Astra[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Astra.zip
Size 1.6MB
Sample260507-1tgftabs21
SHA256 241404f06e9e597751d679391a1a7e0d76a28a8cc923a5c0de402b78ffc0ad2f
MD5 4426d25b2b28ba3662d7c8aaf8d3d8f5
SHA1 6bf7021b893ebdc87d2a58d11de6120b64d8fc4c
SHA512 d39b2fe81fea4ec004eaa04790adc5ef03c2e9b08e4f74dfa979d8ee90a05d859bd3d9fe903c85815bdfa88fc78339dab0e83292517f24e6f44de7b670b430f8
SSDEEP 49152:KWUgAqVdbx9mZ1IhYGXw2I9BTgWEG3Cg93lqJr1f9:KsAqVd3mEhYdTcWEGt3lkl9
TLSH
T1E585336AB46AD50A00432A7E6EF8353E790C6574E85DCF451A39C1CFBC46D93D8AA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Astra/Astra.exe
unpack001/Astra/brotlicommon.dll
unpack001/Astra/brotlidec.dll
unpack001/Astra/brotlienc.dll
unpack001/Astra/bz2.dll
unpack001/Astra/freetype.dll
unpack001/Astra/libpng16.dll
unpack001/Astra/zlib1.dll

File Explorer

Astra.zip

.zip 1.6MB
Astra/Astra.exe

.exe 1.5MB
Astra/brotlicommon.dll

.dll .js 134KB
Astra/brotlidec.dll

.dll 49KB
Astra/brotlienc.dll

.dll 663KB
Astra/bz2.dll

.dll 74KB
Astra/freetype.dll

.dll 672KB
Astra/libpng16.dll

.dll 191KB
Astra/zlib1.dll

.dll 86KB

Astra.zip

SHA256 241404f06e9e597751d679391a1a7e0d76a28a8cc923a5c0de402b78ffc0ad2f
MD5 4426d25b2b28ba3662d7c8aaf8d3d8f5
SHA1 6bf7021b893ebdc87d2a58d11de6120b64d8fc4c
SHA512 d39b2fe81fea4ec004eaa04790adc5ef03c2e9b08e4f74dfa979d8ee90a05d859bd3d9fe903c85815bdfa88fc78339dab0e83292517f24e6f44de7b670b430f8
SSDEEP 49152:KWUgAqVdbx9mZ1IhYGXw2I9BTgWEG3Cg93lqJr1f9:KsAqVd3mEhYdTcWEGt3lkl9
TLSH
T1E585336AB46AD50A00432A7E6EF8353E790C6574E85DCF451A39C1CFBC46D93D8AA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Astra/Astra.exe

IMPHASH 761fc86d0269700a127df3f1ede7aa20
SHA256 28b64ee253526ca9b69f649d48caf7467c9ac1395af4214bec222fae688ee4c2
MD5 a95ac1ff6271e729678abe2290575967
SHA1 e4ccb5af2af9d5dad2ee87f4a4af7f9f2147ce8a
SHA512 1b92fff199766ee2a1c61938237ce512324982d2a0bbffe08d5f811b4dd79894c137ab50084e4a8b38101f98a103ab096f010dd4bdde71ce67c6e0aa992a9213
SSDEEP 24576:CUrnVSgyCFPAGgAKs68StrS4q2iaqtpQExsLi8u0jEFQT:CaQzIhVLotzzyLQQf8u0
TLSH
T19865BF07B2AA42ECD07BE078C942A127E77138084730AAFB67D159956F737F0597BE12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

