d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384.zip
Size 13.9MB
Sample260724-t3kfhaswcs
SHA256 434ce3435d9ae3c2b288295de93bf7fdd30f3829b1452b7005661b2f280ed31a
MD5 c1619ac41c14924718c88610753484a4
SHA1 6342a808f0d409f0e2db26cb3db8b1b431cf66cb
SHA512 0d2e8d60bd778ca592c1f4a700de5c5195057dacacb9bb0a6eea9a807ca7a8116a7f15cdcbc378c6f2329f7ffc1d46958aeb7276af5710e0f127c8864b79951c
SSDEEP 196608:GZRPMjTWm0BLRcztZGlxSMPDIP7y/FinbRbYmkO6kBquImhBHIsDSYv7w89GQ5be:oMe9LRuQvSMPn9OUO6CqWB5D9ZWnH
TLSH
T1D7E633E6E95DB8C8B7C6FD6863075617C635B2ADCC8CF1A67D092131F04780A613ADB8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384

File Explorer

d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384.zip

.zip 13.9MB
d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384

.dll 34.5MB

d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384.zip

SHA256 434ce3435d9ae3c2b288295de93bf7fdd30f3829b1452b7005661b2f280ed31a
MD5 c1619ac41c14924718c88610753484a4
SHA1 6342a808f0d409f0e2db26cb3db8b1b431cf66cb
SHA512 0d2e8d60bd778ca592c1f4a700de5c5195057dacacb9bb0a6eea9a807ca7a8116a7f15cdcbc378c6f2329f7ffc1d46958aeb7276af5710e0f127c8864b79951c
SSDEEP 196608:GZRPMjTWm0BLRcztZGlxSMPDIP7y/FinbRbYmkO6kBquImhBHIsDSYv7w89GQ5be:oMe9LRuQvSMPn9OUO6CqWB5D9ZWnH
TLSH
T1D7E633E6E95DB8C8B7C6FD6863075617C635B2ADCC8CF1A67D092131F04780A613ADB8
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384

IMPHASH 84d1a14f79a85240831daf6802d26899
SHA256 d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384
MD5 07f153011d233452980433e4ea2d1b44
SHA1 eb28760022646e426fc95ce3e00b77feb5895d6f
SHA512 c3addca13a05196eacdde5eaf40aa103f78db5f7b1c3590873592b0b912aa6ed1063b84f464a0a9cc1b87f425c30f896c9f61d99ac27c0e3dd78e30a78b3129c
SSDEEP 393216:PQ4A1gZX0ooSiR38M3ZIpAUnoALSq+yu6+UzFy8H5ueHGSGPkmYaMXrHdwZWzYyf:PQ5gZvSh/J1PZO
TLSH
T192877C46F36651A8C02AE574826B6E22FBB17C4D43316BEB17D44A213E63BD05B3F784
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

23037060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

sas

SendSAS

newdev

UpdateDriverForPlugAndPlayDevicesW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsA

oleaut32

GetErrorInfo SetErrorInfo SysStringLen SysFreeString

kernel32

GetExitCodeProcess CreateSemaphoreA CreateThread FreeLibrary CreateEventA DeviceIoControl CreateFileW LocalAlloc WaitForSingleObject CreateFileMappingW MapViewOfFile DuplicateHandle UnmapViewOfFile QueryFullProcessImageNameW VirtualProtect OpenProcess GetCurrentProcessId FlushFileBuffers SetLastError ReleaseSemaphore GetCurrentProcess LocalFree GetCurrentDirectoryW Sleep SetEvent TerminateProcess GetCurrentThreadId CloseHandle SystemTimeToTzSpecificLocalTime EncodePointer GetCommandLineA FindFirstFileExW SetEndOfFile HeapQueryInformation HeapSize GetFileSizeEx FlsFree FlsSetValue FlsGetValue FlsAlloc PeekNamedPipe TryAcquireSRWLockExclusive ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc GetStartupInfoW IsProcessorFeaturePresent CreateEventW FindClose FindFirstFileW FindNextFileW ConnectNamedPipe CreateNamedPipeW GetFileAttributesW GetFileSize GetFileTime ReadFile SetFilePointer GetOverlappedResult ResetEvent ReleaseMutex CreateMutexA GlobalAlloc GlobalSize GlobalUnlock GlobalLock GlobalFree ReleaseSRWLockShared VirtualQueryEx GetProcessId OpenFileMappingW VirtualQuery ExpandEnvironmentStringsW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList AcquireSRWLockShared CreateProcessW WriteFile GetFileType GetNamedPipeInfo CreatePipe SetThreadPriority WaitForMultipleObjectsEx WaitForSingleObjectEx CreateSemaphoreW WakeConditionVariable InitializeConditionVariable InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable InitializeSRWLock ResumeThread GetLastError QueueUserAPC CreateToolhelp32Snapshot SwitchToThread GetFullPathNameW GetProcessAffinityMask MoveFileExA MoveFileExW GetCurrentThread ReleaseSRWLockExclusive AcquireSRWLockExclusive Process32FirstW Process32NextW GetNamedPipeClientProcessId HeapFree GetProcAddress LoadLibraryExA GetTimeZoneInformationForYear HeapAlloc GetProcessHeap FormatMessageW SleepConditionVariableSRW VirtualAllocEx GetModuleHandleA UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead IsDebuggerPresent GetStringTypeW GetLocaleInfoEx DecodePointer LCMapStringEx GetCPInfo InterlockedFlushSList RtlPcToFileHeader RaiseException RtlUnwindEx RtlUnwind InitializeCriticalSectionAndSpinCount FreeLibraryAndExitThread GetConsoleOutputCP CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW IsValidCodePage GetACP GetOEMCP GetTimeZoneInformation SetStdHandle WriteProcessMemory GetTempPathW ReadConsoleW GetWindowsDirectoryW WaitForMultipleObjects ReadFileEx ExitProcess CancelIo CopyFileExW GetFinalPathNameByHandleW RemoveDirectoryW DeleteFileW CreateDirectoryW GetFileInformationByHandle HeapReAlloc SleepEx WriteFileEx SetFilePointerEx GetCommandLineW SetEnvironmentVariableW GetEnvironmentVariableW GetEnvironmentStringsW SetWaitableTimer CreateWaitableTimerExW SetThreadStackGuarantee CompareStringOrdinal FreeEnvironmentStringsW CancelIoEx SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort PostQueuedCompletionStatus SetHandleInformation GetProcessIoCounters GetSystemTimes GetDriveTypeW GetLogicalProcessorInformationEx GetProcessTimes K32GetPerformanceInfo GlobalMemoryStatusEx GetTickCount64 SetConsoleMode GetFileInformationByHandleEx GetComputerNameExW SetFileTime GetLogicalDrives RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetThreadErrorMode GetSystemDirectoryW GetSystemTimeAsFileTime InitializeCriticalSection WideCharToMultiByte SetInformationJobObject AssignProcessToJobObject CreateJobObjectW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleW GetConsoleMode GetStdHandle GetLogicalProcessorInformation TryEnterCriticalSection SleepConditionVariableCS LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionEx FileTimeToSystemTime SetErrorMode QueryPerformanceCounter QueryPerformanceFrequency GetModuleFileNameW GetModuleHandleExW ReadProcessMemory MultiByteToWideChar lstrcmpiW GetUserPreferredUILanguages GetSystemInfo lstrlenW VerifyVersionInfoW FormatMessageA VerSetConditionMask GetModuleHandleExA SetThreadExecutionState LoadLibraryW ProcessIdToSessionId LoadLibraryExW SetDllDirectoryW GetNativeSystemInfo LoadLibraryA GetModuleHandleW WTSGetActiveConsoleSessionId SetConsoleCtrlHandler

comctl32

SetWindowSubclass RemoveWindowSubclass DefSubclassProc

shell32

ShellExecuteExW Shell_NotifyIconW SHGetKnownFolderPath DragFinish DragQueryFileW Shell_NotifyIconGetRect SHAddToRecentDocs CommandLineToArgvW SHAppBarMessage ShellExecuteW ShellExecuteA

