chameleon_esp_release_[unknowncheats.me]_.zip
- SHA256 e2e6929cb17e145bea71c0ceb56a0b7229a6fb3e25ebf29c57d2cd15af0faf59
Overview
overview
3Static
static
3chameleon_...]_.zip
windows10-2004-x64
1chameleon_...]_.zip
windows11-ltsc_2024-x64
1chameleon_...se.exe
windows10-2004-x64
1chameleon_...se.exe
windows11-ltsc_2024-x64
1dll/bridge-loader.dll
windows10-2004-x64
1dll/bridge-loader.dll
windows11-ltsc_2024-x64
1dll/loader...g.json
windows10-2004-x64
3dll/loader...g.json
windows11-ltsc_2024-x64
3dll/loader...s.json
windows10-2004-x64
3dll/loader...s.json
windows11-ltsc_2024-x64
3dll/mesh-p...2.json
windows10-2004-x64
3dll/mesh-p...2.json
windows11-ltsc_2024-x64
3dll/mesh-p...2.json
windows10-2004-x64
3dll/mesh-p...2.json
windows11-ltsc_2024-x64
3dll/runtim...ge.dll
windows10-2004-x64
1dll/runtim...ge.dll
windows11-ltsc_2024-x64
1dll/runtim...n.json
windows10-2004-x64
3dll/runtim...n.json
windows11-ltsc_2024-x64
3runtime-injector.exe
windows10-2004-x64
1runtime-injector.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
chameleon_esp_release_[unknowncheats.me]_.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
chameleon_esp_release_[unknowncheats.me]_.zip
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
chameleon_esp_release.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
chameleon_esp_release.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
dll/bridge-loader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
dll/bridge-loader.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
dll/loader-config.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
dll/loader-config.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
dll/loader-status.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
dll/loader-status.json
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
dll/mesh-profiles/paintman.mesh-profile-v2.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
dll/mesh-profiles/paintman.mesh-profile-v2.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
dll/mesh-profiles/paintman_cube.mesh-profile-v2.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
dll/mesh-profiles/paintman_cube.mesh-profile-v2.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
dll/runtime-bridge.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
dll/runtime-bridge.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
dll/runtime-bridge.dll.listen.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
dll/runtime-bridge.dll.listen.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
runtime-injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
runtime-injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target chameleon_esp_release_[unknowncheats.me]_.zip
- Size 1.4MB
- Sample260731-qs85bsbc74
- SHA256 e2e6929cb17e145bea71c0ceb56a0b7229a6fb3e25ebf29c57d2cd15af0faf59
- MD5 95d2bec78e302b34f50fc25aabc28c44
- SHA1 f912c53ae2839e905f3a4033f2738dbb7ba0ca20
- SHA512 3acd92f428037d35b9249906a48418ef13a2cc6644d2996e2dbaecf4e08cec1814ff6b5a7bb72713b7fe63a896937432e3c5e34137b62f9a2e469c37473ae800
- SSDEEP 24576:MoyBNC7QXucs4eduRgh3wPsk7OPjDlQ4Kx6HN5cW7gdVwVz7VCT4/6ILy9euj68u:qXC7QPeYRghgwjDlQ4Kxc3TsdVwF7VCy
- TLSH T1AE6533A5482B3801E1D59EB793F306B8132CEA6DEAC7EB506899FCD0544C5F12C1B3E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/chameleon_esp_release.exe unpack001/dll/bridge-loader.dll unpack001/dll/runtime-bridge.dll unpack001/runtime-injector.exe
File Explorer
-
chameleon_esp_release_[unknowncheats.me]_.zip.zip 1.4MB
-
chameleon_esp_release.exe.exe 829KB