947312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\rayan\Downloads\98arot\ext_momentum\build\release.pdb

freetype

FT_New_Size FT_Done_Library FT_Get_Char_Index FT_Done_Size FT_Select_Charmap FT_Done_Face FT_GlyphSlot_Embolden FT_Render_Glyph FT_Add_Default_Modules FT_New_Library FT_GlyphSlot_Oblique FT_New_Memory_Face FT_Load_Glyph FT_Request_Size FT_Activate_Size

kernel32

GetFileAttributesExW SetConsoleCtrlHandler SetConsoleTitleA CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle ExitProcess GetModuleHandleW GetConsoleWindow IsDebuggerPresent GetModuleHandleA GetProcAddress SetThreadPriority GetCurrentThread QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcess GetSystemInfo GetSystemTimeAsFileTime GetProcessTimes OpenProcess SetFileInformationByHandle K32EnumProcessModules ReadProcessMemory lstrcmpiW GetExitCodeProcess GetLastError MultiByteToWideChar LoadLibraryA VerSetConditionMask FreeLibrary GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock InitializeSListHead FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree ReleaseSRWLockExclusive AcquireSRWLockExclusive CreateFile2 VirtualAllocEx SleepConditionVariableSRW GetCurrentThreadId InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable SetUnhandledExceptionFilter AreFileApisANSI GetFileInformationByHandleEx GetLocaleInfoA GetCurrentProcessId

user32

ClientToScreen ScreenToClient SetForegroundWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState SetCursorPos GetCapture TrackMouseEvent GetKeyboardLayout SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture GetWindowRect DestroyWindow GetMessageExtraInfo GetAsyncKeyState FindWindowA SetWindowPos GetSystemMetrics UnregisterClassW RegisterClassExW GetCursorPos DefWindowProcW CreateWindowExW ShowWindow DispatchMessageW PeekMessageW RegisterClassW TranslateMessage SendInput SetWindowDisplayAffinity GetForegroundWindow MoveWindow SetLayeredWindowAttributes SetFocus LoadIconW LoadCursorW SetWindowLongW PostQuitMessage GetClientRect

gdi32

CreateSolidBrush

comdlg32

GetOpenFileNameA

shell32

ShellExecuteW SHGetKnownFolderPath

ole32

CoInitialize CoInitializeEx CoCreateInstance CoTaskMemFree

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ _Mtx_lock _Mtx_unlock _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ _Cnd_wait _Cnd_broadcast ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ

winmm

timeBeginPeriod

urlmon

URLDownloadToCacheFileW

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate _purecall strchr strstr memcmp memchr memcpy memmove memset __current_exception __current_exception_context __C_specific_handler _CxxThrowException

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-string-l1-1-0

strcpy_s _wcsicmp strcmp strlen strncmp strncpy tolower wcslen

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _get_initial_narrow_environment _initterm _initterm_e exit _exit terminate __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _initialize_narrow_environment system _configure_narrow_argv _beginthreadex abort _errno

api-ms-win-crt-math-l1-1-0

roundf nearbyint _dsign powf remainderf asinf acosf sqrtf atan2f ceilf cosf tanf expf floorf fmodf sinf logf __setusermatherr

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-stdio-l1-1-0

_wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell __p__commode _get_stream_buffer_pointers _fseeki64 fread __stdio_common_vsscanf ungetc setvbuf fgetpos fwrite _set_fmode fgetc fclose fflush fputc fsetpos __stdio_common_vsprintf __stdio_common_vsprintf_s

api-ms-win-crt-convert-l1-1-0

strtoll strtod strtoull atof

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Astra/brotlicommon.dll

IMPHASH 2a5f637f1949fb3444b794bbcc81c34a
SHA256 2a7b4b003480e610a2519fec6b393352461a8988c48aab95dfb870480f646281
MD5 9b296e3f3e0935a512587193f8808d2b
SHA1 05d307b1dc0193a15eba47cfabef02a1032b6ef6
SHA512 7aa0190dbd8c3a201f6910751b5e06619381831198f2f77729d7dcf229169dff07a5e8dee7f38b0178565efb839c7c627b296f46c3bcbae3657ee86369d48763
SSDEEP 3072:a4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBmf:a4AhdNorGvHdbi09GJQ
TLSH
T1C5D36BA1F3051736C26B227AE45A6BB9F33582B493630551B4A9066D20C3DE4873F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64 polyglot

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\user\vcpkg\buildtrees\brotli\x64-windows-rel\brotlicommon.pdb

