Claude-Pro-Relay-Technical-Overview.zip
- SHA256 a569f2a5534f9d5990356d260860286e43c1b0eb8290b7e9726ccd7c7d241e5a
Overview
overview
7Static
static
5Claude-Pro...ew.lnk
windows10-2004-x64
7Claude-Pro...ew.lnk
windows11-ltsc_2024-x64
7Claude-Pro...53.pdf
windows10-2004-x64
3Claude-Pro...53.pdf
windows11-ltsc_2024-x64
3Claude-Pro...53.exe
windows10-2004-x64
3Claude-Pro...53.exe
windows11-ltsc_2024-x64
3Claude-Pro...53.dll
windows10-2004-x64
3Claude-Pro...53.dll
windows11-ltsc_2024-x64
3Claude-Pro...53.vbs
windows10-2004-x64
5Claude-Pro...53.vbs
windows11-ltsc_2024-x64
5Behavioral task
behavioral1
Sample
Claude-Pro-Relay-Technical-Overview/Claude-Pro-Relay-Technical-Overview.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Claude-Pro-Relay-Technical-Overview/Claude-Pro-Relay-Technical-Overview.lnk
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_17753.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_17753.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_17753.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_17753.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_17753.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_17753.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_17753.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_17753.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Claude-Pro-Relay-Technical-Overview.zip
- Size 389KB
- Sample260731-qee94aba28
- SHA256 a569f2a5534f9d5990356d260860286e43c1b0eb8290b7e9726ccd7c7d241e5a
- MD5 9dec83243326a5174e7b84573b611469
- SHA1 8fb4ac7cac5911693c7bf241715b5a380f5b5cc1
- SHA512 cfaeda92b7702677d799b23e8c2c4e2d6737d05ade4558ac19a7454877516e3a57315d3a4b081c98b0af8d512316c7e4074e93b5b7befd8732090f5f0c95c39c
- SSDEEP 12288:Km0QiMbAwgytaYFpT3ksyxRqVJb2ru8ZY:KSiM7gyYi37Su8ZY
- TLSH T1A8841263211288E6CAEB87BC743C8E4C79BB1993BED6231EC727E385746411613E4B75
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/avk.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/avk.dll - One or more email addresses in PDF identified
Detects presence of email addresses in PDF files.
File Explorer
-
Claude-Pro-Relay-Technical-Overview.zip.zip 389KB
-
Claude-Pro-Relay-Technical-Overview/Claude-Pro-Relay-Technical-Overview.lnk.lnk 249KB
-
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/Claude-Pro-Relay-Technical-Overview.pdf.pdf 154KB
-
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/NOVUpdate.exe.exe 498KB
-
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/NOVUpdate.exe.dat89KB
-
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/avk.dll.dll 83KB
-
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/pdf.vbs.vbs 630B
-
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/script.dat246B
Claude-Pro-Relay-Technical-Overview/Claude-Pro-Relay-Technical-Overview.lnk
- SHA256 8ad109da60e31fc714cf2fb2791b36fdd5817abf62b6022c290538c770cfacac
- MD5 c1f45a0609c5c1bd2c21cad20703f126
- SHA1 bf4a26fe2232eb0829ef20a69ee884f1240d66b3
- SHA512 1b72f2ae047e3a8199d0179892eaaac36b566bb10f30394394bedb82b863c3be6ae3c57e3e280b34ceaacf94498edb0ef62de8ed8cbcd96c09f1e0ff16af9838
- SSDEEP 768:kbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb3:E
- TLSH T1B3449E3489421739E2F0457DA0DE6227CB17E4D6D9FA4F2D05AF238827472026EE5F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/Claude-Pro-Relay-Technical-Overview.pdf
- SHA256 41f93bf6c7373efbeeebcccaa3a9e4db22084ef3fafba3f3ef513e2ddc46bc64
- MD5 e0e156d67134afc840c167e14183aef8
- SHA1 4d8f35a7ba21ae81f778a5fed638fc658ece70b4
- SHA512 767968d9ec983b1f6630b7ea042bc75d25df55c538bf0c0470534265077bd7715779d84127aec799bc0a077e7592caa1a4c70c3df3b404799594298c0e639c68
- SSDEEP 3072:OuhvgTIfNhnBaMSg6fu9rAUyBBVSz5UMlhbkM65eniIbbdN6Ed+BVKUED:OuhviY9E9wUMziNQB
- TLSH T180F34AB4F89ACC8CF846B605C06D357D4B9CB1F776C824A60D2C4BCDB00AA55EB235A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
file http://127.0.0.1/
-
file mailto:[email protected]
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/NOVUpdate.exe
- IMPHASH 05ee01066053750ea840d419f2e58a7c
- SHA256 be153ac4db95db7520049a4c1e5182be07d27d2c11088a2d768e931b9a981c7f
