Reveals.gg external.zip
- SHA256 9094b865a01aab839e875ed466c63bcc004d5bace088a3e29fa15fe741616b0b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Reveals.gg external/tc1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Reveals.gg external/tc1.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Reveals.gg external/xxhash.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Reveals.gg external/xxhash.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Reveals.gg external/zstd.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Reveals.gg external/zstd.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Reveals.gg external.zip
- Size 2.6MB
- Sample260720-z4e53aez4n
- SHA256 9094b865a01aab839e875ed466c63bcc004d5bace088a3e29fa15fe741616b0b
- MD5 c600c5d0e9d89bc877e6e6a505f93c42
- SHA1 88352c500f0a97b4ebf0f5076896d82c04b19abe
- SHA512 d8bad356792df88760b5dce72789a4a381431537ba364b14f2005e2e8282114d2bc84089a553932e463b743b0349e49344e93eed0f0e8f021f7c026b5dbeebe8
- SSDEEP 49152:1LVTkT5DMShUtkc20YTudSypRmDSoFzUQ6dpvIO6NTqZTRV/1S6g6JvptpK:1iT5D9hTP7TudSypRYwJHA7T+p1S6PJE
- TLSH T1D7D533AEC98F0D8AFC76317AE89587554CACA6CF2134F8B201D649C40EC9D197FAC59C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Reveals.gg external/tc1.exe unpack001/Reveals.gg external/xxhash.dll unpack001/Reveals.gg external/zstd.dll
File Explorer
-
Reveals.gg external.zip.zip 2.6MB
-
Reveals.gg external/tc1.exe.exe 4.6MB
-
Reveals.gg external/xxhash.dll.dll 57KB
-
Reveals.gg external/zstd.dll.dll 640KB
Reveals.gg external/tc1.exe
- IMPHASH d5eea0a9deaa1fc37a33153e392e1f44
- SHA256 635acaeb6f6dc1cdf4b31f678eaba4c57cb62900a476dd5d3eea253db856a146
- MD5 c4fcea568597fcfea1666c48a7a0546f
- SHA1 1df2495e996fcee99de0f853df23a9a2f2ab9716
- SHA512 5e6e50d39e49529473167b041b6a02f444da3320fc61bdfa30def1865937d27d26a6551c9dfe66e1f52ebde65cdf8532b6cbc2d9d4d70cfccd8018c3923ea661
- SSDEEP 98304:pjcaYJluuOTo/Y7mgTm05AwJHE6h1J/lZqL9PlF6:5YLTZg7PAmkK3ZqL1lF
- TLSH T15526BE42F392C5A9D2568138CA45D7ABD3323C080F2257EB369C7E1A7F726E04E79752
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1474784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Beertje\Downloads\1777151302357-turtleclub\build\tc1.pdb
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
xxhash
XXH32
zstd
ZSTD_decompress
ZSTD_isError
kernel32
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
Sleep
GetVolumeInformationA
ExitProcess
GetComputerNameA
SwitchToThread
GetConsoleWindow
GetCurrentProcess
GetCurrentThread
RaiseException
GetThreadContext
IsDebuggerPresent
CheckRemoteDebuggerPresent
SetThreadPriority
ReadProcessMemory
SetConsoleTitleA
GetStdHandle
SetConsoleMode
SetCurrentConsoleFontEx
GetConsoleMode
Process32First
Module32Next
GetProcessId
Module32First
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CloseHandle
CreateFileA
GetFileSizeEx
MultiByteToWideChar
FindClose
HeapFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
FindFirstFileW
GetLocaleInfoEx
FormatMessageA
LocalFree
InitOnceBeginInitialize
InitOnceComplete
GetCurrentThreadId
SleepConditionVariableSRW
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
CreateFile2
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
WakeAllConditionVariable
SetUnhandledExceptionFilter
LoadLibraryA
GetLocaleInfoA
GetModuleHandleA
ReadFile
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
FindFirstFileExW
FindNextFileW
CreateDirectoryW
GetFileAttributesExW
HeapAlloc
SetFileInformationByHandle
user32
ReleaseDC
GetCursorPos
GetMessageExtraInfo
MonitorFromPoint
DispatchMessageA
GetAsyncKeyState
DestroyWindow
SetWindowPos
SetWindowLongA
MessageBoxA
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
PeekMessageA
UnregisterClassA
GetWindowRect
PostQuitMessage
RegisterClassExA
