9e315dfac5c0d9f

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

bcryptprimitives

.text
Size: 6.1MB - Virtual size: 6.1MB

.rdata
Size: 5.1MB - Virtual size: 5.1MB

.data
Size: 2KB - Virtual size: 13KB

.pdata
Size: 353KB - Virtual size: 353KB

.rsrc
Size: 86KB - Virtual size: 85KB

.reloc
Size: 17KB - Virtual size: 16KB

.text
Size: - Virtual size: 473KB

.rdata
Size: - Virtual size: 116KB

.data
Size: - Virtual size: 24KB

.pdata
Size: - Virtual size: 19KB

.fptable
Size: - Virtual size: 256B

.vmp0
Size: - Virtual size: 1.6MB

.vmp1
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 512B - Virtual size: 228B

.rsrc
Size: 512B - Virtual size: 469B

.text
Size: 67KB - Virtual size: 66KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 4KB - Virtual size: 3KB

.gfids
Size: 512B - Virtual size: 148B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 6.9MB - Virtual size: 6.9MB

.rdata
Size: 2.4MB - Virtual size: 2.4MB

.data
Size: 70KB - Virtual size: 97KB

.pdata
Size: 296KB - Virtual size: 295KB

.fptable
Size: 512B - Virtual size: 256B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 62KB - Virtual size: 62KB