-
dll/bridge-loader.dll.dll 306KB
-
dll/loader-config.json519B
-
dll/loader-status.json414B
-
dll/mesh-profiles/paintman.mesh-profile-v2.json4.7MB
-
dll/mesh-profiles/paintman_cube.mesh-profile-v2.json415KB
-
dll/runtime-bridge.dll.dll 1.3MB
-
dll/runtime-bridge.dll.listen.json74B
-
runtime-injector.exe.exe 300KB
chameleon_esp_release.exe
- IMPHASH f555fcaab8e720d8057e5e90d8b20e59
- SHA256 fbf23f01ecd9dc67476cd87c27d8c9c7442f5b06987a145453423dc5a7b2a6a1
- MD5 25737f83888413d6d529a73227a57a69
- SHA1 3b98531860b7581e0954524a725d2c3439bcfec0
- SHA512 25cff5b1f867e3e2525185d9a7f00e79e267d4315fefa8dd8a218877afc7d7a0a6cebea3cd0745879aa97907a55f1220d4c25b861a6ef3c2b39f5b90130fb287
- SSDEEP 12288:YQ+7lCbF2B59yDtC/nCnMpE9+mSDT/ahqvo4y6bJZ801hmvIOnbDMWf:YzlCBAAGCMpOyv/SqvxXbyIOnbD1
- TLSH T1E8058D0AF2A801F9D0779638C9A2A717D672781A0B7096DF13D406593F736E05FBBB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
360728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
TranslateMessage
DispatchMessageA
PeekMessageA
PostThreadMessageA
DefWindowProcA
PostQuitMessage
RegisterClassA
CreateWindowExA
MoveWindow
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
SetWindowDisplayAffinity
GetAsyncKeyState
GetSystemMetrics
CreatePopupMenu
DestroyMenu
AppendMenuW
TrackPopupMenu
ClientToScreen
SetCursorPos
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetActiveWindow
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
SetWindowLongA
GetWindowLongA
GetWindowRect
GetForegroundWindow
mouse_event
GetMessageA
IsWindow
GetWindowThreadProcessId
EnumWindows
GetWindowTextA
IsWindowVisible
SetProcessDPIAware
LoadCursorA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
ScreenToClient
GetCursorPos
SetCursor
MessageBoxW
GetClientRect
EndPaint
BeginPaint
SetForegroundWindow
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
ws2_32
setsockopt
closesocket
connect
htons
inet_addr
WSACleanup
send
recv
socket
WSAStartup
winmm
timeBeginPeriod
timeEndPeriod
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
kernel32
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
OutputDebugStringW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
CreateFileW
HeapFree
HeapAlloc
GetCommandLineW
GetCommandLineA
WriteFile
ReadFile
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwindEx
RaiseException
RtlPcToFileHeader
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSize
SetEndOfFile
FlsAlloc
GlobalLock
GetFileAttributesA
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateThread
OpenProcess
GetWindowsDirectoryA
GetModuleHandleA
CreateToolhelp32Snapshot
Module32First
ReadProcessMemory
WriteProcessMemory
Process32First
Process32Next
GetTickCount
GetModuleFileNameA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetLocalTime
GetTickCount64
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
GetFileAttributesW
CreateRemoteThread
GetExitCodeThread
VirtualAllocEx
VirtualFreeEx
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
Module32FirstW
Module32NextW
GlobalAlloc
GlobalUnlock
RtlUnwind
GlobalFree
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetSystemTimeAsFileTime
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Name
.text
Size
567KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
223KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
866KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=36, id=260, version=33145,
count=25, id=259, version=33145,
count=10, id=259, version=35207,
count=17, id=260, version=35207,