advapi32

GetLengthSid SetSecurityDescriptorDacl CreateWellKnownSid InitializeSecurityDescriptor CreateProcessWithLogonW DuplicateToken LookupAccountSidW FreeSid EqualSid AllocateAndInitializeSid LogonUserW IsWellKnownSid GetTokenInformation ConvertStringSidToSidW ConvertSidToStringSidW RevertToSelf ImpersonateAnonymousToken OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx ImpersonateLoggedOnUser LookupPrivilegeValueW CreateProcessWithTokenW GetNamedSecurityInfoW SetEntriesInAclW ConvertStringSecurityDescriptorToSecurityDescriptorW CreateProcessAsUserW SetNamedSecurityInfoW RegQueryValueExW RegOpenKeyExW RegSetValueExW StartServiceCtrlDispatcherW RegDeleteValueW RegDeleteTreeW RegisterServiceCtrlHandlerExW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW SetServiceStatus GetUserNameW SystemFunction036 IsValidSid CopySid

userenv

DestroyEnvironmentBlock GetUserProfileDirectoryW CreateEnvironmentBlock

user32

DefWindowProcA InsertMenuW CreatePopupMenu CreateMenu DestroyMenu SetWindowLongW GetSystemMenu SetWindowDisplayAffinity EnumDisplayDevicesW EnumDisplaySettingsExW GetWindowThreadProcessId DrawTextW MapVirtualKeyExW GetKeyboardState GetRawInputData SystemParametersInfoW ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx SetPropW AdjustWindowRectEx GetMonitorInfoA PostMessageA FindWindowExA IsWindowVisible LoadCursorA SetWindowsHookExA GetMessageA GetDesktopWindow EnumDisplayMonitors GetKeyState CallNextHookEx OpenInputDesktop PostThreadMessageA SetThreadDesktop AttachThreadInput FillRect GetWindowDC OffsetRect MapWindowPoints GetForegroundWindow GetMenuBarInfo RegisterClipboardFormatA GetClipboardData GetMenu SetMenu AppendMenuW RegisterRawInputDevices RegisterTouchWindow IsWindow CreateWindowExW RemoveMenu GetMenuItemInfoW TrackPopupMenu SetClipboardData ChangeClipboardChain SetClipboardViewer SetTimer KillTimer SetWindowLongPtrW GetWindowLongPtrW RegisterClassExW SendInput RegisterClipboardFormatW ChangeWindowMessageFilterEx GetDoubleClickTime AllowSetForegroundWindow GetClipCursor ExitWindowsEx TranslateMessage DispatchMessageA UnhookWindowsHookEx PostMessageW AddClipboardFormatListener GetCursorPos GetCursorInfo GetMessageW RemoveClipboardFormatListener SetMenuItemInfoW EnableMenuItem CheckMenuItem IsProcessDPIAware IsClipboardFormatAvailable EmptyClipboard GetClipboardFormatNameA DispatchMessageW LockWorkStation MessageBoxW ToUnicodeEx GetKeyboardLayout EnumDisplaySettingsW ShowWindow FindWindowW SendMessageA BlockInput ReleaseDC GetDC GetIconInfo ClipCursor SetCursorPos GetClipboardOwner RegisterClassW CloseClipboard OpenClipboard CreateWindowExA RegisterClassExA SendMessageW RedrawWindow GetClientRect ValidateRect PeekMessageW CreateIcon DestroyIcon RegisterWindowMessageA PostThreadMessageW DefWindowProcW GetThreadDesktop ScreenToClient DrawIconEx GetUserObjectInformationA DrawMenuBar GetWindowLongW VkKeyScanExW DestroyAcceleratorTable ClientToScreen CountClipboardFormats CloseDesktop ShowCursor GetWindowPlacement InvalidateRgn PostQuitMessage SystemParametersInfoA SetWindowPlacement ChangeDisplaySettingsExW MonitorFromRect GetUpdateRect GetActiveWindow wsprintfW MapVirtualKeyW GetAsyncKeyState CreateAcceleratorTableW GetMonitorInfoW SetCursor LoadCursorW GetWindowRect SetWindowPos MonitorFromWindow GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetForegroundWindow

ole32

RevokeDragDrop CoTaskMemAlloc PropVariantClear StringFromGUID2 RegisterDragDrop CoTaskMemFree OleUninitialize CoUninitialize ReleaseStgMedium OleIsCurrentClipboard CoCreateInstance CoInitializeEx OleSetClipboard OleInitialize OleGetClipboard

secur32

AcceptSecurityContext InitializeSecurityContextW DecryptMessage QueryContextAttributesW DeleteSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA EncryptMessage FreeContextBuffer ApplyControlToken