SetCursorPos
ReleaseCapture
UpdateWindow
SetForegroundWindow
GetWindowThreadProcessId
IsWindow
EnumWindows
GetSystemMetrics
FindWindowExA
GetWindowTextA
LoadCursorA
SetClipboardData
GetDC
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SendInput
GetKeyState
FindWindowA
ShowWindow
IsWindowVisible
SetWindowDisplayAffinity
gdi32
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC
DeleteDC
GetDeviceCaps
SelectObject
DeleteObject
advapi32
GetUserNameA
shell32
SHGetFolderPathA
ShellExecuteA
ShellExecuteW
ole32
CLSIDFromString
CreateStreamOnHGlobal
msvcp140
?_Winerror_map@std@@YAHH@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
__crtLCMapStringA
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
??Bios_base@std@@QEBA_NXZ
_Cnd_broadcast
_Cnd_wait
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
_Xtime_get_ticks
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Query_perf_counter
_Mtx_unlock
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
_Cnd_unregister_at_thread_exit
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Cnd_register_at_thread_exit
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetConnectA
HttpSendRequestA
HttpOpenRequestA
winhttp
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpConnect
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetTimeouts
winmm
timeBeginPeriod
PlaySoundA
gdiplus
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdiplusShutdown
GdipSaveImageToStream
GdipFree
GdiplusStartup
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
_CxxThrowException
__intrinsic_setjmp
__current_exception_context
memcmp
memchr
memset
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
strchr
__std_type_info_compare
__RTtypeid
_purecall
__C_specific_handler
strrchr
longjmp
memcpy
memmove
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
malloc
free
realloc
api-ms-win-crt-math-l1-1-0
fmaxf
asinf
atan2f
__setusermatherr
ceilf
acosf
sqrtf
cos
cosf
logf
floorf
roundf
pow
ldexp
fminf
powf
sin
sinf
tanf
nearbyint
fmodf
api-ms-win-crt-string-l1-1-0
isalnum
isblank
isspace
tolower
toupper
_stricmp
strcpy_s
strncpy
strcmp
strncpy_s
strncmp
strlen
wcscpy_s
wcslen
api-ms-win-crt-stdio-l1-1-0
_set_fmode
fgetc
fseek
fgetpos
fclose
setvbuf
ungetc
__p__commode
fflush
__acrt_iob_func
ftell
fsetpos
fwrite
_wfopen
__stdio_common_vsprintf_s
_fseeki64
fputc
__stdio_common_vsprintf
__stdio_common_vfprintf
fread
__stdio_common_vsscanf
_get_stream_buffer_pointers
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atoi
atof
strtol
strtoull
strtof
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
terminate
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
system
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_errno
abort
api-ms-win-crt-time-l1-1-0
_localtime64_s
_time64
strftime
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
___lc_collate_cp_func
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=253, version=35721,
count=10, id=260, version=35721,
count=42, id=261, version=35721,
count=6, id=259, version=35721,
count=6, id=257, version=35721,
count=2, id=257, version=34808,
count=4, id=257, version=35717,
count=27, id=260, version=32822,
count=2, id=156, version=21202,
count=29, id=257, version=33145,
count=499, id=1, productName=Unmarked objects,
count=62, id=265, version=36248,
count=1, id=259, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
Reveals.gg external/xxhash.dll
- IMPHASH 28ae412fdf6d0850d90fb1527a06777c
- SHA256 c3af6cb87a7f70b2d8546bd01c4875bd1ff6ed9daf470d98c6da55c800f9187e
- MD5 466300a481b35f64f8e1478658b0a2c4
- SHA1 95fe877d0ceae5b52a6d9c2f063a5fa4d2ffcbf1
- SHA512 37e8b0a69fe66549985794e6ac2a48e9725d6027cf78c4c1390007fe63cb7dbd4a787807843cdcc9ec55c67dc7fefad3a2e6b5f2e4b3b5797ae42542f21fb571