count=90, id=261, version=35207,
count=15, id=257, version=33145,
count=234, id=1, productName=Unmarked objects,
count=12, id=261, version=35228,
count=1, id=258, version=35228,
dll/bridge-loader.dll
- IMPHASH 55eabb8ae27743d410e017930fdb8ae0
- SHA256 a4da63257d3d859be4e22a1ba7f9dcfbbae29308710fa125dd41463b42d983ba
- MD5 6a2f846625ce1f58a74ea6ad04b4be36
- SHA1 68140efb80023b836241e1a305ddb27b62e58152
- SHA512 8b3654508ef852df92db89440e39f4eb1cfba25c9adfbe1418c7d119a7c1a2ffd78b39b0166fd800d06b0a8620344f9cdcd3c468fa44824acd686cf68c5166f9
- SSDEEP 3072:PzKJypqSUy32KcXIBw6Nxg7ABTVw/MBhmoSUSXy8QUUSTTShpt7pDTBoFPp5DSVp:P5rLffUMBhmonF5j4+7JwxYnlpO
- TLSH T194647D1AF7A41479E167963CCD534905E7F2BC4647A1EACF03904A963F23BE09A3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
ReadFile
WriteFile
CloseHandle
GetLastError
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
Sleep
GetCurrentProcessId
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceCounter
WakeAllConditionVariable
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
WriteConsoleW
SetEndOfFile
RtlUnwind
McLoader_GetAbiVersion
McLoader_RemoteMain
Name
.text
Size
204KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=174, id=261, version=33145,
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=3, id=257, version=33145,
count=137, id=1, productName=Unmarked objects,
count=10, id=259, version=35207,
count=14, id=260, version=35207,
count=79, id=261, version=35207,
count=1, id=261, version=35228,
count=1, id=256, version=35228,
count=1, id=258, version=35228,
dll/loader-config.json
- SHA256 795dabd30f055ebd5496944af8d93ce0e7c8c27f82a564bbd4e82e281825b88c
- MD5 b04073d1561857036e27692d0a5cf5d5
- SHA1 3e793985bf66ad91a85949c9d45f06c4d7bb1a7f
- SHA512 28e1b24eb6b3849aba2699d561085d58d8ce7a9b39815d585596ca0ce9431a49769641f9becc85d4dfcafa482ebfc73958e656305403f10eb72979b797ed718f
- TLSH T17EF02BBA609F82CB9AD3164428288AEE5F178A16C0F1385DDF46C06EA25E3119C35FDC
- MD5 SHA1 SHA512 TLSH
dll/loader-status.json
- SHA256 e83e90bc598d792161b671fa829d12498a40ce22f4b447f128c052b3b6090eeb
- MD5 0ae1b408281af417bcde6975dcb3648c
- SHA1 d87374fa1558a385facd06ddd1e0423d62cb9b1d
- SHA512 14a5eb9ca45eb05695db906fde664e9502d5ffa18fb95dbedc4bea1640fc7fd2dd3499aca55b0779be916335ff97959fa90469c179986f2f127d18dacf4c042f
- TLSH T174E0ABB9320400ABA5C90AA02C2C438E0A2B8F0AD2563C04EA47812CF04D52742B7F68
- MD5 SHA1 SHA512 TLSH
dll/mesh-profiles/paintman.mesh-profile-v2.json
- SHA256 e2319d616933b5456ed25182e2783858408ba31152bd5820f407607e8e0d2baa
- MD5 a0e504a43dd48c7b4f8db59865ef3851
- SHA1 cef5a43704c18bdaeaccff473ec727ba2f746c5d
- SHA512 44a21984cb839eaab6cf1952dfe5a2daee566081fb2e5b38f78e0fa8d4dd936f9daad14f38796bbfda6eacc03b1731dc12ae9ce4d09960851cdd06db90b134c9
- SSDEEP 49152:UJFwPzKXTdj6/J2HEZlmLo+yfM62bP7xFvmfy3VNi5sDspaue5NR/nSN21EDMYRr:L
- TLSH T168366A2AD5102CD4A9D9D43AA4BE734120F4269B5CE8BC05731E4E0DAF7E12D1ABB74F
- MD5 SHA1 SHA512 SSDEEP TLSH
dll/mesh-profiles/paintman_cube.mesh-profile-v2.json
- SHA256 c55b544120463cbe9077646042e58d38c9feb38cd7681ffaa003e584538349e5
- MD5 6f9218782a112c688de78e8a83747121
- SHA1 1d088f1970d679a529c4bfeda670a6ad5d5ec0d1
- SHA512 10767234cf2399baa6448cd1b1f8a3e58354173a431b40d62b44434d2705126e9d9653fb0af181221032650eeb0bd3f97b210c0578af0dcc914fa7acb3691d79
- SSDEEP 12288:f0r0wuC38zjqFSarYY48ixlevbDjo2OILjBuCKbcfevTWtTUrGzDUDZ/27HIEyZU:f0r0wuC38zjqFSarYY48ixlevbDjo2OW
- TLSH T15A94BDA8E4201CD9F599A07A985F73813064635B8DE8BC057B1D4F1E5F7E02F2A7A34B
- MD5 SHA1 SHA512 SSDEEP TLSH