Astra/brotlidec.dll

IMPHASH 4f8041f89db18a93f3f026abef3d9814
SHA256 77eb74801462b7842e7be536f47765af58681f36f021a626c53806164ccbab93
MD5 d1f979a300134cde4854f2f14e47ae0e
SHA1 bf6b1cecaa5fcb5cf983fa1f2e2c808785cea9b2
SHA512 52ec308f7500d2742481ce080e716aa28801397782b56d24cd2bf12ff6d736a28396fe29ab18de452d3460a501076c3c24cc80ed21c766af474aaf30d7f6e402
SSDEEP 768:pQUwDM0oE4j4vwyu/x6oOWIH880mL/RkeaU/azQxARbYs3l8Hau:pQUwA1ewyu/xiHfL/v0G
TLSH
T100335C41B5D65A58DD13C13893EB976BE7BBB84A9301E3E7F2D0E6223E07AE11375240
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\user\vcpkg\buildtrees\brotli\x64-windows-rel\brotlidec.pdb

Astra/brotlienc.dll

IMPHASH d84a9199b6ab53f886e81195458946d2
SHA256 65b6f1fdd4ce78749f54727195c855d8769d37520e93dede66bdc4905df40f41
MD5 ea4fd078345bb1b6c0cd71b1abaee52c
SHA1 9779ed14b540bb93dccad1ec101f9f7ab3654c74
SHA512 e93fe7cacc3561ca92201d97ebb314822814790f77ef9bdc8c148755efc3c578f34ebac6361ba0fa453da08332bef5dbc94cae1888a611b910be70868b3f2b5b
SSDEEP 12288:FTQYvtzOxI4Z0fCXURoy8hnnb3xKWulsON:6YvtWk/elgWulsON
TLSH
T1B3E48D0BDCF3977AC826C079CEB75227EB39704892109967A35CE4313B437185ABB75A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

343744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\user\vcpkg\buildtrees\brotli\x64-windows-rel\brotlienc.pdb

Astra/bz2.dll

IMPHASH 5f60da79124e5b501468e93daf73f658
SHA256 75f94ab121336dff2234bba420ca02cec095ffbb6fc2a089f4eb3025bd7c4843
MD5 bf46528929d9de51ba1fc780c4553abd
SHA1 b874861f7dcaca0210d826fef91dde704b3996e3
SHA512 e2295a1ec762d9f139cf2270cf22a95326f7b7c64e559948f167f1e5a80151e1db4c0e69f25a3276cb0954b68c78d8ab29a5ac26ace97749106fdba38fda2668
SSDEEP 1536:ttYPj/yb4mgmij1vgqFUtDHE77/GPKf4ez/qlLXlbQp8Vf:z4t0ZkZ4eWRXlUmVf
TLSH
T126733B81A7A2BBEED61B857982330352EB38B93C0B5157BF22A4C7362751FE55CB1305
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\user\vcpkg\buildtrees\bzip2\x64-windows-rel\bz2.pdb

Astra/freetype.dll

IMPHASH 1d1f72f133ba13a369c5242abfa37030
SHA256 bc2c0889ca4f8d88bd9758e3ad66f28af606358e74f36796b80c38c1e5b34efa
MD5 917b3651bf64a7b68f1775e3e74fa6bd
SHA1 0951e8231a0b4648263e472bde86ae0534c7a4ea
SHA512 46988cf8133506cc4e0fe1525131a43446105a1509c63432e76e27da6e10d11c36f5613fec4ff5c40695fa1da1490391db0a9bfb6b61b98d1da07e6ee123c4ae
SSDEEP 12288:mWxVmCDHznPuyxu+vNiecqxgJKsjgUs7XH1afEWm:mWS6qyxpNbLxgJKEJs7dZ
TLSH
T16FE48D82F3A111A8C667C27C8617872BE776B4051310ABDB56A05B6BBF13FE16B39314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