- SSDEEP 768:upGDuJCwTes5ovICVq1XwxMBP5+injQZOl2GnWrkiASW2fJ:KoOcxKxPjIY
- TLSH T1A1435BDFD952A87CC7C6C33CD79F6D4649B6F6200170472583A361642D136AC8FBAE92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4754
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
fwrite
api-ms-win-crt-string-l1-1-0
strlen
strncmp
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
XXH128
XXH128_canonicalFromHash
XXH128_cmp
XXH128_hashFromCanonical
XXH128_isEqual
XXH32
XXH32_canonicalFromHash
XXH32_copyState
XXH32_createState
XXH32_digest
XXH32_freeState
XXH32_hashFromCanonical
XXH32_reset
XXH32_update
XXH3_128bits
XXH3_128bits_digest
XXH3_128bits_reset
XXH3_128bits_reset_withSecret
XXH3_128bits_reset_withSecretandSeed
XXH3_128bits_reset_withSeed
XXH3_128bits_update
XXH3_128bits_withSecret
XXH3_128bits_withSecretandSeed
XXH3_128bits_withSeed
XXH3_64bits
XXH3_64bits_digest
XXH3_64bits_reset
XXH3_64bits_reset_withSecret
XXH3_64bits_reset_withSecretandSeed
XXH3_64bits_reset_withSeed
XXH3_64bits_update
XXH3_64bits_withSecret
XXH3_64bits_withSecretandSeed
XXH3_64bits_withSeed
XXH3_copyState
XXH3_createState
XXH3_freeState
XXH3_generateSecret
XXH3_generateSecret_fromSeed
XXH64
XXH64_canonicalFromHash
XXH64_copyState
XXH64_createState
XXH64_digest
XXH64_freeState
XXH64_hashFromCanonical
XXH64_reset
XXH64_update
XXH_versionNumber
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Reveals.gg external/zstd.dll
- IMPHASH 2c40e0a8c17f455b7494f121efd989b7
- SHA256 d580e36ca1480c544c7bf8b036dcd8062168fc966a9761358f12149a22767a23
- MD5 be019017d876b97e3114d10fc38c80cc
- SHA1 92cf519932d4a1f104c9f74c6094b46bd9ad4964
- SHA512 3d39a64f5c618e81efd749edabb3a3888ec4ab9b139221abe570a683890bcf97e73c19d792058d3a65aabe1a5efd92d252a6de6476204d1b84af201bc1690524
- SSDEEP 12288:udFgvkkkrBELbqJBPWT/ZKg39+Pedp1FLuOxAtGdiNyb:winGtWT/ZKgtqedp1FqObx
- TLSH T199D48D83F29592ECD02BD139C6565363EBB67C4513006AEB83A0EF653F13AE55B34386
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
568800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\vcpkg\buildtrees\zstd\x64-windows-rel\lib\zstd.pdb
kernel32
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
CloseHandle
GetLastError
WaitForSingleObject
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
vcruntime140
__C_specific_handler
memcmp
memmove
__std_type_info_destroy_list
memcpy
memset
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
_initialize_narrow_environment
_initialize_onexit_table
_initterm_e
_cexit
_seh_filter_dll
_errno
_initterm
_execute_onexit_table
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
fflush
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort_s
api-ms-win-crt-time-l1-1-0
clock
ZDICT_addEntropyTablesFromBuffer
ZDICT_finalizeDictionary
ZDICT_getDictHeaderSize
ZDICT_getDictID
ZDICT_getErrorName
ZDICT_isError
ZDICT_optimizeTrainFromBuffer_cover
ZDICT_optimizeTrainFromBuffer_fastCover
ZDICT_trainFromBuffer
ZDICT_trainFromBuffer_cover
ZDICT_trainFromBuffer_fastCover
ZDICT_trainFromBuffer_legacy
ZSTD_CCtxParams_getParameter
ZSTD_CCtxParams_init
ZSTD_CCtxParams_init_advanced
ZSTD_CCtxParams_registerSequenceProducer
ZSTD_CCtxParams_reset
ZSTD_CCtxParams_setParameter
ZSTD_CCtx_getParameter
ZSTD_CCtx_loadDictionary
ZSTD_CCtx_loadDictionary_advanced
ZSTD_CCtx_loadDictionary_byReference
ZSTD_CCtx_refCDict
ZSTD_CCtx_refPrefix
ZSTD_CCtx_refPrefix_advanced
ZSTD_CCtx_refThreadPool
ZSTD_CCtx_reset
ZSTD_CCtx_setCParams
ZSTD_CCtx_setFParams
ZSTD_CCtx_setParameter
ZSTD_CCtx_setParametersUsingCCtxParams
ZSTD_CCtx_setParams
ZSTD_CCtx_setPledgedSrcSize
ZSTD_CStreamInSize
ZSTD_CStreamOutSize
ZSTD_DCtx_getParameter
ZSTD_DCtx_loadDictionary
ZSTD_DCtx_loadDictionary_advanced
ZSTD_DCtx_loadDictionary_byReference
ZSTD_DCtx_refDDict