dll/runtime-bridge.dll
- IMPHASH 28527097de1e78c367085286090de4b2
- SHA256 e1d45805b30e8ca7c81f6068fbcde4b4e48026b6b10832f171e496e503e2c9ee
- MD5 b6e1fb88fec4ade0cd4096ffb69e8d51
- SHA1 58aedb08a7e59b3cac033eca2af6a943c67045d7
- SHA512 92bd352ad78527d76004bf010ff4de3937ff1d25df1e9de5ebd917b7fb84f0a1ebe83745801bb541a5843cb7377ca763dabe9b654ae625111212ff79a7578ec1
- SSDEEP 12288:t21zeCMeEjvBEkqxudvZH+YOlNxqrPnBcbq7YJXkdrU9kuSePDQ:Q1z7WBT0udvl+zlNxqrfBm6Y9k5aIeP
- TLSH T1EB555A3A9788016CE0FAC1B98F575853E776380903B1ACFF0BD159950D5B7A0AB7BB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
610656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
bind
WSAGetLastError
WSACleanup
WSAStartup
socket
setsockopt
send
select
recv
listen
htons
htonl
closesocket
accept
user32
PostThreadMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
EnumWindows
KillTimer
SetTimer
IsWindowVisible
PostMessageW
kernel32
WriteConsoleW
HeapReAlloc
HeapSize
SetStdHandle
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
GetEnvironmentVariableW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileSizeEx
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetLastError
Sleep
GetCurrentProcess
GetCurrentProcessId
FlushInstructionCache
GetTickCount64
VirtualProtect
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
InitializeSListHead
GetStdHandle
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
McBridge_GetApi
Name
.text
Size
746KB
Virtual Size
745KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
374KB
Virtual Size
379KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=144, id=261, version=33145,
count=31, id=260, version=33145,
count=16, id=259, version=33145,
count=10, id=259, version=35207,
count=14, id=260, version=35207,
count=51, id=261, version=35207,
count=163, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=1, id=261, version=35228,
count=1, id=256, version=35228,
count=1, id=258, version=35228,
dll/runtime-bridge.dll.listen.json
- SHA256 9be99ff4681e56b1da413ea471d276f74307b62e8f792cab940b5b6904cfaf16
- MD5 8e07683561242cd9b1fecbb1c883239a
- SHA1 98b3abdda434ce0c2e1772812ae8864c9abe4eb8
- SHA512 56b93d75ae4bd2ed957f24e3fb47eb24a141c74cf4ec33891a763cfc2551ca598172b72e7ac3209dcb43c7c3627e0ff1399a014ee8670fbb1c104928fcd33ce4
- TLSH T16AA0223000C80E3BFB000002088E08C082380ACCA823FEA3F0E8C300F03C033C082080
- MD5 SHA1 SHA512 TLSH
runtime-injector.exe
- IMPHASH fefbc144e77169db5d9e1b1ecad621d2
- SHA256 081a2bb165e78a5b761e8c679cca14d6bd886fb0058c45c82feb64a49fdaab34
- MD5 172b21604f73456bb7683f2d09c05b11
- SHA1 b313deb1f26e2faf51de08bce8dfb62d7dc6f91c
- SHA512 e7d88893bd403886b4a45625cb1b7dabfb27caa42696482afd6b0e67c730bba3e2b7c0ee82ddb225310adae80046ef6c5fd9afe57c9854ecff01fe5849592245
- SSDEEP 6144:R+CiH1doZ0ec81ueH+B66VkYTApF/poog:w1doGMue96+SAb/pH
- TLSH T1DA648D1AF3A510F9E967853CCC524906EB72BC5647A1E7CF03904A963F276E09E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
69676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseHandle
GetLastError
WaitForSingleObject
CreateRemoteThread
GetExitCodeThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
HeapSize
CreateFileW
RtlUnwind
Name
.text
Size
197KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=169, id=261, version=33145,
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=3, id=257, version=33145,
count=111, id=1, productName=Unmarked objects,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=82, id=261, version=35207,
count=1, id=261, version=35228,
count=1, id=258, version=35228,