ws2_32

ioctlsocket accept connect socket closesocket getsockname freeaddrinfo bind WSASocketW send recv getaddrinfo WSAGetLastError getpeername getsockopt WSAStartup shutdown recvfrom sendto setsockopt WSAIoctl WSACleanup WSASend listen

gdi32

GetObjectA DeleteObject GetBitmapBits CreateDCW GetDeviceCaps SetTextColor CreateCompatibleDC GetDIBits SetBkMode CreateSolidBrush SelectObject DeleteDC CreateDIBSection BitBlt CreateDIBitmap CreateCompatibleBitmap CreateRectRgn

crypt32

CertDuplicateStore CertCloseStore CertOpenStore CertVerifyTimeValidity CertEnumCertificatesInStore CertGetEnhancedKeyUsage CertGetCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CertFreeCertificateChain CertDuplicateCertificateChain CertAddCertificateContextToStore CertVerifyCertificateChainPolicy

winspool.drv

DeletePrinterDriverExW EnumPortsW OpenPrinterW EnumPrintersW GetDefaultPrinterW XcvDataW ClosePrinter SetPrinterW DeletePrinter UploadPrinterDriverPackageW InstallPrinterDriverFromPackageW AddPrinterW EnumPrinterDriversW DeletePrinterDriverPackageW

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiGetClassDevsW SetupDiCreateDeviceInfoW SetupDiSetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiGetClassDevsExW SetupDiGetDeviceInfoListDetailW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiGetDeviceInstallParamsW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW

dwmapi

DwmEnableBlurBehindWindow

cfgmgr32

CM_Get_DevNode_Status

iphlpapi

GetBestInterface GetAdaptersAddresses SendARP

ntdll

NtQuerySystemInformation NtQueryInformationProcess NtWriteFile RtlGetVersion RtlGetNtVersionNumbers NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtReadFile

powrprof

CallNtPowerInformation

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider

pdh

PdhOpenQueryA PdhCollectQueryDataEx PdhAddEnglishCounterA PdhCollectQueryData PdhCloseQuery PdhRemoveCounter PdhAddEnglishCounterW PdhGetFormattedCounterValue