493552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\user\vcpkg\buildtrees\freetype\x64-windows-rel\freetype.pdb

zlib1

inflateInit2_ inflateReset inflateEnd inflate

bz2

BZ2_bzDecompress BZ2_bzDecompressInit BZ2_bzDecompressEnd

libpng16

png_set_expand_gray_1_2_4_to_8 png_set_palette_to_rgb png_set_tRNS_to_alpha png_set_gray_to_rgb png_set_filler png_set_packing png_set_interlace_handling png_set_strip_16 png_read_update_info png_create_info_struct png_read_end png_destroy_read_struct png_get_error_ptr png_set_read_fn png_get_io_ptr png_set_read_user_transform_fn png_error png_get_valid png_get_IHDR png_set_longjmp_fn png_read_info png_read_image png_create_read_struct

brotlidec

BrotliDecoderDecompress

kernel32

InitializeSListHead DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetFileSizeEx ReadFile CloseHandle HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile CreateFileA UnmapViewOfFile CreateFileMappingA

vcruntime140

memcpy memset strrchr strstr memmove memcmp memchr __intrinsic_setjmp __C_specific_handler __std_type_info_destroy_list longjmp

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-string-l1-1-0

strncmp strcpy strcmp strncpy strlen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _initterm_e _initterm _cexit _execute_onexit_table _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment

FTC_CMapCache_Lookup FTC_CMapCache_New FTC_ImageCache_Lookup FTC_ImageCache_LookupScaler FTC_ImageCache_New FTC_Manager_Done FTC_Manager_LookupFace FTC_Manager_LookupSize FTC_Manager_New FTC_Manager_RemoveFaceID FTC_Manager_Reset FTC_Node_Unref FTC_SBitCache_Lookup FTC_SBitCache_LookupScaler FTC_SBitCache_New FT_Activate_Size FT_Add_Default_Modules FT_Add_Module FT_Angle_Diff FT_Atan2 FT_Attach_File FT_Attach_Stream FT_Bitmap_Blend FT_Bitmap_Convert FT_Bitmap_Copy FT_Bitmap_Done FT_Bitmap_Embolden FT_Bitmap_Init FT_Bitmap_New FT_CeilFix FT_ClassicKern_Free FT_ClassicKern_Validate FT_Cos FT_DivFix FT_Done_Face FT_Done_FreeType FT_Done_Glyph FT_Done_Library FT_Done_MM_Var FT_Done_Size FT_Error_String FT_Face_CheckTrueTypePatents FT_Face_GetCharVariantIndex FT_Face_GetCharVariantIsDefault FT_Face_GetCharsOfVariant FT_Face_GetVariantSelectors FT_Face_GetVariantsOfChar FT_Face_Properties FT_Face_SetUnpatentedHinting FT_FloorFix FT_Get_Advance FT_Get_Advances FT_Get_BDF_Charset_ID FT_Get_BDF_Property FT_Get_CID_From_Glyph_Index FT_Get_CID_Is_Internally_CID_Keyed FT_Get_CID_Registry_Ordering_Supplement FT_Get_CMap_Format FT_Get_CMap_Language_ID FT_Get_Char_Index FT_Get_Charmap_Index FT_Get_Color_Glyph_ClipBox FT_Get_Color_Glyph_Layer FT_Get_Color_Glyph_Paint FT_Get_Colorline_Stops FT_Get_Default_Named_Instance FT_Get_FSType_Flags FT_Get_First_Char FT_Get_Font_Format FT_Get_Gasp FT_Get_Glyph FT_Get_Glyph_Name FT_Get_Kerning FT_Get_MM_Blend_Coordinates FT_Get_MM_Var FT_Get_MM_WeightVector FT_Get_Module FT_Get_Multi_Master FT_Get_Name_Index FT_Get_Next_Char FT_Get_PFR_Advance FT_Get_PFR_Kerning FT_Get_PFR_Metrics FT_Get_PS_Font_Info FT_Get_PS_Font_Private FT_Get_PS_Font_Value FT_Get_Paint FT_Get_Paint_Layers FT_Get_Postscript_Name FT_Get_Renderer FT_Get_Sfnt_LangTag FT_Get_Sfnt_Name FT_Get_Sfnt_Name_Count FT_Get_Sfnt_Table FT_Get_SubGlyph_Info FT_Get_Track_Kerning FT_Get_Transform FT_Get_TrueType_Engine_Type FT_Get_Var_Axis_Flags FT_Get_Var_Blend_Coordinates FT_Get_Var_Design_Coordinates FT_Get_WinFNT_Header FT_Get_X11_Font_Format FT_GlyphSlot_AdjustWeight FT_GlyphSlot_Embolden FT_GlyphSlot_Oblique FT_GlyphSlot_Own_Bitmap FT_GlyphSlot_Slant FT_Glyph_Copy FT_Glyph_Get_CBox FT_Glyph_Stroke FT_Glyph_StrokeBorder FT_Glyph_To_Bitmap FT_Glyph_Transform FT_Gzip_Uncompress FT_Has_PS_Glyph_Names FT_Init_FreeType FT_Library_SetLcdFilter FT_Library_SetLcdFilterWeights FT_Library_SetLcdGeometry FT_Library_Version FT_List_Add FT_List_Finalize FT_List_Find FT_List_Insert FT_List_Iterate FT_List_Remove FT_List_Up FT_Load_Char FT_Load_Glyph FT_Load_Sfnt_Table FT_Matrix_Invert FT_Matrix_Multiply FT_MulDiv FT_MulFix FT_New_Face FT_New_Glyph FT_New_Library FT_New_Memory_Face FT_New_Size FT_OpenType_Free FT_OpenType_Validate FT_Open_Face FT_Outline_Check FT_Outline_Copy FT_Outline_Decompose FT_Outline_Done FT_Outline_Embolden FT_Outline_EmboldenXY FT_Outline_GetInsideBorder FT_Outline_GetOutsideBorder FT_Outline_Get_BBox FT_Outline_Get_Bitmap FT_Outline_Get_CBox FT_Outline_Get_Orientation FT_Outline_New FT_Outline_Render FT_Outline_Reverse FT_Outline_Transform FT_Outline_Translate FT_Palette_Data_Get FT_Palette_Select FT_Palette_Set_Foreground_Color FT_Property_Get FT_Property_Set FT_Reference_Face FT_Reference_Library FT_Remove_Module FT_Render_Glyph FT_Request_Size FT_RoundFix FT_Select_Charmap FT_Select_Size FT_Set_Char_Size FT_Set_Charmap FT_Set_Debug_Hook FT_Set_Default_Log_Handler FT_Set_Default_Properties FT_Set_Log_Handler FT_Set_MM_Blend_Coordinates FT_Set_MM_Design_Coordinates FT_Set_MM_WeightVector FT_Set_Named_Instance FT_Set_Pixel_Sizes FT_Set_Renderer FT_Set_Transform FT_Set_Var_Blend_Coordinates FT_Set_Var_Design_Coordinates FT_Sfnt_Table_Info FT_Sin FT_Stream_OpenBzip2 FT_Stream_OpenGzip FT_Stream_OpenLZW FT_Stroker_BeginSubPath FT_Stroker_ConicTo FT_Stroker_CubicTo FT_Stroker_Done FT_Stroker_EndSubPath FT_Stroker_Export FT_Stroker_ExportBorder FT_Stroker_GetBorderCounts FT_Stroker_GetCounts FT_Stroker_LineTo FT_Stroker_New FT_Stroker_ParseOutline FT_Stroker_Rewind FT_Stroker_Set FT_Tan FT_Trace_Set_Default_Level FT_Trace_Set_Level FT_TrueTypeGX_Free FT_TrueTypeGX_Validate FT_Vector_From_Polar FT_Vector_Length FT_Vector_Polarize FT_Vector_Rotate FT_Vector_Transform FT_Vector_Unit TT_New_Context TT_RunIns