ZSTD_DCtx_refPrefix
ZSTD_DCtx_refPrefix_advanced
ZSTD_DCtx_reset
ZSTD_DCtx_setFormat
ZSTD_DCtx_setMaxWindowSize
ZSTD_DCtx_setParameter
ZSTD_DStreamInSize
ZSTD_DStreamOutSize
ZSTD_adjustCParams
ZSTD_cParam_getBounds
ZSTD_checkCParams
ZSTD_compress
ZSTD_compress2
ZSTD_compressBegin
ZSTD_compressBegin_advanced
ZSTD_compressBegin_usingCDict
ZSTD_compressBegin_usingCDict_advanced
ZSTD_compressBegin_usingDict
ZSTD_compressBlock
ZSTD_compressBound
ZSTD_compressCCtx
ZSTD_compressContinue
ZSTD_compressEnd
ZSTD_compressSequences
ZSTD_compressSequencesAndLiterals
ZSTD_compressStream
ZSTD_compressStream2
ZSTD_compressStream2_simpleArgs
ZSTD_compress_advanced
ZSTD_compress_usingCDict
ZSTD_compress_usingCDict_advanced
ZSTD_compress_usingDict
ZSTD_copyCCtx
ZSTD_copyDCtx
ZSTD_createCCtx
ZSTD_createCCtxParams
ZSTD_createCCtx_advanced
ZSTD_createCDict
ZSTD_createCDict_advanced
ZSTD_createCDict_advanced2
ZSTD_createCDict_byReference
ZSTD_createCStream
ZSTD_createCStream_advanced
ZSTD_createDCtx
ZSTD_createDCtx_advanced
ZSTD_createDDict
ZSTD_createDDict_advanced
ZSTD_createDDict_byReference
ZSTD_createDStream
ZSTD_createDStream_advanced
ZSTD_createThreadPool
ZSTD_dParam_getBounds
ZSTD_decodingBufferSize_min
ZSTD_decompress
ZSTD_decompressBegin
ZSTD_decompressBegin_usingDDict
ZSTD_decompressBegin_usingDict
ZSTD_decompressBlock
ZSTD_decompressBound
ZSTD_decompressContinue
ZSTD_decompressDCtx
ZSTD_decompressStream
ZSTD_decompressStream_simpleArgs
ZSTD_decompress_usingDDict
ZSTD_decompress_usingDict
ZSTD_decompressionMargin
ZSTD_defaultCLevel
ZSTD_endStream
ZSTD_estimateCCtxSize
ZSTD_estimateCCtxSize_usingCCtxParams
ZSTD_estimateCCtxSize_usingCParams
ZSTD_estimateCDictSize
ZSTD_estimateCDictSize_advanced
ZSTD_estimateCStreamSize
ZSTD_estimateCStreamSize_usingCCtxParams
ZSTD_estimateCStreamSize_usingCParams
ZSTD_estimateDCtxSize
ZSTD_estimateDDictSize
ZSTD_estimateDStreamSize
ZSTD_estimateDStreamSize_fromFrame
ZSTD_findDecompressedSize
ZSTD_findFrameCompressedSize
ZSTD_flushStream
ZSTD_frameHeaderSize
ZSTD_freeCCtx
ZSTD_freeCCtxParams
ZSTD_freeCDict
ZSTD_freeCStream
ZSTD_freeDCtx
ZSTD_freeDDict
ZSTD_freeDStream
ZSTD_freeThreadPool
ZSTD_generateSequences
ZSTD_getBlockSize
ZSTD_getCParams
ZSTD_getDecompressedSize
ZSTD_getDictID_fromCDict
ZSTD_getDictID_fromDDict
ZSTD_getDictID_fromDict
ZSTD_getDictID_fromFrame
ZSTD_getErrorCode
ZSTD_getErrorName
ZSTD_getErrorString
ZSTD_getFrameContentSize
ZSTD_getFrameHeader
ZSTD_getFrameHeader_advanced
ZSTD_getFrameProgression
ZSTD_getParams
ZSTD_initCStream
ZSTD_initCStream_advanced
ZSTD_initCStream_srcSize
ZSTD_initCStream_usingCDict
ZSTD_initCStream_usingCDict_advanced
ZSTD_initCStream_usingDict
ZSTD_initDStream
ZSTD_initDStream_usingDDict
ZSTD_initDStream_usingDict
ZSTD_initStaticCCtx
ZSTD_initStaticCDict
ZSTD_initStaticCStream
ZSTD_initStaticDCtx
ZSTD_initStaticDDict
ZSTD_initStaticDStream
ZSTD_insertBlock
ZSTD_isError
ZSTD_isFrame
ZSTD_isSkippableFrame
ZSTD_maxCLevel
ZSTD_mergeBlockDelimiters
ZSTD_minCLevel
ZSTD_nextInputType
ZSTD_nextSrcSizeToDecompress
ZSTD_readSkippableFrame
ZSTD_registerSequenceProducer
ZSTD_resetCStream
ZSTD_resetDStream
ZSTD_sequenceBound
ZSTD_sizeof_CCtx
ZSTD_sizeof_CDict
ZSTD_sizeof_CStream
ZSTD_sizeof_DCtx
ZSTD_sizeof_DDict
ZSTD_sizeof_DStream
ZSTD_toFlushNow
ZSTD_versionNumber
ZSTD_versionString
ZSTD_writeSkippableFrame
Name
.text
Size
553KB
Virtual Size
553KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35403,
count=4, id=259, version=35403,
count=8, id=260, version=35403,
count=13, id=261, version=35403,
count=3, id=257, version=33145,
count=50, id=1, productName=Unmarked objects,
count=37, id=260, version=35717,
count=1, id=256, version=35717,
count=1, id=255, version=35717,
count=1, id=151,
count=1, id=258, version=35717,