WinPcap_4_1_3[.]exe

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$SYSDIR/pthreadVC.dll

resource
WinPcap_4_1_3.exe
unpack001/$SYSDIR/Packet.dll
unpack001/$SYSDIR/wpcap.dll
unpack001/WinPcapInstall.dll
unpack001/rpcapd.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

WinPcap_4_1_3.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fc4623b113a1f603c0d9ad5f83130bd6de1c62b973be9892305132389c8588de
MD5 a11a2f0cfe6d0b4c50945989db6360cd
SHA1 e2516fcd1573e70334c8f50bee5241cdfdf48a00
SHA512 2652d84eb91ca7957b4fb3ff77313e5dae978960492669242df4f246296f1bedaa48c0d33ffb286b2859a1b86ef5460060b551edca597b4ec60ee08676877c70
SSDEEP 24576:UBOldyR6ORWsaM2QROxa6jsqUENfJjNK/CG6niqiL:2KzqWsayROxa6QDENuaG+ifL
TLSH
T17F15231507A47D77FF274270906FEA60AFFEC2294390362733A464EA2D53AD62B1417B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

be:72:38:f0:32:8c:16:3b:2e:d9:97:ba:f7:42:66:0c:3b:6b:63:df

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 1, 2013

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 26, 2012 - Oct 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/bootOptions.ini

SHA256 f6f2e247226ab06e9b56ae2d10ccd02d9298abccac85c56abfa19e5587446d54
MD5 9f64b7e590b32b5ba414f4301fb8b3d5
SHA1 8d44c84b3a78b4fd8b2dcf8d3d49400e47b41840
SHA512 513251b52da94d56e505ed8b8bac07b6f5e325561c6c6865c424bd2aecb437e69d9a8c91a1595deb2293f1df166b9712e8807a57506f80889bc5c2e1afb6d5f7
TLSH
T1A9E0C040200287358C20A1449D2F9BC1FB7030383F9409B0F0942C43FA455D213BCAC9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 c0e284fde834fe8a6f90504dba7abff25b1e7dd4611483341203fd3efc5de8a6
MD5 d8f59a707b2a5000c7903595eddc3d48
SHA1 e86239fe1dc3cfdbec6006817160eb5f1fc92bca
SHA512 91e28a685733620832d3851d7f3eee36495f2728610bd6c66f305cdda039f75ab8499d0e51e64afa018c221a728889503db2fc7c84cf9599a61b68951686b048
SSDEEP 192:UdCd/28k2hZrlQ+jP3/PGs/ZkTnSQpuWE:UD8jLlQ+jP3///ZUSJ5
TLSH
T191D2A23B6433AC7C81A527E5DFB2ED8E80B76EB32660B910A5B4F3F764B12D75020446
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$SYSDIR/Packet.dll

IMPHASH 19fa7010cacd16ef346ea8bbc2e8b999
SHA256 cd9f4fb077c25013226e0883f9ae02e9ced9b71f07637081e55ae70fd0788f29
MD5 2ce150705bbeb30e6c8059cc530043aa
SHA1 3d8615f9d8f8f7a5d78b3c06bf746948b9ef6ba5
SHA512 9f7573ca679ef0cc0e1d815f605a399e87f7a046e3e51970d2c7597329b19e118cc2da7240ee854e13e31582f12bab8be506d1612ac81d5b453ef366d4674dcf
SSDEEP 1536:zbDKMXRC2wKDDuDirGfqs97WcETlsxtl2o+V:PDKMtfuysAcETlsxtco8
TLSH
T1C2A38D02B993C072F4928A7D819587A2AB7F78537FE554DFEF6009890DA03D3277A271
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

86:ca:55:b7:f9:4a:c7:29:69:93:49:93:a7:2a:43:b4:e9:30:f5:a5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 1, 2013

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 26, 2012 - Oct 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