Astra/libpng16.dll

IMPHASH 63a0b7a59ae9bf6c6a1a400cb508669d
SHA256 6519cf0a302b60498c15aee3a209e2eb081acabfc4e27707dcb5a5ad8be7a559
MD5 ab340d81e27db32a83c749c5d22cee24
SHA1 20c2f5e26a5b8c70c4e736dcd2f27092b305d87c
SHA512 2e0fbaf87f037530ae41b8c7b5a0326f6a0ca8c6adb5a0d457a47cc91b9eeca9812f3106fe8dd0d67adcf549cbf24823c50ee0d7bf1da822784a7a5e444c13f5
SSDEEP 1536:cN3cibyakiyfYm5OXHfuQU64e4goHm6nuOt9tm5FkpAnl8U81e/yhqL6rj/UG20Y:cN2JfE/uH6AmKj/bKUqL6MpLFTKSvjI
TLSH
T1B9147DC7B26500B9E9D3D03C8606A117D2B1756813609BEF1BD08BBD6B23BEC793A751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\user\vcpkg\buildtrees\libpng\x64-windows-rel\libpng16.pdb

png_access_version_number png_benign_error png_build_grayscale_palette png_calloc png_chunk_benign_error png_chunk_error png_chunk_warning png_convert_from_struct_tm png_convert_from_time_t png_convert_to_rfc1123 png_convert_to_rfc1123_buffer png_create_info_struct png_create_read_struct png_create_read_struct_2 png_create_write_struct png_create_write_struct_2 png_data_freer png_destroy_info_struct png_destroy_read_struct png_destroy_write_struct png_error png_free png_free_data png_free_default png_get_IHDR png_get_PLTE png_get_bKGD png_get_bit_depth png_get_cHRM png_get_cHRM_XYZ png_get_cHRM_XYZ_fixed png_get_cHRM_fixed png_get_cICP png_get_cLLI png_get_cLLI_fixed png_get_channels png_get_chunk_cache_max png_get_chunk_malloc_max png_get_color_type png_get_compression_buffer_size png_get_compression_type png_get_copyright png_get_current_pass_number png_get_current_row_number png_get_eXIf png_get_eXIf_1 png_get_error_ptr png_get_filter_type png_get_gAMA png_get_gAMA_fixed png_get_hIST png_get_header_ver png_get_header_version png_get_iCCP png_get_image_height png_get_image_width png_get_int_32 png_get_interlace_type png_get_io_chunk_type png_get_io_ptr png_get_io_state png_get_libpng_ver png_get_mDCV png_get_mDCV_fixed png_get_mem_ptr png_get_oFFs png_get_pCAL png_get_pHYs png_get_pHYs_dpi png_get_palette_max png_get_pixel_aspect_ratio png_get_pixel_aspect_ratio_fixed png_get_pixels_per_inch png_get_pixels_per_meter png_get_progressive_ptr png_get_rgb_to_gray_status png_get_rowbytes png_get_rows png_get_sBIT png_get_sCAL png_get_sCAL_fixed png_get_sCAL_s png_get_sPLT png_get_sRGB png_get_signature png_get_tIME png_get_tRNS png_get_text png_get_uint_16 png_get_uint_31 png_get_uint_32 png_get_unknown_chunks png_get_user_chunk_ptr png_get_user_height_max png_get_user_transform_ptr png_get_user_width_max png_get_valid png_get_x_offset_inches png_get_x_offset_inches_fixed png_get_x_offset_microns png_get_x_offset_pixels png_get_x_pixels_per_inch png_get_x_pixels_per_meter png_get_y_offset_inches png_get_y_offset_inches_fixed png_get_y_offset_microns png_get_y_offset_pixels png_get_y_pixels_per_inch png_get_y_pixels_per_meter png_handle_as_unknown png_image_begin_read_from_file png_image_begin_read_from_memory png_image_begin_read_from_stdio png_image_finish_read png_image_free png_image_write_to_file png_image_write_to_memory png_image_write_to_stdio png_info_init_3 png_init_io png_longjmp png_malloc png_malloc_default png_malloc_warn png_permit_mng_features png_process_data png_process_data_pause png_process_data_skip png_progressive_combine_row png_read_end png_read_image png_read_info png_read_png png_read_row png_read_rows png_read_update_info png_reset_zstream png_save_int_32 png_save_uint_16 png_save_uint_32 png_set_IHDR png_set_PLTE png_set_add_alpha png_set_alpha_mode png_set_alpha_mode_fixed png_set_bKGD png_set_background png_set_background_fixed png_set_benign_errors png_set_bgr png_set_cHRM png_set_cHRM_XYZ png_set_cHRM_XYZ_fixed png_set_cHRM_fixed png_set_cICP png_set_cLLI png_set_cLLI_fixed png_set_check_for_invalid_index png_set_chunk_cache_max png_set_chunk_malloc_max png_set_compression_buffer_size png_set_compression_level png_set_compression_mem_level png_set_compression_method png_set_compression_strategy png_set_compression_window_bits png_set_crc_action png_set_eXIf png_set_eXIf_1 png_set_error_fn png_set_expand png_set_expand_16 png_set_expand_gray_1_2_4_to_8 png_set_filler png_set_filter png_set_filter_heuristics png_set_filter_heuristics_fixed png_set_flush png_set_gAMA png_set_gAMA_fixed png_set_gamma png_set_gamma_fixed png_set_gray_to_rgb png_set_hIST png_set_iCCP png_set_interlace_handling png_set_invalid png_set_invert_alpha png_set_invert_mono png_set_keep_unknown_chunks png_set_longjmp_fn png_set_mDCV png_set_mDCV_fixed png_set_mem_fn png_set_oFFs png_set_option png_set_pCAL png_set_pHYs png_set_packing png_set_packswap png_set_palette_to_rgb png_set_progressive_read_fn png_set_quantize png_set_read_fn png_set_read_status_fn png_set_read_user_chunk_fn png_set_read_user_transform_fn png_set_rgb_to_gray png_set_rgb_to_gray_fixed png_set_rows png_set_sBIT png_set_sCAL png_set_sCAL_fixed png_set_sCAL_s png_set_sPLT png_set_sRGB png_set_sRGB_gAMA_and_cHRM png_set_scale_16 png_set_shift png_set_sig_bytes png_set_strip_16 png_set_strip_alpha png_set_swap png_set_swap_alpha png_set_tIME png_set_tRNS png_set_tRNS_to_alpha png_set_text png_set_text_compression_level png_set_text_compression_mem_level png_set_text_compression_method png_set_text_compression_strategy png_set_text_compression_window_bits png_set_unknown_chunk_location png_set_unknown_chunks png_set_user_limits png_set_user_transform_info png_set_write_fn png_set_write_status_fn png_set_write_user_transform_fn png_sig_cmp png_start_read_image png_warning png_write_chunk png_write_chunk_data png_write_chunk_end png_write_chunk_start png_write_end png_write_flush png_write_image png_write_info png_write_info_before_PLTE png_write_png png_write_row png_write_rows png_write_sig