- MD5 3a5b4b08e6ae35fd3ff44ccfb6c4b1aa
- SHA1 b5b57a9737a2572d7920d67455f370237ea3c793
- SHA512 b7d570f0ada7bf7c6893aae06bdb3b182a12ef941c6ed099f17149407395d677fc31736aa2e326b57607be2335c35c659621592c1ea83e59c373f52ccb6a5d81
- SSDEEP 6144:a90odz4lMRUBzynGdXpdMTvyE1NKBmtS/TKA8PCMNf1:a90gmMRUBzFvdMTvyEz+hLXGN
- TLSH T1A4B4B4169D80F26EE8E40531555C09378E2B5CEE337788A7A5B63A563C7F2A18CFE017
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
94:68:31:14:70:16:44:a2:3a:49:c1:98:f3:b9:3b:be:ba:eb:44:2e:26:f6:e5:97:02:b3:aa:1c:91:02:71:e9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=G DATA Software AG,O=G DATA Software AG,L=Bochum,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c0d7369676e4067646174612e6465
Chains
Jun 8, 2017
CN=G DATA Software AG,O=G DATA Software AG,L=Bochum,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c0d7369676e4067646174612e6465
CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=G DATA Software AG,O=G DATA Software AG,L=Bochum,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c0d7369676e4067646174612e6465
CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
PE Signature issue
Digest
4e:c4:ad:a4:8c:0c:81:a1:a2:f0:c5:e3:d4:a9:08:3c:d2:e8:95:be
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=G DATA Software AG,O=G DATA Software AG,L=Bochum,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c0d7369676e4067646174612e6465
Chains
Jun 8, 2017
CN=G DATA Software AG,O=G DATA Software AG,L=Bochum,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c0d7369676e4067646174612e6465
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE
Serial Number
47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Mar 16, 2016 - Mar 16, 2024
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=G DATA Software AG,O=G DATA Software AG,L=Bochum,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c0d7369676e4067646174612e6465
Serial Number
6e:e2:10:e8:63:61:28:a4:35:29:60:4f
Issuer
CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 11, 2016 - Nov 23, 2019
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:25:07:1d:f9:af
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 18, 2009 - Mar 18, 2019
Subject
CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=G DATA Software AG,O=G DATA Software AG,L=Bochum,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c0d7369676e4067646174612e6465
Serial Number
14:b0:f8:c6:6e:46:4d:b5:22:01:c9:77
Issuer
CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 23, 2016 - Nov 23, 2019
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 2, 2017 - Apr 1, 2028
Minor OS version
1
Major OS version
5
Entry point
71600
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Security\branches\R_25.2\Retail\AVK\Loader\Release\AVK.pdb
shell32
ShellExecuteW
advapi32
CloseServiceHandle
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegSetValueExW
RegCreateKeyExW
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RevertToSelf
CreateProcessAsUserW
ImpersonateLoggedOnUser
SetTokenInformation
GetLengthSid
GetTokenInformation
GetSidSubAuthority
InitializeSid
DuplicateTokenEx
CreateServiceW
avk
ModuleMain
kernel32
EncodePointer
DecodePointer
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
GetProcAddress
LoadLibraryA
GetModuleHandleA
DeleteCriticalSection
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
CloseHandle
WaitForSingleObject
Sleep
TerminateThread
SetEvent
ResumeThread
CreateEventW
ResetEvent
GetModuleFileNameW
OpenEventW
WaitForMultipleObjects
GetSystemDirectoryW
GetCurrentProcessId
InterlockedExchange
MultiByteToWideChar
CreateEventA
GetSystemInfo
InterlockedIncrement
InterlockedDecrement
SwitchToThread
TryEnterCriticalSection
GetLastError
DuplicateHandle
GetCurrentProcess
CreateFileW
FreeLibrary
LocalFree
VerifyVersionInfoW
VerSetConditionMask
lstrlenW
ProcessIdToSessionId
CreateProcessW
GetOverlappedResult
DeviceIoControl
GlobalFree
GlobalAlloc
SetLastError
GetModuleHandleW
WriteFile
MoveFileExW
LoadLibraryW
SearchPathW
LoadLibraryExW
FindClose
FindFirstFileW
SetThreadPriority
GetThreadPriority
GetCurrentThread
CreateThread
GetDriveTypeW
GetWindowsDirectoryW
VirtualQuery