26704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\releases\winpcap_4_1_3\winpcap\packetNtx\Dll\Project\Release\x86\Packet.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

npptools

SetBoolInBlob DestroyBlob CreateBlob CreateNPPInterface GetNPPBlobTable

ws2_32

inet_addr

iphlpapi

GetAdaptersInfo

kernel32

GlobalFree GlobalAlloc GlobalHandle ReleaseMutex GlobalLock WaitForSingleObject GlobalUnlock QueryPerformanceCounter CreateEventW SetEvent DeviceIoControl GetModuleHandleW WriteFile QueryPerformanceFrequency GetSystemDirectoryW WideCharToMultiByte CloseHandle GetVersion GetStringTypeW ReadFile GetFullPathNameW GetModuleFileNameW MultiByteToWideChar CreateFileA GetLastError SetLastError CreateMutexW GetProcAddress InitializeCriticalSection Sleep GetVersionExW LeaveCriticalSection EnterCriticalSection ResetEvent DeleteCriticalSection OutputDebugStringA GetSystemTimeAsFileTime GetLocaleInfoA HeapSize FlushFileBuffers LoadLibraryW GetCurrentThreadId GetStringTypeA LCMapStringW LCMapStringA WriteConsoleW GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree GetTickCount GetCurrentProcessId SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA VirtualAlloc HeapReAlloc RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP

advapi32

QueryServiceStatus StartServiceW OpenServiceA RegOpenKeyExA CreateServiceA ControlService OpenSCManagerW RegEnumKeyW RegCloseKey RegOpenKeyExW RegQueryValueExW RegQueryValueExA CloseServiceHandle

ole32

CoUninitialize CoInitializeEx CoInitialize

$SYSDIR/pthreadVC.dll

IMPHASH 90ee61357770484e2d085958b94141a3
SHA256 99c61abf41c3aec38cab3ed6270adbca9a247bbf5f9aa9d29ecb0659a5527f48
MD5 f04a90f917ba10ae2dcbe859870f4dea
SHA1 6668ebe373ce58c33017697c477557653427e626
SHA512 aec29301b9ce311b27f1590b0e0c4121acdc183a30b570e087d77b7035684f02a6dfbdee950c37f3023b32e2ea5a075a5fbe6d18a2804da9490d4959733bb516
SSDEEP 384:hSvfC8Vv0Vy7ojuq7GQcdWTc4zU+GFronD/yD5rBEe0kiH32Jp9AhOW:wt+TGQcdWYdMG59EeJiH3YzW
TLSH
T19A33C8066E28C1FBC5B768F126AA23FB1D370614131568DFE397D460096ADE5E339783
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