psapi

GetProcessMemoryInfo GetModuleFileNameExW

drop_dart_object free_WireSyncReturn free_c_args free_zero_copy_buffer_f32 free_zero_copy_buffer_f64 free_zero_copy_buffer_i16 free_zero_copy_buffer_i32 free_zero_copy_buffer_i64 free_zero_copy_buffer_i8 free_zero_copy_buffer_u16 free_zero_copy_buffer_u32 free_zero_copy_buffer_u64 free_zero_copy_buffer_u8 get_dart_object get_rustdesk_app_name hwcodec_av_log_callback hwcodec_log init_frb_dart_api_dl new_StringList_0 new_dart_opaque new_int_32_list_0 new_uint_8_list_0 privacy_mode_hook_keyboard privacy_mode_hook_mouse rustdesk_core_main_args session_get_rgba store_dart_post_cobject wire_cm_can_elevate wire_cm_check_click_time wire_cm_check_clients_length wire_cm_close_connection wire_cm_close_voice_call wire_cm_elevate_portable wire_cm_get_click_time wire_cm_get_clients_length wire_cm_get_clients_state wire_cm_get_config wire_cm_handle_incoming_voice_call wire_cm_init wire_cm_login_res wire_cm_remove_disconnected_connection wire_cm_send_chat wire_cm_switch_back wire_cm_switch_permission wire_get_double_click_time wire_get_local_flutter_option wire_get_local_kb_layout_type wire_get_next_texture_key wire_get_voice_call_input_device wire_host_stop_system_key_propagate wire_install_install_me wire_install_install_options wire_install_install_path wire_install_run_without_install wire_install_show_run_without_install wire_is_custom_client wire_is_disable_ab wire_is_disable_account wire_is_disable_group_panel wire_is_disable_installation wire_is_disable_settings wire_is_incoming_only wire_is_outgoing_only wire_is_preset_password wire_is_preset_password_mobile_only wire_is_selinux_enforcing wire_is_support_multi_ui_session wire_main_account_auth wire_main_account_auth_cancel wire_main_account_auth_result wire_main_audio_support_loopback wire_main_change_id wire_main_change_language wire_main_change_theme wire_main_check_connect_status wire_main_check_hwcodec wire_main_check_mouse_time wire_main_check_super_user_permission wire_main_clear_ab wire_main_clear_group wire_main_clear_trusted_devices wire_main_clip_cursor wire_main_create_shortcut wire_main_current_is_wayland wire_main_default_privacy_mode_impl wire_main_deploy_device wire_main_device_id wire_main_device_name wire_main_discover wire_main_forget_password wire_main_generate2fa wire_main_get_api_server wire_main_get_app_name wire_main_get_app_name_sync wire_main_get_async_status wire_main_get_build_date wire_main_get_buildin_option wire_main_get_common wire_main_get_common_sync wire_main_get_connect_status wire_main_get_data_dir_ios wire_main_get_displays wire_main_get_env wire_main_get_error wire_main_get_fav wire_main_get_fingerprint wire_main_get_hard_option wire_main_get_home_dir wire_main_get_http_status wire_main_get_input_source wire_main_get_lan_peers wire_main_get_langs wire_main_get_last_remote_id wire_main_get_license wire_main_get_local_option wire_main_get_login_device_info wire_main_get_main_display wire_main_get_mouse_time wire_main_get_my_id wire_main_get_new_stored_peers wire_main_get_new_version wire_main_get_option wire_main_get_option_sync wire_main_get_options wire_main_get_options_sync wire_main_get_peer_flutter_option_sync wire_main_get_peer_option wire_main_get_peer_option_sync wire_main_get_peer_sync wire_main_get_printer_names wire_main_get_proxy_status wire_main_get_socks wire_main_get_software_update_url wire_main_get_sound_inputs wire_main_get_temporary_password wire_main_get_trusted_devices wire_main_get_unlock_pin wire_main_get_use_texture_render wire_main_get_user_default_option wire_main_get_uuid wire_main_get_version wire_main_goto_install wire_main_handle_relay_id wire_main_handle_wayland_screencast_restore_token wire_main_has_file_clipboard wire_main_has_gpu_texture_render wire_main_has_hwcodec wire_main_has_valid_2fa_sync wire_main_has_valid_bot_sync wire_main_has_vram wire_main_hide_dock wire_main_http_request wire_main_init wire_main_init_input_source wire_main_is_can_input_monitoring wire_main_is_can_screen_recording wire_main_is_installed wire_main_is_installed_daemon wire_main_is_installed_lower_version wire_main_is_login_wayland wire_main_is_option_fixed wire_main_is_process_trusted wire_main_is_root wire_main_is_share_rdp wire_main_is_using_public_server wire_main_load_ab wire_main_load_fav_peers wire_main_load_group wire_main_load_lan_peers wire_main_load_recent_peers wire_main_load_recent_peers_for_ab wire_main_max_encrypt_len wire_main_on_main_window_close wire_main_peer_exists wire_main_peer_has_password wire_main_remove_discovered wire_main_remove_peer wire_main_remove_trusted_devices wire_main_resolve_avatar_url wire_main_save_ab wire_main_save_group wire_main_set_common wire_main_set_cursor_position wire_main_set_env wire_main_set_home_dir wire_main_set_input_source wire_main_set_local_option wire_main_set_option wire_main_set_options wire_main_set_peer_alias wire_main_set_peer_flutter_option_sync wire_main_set_peer_option wire_main_set_peer_option_sync wire_main_set_permanent_password_with_result wire_main_set_share_rdp wire_main_set_socks wire_main_set_unlock_pin wire_main_set_user_default_option wire_main_show_option wire_main_start_dbus_server