GetTickCount
WideCharToMultiByte
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
HeapSize
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ExitThread
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineW
HeapReAlloc
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
ExitProcess
RtlUnwind
user32
DestroyWindow
FindWindowW
SendMessageW
CreateWindowExW
DispatchMessageW
TranslateMessage
PeekMessageW
DefWindowProcW
SetForegroundWindow
DispatchMessageA
GetMessageA
GetMessageW
RegisterClassW
IsWindowUnicode
CharLowerW
MsgWaitForMultipleObjectsEx
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateGuid
StringFromGUID2
CreateStreamOnHGlobal
CoTaskMemFree
StringFromCLSID
CLSIDFromProgID
oleaut32
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VariantCopy
SysFreeString
SysAllocString
VariantClear
VariantInit
shlwapi
PathFileExistsW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
psapi
GetModuleBaseNameW
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
289KB
Virtual Size
288KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=115, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=171, productName=VS2010 build 30319, version=30319,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=232, id=1, productName=Unmarked objects,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=52, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/NOVUpdate.exe.dat
- SHA256 8ac88aeecd19d842729f000c6ab732261cb11dd15cdcbb2dd137dc768b2f12bc
- MD5 3fe9c84025f4401f8cd661675642c526
- SHA1 8c1966e50b4bff1c85916e2648534d6c4d0b26c2
- SHA512 7eea213a10bc2179747047925f055e51991c8a2ed72df1273f6326fc608bd6529742238dc5d262a8bcaa204e52a09f6d5cfa2649b5218c51ba10f34885d3e550
- SSDEEP 1536:maYlKPYTtOyawa/ca9gi4ZOCVt0//gCBSFPESov4VuBo/:maY1tzawCv4h4//do1fuBy
- TLSH T1259312C9647F9BDF05618B993A716A0C9ADF429D3366BB0A0B1DD32236D00378E77631
- MD5 SHA1 SHA512 SSDEEP TLSH
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/avk.dll
- IMPHASH beedc7d4037d91c520cf5ed1e6c23f67
- SHA256 d5590802bf0926ac30d8e31c0911439c35aead82bf17771cfd1f9a785a7bf143
- MD5 88ac1c5fc9ee89491c70ea16131e264a
- SHA1 910465739b3170584150e9260bfba6a65e633f35
- SHA512 3b82d2a5a8de77cad0f3ff25e629953690616ec802814d5692b4ccdf15eb60188b3b562232c57bbb26c267fcfe829b90ae4b6fc2329bcbf0a0c03cdd31bab890
- SSDEEP 1536:slkswt5LGk3FpPTKEwhfZvEmd8nwzN68t2PCbzsYDJgzneesW5cdwJeMnx1+:shwt5xpPGEocmd8OZt2PCN1UnmwJeMnm
- TLSH T103836B0075D1C075D9BE19351828D6B59B3EB910DFE1DDEB3B9907AA0F302D1EE31A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5333
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
GetFileSize
ReadFile
VirtualProtectEx
GetCurrentProcess
GetModuleHandleA
GetProcAddress
WaitForSingleObject
GetModuleFileNameA
Sleep
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
ModuleMain
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33140,
count=137, id=261, version=33140,
count=19, id=260, version=33140,
count=20, id=259, version=35207,
count=15, id=260, version=35207,
count=30, id=261, version=35207,
count=3, id=257, version=33140,
count=95, id=1, productName=Unmarked objects,
count=2, id=265, version=35209,
count=1, id=256, version=35209,
count=1, id=258, version=35209,
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/pdf.vbs
- SHA256 df1ab9210252ad76e3451eeb287747af510658afeb82b22e20bea1c6ddc55131
- MD5 bef0b8599d18acf1c74192ae9f198f85
- SHA1 7275513e1a03b8c75e0eb17b66103ce6c917cc52
- SHA512 567572bdf3b00e6c6026fadfce7f1fc1d587e38d66c6fb37e51c8761a32c924a390ac2fe32fbcc92517077e3b6fa49b71a1c9b915ad7e912ac4a76425b43e6bb
- TLSH T112F0F656E922CFB6CB49228E01F69D8D86A350F81611E00CBB1C5C48A71CE3C9D2CACF
- MD5 SHA1 SHA512 TLSH
Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/script.dat
- SHA256 cc9839f9053cf5d57608da5c8706ea710b4878b57fe86b47b83b5fb941c1df12
- MD5 a4cdecc57a215243d279cdb065863308
- SHA1 76cf4bda16d11635ea79dd620f0f0d1439cbd095
- SHA512 73d5ebdeecf70e2cc92fb5d454a02f203203eeb168dd3980e7823ed255d0ab7f6e6e2df46519b8f382560af02925ce2745a1cfed5b4ed10c5bbea82483aa1ad5
- TLSH T124D09297640714F58BC8D7CD323D278239F220433CD03118F113C744302921A51C03FA
- MD5 SHA1 SHA512 TLSH