25783

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

pthreadCancelableTimedWait pthreadCancelableWait pthread_attr_destroy pthread_attr_getdetachstate pthread_attr_getinheritsched pthread_attr_getschedparam pthread_attr_getschedpolicy pthread_attr_getscope pthread_attr_getstackaddr pthread_attr_getstacksize pthread_attr_init pthread_attr_setdetachstate pthread_attr_setinheritsched pthread_attr_setschedparam pthread_attr_setschedpolicy pthread_attr_setscope pthread_attr_setstackaddr pthread_attr_setstacksize pthread_barrier_destroy pthread_barrier_init pthread_barrier_wait pthread_barrierattr_destroy pthread_barrierattr_getpshared pthread_barrierattr_init pthread_barrierattr_setpshared pthread_cancel pthread_cond_broadcast pthread_cond_destroy pthread_cond_init pthread_cond_signal pthread_cond_timedwait pthread_cond_wait pthread_condattr_destroy pthread_condattr_getpshared pthread_condattr_init pthread_condattr_setpshared pthread_create pthread_delay_np pthread_detach pthread_equal pthread_exit pthread_getconcurrency pthread_getschedparam pthread_getspecific pthread_getw32threadhandle_np pthread_join pthread_key_create pthread_key_delete pthread_kill pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_timedlock pthread_mutex_trylock pthread_mutex_unlock pthread_mutexattr_destroy pthread_mutexattr_getkind_np pthread_mutexattr_getpshared pthread_mutexattr_gettype pthread_mutexattr_init pthread_mutexattr_setkind_np pthread_mutexattr_setpshared pthread_mutexattr_settype pthread_num_processors_np pthread_once pthread_rwlock_destroy pthread_rwlock_init pthread_rwlock_rdlock pthread_rwlock_timedrdlock pthread_rwlock_timedwrlock pthread_rwlock_tryrdlock pthread_rwlock_trywrlock pthread_rwlock_unlock pthread_rwlock_wrlock pthread_rwlockattr_destroy pthread_rwlockattr_getpshared pthread_rwlockattr_init pthread_rwlockattr_setpshared pthread_self pthread_setcancelstate pthread_setcanceltype pthread_setconcurrency pthread_setschedparam pthread_setspecific pthread_spin_destroy pthread_spin_init pthread_spin_lock pthread_spin_trylock pthread_spin_unlock pthread_testcancel pthread_timechange_handler_np pthread_win32_process_attach_np pthread_win32_process_detach_np pthread_win32_thread_attach_np pthread_win32_thread_detach_np ptw32_get_exception_services_code ptw32_pop_cleanup ptw32_push_cleanup sched_get_priority_max sched_get_priority_min sched_getscheduler sched_setscheduler sched_yield sem_close sem_destroy sem_getvalue sem_init sem_open sem_post sem_post_multiple sem_timedwait sem_trywait sem_unlink sem_wait

$SYSDIR/wpcap.dll

IMPHASH 10dce091d63eed72dc0010ebc8838f6a
SHA256 b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
MD5 4633b298d57014627831ccac89a2c50b
SHA1 e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA512 29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
SSDEEP 6144:E4yIm5rC9WNWwKcNBSCiLvK8+jKgZBwIbg2:jyIm59WwpqCuEKIwv2
TLSH
T124549D027F13C07AE51A057941AABB564F3EA51227F194C7FFC06CABAC632C3667216D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

cf:62:51:f0:27:45:ec:8f:43:5a:c8:f8:39:3a:ab:b8:9f:42:52:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 1, 2013

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 26, 2012 - Oct 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

124026

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\releases\winpcap_4_1_3\winpcap\wpcap\PRJ\Release\x86\wpcap.pdb

ws2_32

WSACleanup ntohl gethostbyname htons gethostbyaddr WSAGetLastError htonl getservbyname inet_addr getservbyport inet_ntoa WSASetLastError getprotobyname accept closesocket getpeername getsockopt setsockopt getsockname select WSAStartup shutdown connect listen send socket bind ntohs recv

packet

PacketGetNetInfoEx PacketGetAdapterNames PacketSetMinToCopy PacketSetLoopbackBehavior PacketSetHwFilter PacketGetStats PacketSendPacket PacketSetReadTimeout PacketReceivePacket PacketSetMode PacketOpenAdapter PacketSetBpf PacketAllocatePacket PacketInitPacket PacketCloseAdapter PacketFreePacket PacketGetNetType PacketSetBuff PacketGetVersion PacketSetDumpName PacketSendPackets PacketIsDumpEnded PacketGetReadEvent PacketSetDumpLimits PacketGetAirPcapHandle PacketGetStatsEx

kernel32

SetUnhandledExceptionFilter SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA CreateFileA GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA ReadFile MultiByteToWideChar FlushFileBuffers GetConsoleMode GetConsoleCP WideCharToMultiByte HeapSize SetFilePointer CloseHandle VirtualAlloc VirtualFree HeapCreate HeapDestroy TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo GetModuleFileNameA WriteFile DeleteCriticalSection GetLastError GetSystemDirectoryA FreeLibrary GetProcAddress EnterCriticalSection LoadLibraryA LeaveCriticalSection GetVersion FindNextFileA FormatMessageA FindFirstFileA FindClose InterlockedExchange SetLastError InterlockedCompareExchange Sleep InitializeCriticalSection UnhandledExceptionFilter HeapFree HeapAlloc RtlUnwind SetStdHandle GetFileType HeapReAlloc GetModuleHandleA ExitProcess GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap TerminateProcess GetCurrentProcess IsDebuggerPresent SetHandleCount GetStdHandle GetStartupInfoA