wire_main_start_ipc_url_server wire_main_start_service wire_main_stop_service wire_main_store_fav wire_main_support_remove_wallpaper wire_main_supported_hwdecodings wire_main_supported_input_source wire_main_supported_privacy_mode_impls wire_main_test_if_valid_server wire_main_test_wallpaper wire_main_update_me wire_main_update_temporary_password wire_main_uri_prefix_sync wire_main_verify2fa wire_main_verify_bot wire_main_video_save_directory wire_main_wol wire_option_synced wire_peer_get_sessions_count wire_plugin_enable wire_plugin_event wire_plugin_feature_is_enabled wire_plugin_get_session_option wire_plugin_get_shared_option wire_plugin_install wire_plugin_is_enabled wire_plugin_list_reload wire_plugin_register_event_stream wire_plugin_reload wire_plugin_set_session_option wire_plugin_set_shared_option wire_plugin_sync_ui wire_query_onlines wire_send_url_scheme wire_session_add_existed_sync wire_session_add_job wire_session_add_port_forward wire_session_add_sync wire_session_alternative_codecs wire_session_cancel_job wire_session_change_prefer_codec wire_session_change_resolution wire_session_close wire_session_close_terminal wire_session_close_voice_call wire_session_create_dir wire_session_ctrl_alt_del wire_session_elevate_direct wire_session_elevate_with_logon wire_session_enter_or_leave wire_session_get_audit_guid wire_session_get_audit_server_sync wire_session_get_common wire_session_get_common_sync wire_session_get_conn_session_id wire_session_get_conn_token wire_session_get_custom_image_quality wire_session_get_displays_as_individual_windows wire_session_get_edge_scroll_edge_thickness wire_session_get_enable_trusted_devices wire_session_get_flutter_option wire_session_get_image_quality wire_session_get_is_recording wire_session_get_keyboard_mode wire_session_get_last_audit_note wire_session_get_option wire_session_get_peer_option wire_session_get_platform wire_session_get_remember wire_session_get_reverse_mouse_wheel_sync wire_session_get_rgba_size wire_session_get_scroll_style wire_session_get_toggle_option wire_session_get_toggle_option_sync wire_session_get_trackpad_speed wire_session_get_use_all_my_displays_for_the_remote_session wire_session_get_view_style wire_session_handle_flutter_key_event wire_session_handle_flutter_raw_key_event wire_session_handle_screenshot wire_session_input_key wire_session_input_os_password wire_session_input_string wire_session_is_keyboard_mode_supported wire_session_is_multi_ui_session wire_session_load_last_transfer_jobs wire_session_lock_screen wire_session_login wire_session_new_rdp wire_session_next_rgba wire_session_on_waiting_for_image_dialog_show wire_session_open_terminal wire_session_peer_option wire_session_printer_response wire_session_read_dir_to_remove_recursive wire_session_read_local_dir_sync wire_session_read_local_empty_dirs_recursive_sync wire_session_read_remote_dir wire_session_read_remote_empty_dirs_recursive_sync wire_session_reconnect wire_session_record_screen wire_session_refresh wire_session_register_gpu_texture wire_session_register_pixelbuffer_texture wire_session_remove_all_empty_dirs wire_session_remove_file wire_session_remove_port_forward wire_session_rename_file wire_session_request_new_display_init_msgs wire_session_request_voice_call wire_session_resize_terminal wire_session_restart_remote_device wire_session_resume_job wire_session_send2fa wire_session_send_chat wire_session_send_files wire_session_send_mouse wire_session_send_note wire_session_send_pointer wire_session_send_selected_session_id wire_session_send_terminal_input wire_session_set_audit_guid wire_session_set_common wire_session_set_confirm_override_file wire_session_set_custom_fps wire_session_set_custom_image_quality wire_session_set_displays_as_individual_windows wire_session_set_edge_scroll_edge_thickness wire_session_set_flutter_option wire_session_set_image_quality wire_session_set_keyboard_mode wire_session_set_reverse_mouse_wheel wire_session_set_scroll_style wire_session_set_size wire_session_set_trackpad_speed wire_session_set_use_all_my_displays_for_the_remote_session wire_session_set_view_style wire_session_start wire_session_start_with_displays wire_session_switch_display wire_session_switch_sides wire_session_take_screenshot wire_session_toggle_option wire_session_toggle_privacy_mode wire_session_toggle_virtual_display wire_set_cur_session_id wire_set_local_flutter_option wire_set_local_kb_layout_type wire_set_voice_call_input_device wire_start_global_event_stream wire_stop_global_event_stream wire_translate wire_version_to_number wire_will_session_close_close_session

Name

.text

Size

22.6MB

Virtual Size

22.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.2MB

Virtual Size

11.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

459KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

276KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384.zip

d88bd864c82d862f506c55b97cff893a852e8b6292ce80075c91cd10b7332384

sas

newdev

wtsapi32

oleaut32

kernel32

comctl32

shell32

advapi32

userenv

user32

ole32

secur32

ws2_32

gdi32

crypt32

winspool.drv

setupapi

dwmapi

cfgmgr32

iphlpapi

ntdll

powrprof

d3d11

dxgi

bcrypt

pdh

psapi

generic