Astra/zlib1.dll

IMPHASH bd580d7531bda4ccb9d366b517af082d
SHA256 bfa3fecd8beef9d94a921ce6b8dc6b930dafe019e62cc371abce45f911dc59c9
MD5 2d64bb8aa0129659f797fc84ff7008bb
SHA1 d209adac1c1c207052650fd67f5dd2669274587c
SHA512 2e71fc50f7262a34a202f56161b987406d6a6593d9da652a3c2e182d2956b3af7af318893a13f8589475a085a0a2a3ef02ca059807f3a77bb97c48335626f355
SSDEEP 1536:Wo5L+dFVRXa8tQahDhaBJeJ6FQMhXgFeBTIOcIOZr3u9cB:Wo5La9Xa8+EgJrdhIS1SZr3uo
TLSH
T133838D95AAB422A2D6B34178E8D3479DD335B01403645BDF938CA76A1F23AE01F353ED
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\user\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb

Sharing

General

Malware Config

Signatures

File Explorer

Astra.zip

Astra/Astra.exe

freetype

kernel32

user32

gdi32

comdlg32

shell32

ole32

msvcp140

winmm

urlmon

d3d11

winhttp

d3dcompiler_47

dwmapi

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic

Astra/brotlicommon.dll

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

generic

Astra/brotlidec.dll

brotlicommon

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

generic

Astra/brotlienc.dll

brotlicommon

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

generic

Astra/bz2.dll

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

kernel32

generic

Astra/freetype.dll

zlib1

bz2

libpng16

brotlidec

kernel32

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic

Astra/libpng16.dll

zlib1