bpf_dump bpf_filter bpf_image bpf_validate endservent eproto_db getservent install_bpf_program pcap_activate pcap_breakloop pcap_close pcap_compile pcap_compile_nopcap pcap_create pcap_createsrcstr pcap_datalink pcap_datalink_name_to_val pcap_datalink_val_to_description pcap_datalink_val_to_name pcap_dispatch pcap_dump pcap_dump_close pcap_dump_file pcap_dump_flush pcap_dump_ftell pcap_dump_open pcap_file pcap_fileno pcap_findalldevs pcap_findalldevs_ex pcap_free_datalinks pcap_freealldevs pcap_freecode pcap_get_airpcap_handle pcap_geterr pcap_getevent pcap_getnonblock pcap_hopen_offline pcap_is_swapped pcap_lib_version pcap_list_datalinks pcap_live_dump pcap_live_dump_ended pcap_lookupdev pcap_lookupnet pcap_loop pcap_major_version pcap_minor_version pcap_next pcap_next_etherent pcap_next_ex pcap_offline_filter pcap_offline_read pcap_open pcap_open_dead pcap_open_live pcap_open_offline pcap_parsesrcstr pcap_perror pcap_read pcap_remoteact_accept pcap_remoteact_cleanup pcap_remoteact_close pcap_remoteact_list pcap_sendpacket pcap_sendqueue_alloc pcap_sendqueue_destroy pcap_sendqueue_queue pcap_sendqueue_transmit pcap_set_buffer_size pcap_set_datalink pcap_set_promisc pcap_set_snaplen pcap_set_timeout pcap_setbuff pcap_setdirection pcap_setfilter pcap_setmintocopy pcap_setmode pcap_setnonblock pcap_setsampling pcap_setuserbuffer pcap_snapshot pcap_stats pcap_stats_ex pcap_strerror wsockinit

WinPcapInstall.dll

IMPHASH ad1fff2efc5a1aa2884d5c780a51aa99
SHA256 d9f4cd9f0e1bc9a138fb4da6f83c92c3e86eb3de4f988d5943d75c9b1dc6bb9d
MD5 e78291558cb803dfd091ad8fb56feecc
SHA1 4bde2f87e903fe8d3bd80179c5584cec7a8cbdc4
SHA512 042b96bc2c0e6d8b6e2730426938eb7400fd833be8a108a4942f559fedefabc35fd5dcb7ea1898d377b4382c0a9af8eeeebd663a4c852c706e3bd168c1f1f62f
SSDEEP 1536:s7xjrG5m+619YG7L2xo8JfmL4iMtgLZtAeYjFH:s7s27yaL4kVtAeE9
TLSH
T1C6938C113AE3C0B3E4460834D1C687A16FBE7D13FEEA545FEFA3029A5D816C4636B169
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

26:4b:32:ba:02:ff:cd:d6:6e:bf:35:a6:b9:a2:17:e5:f8:50:5e:5e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 1, 2013

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 26, 2012 - Oct 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

10944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\releases\winpcap_4_1_3\winpcap\install\WinPcap Installer Helper\Release\x86\WinPcapInstall.pdb

kernel32

LoadLibraryA GetProcAddress GetCurrentProcess LoadLibraryExA GetLastError Sleep FormatMessageA FreeLibrary GetModuleHandleA LocalFree GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent CloseHandle EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc SetStdHandle WriteFile GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileA InitializeCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetFilePointer SetEndOfFile ReadFile LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

advapi32

OpenSCManagerA ChangeServiceConfigA StartServiceA CreateServiceA DeleteService CloseServiceHandle OpenServiceA ControlService

ole32

CoUninitialize CoInitializeEx CoCreateInstance

rpcapd.exe

IMPHASH 2b9e73ff502840fe6b381682c42d43cf
SHA256 52360f17c9c70c9cea3316560b40c4d89fd705ed7e6b6088c99fc54d4cc35eb5
MD5 83a6c2cafe236652d1559640594a0ea8
SHA1 c99aa678f387c00c4470fa3cd7b037d26720960d
SHA512 4f6981c4e8d64311087795e9639516409bf80ebca5c7f25af1fb436aaccf90f24617ecd3f95b63558981b12bc0e5eeacf120fea7be5e5fa05ecf3afa4f9f799b
SSDEEP 3072:mL7m5RTfrUna0m2BeIIgJ3155FulLfbt/6:C7m5RTEaseIH515qfA
TLSH
T144C3BF0539C2C0B3F455027141878BF29F7EB8333B6669CBFB9409995E812C29A772DB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

61:6f:43:de:5d:fa:a5:33:da:d2:7b:2b:a1:91:56:48:59:00:98:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 1, 2013

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 26, 2012 - Oct 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

36901

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\releases\winpcap_4_1_3\winpcap\wpcap\libpcap\rpcapd\Release\x86\rpcapd.pdb

wpcap

install_bpf_program pcap_compile pcap_open_offline pcap_create pcap_open_live bpf_validate pcap_findalldevs pcap_strerror pcap_freealldevs pcap_geterr pcap_close pcap_setfilter pcap_stats pcap_next_ex

ws2_32

gethostbyaddr closesocket WSASetLastError getsockname htonl inet_addr getservbyname ntohl inet_ntoa ntohs accept htons connect WSAStartup shutdown WSACleanup recv bind socket send listen getservbyport select gethostbyname getpeername WSAGetLastError

pthreadvc

pthread_attr_init pthread_attr_setdetachstate pthread_exit pthread_cancel pthread_attr_destroy pthread_setcancelstate pthread_setcanceltype pthread_create

packet

PacketSetMinToCopy PacketSetLoopbackBehavior

kernel32

GetConsoleOutputCP WriteConsoleA HeapSize FlushFileBuffers SetStdHandle CreateFileA ReadFile GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InitializeCriticalSection WriteConsoleW RtlUnwind GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA GetStdHandle WriteFile HeapReAlloc VirtualAlloc DeleteCriticalSection VirtualFree HeapCreate HeapDestroy GetCurrentThreadId SetLastError TlsFree GetSystemDirectoryA FormatMessageA GetLastError FreeLibrary GetProcAddress CloseHandle Sleep LoadLibraryA TlsSetValue TlsAlloc SetEndOfFile SetConsoleCtrlHandler HeapFree HeapAlloc GetModuleHandleA ExitProcess EnterCriticalSection LeaveCriticalSection GetCommandLineA GetVersionExA GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue

user32

MessageBoxA

advapi32

StartServiceCtrlDispatcherA SetServiceStatus LogonUserA ImpersonateLoggedOnUser RegisterServiceCtrlHandlerA

Sharing

General

Malware Config

Signatures

File Explorer

WinPcap_4_1_3.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/bootOptions.ini

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$SYSDIR/Packet.dll

PE Signature issue

version

npptools

ws2_32

iphlpapi

kernel32

advapi32

ole32

generic

$SYSDIR/pthreadVC.dll

msvcrt

wsock32

kernel32

generic

$SYSDIR/wpcap.dll

PE Signature issue

ws2_32

packet

kernel32

generic

WinPcapInstall.dll

PE Signature issue

kernel32

advapi32

ole32

generic

rpcapd.exe

PE Signature issue

wpcap

ws2_32

pthreadvc

packet

kernel32

user32

advapi32

generic